ML23067A174

Rev. 18 to Technical Specifications, Bases Change, Chapter 3.7, Plant Systems

ML23067A174
Person / Time
Site:	Callaway
Issue date:	12/29/2022
From:	Union Electric Co, Ameren Missouri
To:	Office of Nuclear Reactor Regulation
Shared Package
ML23067A139	List: ML23062A606 ML23062A607 ML23062A608 ML23062A609 ML23062A611 ML23062A612 ML23062A613 ML23062A615 ML23062A616 ML23062A617 ML23062A618 ML23062A619 ML23062A620 ML23062A621 ML23062A622 ML23062A623 ML23062A624 ML23062A625 ML23062A626 ML23062A627 ML23062A628 ML23062A629 ML23062A630 ML23062A631 ML23062A632 ML23062A633 ML23062A634 ML23062A635 ML23062A636 ML23062A637 ML23062A638 ML23062A639 ML23062A640 ML23062A641 ML23062A642 ML23062A643 ML23062A644 ML23062A645 ML23062A647 ML23062A649 ML23062A650 ML23062A651 ML23062A652 ML23062A653 ML23062A654 ML23067A108 ML23067A109 ML23067A110 ML23067A111 ML23067A112 ... further results
References
ULNRC-06782
Download: ML23067A174 (1)

Text

CHAPTER TABLE OF CONTENTS CHAPTER B 3.7 PLANT SYSTEMS Section Page B 3.7.1 Main Steam Safety Valves (MSSVs) ............................................................B 3.7.1-1 BACKGROUND ......................................................................................B 3.7.1-1 APPLICABLE SAFETY ANALYSES ......................................................B 3.7.1-1 LCO ........................................................................................................B 3.7.1-2 APPLICABILITY .....................................................................................B 3.7.1-3 ACTIONS ...............................................................................................B 3.7.1-3 SURVEILLANCE REQUIREMENTS .........................................................B 3.7.1-5 REFERENCES ........................................................................................B 3.7.1-5 B 3.7.2 Main Steam Isolation Valves (MSIVs), Main Steam Isolation Valve Bypass Valves (MSIVBVs), and Main Steam Low Point Drain Isolation Valves (MSLPDIVs) .................................................................................................B 3.7.2-1 BACKGROUND ......................................................................................B 3.7.2-1 APPLICABLE SAFETY ANALYSES ......................................................B 3.7.2-2 LCO ........................................................................................................B 3.7.2-4 APPLICABILITY .....................................................................................B 3.7.2-4 ACTIONS ..................................................................................................B 3.7.2-6 SURVEILLANCE REQUIREMENTS .......................................................B 3.7.2-12 REFERENCES .....................................................................................B 3.7.2-13 B 3.7.3 Main Feedwater Isolation Valves (MFIVs), Main Feedwater Regulating Valves (MFRVs) and Main Feedwater Regulating Valve Bypass Valves (MFRVBVs) ...................................................................................................B 3.7.3-1 BACKGROUND ......................................................................................B 3.7.3-1 APPLICABLE SAFETY ANALYSES ......................................................B 3.7.3-3 LCO ........................................................................................................B 3.7.3-3 APPLICABILITY .....................................................................................B 3.7.3-4 ACTIONS ...............................................................................................B 3.7.3-8 SURVEILLANCE REQUIREMENTS .......................................................B 3.7.3-10 REFERENCES .....................................................................................B 3.7.3-13 B 3.7.4 Atmospheric Steam Dump Valves (ASDs) ...................................................B 3.7.4-1 BACKGROUND ......................................................................................B 3.7.4-1 CALLAWAY PLANT 3.7-i

CHAPTER TABLE OF CONTENTS (Continued)

Section Page APPLICABLE SAFETY ANALYSES ......................................................B 3.7.4-1 LCO ........................................................................................................B 3.7.4-2 APPLICABILITY ......................................................................................B 3.7.4-3 ACTIONS ..................................................................................................B 3.7.4-3 SURVEILLANCE REQUIREMENTS .........................................................B 3.7.4-4 REFERENCES .......................................................................................B 3.7.4-5 B 3.7.5 Auxiliary Feedwater (AFW) System ............................................................B 3.7.5-1 BACKGROUND ......................................................................................B 3.7.5-1 APPLICABLE SAFETY ANALYSES ......................................................B 3.7.5-2 LCO ........................................................................................................B 3.7.5-4 APPLICABILITY .....................................................................................B 3.7.5-5 ACTIONS ...............................................................................................B 3.7.5-5 SURVEILLANCE REQUIREMENTS .........................................................B 3.7.5-8 REFERENCES .....................................................................................B 3.7.5-12 B 3.7.6 Condensate Storage Tank (CST) .................................................................B 3.7.6-1 BACKGROUND ......................................................................................B 3.7.6-1 APPLICABLE SAFETY ANALYSES ......................................................B 3.7.6-1 LCO ........................................................................................................B 3.7.6-2 APPLICABILITY .....................................................................................B 3.7.6-2 ACTIONS ..................................................................................................B 3.7.6-2 SURVEILLANCE REQUIREMENTS .........................................................B 3.7.6-3 REFERENCES .......................................................................................B 3.7.6-3 B 3.7.7 Component Cooling Water (CCW) System .................................................B 3.7.7-1 BACKGROUND ......................................................................................B 3.7.7-1 APPLICABLE SAFETY ANALYSES ......................................................B 3.7.7-2 LCO ........................................................................................................B 3.7.7-2 APPLICABILITY .....................................................................................B 3.7.7-3 ACTIONS ..................................................................................................B 3.7.7-3 SURVEILLANCE REQUIREMENTS .........................................................B 3.7.7-4 REFERENCES .......................................................................................B 3.7.7-5 B 3.7.8 Essential Service Water (ESW) System ......................................................B 3.7.8-1 BACKGROUND ......................................................................................B 3.7.8-1 APPLICABLE SAFETY ANALYSES ......................................................B 3.7.8-2 LCO ........................................................................................................B 3.7.8-2 APPLICABILITY .....................................................................................B 3.7.8-3 ACTIONS ..................................................................................................B 3.7.8-3 SURVEILLANCE REQUIREMENTS .........................................................B 3.7.8-4 3.7-ii

CHAPTER TABLE OF CONTENTS (Continued)

Section Page REFERENCES .......................................................................................B 3.7.8-6 B 3.7.9 Ultimate Heat Sink (UHS) ..........................................................................B 3.7.9-1 BACKGROUND ......................................................................................B 3.7.9-1 APPLICABLE SAFETY ANALYSES ......................................................B 3.7.9-2 LCO ........................................................................................................B 3.7.9-2 APPLICABILITY .....................................................................................B 3.7.9-3 ACTIONS ..................................................................................................B 3.7.9-3 SURVEILLANCE REQUIREMENTS .........................................................B 3.7.9-3 REFERENCES .......................................................................................B 3.7.9-5 B 3.7.10 Control Room Emergency Ventilation System (CREVS) ...........................B 3.7.10-1 BACKGROUND ....................................................................................B 3.7.10-1 APPLICABLE SAFETY ANALYSES .....................................................B 3.7.10-3 LCO ......................................................................................................B 3.7.10-4 APPLICABILITY ...................................................................................B 3.7.10-5 ACTIONS ................................................................................................B 3.7.10-5 SURVEILLANCE REQUIREMENTS .......................................................B 3.7.10-7 REFERENCES ......................................................................................B 3.7.10-9 B 3.7.11 Control Room Air Conditioning System (CRACS) .....................................B 3.7.11-1 BACKGROUND .....................................................................................B 3.7.11-1 APPLICABLE SAFETY ANALYSES ....................................................B 3.7.11-1 LCO ......................................................................................................B 3.7.11-1 APPLICABILITY ...................................................................................B 3.7.11-2 ACTIONS ................................................................................................B 3.7.11-2 SURVEILLANCE REQUIREMENTS .......................................................B 3.7.11-3 REFERENCES .....................................................................................B 3.7.11-3 B 3.7.12 Not used. ....................................................................................................B 3.7.12-1 B 3.7.13 Emergency Exhaust System (EES) ...........................................................B 3.7.13-1 BACKGROUND .....................................................................................B 3.7.13-1 APPLICABLE SAFETY ANALYSES ....................................................B 3.7.13-2 LCO ......................................................................................................B 3.7.13-2 APPLICABILITY ...................................................................................B 3.7.13-3 ACTIONS ................................................................................................B 3.7.13-3 SURVEILLANCE REQUIREMENTS .......................................................B 3.7.13-5 REFERENCES .....................................................................................B 3.7.13-7 B 3.7.14 Not used. ....................................................................................................B 3.7.14-1 3.7-iii

CHAPTER TABLE OF CONTENTS (Continued)

Section Page B 3.7.15 Fuel Storage Pool Water Level ..................................................................B 3.7.15-1 BACKGROUND ...................................................................................B 3.7.15-1 APPLICABLE SAFETY ANALYSES ....................................................B 3.7.15-1 LCO ......................................................................................................B 3.7.15-2 APPLICABILITY ...................................................................................B 3.7.15-2 ACTIONS ................................................................................................B 3.7.15-2 SURVEILLANCE REQUIREMENTS .......................................................B 3.7.15-2 REFERENCES .....................................................................................B 3.7.15-3 B 3.7.16 Fuel Storage Pool Boron Concentration ....................................................B 3.7.16-1 BACKGROUND ....................................................................................B 3.7.16-1 APPLICABLE SAFETY ANALYSES ....................................................B 3.7.16-2 LCO ......................................................................................................B 3.7.16-2 APPLICABILITY ...................................................................................B 3.7.16-2 ACTIONS ................................................................................................B 3.7.16-3 SURVEILLANCE REQUIREMENTS .......................................................B 3.7.16-3 REFERENCES .....................................................................................B 3.7.16-3 B 3.7.17 Spent Fuel Assembly Storage ....................................................................B 3.7.17-1 BACKGROUND ....................................................................................B 3.7.17-1 APPLICABLE SAFETY ANALYSES ....................................................B 3.7.17-2 LCO ......................................................................................................B 3.7.17-2 APPLICABILITY ...................................................................................B 3.7.17-2 ACTIONS ................................................................................................B 3.7.17-2 SURVEILLANCE REQUIREMENTS .......................................................B 3.7.17-3 REFERENCES .....................................................................................B 3.7.17-3 B 3.7.18 Secondary Specific Activity ........................................................................B 3.7.18-1 BACKGROUND ....................................................................................B 3.7.18-1 APPLICABLE SAFETY ANALYSES ....................................................B 3.7.18-1 LCO ......................................................................................................B 3.7.18-2 APPLICABILITY ...................................................................................B 3.7.18-2 ACTIONS ................................................................................................B 3.7.18-2 SURVEILLANCE REQUIREMENTS .......................................................B 3.7.18-3 REFERENCES .....................................................................................B 3.7.18-3 B 3.7.19 Secondary System Isolation Valves (SSIVs) .............................................B 3.7.19-1 BACKGROUND ....................................................................................B 3.7.19-1 APPLICABLE SAFETY ANALYSES ....................................................B 3.7.19-3 LCO ......................................................................................................B 3.7.19-3 3.7-iv

CHAPTER TABLE OF CONTENTS (Continued)

Section Page APPLICABILITY ...................................................................................B 3.7.19-4 ACTIONS ................................................................................................B 3.7.19-5 SURVEILLANCE REQUIREMENTS .......................................................B 3.7.19-6 REFERENCES .....................................................................................B 3.7.19-7 B 3.7.20 Class 1E Electrical Equipment Air Conditioning (A/C) System ...................B 3.7.20-1 BACKGROUND.......................................................................................B 3.7.20-1 APPLICABLE SAFETY ANALYSES .....................................................B 3.7.20-2 LCO .......................................................................................................B 3.7.20-2 APPLICABILITY ....................................................................................B 3.7.20-2 ACTIONS ..............................................................................................B 3.7.20-3 SURVEILLANCE REQUIREMENTS .....................................................B 3.7.20-4 REFERENCES ......................................................................................B 3.7.20-5 3.7-v

LIST OF FIGURES Number Title 3.7.2-1 MSIV Stroke Time Limit vs Steam Generator Pressure 3.7.3-1 MFIV Stroke Time Limit vs Steam Generator Pressure B 3.7.1-1

MSSVs B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)

BASES BACKGROUND The primary purpose of the MSSVs is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available.

Five MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in the FSAR, Section 10.3.2 (Ref. 1). The MSSVs must have sufficient flow capacity to limit the secondary system pressure to 110% of the steam generator design pressure in order to meet the requirements of the ASME Code,Section III (Ref. 2). The MSSV design includes staggered setpoints, according to Table 3.7.1-2 in the accompanying LCO, so that only the needed valves will actuate. Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine trip.

APPLICABLE The design basis for the MSSVs comes from Reference 2 and its purpose SAFETY is to limit the secondary system pressure to 110% of design pressure for ANALYSES any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis.

The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are those characterized as decreased heat removal events, which are presented in the FSAR, Section 15.2 (Ref. 3). Of these, the full power turbine trip without steam dump typically is the limiting AOO with respect to secondary system pressure. This event also terminates normal feedwater flow to the steam generators.

The safety analysis demonstrates that the transient response for turbine trip occurring from full power without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System. One turbine trip analysis is performed assuming primary system pressure control via operation of the pressurizer power operated relief valves and sprays. This analysis demonstrates that the DNB design basis is met.

Another analysis is performed assuming no primary system pressure control, but crediting reactor trip on high pressurizer pressure and operation of the pressurizer safety valves. This analysis demonstrates (continued)

CALLAWAY PLANT B 3.7.1-1 Revision 16

MSSVs B 3.7.1 BASES APPLICABLE that the maximum RCS pressure does not exceed 110% of the design SAFETY pressure. All cases analyzed demonstrate that the MSSVs maintain main ANALYSES steam system integrity by limiting the maximum steam pressure to less (continued) than 110% of the steam generator design pressure. In some circumstances it is necessary to limit the primary side heat generation that can be achieved during an AOO by reducing the setpoint of the Power Range Neutron Flux-High reactor trip function. For example, if more than one MSSV on a single steam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurring from a partial power level may result in an increase in reactor power that exceeds the combined steam flow capacity of the turbine and the remaining OPERABLE MSSVs. Thus, for multiple inoperable MSSVs on the same steam generator it is necessary to prevent this power increase by lowering the Power Range Neutron Flux-High setpoint to an appropriate value. When the Moderator Temperature Coefficient (MTC) is positive, the reactor power may increase above the initial value during an RCS heatup event (e.g., turbine trip). Thus, for any number of inoperable MSSVs it is necessary to reduce the trip setpoint if a positive MTC may exist at partial power conditions.

The MSSVs are assumed to have two active and one passive failure modes. The active failure modes are spurious opening, and failure to reclose once opened. The passive failure mode is failure to open upon demand.

The MSSVs satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO The accident analysis requires that five MSSVs per steam generator be OPERABLE to provide overpressure protection for design basis transients occurring at 102% RTP. The LCO requires that five MSSVs per steam generator be OPERABLE in compliance with Reference 2 and the DBA analysis.

The OPERABILITY of the MSSVs is defined as the ability to open upon demand within the setpoint tolerances to relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the INSERVICE TESTING PROGRAM.

This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB or Main Steam System Integrity.

(continued)

CALLAWAY PLANT B 3.7.1-2 Revision 16

MSSVs B 3.7.1 BASES (Continued)

APPLICABILITY In MODES 1, 2, and 3, five MSSVs per steam generator are required to be OPERABLE to limit secondary system pressure. In MODES 4, 5 and 6 there are no credible transients requiring the MSSVs.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each MSSV.

A.1 In the case of only a single inoperable MSSV on one or more steam generators when the Moderator Temperature Coefficient is not positive a reactor power reduction alone is sufficient to limit primary side heat generation such that overpressurization of the secondary side is precluded for any RCS heatup event. Furthermore, for this case there is sufficient total steam flow capacity provided by the turbine and remaining insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Therefore, Required Action A.1 requires an appropriate reduction in reactor power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Required Action A.1 is only applicable when the Moderator Temperature Coefficient is negative at all power levels.

The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the attachment to References 6 and 7, with an appropriate allowance for calorimetric power uncertainty.

With one or more MSSVs inoperable, action must be taken so that the available MSSV relieving capacity meets Reference 2 requirements.

Continued operation with less than all five MSSVs OPERABLE for each steam generator is permissible, if THERMAL POWER is limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam generator.

B.1 and B.2 In the case of multiple inoperable MSSVS on one or more steam generators, with a reactor power reduction alone there may be insufficient total steam flow capacity provided by the turbine and remaining (continued)

CALLAWAY PLANT B 3.7.1-3 Revision 16

MSSVs B 3.7.1 BASES ACTIONS B.1 and B.2 (continued)

OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Furthermore, for a single inoperable MSSV on one or more steam generators when the Moderator Temperature Coefficient is positive at any power level the reactor power may increase as a result of an RCS heatup event such that flow capacity of the remaining OPERABLE MSSVs is insufficient. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time for required Action B.1 is consistent with A.1. An additional 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> is allowed in Required Action B.2 to reduce the setpoints. The completion time of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> is based on a reasonable time to correct the MSSV inoperability, the time required to perform the power reduction, operating experience in resetting all channels of a protective function, and on the low probability of the occurrence of a transient that could result in steam generator overpressure during this period.

The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in Reference 6, with an appropriate allowance for Nuclear Instrumentation System trip channel uncertainties.

Required Action B.2 is modified by a Note, indicating that the Power Range Neutron Flux-High reactor trip setpoint reduction is only required in MODE 1. In MODES 2 and 3 the reactor trips specified in LCO 3.3.1, "Reactor Trip System Instrumentation," provides sufficient protection.

The allowed Completion Times are reasonable based on operating experience to accomplish the Required Actions in an orderly manner without challenging unit systems.

C.1 and C.2 If THERMAL POWER or the Power Range Neutron Flux - High trip setpoints is not reduced within the associated Completion Time, or if one or more steam generators have less than two MSSVs OPERABLE, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

CALLAWAY PLANT B 3.7.1-4 Revision 16

MSSVs B 3.7.1 BASES (Continued)

SURVEILLANCE SR 3.7.1.1 REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the INSERVICE TESTING PROGRAM.

The ASME Code (Ref. 5) specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7.1-2 allows a +3%/-1%

setpoint tolerance for OPERABILITY; however, the valves are reset to

+/- 1% during the Surveillance to allow for drift. The lift settings pressure shall correspond to ambient conditions of the valve at nominal operating temperature and pressure.

This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected, if necessary, to ambient conditions of the valve at operating temperature and pressure.

REFERENCES 1. FSAR, Section 10.3.2, Main Steam Supply System - System Description.

2. ASME, Boiler and Pressure Vessel Code,Section III, Article NC-7000, Class 2 Components.

3. FSAR, Section 15.2, Decrease in Heat Removal by the Secondary System.

4. NRC Information Notice 94-60, "Potential Overpressurization of the Main Steam System," August 22, 1994.

5. ASME Code for Operation and Maintenance of Nuclear Power Plants.

6. Westinghouse Letter SCP-99-129, dated July 7, 1999.

7. WCAP-16265-P, "Callaway Replacement Steam Generator Program NSSS Licensing Report," September 2004.

CALLAWAY PLANT B 3.7.1-5 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Main Steam Isolation Valves (MSIVs), Main Steam Isolation Valve Bypass Valves (MSIVBVs), and Main Steam Low Point Drain Isolation Valves (MSLPDIVs)

BASES BACKGROUND The MSIVs isolate steam flow from the secondary side of the steam generators following a high energy line break (HELB). MSIV closure terminates flow from the unaffected (intact) steam generators.

One MSIV is located in each main steam line outside, but close to, containment. The MSIVs are downstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam supply, to prevent MSSV and AFW isolation from the steam generators by MSIV closure. Closing the MSIVs isolates each steam generator from the others, and isolates the turbine, Condenser Steam Dump System, and other auxiliary steam supplies from the steam generators.

The MSIV is a 28-inch gate valve with a system-medium actuator. Since the MSIV actuators are system-medium actuators, the MSIV isolation time is a function of steam generator steam pressure. The assumed single active failure of one of the redundant MSIV actuation trains will not prevent the MSIV from closing.

The MSIV actuators (skid-mounted at the valve) consist of two separate system-medium actuation trains. For each MSIV, one actuator train is associated with separation group 4 (yellow), and one actuator train is associated with separation group 1 (red). A single active failure in one power train would not prevent the other power train from functioning. The MSIVs provide the primary success path for events requiring steam isolation and isolation of non-safety-related portions from the safety-related portion of the system.

The MSIVs close on a main steam isolation signal generated by low steam line pressure, high steam line negative pressure rate or High-2 containment pressure. The MSIVs fail as is on loss of control signal. The MSIVs fail closed on loss of actuation power.

Each MSIV has an MSIV bypass valve (MSIVBV). Although the bypass valves are normally closed, they receive the same emergency closure signals as the associated MSIVs. The MSIVBVs are open when the MSIVs are closed, to permit warming of the main steam lines prior to startup. MSIVBVs are air-operated globe valves. For emergency closure of each MSIVBV, either of two separate solenoid valves, when de-energized, will result in valve closure. The two electrical solenoid valves (continued)

CALLAWAY PLANT B 3.7.2-1 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES BACKGROUND are energized from separate Class 1E sources. The MSIVBVs fail in the (continued) closed position.

On each of the four main steam lines, upstream of the main steam isolation valves, is a 12-inch diameter low point drain line. Each drain line has a level detection system that consists of a level switch that annunciates on a high level. Attached to the 12-inch line is a 1-inch diameter line back to the condenser. One air-operated low point drain isolation valve (MSLPDIV) is installed in each 1-inch drain line. The MSLPDIVs are normally open to allow a steam trap to pass moisture to the main condenser. The MSLPDIVs close upon receipt of an SLIS and function to isolate the plants secondary side. For emergency closure on receipt of an SLIS, either of two safety-related solenoid valves is de-energized to dump air supplied to the valve actuator. The electrical solenoid valves are energized from separate Class 1E sources. The MSLPDIVs fail in the closed position.

A description of the MSIVs, MSIVBVs, and MSLPDIVs is found in the FSAR, Section 10.3 (Ref. 1).

APPLICABLE The design basis of the MSIVs, MSIVBVs, and MSLPDIVs is established SAFETY by the containment analysis for the large steam line break (SLB) inside ANALYSES containment, discussed in the FSAR, Section 6.2.1.4 (Ref. 2). It is also affected by the accident analysis of the SLB events presented in the FSAR, Section 15.1.5 (Ref. 3). The design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one MSIV, MSIVBV, or MSLPDIV to close on demand). The postulated accidents (including the main steam line break, the feed water line break, and the steam generator tube rupture) assume the MSIVs, MSIVBVs, and MSLPDIVs function to isolate the secondary system to ensure the primary success path for steamline and feedline isolation and for delivery of required auxiliary feedwater flow.

The limiting case for the containment pressure analysis is the double-ended hot leg LOCA, with initial reactor power at 102%, with loss of offsite power and the failure of one train of containment cooling (one containment spray pump and two containment fan coolers).

At lower powers, the steam generator inventory and temperature are at their maximum, generally maximizing the analyzed mass and energy release to the containment. With the most reactive rod cluster control assembly assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power.

(continued)

CALLAWAY PLANT B 3.7.2-2 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES APPLICABLE The core is ultimately shut down by the boric acid injection delivered by SAFETY the Emergency Core Cooling System (Ref. 3).

ANALYSES (continued) The accident analysis compares several different SLB events against different acceptance criteria. The large SLB outside containment upstream of the MSIV is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB inside containment at hot zero power is the limiting case for a post trip return to power. The analysis includes scenarios with offsite power available, and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System cooldown. With a loss of offsite power, the response of mitigating systems is delayed. Significant single failures considered include failure of an MSIV to close.

The MSIVs serve only a safety function and remain open during power operation. The MSIVBVs are typically used for turbine warming and pressure equalization during startup, and are normally closed during power operation, but may be opened, for example, for testing or maintenance.

The MSLPDIVs are normally open during power operation to allow a steam trap to pass moisture to the main condenser. The MSLPDIVs close upon receipt of an SLIS and function to isolate the plants secondary side.

These valves operate under the following situations:

a. An HELB inside containment. In order to maximize the mass and energy release into containment, the analysis assumes that the MSIV in the affected steam generator remains open. For this accident scenario, steam is discharged into containment from all steam generators until the remaining MSIVs, MSIVBVs, and MSLPDIVs close. After MSIV, MSIVBV, and MSLPDIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIVs, MSIVBVs, and MSLPDIVs in the unaffected loops. Closure of the MSIVs, MSIVBVs, and MSLPDIVs isolates the break from the unaffected steam generators.

b. A break outside of containment and upstream from the MSIVs is not a containment pressurization concern. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition. Closure of the MSIVs, MSIVBVs, and (continued)

CALLAWAY PLANT B 3.7.2-3 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES APPLICABLE MSLPDIVs isolates the break and limits the blowdown to a single SAFETY steam generator.

ANALYSES (continued) c. A break downstream of the MSIVs will be isolated by the closure of the MSIVs, MSIVBVs, and MSLPDIVs.

d. Following a steam generator tube rupture, closure of the MSIVs isolates the ruptured steam generator from the intact steam generators to minimize radiological releases.

e. The MSIVs, MSIVBVs, and MSLPDIVs are also utilized during other less limiting events such as a feedwater line break.

Figure B 3.7.2-1 is a curve of the MSIV isolation time as function of steam generator pressure. Meeting the MSIV isolation times in Figure B 3.7.2-1 ensures that the evaluation performed in Reference 7 remains valid.

The MSIVs, MSIVBVs, and MSLPDIVs satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO This LCO requires that the MSIV and its associated actuator trains, the MSIVBV, and the MSLPDIV for each of the four main steam lines be OPERABLE. The MSIVs are considered OPERABLE when the isolation times are within the limits of Figure B 3.7.2-1 and they are capable of closing on an isolation actuation signal. An MSIV actuator train is considered OPERABLE when it is capable of closing its associated MSIV on an isolation actuation signal. The MSIVBVs and MSLPDIVs are considered OPERABLE when their isolation times are within limits and they are capable of closing on an isolation actuation signal.

This LCO provides assurance that the MSIVs, MSIVBVs, and MSLPDIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 100 (Ref. 4) limits or the NRC staff approved licensing basis.

APPLICABILITY The MSIVs, MSIVBVs, and MSLPDIVs must be OPERABLE in MODES 1, 2 and 3, when there is significant mass and energy in the RCS and steam generators.

Steam is supplied to the turbine and other loads from the four steam generators by four main steam lines. One MSIV and MSIVBV is installed in each of the four main steam lines. One MSLPDIV is installed in the drain line off each of the four main steam lines. When the main steam line (continued)

CALLAWAY PLANT B 3.7.2-4 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES APPLICABILITY that feeds a given steam generator and its low point drain are isolated, the (continued) specified safety function is being met.

Exceptions to the APPLICABILITY in MODES 2 and 3 for the MSIVs and their associated actuator trains in each main steam line, as well as in MODES 1, 2, and 3 for the MSIVBVs and MSLPDIVs in each main steam line, are allowed for the following cases where the valve(s) is assured of performing its specified safety function:

a. When the MSIV in a given main steam line is closed and de-activated in MODES 2 and 3, it is performing the specified safety function for that main steam line. Requiring the MSIV to be closed and de-activated provides assurance that the MSIV for that main steam line is performing the specified safety function. Closing and de-activating provides a means of isolation that cannot be adversely affected by a single active failure, thus assuring the MSIV is performing the specified safety function. The MSIV is a system-medium actuated valve, opened by system pressure acting on the lower piston chamber, closed by the weight of the valve internals and system pressure acting on the upper piston chamber. To de-activate the MSIV, all electrical power sources must be removed from the actuation solenoids and a drain or vent path must be available from the lower piston chamber.

b. When the MSIVBV in a given main steam line is closed and de-activated, or closed and isolated by a closed manual valve, or isolated by two closed manual valves, it is performing the specified safety function. Requiring the valve to be closed and de-activated provides assurance that it is performing its specified safety function. Closing and de-activating provides a means of isolation that cannot be adversely affected by a single active failure, thus assuring the MSIVBV is performing the specified safety function. When the valve is de-activated, power or air is removed from both actuation solenoid valves and the valve is spring closed. Requiring the MSIVBV to be closed and isolated by a closed manual valve provides additional assurance that the specified safety function is being performed. Requiring the MSIVBV to be isolated by two closed manual valves also provides additional assurance that the specified safety function is being performed.

(continued)

CALLAWAY PLANT B 3.7.2-5 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES APPLICABILITY c. When the MSLPDIV in a given main steam line is closed (continued) and de-activated, or closed and isolated by a closed manual valve, or isolated by two closed manual valves, it is performing the specified safety function. Requiring the valve to the closed and de-activated provides assurance that it is performing its specified safety function. Closing and de-activating provides a means of isolation that cannot be adversely affected by a single active failure, thus assuring the MSLPDIV is performing the specified safety function. When the valve is de-activated, power or air is removed from both actuation solenoid valves and the valve is spring closed. Requiring the MSLPDIV to be closed and isolated by a closed manual valve provides additional assurance that the specified safety function is being performed. Requiring the MSLPDIV to be isolated by two closed manual valves also provides additional assurance that the specified safety function is being performed.

In MODE 4, 5 or 6, the steam generator energy is low. Therefore, the MSIVs, MSIVBVs, and MSLPDIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.

ACTIONS On the basis that the LCO specifies operability requirements for the MSIVs as well as for their associated actuator trains, the Conditions and Actions specified for TS 3.7.2 separately address inoperability of the MSIV actuator trains and inoperability of the MSIVs themselves.

With respect to the MSIV actuator trains, Conditions A, B, and C (i.e.,

Required Actions A.1, B.1, and C.1) address the condition of when only one MSIV actuator train is inoperable per MSIV, for up to two MSIVs.

Condition D (Required Action D.1) addresses the condition of having both actuator trains inoperable for a single MSIV, and Condition E (Required Action E.1) addresses the condition of having three or more actuator trains inoperable in any combination or when the Required Action and associated Completion Time of Condition A, B, or C cannot be met. The acceptability of the Required Actions and associated Completion Times for addressing inoperable MSIV actuator trains is documented in the NRC Safety Evaluation for License Amendment 172 (Reference 6).

Conditions F and J address inoperability of the MSIVs themselves. During MODE 1 with one MSIV itself inoperable, Condition F (i.e., Required Action F.1) applies. Condition G subsequently applies if the Required Action and Completion Time of Condition F cannot be met. With more (continued)

CALLAWAY PLANT B 3.7.2-6 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES ACTIONS than one MSIV inoperable during MODE 1, LCO 3.0.3 applies. During (continued) MODE 2 or 3, with one MSIV itself or two or more MSIVs themselves inoperable, Condition J applies so that Required Actions J.1 and J.2 are required to be entered. Condition K subsequently applies if the Required Action and associated Completion Time of Condition J cannot be met.

Condition H addresses inoperability of the MSIVBVs. With one or more MSIVBVs inoperable, Condition H (i.e., Required Actions H.1 and H.2) applies. Condition K subsequently applies if the Required Action and associated Completion Time of Condition H cannot be met.

Condition I addresses inoperability of the MSLPDIVs. With one or more MSLPDIVs inoperable, Condition I (i.e., Required Action I.1 and I.2) applies. Condition K subsequently applies if the Required Action and associated Completion Time of Condition I cannot be met.

A.1 With only a single actuator train inoperable on one MSIV, action must be taken to restore the inoperable actuator train to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The 72-hour Completion Time is reasonable in light of the dual-redundant actuator train design such that with one actuator train inoperable, the affected MSIV is still be capable of closing on demand via the remaining operable actuator train. The 72-hour Completion Time takes into account the design redundancy, reasonable time for repairs, and the low probability of a design basis accident occurring during this period.

B.1 With an actuator train on one MSIV inoperable and an actuator train on another MSIV inoperable, such that the inoperable actuator trains are not in the same separation group, action must be taken to restore one of the inoperable actuator trains to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. With two actuator trains inoperable on two MSIVs, there is an increased likelihood that an additional failure (such as the failure of an actuation logic train) could cause one MSIV to fail to close. The 24-hour Completion Time is reasonable, however, since the dual-redundant actuator train design ensures that with only one actuator train on each of two affected MSIVs inoperable, each MSIV is still capable of closing on demand.

(continued)

CALLAWAY PLANT B 3.7.2-7 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES ACTIONS C.1 (continued)

With an actuator train on one MSIV inoperable and an actuator train on another MSIV inoperable, but with both inoperable actuator trains in the same separation group, action must be taken to restore one of the inoperable actuator trains to OPERABLE status within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. A reasonable amount of time for restoring at least one actuator train is permitted since the dual-redundant actuator train design for each MSIV ensures that a single inoperable actuator train cannot prevent the affected MSIV(s) from closing on demand. Wtih two actuator trains inoperable in the same separation group, however, an additional failure (such as the failure of an actuation logic train in the other separation group) could cause both affected MSIVs to fail to close on demand. The 4-hour Completion Time takes into account the low probability of occurrence of an event that would require MSIV closure during such an interval.

D.1 With both (two) actuator trains for a single MSIV inoperable, the affected MSIV must immediately be declared inoperable. This is appropriate since such a condition renders the affected MSIV incapable of closing on demand.

E.1 With three or more MSIV actuator trains inoperable, or with the Required Action and associated Completion Time of Condition A, B, or C not met, the affected MSIVs must immediately be declared inoperable. Having three actuator trains inoperable could involve two inoperable actuator trains on one MSIV and one inoperable actuator train on another MSIV, or an inoperable actuator train on each of three MSIVs, for which the inoperable actuator trains could all be in the same separation group or be staggered among the two separation groups.

Depending on which of these conditions or combinations is in effect, the condition or combination could mean that all of the affected MSIVs remain capable of closing on demand (due to the dual-redundant actuator train design), or that at least one MSIV is inoperable, or that with an additional single failure up to all three MSIVs could be incapable of closing on demand. Therefore, in some cases, immediately declaring the affected MSIVs inoperable is conservative (such as when some or all of the affected MSIVs may still be capable of closing on demand even with a single additional failure), while in other cases it is appropriate (such as when at least one of the MSIVs would be inoperable, or up to all three could be rendered inoperable by an additional single failure). Since Condition E addresses all of these conditions or combinations, Required (continued)

CALLAWAY PLANT B 3.7.2-8 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES ACTIONS E.1 (continued)

Action E.1 is conservatively based on the worst-case condition and therefore requires immediately declaring all of the affected MSIVs inoperable. It may be noted that declaring two or more MSIVs inoperable during Mode 1 requires entry into Specification 3.0.3.

F.1 With one MSIV inoperable in MODE 1, action must be taken to restore OPERABLE status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Some repairs to the MSIV can be made with the unit hot. The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the MSIVs.

Required Action F.1 is entered when one MSIV is inoperable during MODE 1, including when both actuator trains for a single, affected MSIV are inoperable. When only a single MSIV actuator train is inoperable (for one MSIV), Condition A applies and entry only into Required Action A.1 is required.

G.1 If the MSIV cannot be restored to OPERABLE status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Condition H would be entered. The Completion Times are reasonable, based on operating experience, to reach MODE 2 and to close the MSIVs in an orderly manner and without challenging unit systems.

H.1 and H.2 Condition H is modified by a Note indicating that, when one or more MSIVBVs are inoperable, separate Condition entry is allowed for each main steam line.

With one or more MSIVBVs inoperable, action must be taken to restore each MSIVBV to OPERABLE status within 7 days or the inoperable MSIVBV must be closed or isolated. When closed or isolated, the MSIVBV is already in the position required by the assumptions in the safety analysis. The 7 day Completion Time is reasonable, considering (continued)

CALLAWAY PLANT B 3.7.2-9 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES ACTIONS H.1 and H.2 (continued) the low probability of an accident occurring during this time period that would require a closure of the MSIVBVs.

For inoperable MSIVBVs that cannot be restored to OPERABLE status within 7 days, but are closed or isolated, the inoperable MSIVBVs must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls to ensure that these valves are in the closed position or isolated.

If the MSIVBV in a given main steam line is closed and de-activated, or closed and isolated by a closed manual valve, or isolated by two closed manual valves, this LCO does not apply as discussed in the Applicability section of these Bases.

I.1 and I.2 Condition I is modified by a Note indicating that, when one or more MSLPDIVs are inoperable, separate Condition entry is allowed for each main steam line.

With one or more MSLPDIVs inoperable, action must be taken to restore each MSLPDIV to OPERABLE status within 7 days or the inoperable MSLPDIV must be closed or isolated. When closed or isolated, the MSLPDIV is already in the position required by the assumptions in the safety analysis. The 7 day Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the MSLPDIVs.

When the MSLPDIV is isolated by two closed manual valves, one manual valve meets ASME Class 2 requirements and the other manual valve meets Class D requirements. The method of isolation is acceptable because (1) the MSLPDIV is an isolation in the secondary system, (2) the line isolated is a 1-inch drain line, and (3) the isolation valve in the Class D piping serves in addition to the other closed manual valve located in the ASME Class 2 piping.

For inoperable MSLPDIVs that cannot be restored to OPERABLE status within 7 days, but are closed or isolated, the inoperable MSLPDIVs must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day (continued)

CALLAWAY PLANT B 3.7.2-10 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES ACTIONS I.1 and I.2 (continued)

Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls to ensure that these valves are in the closed position or isolated.

If the MSLPDIV is a given steam line is closed and de-activated, or closed and isolated by a closed manual valves, or isolated by two closed manual valves, this LCO does not apply as discussed in the Applicability section of these Bases.

J.1 and J.2 Condition J is modified by a Note indicating that, when one or more MSIVs are inoperable in MODE 2 or 3, separate Condition entry is allowed for each main steam line.

Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the inoperable MSIVs may either be restored to OPERABLE status or closed.

When closed, the MSIVs are already in the position required by the assumptions in the safety analysis.

The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Completion Time is consistent with that allowed in Condition F.

For inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, the inoperable MSIVs must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of MSIV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position.

K.1 and K.2 If the Required Action and associated Completion Time of Conditions H, I or J are not met, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed at least in MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems.

(continued)

CALLAWAY PLANT B 3.7.2-11 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES (Continued)

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that the closure time of each MSIV is within the limits of Figure B 3.7.2-1 from each actuator train when tested pursuant to the INSERVICE TESTING PROGRAM. The MSIV isolation time is assumed in the accident and containment analyses. Figure B 3.7.2-1 is a curve of the MSIV isolation time as a function of steam generator pressure, since there is no pressure indication available at the MSIVs. The acceptance curve for the MSIV stroke time is conservative enough to account for potential pressure differential between the steam generator pressure indication and pressure at the MSIVs. Meeting the MSIV isolation times in Figure B 3.7.2-1 ensures that the evaluation performed in Reference 7 remains valid. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. The MSIVs should not be tested at power, since even a part stroke exercise increases the risk of a valve closure when the unit is generating power.

The Frequency is in accordance with the INSERVICE TESTING PROGRAM.

SR 3.7.2.2 This SR verifies that each MSIV, each MSIVBV, and each MSLPDIV is capable of closure on an actual or simulated actuation signal. The manual fast close handswitch in the Control Room provides an acceptable actuation signal. For the MSIVs each actuation train must be tested separately. This Surveillance is normally performed upon returning the unit to operation following a refueling outage in conjunction with SR 3.7.2.1. However, it is acceptable to perform this surveillance individually. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.2.3 This SR verifies that the closure time of each MSIVBV and MSLPDIV is

< 15 seconds when tested pursuant to the INSERVICE TESTING PROGRAM. This is consistent with the assumptions used in the accident and containment analyses.

For the MSIVBVs and MSLPDIVs, this Surveillance is performed routinely during plant operations (or as required for post-maintenance testing), but it (continued)

CALLAWAY PLANT B 3.7.2-12 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 BASES SURVEILLANCE SR 3.7.2.3 (continued)

REQUIREMENTS may also be required to be performed upon returning the unit to operation following a refueling outage.

The Frequency for this SR is in accordance with the INSERVICE TESTING PROGRAM.

REFERENCES 1. FSAR, Section 10.3, Main Steam Supply System.

2. FSAR, Section 6.2, Containment Systems.

3. FSAR, Section 15.1.5, Steam System Piping Failure.

4. 10 CFR 100.11.

5. FSAR 6.2.1.4.3.3, Containment Pressure - Temperature Results.

6. Amendment 172 to Facility Operating License No. NPF-30, (NRC Safety Evaluation included), Callaway Unit 1, dated June 16, 2006.

7. Westinghouse Letter, SCP-07-26, dated March 6, 2007.

CALLAWAY PLANT B 3.7.2-13 Revision 16

MSIVs, MSIVBVs, and MSLPDIVs B 3.7.2 Figure B 3.7.2-1 (page 1 of 1)

MSIV Stroke Time Limit vs Steam Generator Pressure CALLAWAY PLANT B 3.7.2-14 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Main Feedwater Isolation Valves (MFIVs), Main Feedwater Regulating Valves (MFRVs) and Main Feedwater Regulating Valve Bypass Valves (MFRVBVs)

BASES BACKGROUND The MFIVs isolate main feedwater (MFW) flow to the secondary side of the steam generators following a high energy line break (HELB). The MFRVs and MFRVBVs function to control feedwater flow to the SGs and provide backup isolation of MFW flow in the event an MFIV fails to close.

Because an earthquake is not assumed to occur coincident with a spontaneous break of safety related secondary piping, loss of the non-safety grade MFRVs and MFRVBVs is not assumed. If the single active failure postulated for a secondary pipe break is the failure of a safety grade MFIV to close, then credit is taken for closing the non-safety grade MFRVs and MFRVBVs.

The MFIV is a 14-inch gate valve with a system-medium actuator. Since the MFIV actuators are system-medium actuators, the MFIV isolation time is a function of steam generator steam pressure. The assumed single active failure of one of the redundant MFIV actuation trains will not prevent the MFIV from closing.

Closure of the MFIVs or MFRVs and MFRVBVs terminates flow to the steam generators, terminating the event for feedwater line breaks (FWLBs) occurring upstream of the MFIVs or MFRVs and MFRVBVs.

Since the MFIVs are located upstream of the point where the auxiliary feedwater lines connect to the main feedwater lines, which is in turn upstream of the main feedwater check valves (located in containment),

closure of the MFIVs or the MFRVs and MFRVBVs ensures delivery of auxiliary feedwater to the steam generators for support of the auxiliary feedwater function (LCO 3.7.5) in the event of a main feedwater line break in the turbine building (i.e., upstream of the MFIVs, MFRVs, and MFRVBVs).

Similarly, the consequences of events occurring in the main steam lines or in the MFW lines downstream from the MFIVs will be mitigated by valve closure. Closure of the MFIVs or MFRVs and MFRVBVs effectively terminates the addition of feedwater to an affected steam generator, limiting the mass and energy release for steam line breaks (SLBs) or FWLBs inside containment, and reducing the cooldown effects for SLBs.

The MFIVs isolate the nonsafety related portions from the safety related portions of the system. In the event of a secondary side pipe rupture inside containment, the valves limit the quantity of high energy fluid that (continued)

CALLAWAY PLANT B 3.7.3-1 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES BACKGROUND enters containment through the break, and provide a pressure boundary (continued) for the controlled addition of auxiliary feedwater (AFW) to the intact loops.

One MFIV and one MFRV are located on each MFW line, outside but close to containment. The MFRVBVs are located in six-inch lines that bypass flow around the MFRVs when in service. The MFRVBVs are normally closed during plant power operation above 25 percent power, but may be occasionally open to support maintenance, post-maintenance testing, or other plant activities. As shown in Reference 6, an MFIV can not be isolated with closed manual valves; the MFRV can be isolated upstream by a closed manual valve; and the MFRVBV can be isolated both upstream and downstream with a closed manual valve. The MFIVs and MFRVs and MFRVBVs are located upstream of the AFW injection point so that AFW may be supplied to the steam generators following MFIV or MFRV and MFRVBV closure. The piping volume from these valves to the steam generators is accounted for in calculating mass and energy releases, and purged and refilled prior to AFW reaching the steam generator following either an SLB or FWLB.

The MFIVs and MFRVs and MFRVBVs close on receipt of any safety injection signal, a Tavg - Low coincident with reactor trip (P-4) (not credited in any safety analysis - see Function 8.a Bases in LCO 3.3.2, ESFAS Instrumentation), a low-low steam generator level, or steam generator water level - high high signal. MFIVs may also be actuated manually. In addition to the MFIVs and MFRVs and MFRVBVs a check valve inside containment is available. The check valve isolates the feedwater line penetrating containment and ensures the pressure boundary of any intact loop not receiving auxiliary feedwater.

The MFIV actuators (skid-mounted at the valve) consist of two separate system-medium actuation trains each receiving an actuation signal from one of the redundant ESFAS channels. A single active failure in one power train would not prevent the other power train from functioning. The MFIVs, MFRVs and MFRVBVs provide the primary success path for events requiring feedwater isolation and isolation of non-safety-related portions from the safety-related portion of the system, such as, for auxiliary feedwater addition.

The MFRV and MFRVBV actuators (skid-mounted at the valve) consist of two separate actuation trains each receiving an actuation signal from one of the redundant ESFAS channels. Both trains are required to actuate to close the valve.

A description of the MFIVs and MFRVs and MFRVBVs is found in the FSAR, Section 10.4.7 (Ref. 1).

(continued)

CALLAWAY PLANT B 3.7.3-2 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES (Continued)

APPLICABLE Credit is taken in accident analysis for the MFIVs to close on demand.

SAFETY The function of the MFRVs and associated bypass valves as discussed in ANALYSES the accident analysis is to provide a diverse backup function to the MFIVs for the potential failure of an MFIV to close even though the MFRVs are located in the non-safety-related portion of the feedwater system. Further assurance of feedwater flow termination is provided by the SGFP trip function; however, SGFP trip is not credited in accident analysis. The accident analysis credits the main feedwater check valves as backup to the MFIVs to prevent SG blowdown for pipe ruptures in the non-seismic Category I portions of the feedwater system outside containment.

The impact of an MFIV isolation time as a function of steam generator steam pressure on the safety analyses has been evaluated in Reference 2 and 7. The evaluation concluded that a variable MFIV isolation time is acceptable with respect to the safety analyses. Figure B 3.7.3-1 is a curve of the MFIV isolation time limit as a function of steam generator steam pressure. Meeting the MFIV isolation times in Figure B 3.7.3-1 ensures that the evaluations performed in Reference 2 and 7 remain valid.

Criterion 3 of 10 CFR 50.36(c)(2)(ii) indicates that components that are part of the primary success path and that actuate to mitigate an event that presents a challenge to a fission product barrier should be in Technical Specifications. The primary success path of a safety analysis consists of the combination and sequences of equipment needed to operate (including redundant trains/components) so that the plant response to the event remains within appropriate acceptance criteria. The primary success path includes backup and diverse equipment. The MFIVs, with their dual-redundant actuation trains, are the primary success path for feedwater isolation. The MFIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). The MFRVs and MFRVBVs are backup and diverse equipment and satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO ensures that the MFIVs and MFRVs and MFRVBVs will isolate MFW flow to the steam generators, following an FWLB or main steam line break. The MFIVs will also isolate the nonsafety related portions from the safety related portions of the system.

This LCO requires that the MFIV, MFRV, and MFRVBV for each of the four main feedwater lines be OPERABLE. The MFIVs and MFRVs and MFRVBVs are considered OPERABLE when both of the skid-mounted actuation trains at the valves are operable, their isolation times are within limits when given an isolation actuation signal, and they are capable of closing on an isolation actuation signal. Isolation time limits for the MFIVs are given in Figure 3.7.3-1.

(continued)

CALLAWAY PLANT B 3.7.3-3 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES LCO With one MFIV actuation train unavailable, a single failure of the other (continued) actuation train (such as its associated logic train) could prevent both the affected MFIV and the associated MFRV from closing. In the event of an MSLB, this could result in insufficient isolation of the feedwater line such that the mass and energy addition to containment (by feedwater addition to the steam generator with the broken steam line) would exceed the amount assumed in the accident analysis. Requiring both MFIV actuation trains for MFIV OPERABILITY thus ensures that adequate isolation capability in conformance with the accident analysis exists, assuming a single failure.

For the MFRVs and MFRVBVs, the LCO requires only that the trip close function is OPERABLE. No OPERABILITY requirements are imposed on the analog controls shown on Reference 5.

To ensure the MFRVs close on demand, the valves are provided with a backup nitrogen supply. In particular, the accident analyses assume all four MFRVs close simultaneously within 15 seconds following receipt of a valid Feedwater Isolation signal (FWIS) using the nitrogen backup system as the actuation medium. Consistent with this assumption, the nitrogen supply accumulator tank (TKA06) must be maintained at a pressure sufficient to ensure that all four MFRVs close simultaneously within the assumed time on demand. The tank must therefore be maintained at or above the required pressure (400 psig) for the MFRVs to be considered OPERABLE. (Ref. 9)

Failure to meet the LCO requirements can result in additional mass and energy being released to containment following an SLB or FWLB inside containment. A feedwater isolation signal on high steam generator level is relied on to terminate an excess feedwater flow event.

APPLICABILITY The MFIVs and MFRVs and MFRVBVs must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and steam generators. This ensures that, in the event of an HELB, a single failure cannot result in the blowdown of more than one steam generator.

In MODES 1, 2, and 3, the MFIVs and MFRVs and MFRVBVs are required to be OPERABLE to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment with the following exceptions.

Feedwater is supplied to the four steam generators by four feedwater lines. One MFIV is installed in each of the four feedwater lines downstream of the MFRV and MFRVBV. When the feedwater line that feeds the steam generator is isolated, the specified safety function is being met. When there is assurance that the feedwater line is or can be fully (continued)

CALLAWAY PLANT B 3.7.3-4 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES APPLICABILITY isolated, exceptions are allowed in the Applicability based on the condition (continued) that the specified safety function can still be performed. In MODES 1, 2 and 3, exceptions to the APPLICABILITY are allowed for an MFIV, MFRV, and/or MFRVBV when isolation assurance can be provided by either requiring the valve to be closed in a manner such that its closure cannot be adversely affected by a single active failure, or by having one (or both) of the other valves in that feedwater line closed in such a manner. Since, for each feedwater line, the MFIV serves as one isolation barrier and the combination of the MFRV and MFRVBV (which are in parallel) serves as the other barrier, the valve (or valves) that is (are) required to be closed in the described manner depends on which valve is execpted from the LCO Applicability.

The basis for the exception given for an MFIV, MFRV, and/or MFRVBV in the Applicability is described below.

MFIV Exception To except an MFIV from the Applicability for the affected feedwater line, isolation or isolation capability for the feedwater line can be assured as follows:

a. When the MFIV in a given main feedwater line is closed and de-activated, it is performing the specified safety function. Requiring the MFIV to be closed and de-activated provides assurance that the MFIV is performing the specified safety function, as it provides a means of isolation that cannot be adversely affected by a single active failure. The MFIV is a system-medium actuated valve, opened by system pressure acting on the lower piston chamber, closed by the weight of the valve internals and system pressure acting on the upper piston chamber. To de-activate the MFIV all electrical power sources must be removed from the actuation solenoids on the MFIV and a drain or vent path must be available from the lower piston chamber.

b. Isolation of the affected feedwater line may also be ensured by closure of the MFRV and MFRVBV associated with that feedwater line (since the parallel combination of the MFRV and MFRVBV may serve as an isolation barrier for the affected feedwater line in lieu of the MFIV).

When the MFRV is closed and de-activated or is closed and isolated by a closed manual valve, it is performing its specified safety function. Requiring the valve to be closed and de-activated provides assurance that it is performing its specified safety (continued)

CALLAWAY PLANT B 3.7.3-5 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES APPLICABILITY function, as it provides a means of isolation that cannot be (continued) adversely affected by a single active failure. When the valve is de-activated, power is removed from the actuation solenoids on the valve. Alternatively, requiring the valve to be closed and isolated by a closed manual valve also provides assurance that the specified safety function is being performed. This provides a means of isolation that cannot be adversely affected by a single active failure.

When the MFRVBV is closed and de-activated or is closed and isolated by a closed manual valve, or is isolated by two closed manual valves, it is performing its specified safety function.

Requiring the valve to be closed and de-activated provides assurance that it is performing its specified safety function, as it provides a means of isolation that cannot be adversely affected by a single active failure. When the valve is de-activated, power is removed from the actuation solenoids on the valve. Alternatively, requiring the valve to be closed and isolated by a closed manual valve also provides assurance that the specified safety function is being performed, as this provides a means of isolation that cannot be adversely affected by a single active failure. The safety function may also be ensured when the MFRVBV is isolated by two closed manual valves, as this provides a means of isolation that cannot be adversely affected by a single active failure.

MFRV Exception To except an MFRV from the Applicability of LCO 3.7.3 for the affected feedwater line, isolation or isolation capability for the feedwater line can be assured as follows: Isolation of the main feedwater line may be accomplished by closing and de-activating the MFIV. Alternatively, isolation capability can be ensured by closing and de-activating the MFRV, or closing and isolating the MFRV by a closed manual valve in combination with OPERABILITY or closure of the other valves, i.e., the MFIV and MFRVBV. (Closure in this case means closed in accordance with the Applicability exception taken for either the MFIV or MFRVBV as applicable.)

a. When the MFIV in a given main feedwater line is closed and de-activated, it is performing its specified safety function. Requiring the valve to be closed and de-activated provides assurance that it is performing its specified safety function, as it provides a means of isolation that cannot be adversely affected by a single active failure. The MFIV is a system-medium actuated valve, opened by system pressure acting on the lower piston chamber, closed by the (continued)

CALLAWAY PLANT B 3.7.3-6 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES APPLICABILITY weight of the valve internals and system pressure acting on the (continued) upper piston chamber. To de-activate the MFIV all electrical power sources must be removed from the actuation solenoids on the MFIV and a drain or vent path must be available from the lower piston chamber.

b. When the MFRV in a given main feedwater line is closed and de-activated or is closed and isolated by a closed manual valve, it is performing its specified safety function. Requiring the valve to be closed and de-activated provides assurance that it is performing its specified safety function, as it provides a means of isolation that cannot be adversely affected by a single active failure. When the valve is de-activated, power is removed from the actuation solenoids on the valves. Alternatively, requiring the MFRV to be closed and isolated by a closed manual valve also provides assurance that the specified safety function is being performed, as this provides a means of isolation that cannot be adversely affected by a single active failure.

MFRVBV Exception To except an MFRVBV from the Applicability of LCO 3.7.3 for the affected feedwater line, isolation or isolation capability for the feedwater line can be assured as follows: Isolation of the main feedwater line may be accomplished by closing and de-activating the MFIV. Alternatively, isolation capability can be ensured by closing and de-activating the MFRVBV, or closing and isolating the MFRVBV with a closed manual valve, or isolating the MFRVBV with two closed manual valves, in combination with OPERABILITY or closure of the other valves, i.e., the MFIV and MFRV. (Closure in this case means closed in accordance with the Applicability exception taken for either the MFIV or MFRV as applicable.)

a. When the MFIV in a given main feedwater line is closed and de-activated, it is performing its specified safety function. Requiring the valve to be closed and de-activated provides assurance that it is performing its specified safety function, as it provides a means of isolation that cannot be adversely affected by a single active failure. The MFIV is a system-medium actuated valve, opened by system pressure acting on the lower piston chamber, closed by the weight of the valve internals and system pressure acting on the upper piston chamber. To de-activate the MFIV all electrical power sources must be removed from the actuation solenoids on the MFIV and a drain or vent path must be available from the lower piston chamber.

(continued)

CALLAWAY PLANT B 3.7.3-7 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES APPLICABILITY b. When the MFRVBV in the given main feedwater line is closed and (continued) de-activated or is closed and isolated by a closed manual valve, or isolated by two manual valves, it is performing its specified safety function. Requiring the valve to be closed and de-activated provides assurance that it is performing its specified safety function, as it provides a means of isolation that cannot be adversely affected by a single active failure. When the valve is de-activated, power is removed from the actuation solenoids on the valves. Alternatively, requiring the MFRVBV to be closed and isolated by a closed manual valve also provides assurance that the specified safety function is being performed, as this provides a means of isolation that cannot be adversely affected by a single active failure. Finally, the safety function may also be ensured when the MFRVBV is isolated by two closed manual valves, as this provides a means of isolation that cannot be adversely affected by a single active failure.

In MODES 4, 5, and 6, steam generator energy is low. Therefore, the MFIVs, MFRVs and MFRVBVs are not required to mitigate the effects of a feedwater or steamline break in these MODES.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each main feedwater line.

A.1 and A.2 With one MFIV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close inoperable affected valves within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the redundancy afforded by the dual-redundant actuation trains on the MFIVs, the redundancy afforded by the remaining OPERABLE valves, and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on operating experience.

Inoperable MFIVs that are closed must be verified on a periodic basis that they are closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, the availability of valve status indications available in the control room, and other administrative controls, to ensure (continued)

CALLAWAY PLANT B 3.7.3-8 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES ACTIONS A.1 and A.2 (continued) that these valves are closed.

If the MFIVs are closed and de-activated, this LCO does not apply as discussed in the Applicability section of these Bases.

B.1 and B.2 With one MFRV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or to isolate inoperable affected valves within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on operating experience.

Inoperable MFRVs, that are closed or isolated, must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, the availability of valve status indications in the control room, and other administrative controls to ensure that the valves are closed or isolated. If the MFRVs are closed and de-activated, or closed and isolated by a closed manual valve, this LCO does not apply as discussed in the Applicability section of these Bases.

C.1 and C.2 With one MFRVBV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or to isolate inoperable affected valves within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on operating experience.

Inoperable MFRVBVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to (continued)

CALLAWAY PLANT B 3.7.3-9 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES ACTIONS C.1 and C.2 (continued) ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.

If the MFRVBVs are closed and de-activated, or closed and isolated by a closed manual valve, or isolated by two closed manual valves, this LCO does not apply as discussed in the Applicability section of these Bases.

D.1 Two inoperable valves in the same flow path is treated the same as loss of the isolation capability of this flow path. For each feedwater line there are two flow paths, defined as flow through the MFRV/MFIV and flow through the MFRVBV/MFIV. Because the MFIV, MFRV, and MFRVBV are of different designs, a common mode failure of the valves in the same flow path is not likely. However, under these conditions, affected valves in each flow path must be restored to OPERABLE status, or the affected flow path isolated within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. This action returns the system to the condition where at least one valve in each flow path is performing the required safety function. The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Completion Time is reasonable, based on operating experience, to complete the actions required to close the MFIV or MFRV and MFRVBV, or otherwise isolate the affected flow path.

E.1 and E.2 If the MFIV(s) and MFRV(s) and MFRVBV(s) cannot be restored to OPERABLE status, or closed, within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies that the closure time of each MFRV and MFRVBV is 15 seconds when tested pursuant to the INSERVICE TESTING PROGRAM.

The MFRV and MFRVBV closure time is assumed in the accident and (continued)

CALLAWAY PLANT B 3.7.3-10 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES SURVEILLANCE SR 3.7.3.1 (continued)

REQUIREMENTS containment analyses. For the MFRVs, performance of this surveillance involves simultaneously stroking the MFRVs closed using nitrogen at or below the required accumulator pressure (400 psig) and verifying that the valves close within the required limit. (Ref. 9)

For the MFRVs this Surveillance is normally performed upon returning the unit to operation following a refueling outage, or it may be performed as required for post-maintenance testing under appropriate conditions during applicable MODES. The MFRVs should normally not be tested at power since even a partial stroke exercise increases the risk of a valve closure with the unit generating power. However, when the plant is operating using the MFRVBVs (steam generator level maintained solely by flow through the MFRVBVs), the surveillance for the MFRVs may be performed for post-maintenance testing during such conditions without increasing plant risk.

For the MFRVBVs, this Surveillance is performed routinely during plant operation (or as required for post-maintenance testing), but it may also be required to be performed upon returning the unit to operation following a refueling outage.

For verifying valve closure time when returning the unit to operation following a refueling outage, the SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows a delay of testing until MODE 3, to establish conditions consistent with those under which the acceptance criterion was generated. Test conditions are with the unit at nominal operating temperature and pressure, as dicussed in Reference 8.

Per Reference 4, if it is necessary to adjust stem packing to stop packing leakage and if a required stroke test is not practical in the current plant MODE, it should be shown by analysis that the packing adjustment is within torque limits specified by the manufacturer for the existing configuration of packing, and that the performance parameters of the valve are not adversely affected. A confirmatory test must be performed at the first available opportunity when plant conditions allow testing. Packing adjustments beyond the manufacturer's limits may not be performed without (1) an engineering analysis and (2) input from the manufacturer, unless tests can be performed after adjustments.

The Frequency for this SR is in accordance with the INSERVICE TESTING PROGRAM.

(continued)

CALLAWAY PLANT B 3.7.3-11 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES SURVEILLANCE SR 3.7.3.2 REQUIREMENTS (continued) This SR verifies that each MFIV, MFRV, and MFRVBV is capable of closure on an actual or simulated actuation signal. For the MFIVs the manual fast close handswitch in the Control Room provides an acceptable actuation signal. Each MFIV actuation train must be tested separately. For the MFRVs and the MFRVBVs, actuation of solenoids locally at the MFRVs and MFRVBVs constitutes an acceptable simulated actuation signal.

This Surveillance is normally performed for the MFIVs and MFRVs upon returning the unit to operation following a refueling outage in conjunction with SR 3.7.3.1. The SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR for the MFRVs and MFRVBVs. This allows a delay of testing until MODE 3 to establish conditions consistent with those necessary to perform SR 3.7.3.1 and SR 3.7.3.2 concurrently for the MFRVs and for the MFRVBVs, as necessary.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.3.3 This SR verifies that the closure time of each MFIV is within the limits of Figure B 3.7.3-1 from each actuation train when tested pursuant to the INSERVICE TESTING PROGRAM. The MFIV closure time is assumed in the accident and containment analyses. Figure B 3.7.3-1 is a curve of the MFIV isolation time limit as a function of steam generator steam pressure, since there is no pressure indication available at the MFIVs. The acceptance curve for the MFIV stroke time conservatively accounts for the potential pressure differential between the steam generator pressure indication and the pressure at the MFIVs. Meeting the MFIV isolation times in Figure B 3.7.3-1 ensures that the evaluations performed in Reference 2 and Reference 7 remain valid. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. These valves should not be tested at power since even a partial stroke exercise increases the risk of a valve closure with the unit generating power.

The Frequency for this SR is in accordance with the INSERVICE TESTING PROGRAM.

(continued)

CALLAWAY PLANT B 3.7.3-12 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 BASES (Continued)

REFERENCES 1. FSAR, Section 10.4.7, Condensate and Feedwater System.

2. Westinghouse Letter, SCP-05-027, Revision 2, dated September 9,2005.

3. FSAR, Table 7.3-14, NSSS Instrument Operating Conditions for Isolation Functions.

4. NUREG-1482, "Guidelines for Inservice Testing at Nuclear Power Plants."

5. FSAR Figure 7.2-1, Sheets 13 and 14.

6. FSAR Figure 10.4-6, Sheets 1 and 2.

7. WCAP-16265-P, dated August 2004.

8. ASME Code for Operation and Maintenance of Nuclear Power Plants.

9. FSAR Section 9.3.1, Compressed Air System CALLAWAY PLANT B 3.7.3-13 Revision 16

MFIVs, MFRVs, and MFRVBVs B 3.7.3 Figure B 3.7.3-1 (page 1 of 1)

MFIV Stroke Time Limit vs Steam Generator Pressure CALLAWAY PLANT B 3.7.3-14 Revision 16

ASDs B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Atmospheric Steam Dump Valves (ASDs)

BASES BACKGROUND The ASDs (also referred to as atmospheric relief valves in the FSAR),

provide a method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sink via the Steam Dump Valves to the condenser not be available, as discussed in the FSAR, Section 10.3 (Ref. 1). This is done in conjunction with the Auxiliary Feedwater System providing cooling water from the condensate storage tank (CST). The ASDs assure that subcooling can be achieved to facilitate equalizing pressure between the reactor coolant system and the ruptured steam generator following a postulated steam generator tube rupture event. The ASDs may also be required to meet the design cooldown rate during a normal cooldown when steam pressure drops too low for maintenance of a vacuum in the condenser to permit use of the Steam Dump System.

One ASD line for each of the four steam generators is provided. Each ASD line consists of one ASD and an associated manual isolation valve.

The ASDs are provided with upstream manual isolation valves to provide positive shutoff capability should an ASD develop seat leakage and to facilitate maintenance activities. The ASDs themselves are equipped with pneumatic controllers to permit control of the cooldown rate as well as handwheels for manually opening and closing the valves locally, if needed, under suitable conditions.

The ASDs are provided with a pressurized gas supply of nitrogen that, on a loss of pressure in the normal instrument air supply, automatically supplies nitrogen to operate the ASDs. One nitrogen accumulator supplies one ASD and one auxiliary feedwater control valve per steam generator. The nitrogen accumulator supply is sized to provide sufficient pressurized gas to operate the ASD for the time required for Reactor Coolant System cooldown to RHR entry conditions.

A description of the ASDs is found in Reference 1.

APPLICABLE The design basis of the ASDs is established by the capability to cool the SAFETY unit to RHR entry conditions. The unit can be cooled to RHR entry ANALYSES conditions with only one steam generator and one ASD, utilizing the cooling water supply available in the CST. The valves will pass sufficient (continued)

CALLAWAY PLANT B 3.7.4-1 Revision 18

ASDs B 3.7.4 BASES APPLICABLE flow at all pressures to achieve a 50°F per hour plant cooldown rate. The SAFETY total capacity of the four valves is 15% of rated main steam flow at steam ANALYSES generator no-load pressure.

(continued)

In the accident analysis presented in Reference 2, the main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain steam generator pressure below the design value. The ASDs are assumed to be used by the operator to cool down the unit to RHR entry conditions for accidents accompanied by a loss of offsite power.

The ASDs can be operated locally via each valve's actuator handwheel mechanism. Operation of the ASDs using their handwheels is credited in the event that the environmental conditions following a steam line break result in failure of the ASD valve pneumatic subcomponents (Ref. 7).

Analysis shows that the handwheels are accessible after a minimum period of time following the transient conditions associated with a steam line break.

For the recovery from a steam generator tube rupture (SGTR) event described in Reference 3, the operator is required to perform a rapid cooldown using two intact steam generators to establish adequate subcooling as a necessary step to terminate the primary-to-secondary break flow into the ruptured steam generator. The time required to terminate the primary-to-secondary break flow for an SGTR is more critical than the time required to cool down to RHR conditions for this event and also for other accidents. Thus, the SGTR is the limiting event for ASD performance. The number of ASDs required to be OPERABLE to satisfy the SGTR accident analysis requirements is four. This accounts for the unavailable (isolated) ASD associated with the ruptured SG, concurrent with an assumed single failure of one other ASD, thereby leaving two ASDs available for heat removal.

The required duration of ASD operation is determined by the time for unit cooldown to RHR conditions for those accident scenarios analyzed for unit cooldown to RHR entry conditions, coincident with a loss of offsite power.

The ASDs are equipped with manual isolation valves in the event an ASD spuriously fails open or fails to close during use.

The ASDs satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

(continued)

CALLAWAY PLANT B 3.7.4-2 Revision 18

ASDs B 3.7.4 BASES LCO Four ASD lines are required to be OPERABLE. One ASD line is required from each of four steam generators to ensure that at least two intact SG ASD lines are available to conduct the rapid RCS cooldown following an SGTR, in which one steam generator becomes unavailable due to the steam generator tube rupture, accompanied by a single, active failure of a second ASD line on an unaffected steam generator (Ref. 6). The manual isolation valves must be OPERABLE to isolate a failed open ASD line.

The accident analyses that credit OPERABILITY of the ASDs require them to relieve steam to the atmosphere in order to perform their safety related function.

Failure to meet the LCO could result in the inability to achieve subcooling, consistent with the assumptions used in the steam generator tube rupture analysis, to facilitate equalizing pressures between the reactor coolant system and the ruptured steam generator in the event of an SGTR.

An ASD is considered OPERABLE when it is capable of providing controlled relief of the main steam flow and is capable of fully opening and closing on demand and not experiencing excessive seat leakage.

OPERABILITY of an ASD also requires it to be capable of being opened and closed by use of its actuator handwheel. Excessive seat leakage, although not associated with a specific acceptance criterion, exists when conditions dictate closure of the manual isolation valve to limit leakage.

Each nitrogen accumulator tank supplies one TDAFP control valve and one steam generator ASD. The tanks must be maintained at a pressure sufficient to support an RCS cooldown to RHR entry conditions following an accident coincident with loss of offsite power in order for the ASDs and the TDAFP flow control valves to be considered OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, the ASD lines are required to be OPERABLE.

In MODE 4, the pressure and temperature limitations are such that the probability of a SGTR event requiring ASD operation is low. In addition, the RHR system is available to provide the decay heat removal function in MODE 4. Therefore, the ASD lines are not required to be OPERABLE in MODE 4.

In MODE 5 or 6, an SGTR is not a credible event.

(continued)

CALLAWAY PLANT B 3.7.4-3 Revision 18

ASDs B 3.7.4 BASES ACTIONS A.1 With one required ASD line inoperable for reasons other than excessive ASD seat leakage, action must be taken to restore the ASD line to OPERABLE status within 7 days. The 7 day Completion Time allows for the redundant capability afforded by the remaining OPERABLE ASD lines, a nonsafety grade backup in the Condenser Steam Dump System, and MSSVs.

B.1 With two required ASD lines inoperable for reasons other than excessive ASD seat leakage, action must be taken to restore all but one required ASD line to OPERABLE status. Since the manual isolation valve can be closed to isolate an ASD, some repairs may be possible with the unit at power. The 72-hour Completion Time is reasonable to repair inoperable ASD lines, based on the availability of the Condenser Steam Dump System and/or MSSVs, and the low probability of an event occurring during the restoration period that would require the ASD lines.

C.1 With three or more required ASD lines inoperable for reasons other than excessive ASD seat leakage, action must be taken to restore all but two required ASD lines to OPERABLE status. Since the manual isolation valve can be closed to isolate an ASD, some repairs may be possible with the unit at power. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is reasonable to repair inoperable ASD lines, based on the availability of the Condenser Steam Dump System and MSSVs, and the low probability of an event occurring during this period that would require the ASD lines.

D.1 and D.2 Requiring a 30 day limit for restoring an ASD valve to OPERABLE status from inoperable, due to excessive seat leakage from the valve, provides assurance that the required number of ASDs will be available for plant cooldown. This action limits the period in which a manual isolation valve is closed due to excessive seat leakage of the ASD and minimizes the delay associated with manually opening a closed manual isolation valve (due to excessive seat leakage of the ASD).

(continued)

CALLAWAY PLANT B 3.7.4-4 Revision 18

ASDs B 3.7.4 BASES ACTIONS E.1 and E.2 (continued)

If the required ASD line(s) cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS To perform a controlled cooldown of the RCS, the ASDs must be able to be opened remotely and throttled through their full range from the control room. They must also be able to be manually and locally opened and closed by use of their handwheels. This SR demonstrates both of these capabilities in accordance with the INSERVICE TESTING PROGRAM.

The best conditions for verifying the OPERABILITY of the ASDs using their pneumatic controls to open and close the valves remotely from the control room is with the manual isolation valve open for the tested valve and nominal steam line at operating pressure and temperature. The ASDs are designed such that steam line pressure acts on top of the valve plug.

When the valve is required to move to the open position, the pneumatic actuator must act against steam line pressure. Therefore, to best verify the operational readiness of the ASD pneumatic controls, the Surveillance should be performed at nominal SG operating temperature and pressure, which is in the upper portion of MODE 3 (Ref. 5).

Operating an ASD remotely from the control room using its pneumatic controls during a unit cooldown may satisfy the portion of this SR for pneumatically stroking the valves remotely from the control room.

Operating experience has shown that these components usually pass the Surveillance when performed at the required INSERVICE TESTING PROGRAM Frequency. The Frequency is acceptable from a reliability standpoint.

This Surveillance Requirement is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR, i.e., that portion of the SR that requires operating the ASD using its pneumatic controls to (continued)

CALLAWAY PLANT B 3.7.4-5 Revision 18

ASDs B 3.7.4 BASES SURVEILLANCE SR 3.7.4.1 (continued)

REQUIREMENTS open and close the valve remotely from the control room. This allows a delay of testing until MODE 3, to establish conditions consistent with those under which acceptance criterion was generated (Ref. 5).

SR 3.7.4.2 The function of the manual isolation valve is to isolate a failed open or leaking ASD. Cycling the manual isolation valve both closed and open demonstrates its capability to perform this function. Performance of inservice testing or use of the manual isolation valve during unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed in accordance with the INSERVICE TESTING PROGRAM Frequency. The Frequency is acceptable from a reliability standpoint.

REFERENCES 1. FSAR, Section 10.3, Main Steam Supply System.

2. FSAR, Chapter 15.2, Decrease in Heat Removal by the Secondary System.

3. FSAR, Section 15.6.3, Steam Generator Tube Failure.

4. FSAR, Section 9.3.1, Compressed Air System.

5. Operating License Amendments 45 and 59.

6. Operating License Amendment 131.

7. FSAR, Section 15.1.5, Steam System Piping Failure CALLAWAY PLANT B 3.7.4-6 Revision 18

AFW System B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Auxiliary Feedwater (AFW) System BASES BACKGROUND The AFW system automatically supplies feedwater to the steam generators to remove decay heat from the Reactor Coolant System upon the loss of normal feedwater supply. The AFW pumps normally take suction through a common suction line from the condensate storage tank (CST) (LCO 3.7.6). Should the CST become unavailable, cooling water is available from the Essential Service Water (ESW) system. Each motor-driven AFW pump is supplied from one ESW train. The steam AFW pump is supplied from either ESW train. The AFW pumps discharge to the steam generator secondary side via separate and independent connections to the main feedwater (MFW) piping outside containment.

The steam generators function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam safety valves (MSSVs) (LCO 3.7.1) or atmospheric steam dump valves (ASDs)

(LCO 3.7.4). If the main condenser is available, steam may be released via the Condenser Steam Dump valves and condensate recirculated to the CST.

The AFW system consists of two motor-driven AFW pumps and one steam turbine-driven pump configured into three trains. Each motor-driven pump provides the feedwater flow required for removal of decay heat from the reactor during cooldown to RHR conditions. The turbine-driven pump provides 200% of the capacity of a motor-driven pump. The pumps are equipped with recirculation lines to prevent pump operation against a closed system. Each motor-driven AFW pump is powered from an independent Class 1E power supply and feeds two steam generators, although each pump has the capability to be locally aligned to feed other steam generators. The steam turbine-driven AFW pump receives steam from two main steam lines upstream of the main steam isolation valves and water from either the condensate storage tank or redundant ESW supply lines. Each of the steam feed lines will supply 100% of the requirements of the turbine-driven AFW pump. In addition, each of the ESW supply lines will supply 100% of the requirements of the turbine-driven AFW pump.

The AFW system is capable of supplying feedwater to the steam generators during normal unit startup, shutdown, and hot standby conditions.

(continued)

CALLAWAY PLANT B 3.7.5-1 Revision 16

AFW System B 3.7.5 BASES BACKGROUND The turbine-driven AFW pump supplies a common header capable of (continued) feeding all steam generators with normally open air-operated control valves. The motor-driven pumps supply flow to the steam generators through a normally open motor-operated valve that automatically throttles flow to prevent pump runout conditions under all steam generator pressure conditions. One pump at full flow is sufficient to remove decay heat and cool the unit to residual heat removal (RHR) entry conditions (see the discussion below in the Applicable Safety Analyses section).

Thus, the requirement for diversity in motive power sources for the AFW system is met.

The AFW system is designed to provide feedwater to maintain sufficient steam generator level to ensure heat removal from the reactor coolant system in order to achieve a safe shutdown following a main feedwater line break, a main steamline break, or an abnormal plant situation requiring shutdown. Subsequently, the AFW system supplies sufficient water to cool the unit to RHR entry conditions, with steam released through the ASDs.

The motor-driven AFW pumps start automatically on steam generator water level - low low in any steam generator, on trip of both main feedwater pumps, upon actuation of AMSAC, on actuation by the LOCA sequencer and the shutdown sequencer. The turbine-driven AFW pump is automatically started by steam generator water level - low low in any two steam generators, NB01 or NB02 undervoltage, and upon actuation of AMSAC.

The AFW system is discussed in the FSAR, Section 10.4.9 (Ref. 1).

APPLICABLE The AFW system mitigates the consequences of any event with loss of SAFETY normal feedwater.

ANALYSES The design basis of the AFW system is to provide feedwater to maintain sufficient steam generator level to ensure heat removal from the reactor coolant system in order to achieve a safe shutdown following a main feedwater line break, a main steamline break, or an abnormal plant situation requiring shutdown.

In addition, the AFW system must supply enough makeup water to replace steam generator secondary inventory lost as the unit cools to MODE 4 conditions. Sufficient AFW flow must also be available to account for flow losses such as pump recirculation and line breaks.

(continued)

CALLAWAY PLANT B 3.7.5-2 Revision 16

AFW System B 3.7.5 BASES APPLICABLE The limiting Design Basis Accidents (DBAs) and transients for the AFW SAFETY system are as follows:

ANALYSES (continued) a. Feedwater Line Break (FWLB),

b. Main Steam Line Break; and

c. Loss of MFW.

In addition, the minimum available AFW flow and system characteristics are considerations in the analysis of a small break loss of coolant accident (LOCA).

The AFW system design is such that it can perform its function following an FWLB between the MFW isolation valves and containment, combined with a loss of offsite power following turbine trip, and a single active failure of the turbine-driven AFW pump. This results in minimum assumed flow to the intact steam generators. As discussed in the Bases for LCO 3.8.1, "AC Sources-Operating," the Notes above Required Actions A.2, B.2, and C.1 reflect the fact that one motor-driven AFW pump is not, by itself, capable of delivering 100% of the AFW flow assumed in the FWLB safety analysis. One motor-driven AFW pump would deliver to the broken MFW header at a flow rate throttled by the motor-operated "smart" discharge valve until the problem was detected, and flow terminated by the operator. Sufficient flow would be delivered to the intact steam generator by the throttled flow from the motor-driven AFW pump feeding the affected steam generator (SG) plus the equally split flow to two intact SGs from the other motor-driven AFW pump (Ref. 5).

The FSAR Chapter 15 analyses of the Loss of Non-emergency AC Power (LOAC) and Loss of Normal Feedwater (LONF) events (see References 7 and 8) assume that both motor-driven AFW pumps provide auxiliary feedwater flow to all four steam generators. The limiting single failure in the analyses of these events is the failure of the turbine-driven AFW pump.

The BOP ESFAS automatically actuates the turbine-driven AFW pump when required to ensure an adequate feedwater supply to the steam generators during loss of power. Air-operated valves are provided for the turbine-driven AFW line to each steam generator.

The AFW system satisfies the requirements of Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

(continued)

CALLAWAY PLANT B 3.7.5-3 Revision 16

AFW System B 3.7.5 BASES (Continued)

LCO This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of accidents that could result in overpressurization of the reactor coolant pressure boundary. Three independent AFW pumps in three diverse trains are required to be OPERABLE to ensure the availability of decay heat removal for all events accompanied by a loss of offsite power and a single failure. This is accomplished by powering two of the pumps from independent emergency buses. The third AFW pump is powered by a different means, a steam-driven turbine supplied with steam from a source that is not isolated by closure of the MSIVs.

The AFW System is configured into three trains. The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the steam generators are OPERABLE.

This requires that the two motor-driven AFW pumps (MDAFPs) be OPERABLE in two diverse paths, each capable of automatically transferring the suction from the CST to an ESW supply line and supplying AFW to two steam generators. The turbine-driven AFW pump (TDAFP) is required to be OPERABLE with redundant steam supply lines from each of two main steam lines upstream of the MSIVs, and shall be capable of automatically transferring the suction from the CST to two redundant ESW supply lines and supplying AFW to any of the steam generators.

Therefore, with one ESW train inoperable, the associated MDAFP train is considered inoperable and one TDAFP supply line is considered inoperable. However, the TDAFP is OPERABLE based on the remaining OPERABLE ESW supply line. The piping, valves, instrumentation, and controls in the required flow paths also are required to be OPERABLE. At least one condensate drain path, via FCLV0010 or FCST0001, must exist for the TDAFP to be OPERABLE.

The standby lineup for the TDAFP steam supply lines is when the main steam supply valves, ABHV0005 and ABHV0006, are closed and OPERABLE and the warmup valves, ABHV0048 and ABHV0049, are open and OPERABLE. The TDAFP steam supply lines may also be considered OPERABLE when the associated main steam supply and warmup valves are failed and secured in their safeguards position.

Each nitrogen accumulator tank supplies one TDAFP control valve and one steam generator ASD. The tanks must be maintained at a pressure sufficient to support an RCS cooldown to RHR entry conditions following an accident coincident with loss of offsite power in order for the ASDs and the TDAFP flow control valves to be considered OPERABLE.

(continued)

CALLAWAY PLANT B 3.7.5-4 Revision 16

AFW System B 3.7.5 BASES LCO Although the AFW system can be used in MODE 4 to remove decay heat, (continued) the LCO does not require the AFW system to be OPERABLE in MODE 4 since the RHR system is available for decay heat removal.

APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW is lost. In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory, lost as the unit cools to MODE 4 conditions.

In MODES 4 and 5, the AFW System may be used for heat removal via the steam generators but is not required since the RHR System is available in these MODES.

In MODE 6, the steam generators are not normally used for heat removal, and the AFW System is not required.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable AFW train when entering MODE 1. There is an increased risk associated with entering MODE 1 with an AFW train inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 If one of the two steam supplies to the turbine-driven AFW train is inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time is reasonable, based on the following reasons:

a. The redundant OPERABLE steam supply to the turbine-driven AFW pump;

b. The availability of redundant OPERABLE motor-driven AFW pumps; and

c. The low probability of an event occurring that requires the inoperable steam supply to the turbine-driven AFW pump.

(continued)

CALLAWAY PLANT B 3.7.5-5 Revision 16

AFW System B 3.7.5 BASES ACTIONS A.1 (continued)

The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which multiple Conditions are entered concurrently. The AND connector between 7 days and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

B.1 With one of the two Essential Service Water supply lines in the turbine-driven AFW train inoperable, action must be taken to restore the inoperable ESW supply line to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. One inoperable ESW supply line in the turbine-driven AFW train does not render the TDAFP inoperable since the turbine-driven AFW train is provided with redundant ESW supply lines. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on the following reasons:

a. The redundant OPERABLE Essential Service Water supply line in the turbine-driven AFW train;

b. The availability of the preferred non-safety grade Condensate Storage Tank supply;

c. The availability of at least one OPERABLE motor-driven AFW pump. When an ESW train inoperability renders a TDAFP supply line inoperable and a motor-driven AFW pump supply line inoperable, then one motor-driven AFW pump is OPERABLE and the second motor-driven AFW pump is available with water supplied from the non-safety grade Condensate Storage Tank;

d. The low probability of an event occurring that will require the inoperable Essential Service Water supply line to the turbine-driven AFW pump; and

e. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is consistent with the allowed Completion Time for one train of ESW inoperable (see Ref. 4).

(continued)

CALLAWAY PLANT B 3.7.5-6 Revision 16

AFW System B 3.7.5 BASES ACTIONS B.1 (continued)

The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which multiple Conditions are entered concurrently. The AND connector between 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

C.1 With one of the required AFW trains (pump or flow path) inoperable for reasons other than Condition A or Condition B, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This Condition includes the loss of two steam supply lines or two ESW supply lines to the turbine-driven AFW pump. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.

License Amendment 158 approved a one-time only Completion Time extension to 144 hours0.00167 days <br />0.04 hours <br />2.380952e-4 weeks <br />5.4792e-5 months <br /> for the Condition C entry on 2/3/04 for the turbine-driven auxiliary feedwater pump. Condition C was entered at 0756 hours0.00875 days <br />0.21 hours <br />0.00125 weeks <br />2.87658e-4 months <br /> Central Standard Time on 2/3/04 when the turbine-driven auxiliary feedwater pump was declared inoperable. This one-time Completion Time extension for Required Action C.1 expires at 0756 hours0.00875 days <br />0.21 hours <br />0.00125 weeks <br />2.87658e-4 months <br /> Central Standard Time on 2/9/04, after which Condition D must be entered. At the time a formal cause of the inoperability is determined, Condition D will be entered immediately.

The second Completion Time for Required Action C.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which multiple Conditions are entered concurrently. The AND connector between 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

(continued)

CALLAWAY PLANT B 3.7.5-7 Revision 16

AFW System B 3.7.5 BASES ACTIONS D.1 and D.2 (continued)

When Required Action A.1 or B.1 or C.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

E.1 If all three AFW trains are inoperable, the unit is in a seriously degraded condition with no safety-related means for conducting a cooldown, and only limited means for conducting a cooldown with non-safety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status.

Required Action E.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe condition.

SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW System water and steam supply flow paths provides assurance that the proper flow paths will exist for AFW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown (which may include the use of local or remote indicators), that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, (continued)

CALLAWAY PLANT B 3.7.5-8 Revision 16

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.1 (continued)

REQUIREMENTS such as check valves and relief valves. Additionally, vent and drain valves are not within the scope of this SR.

This SR is modified by a Note indicating that the SR is not required to be performed for the AFW flow control valves until the AFW system is placed in automatic control or when Thermal Power is above 10% RTP.

In order for the TDAFP and MDAFPs to be OPERABLE during normal power operation while the AFW system is in automatic control or above 10% RTP, the applicable discharge flow control valves (ALHV0005 and ALHV0007 for PAL01B; ALHV0009 and ALHV0011 for PAL01A; ALHV0006, ALHV0008, ALHV0010, and ALHV0012 for PAL02) shall be OPERABLE and in the fully open position. The TDAFP and MDAFPs remain OPERABLE with the applicable discharge flow control valves throttled to maintain steam generator levels during plant heatup, cooldown, or if started due to an Auxiliary Feedwater Actuation Signal (AFAS) or manually started in anticipation of an AFAS.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by the ASME Code (Ref. 2). Because it is undesirable to introduce cold AFW into the steam generators while they are operating, this testing is performed on recirculation flow. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.

Performance of inservice testing discussed in the ASME Code (Ref. 2)

(only required at 3 month intervals) satisfies this requirement. The test Frequency in accordance with the INSERVICE TESTING PROGRAM results in testing each pump once every 3 months, as required by Reference 2.

The required differential pressure for the AFW pumps when tested in accordance with the INSERVICE TESTING PROGRAM is:

(continued)

CALLAWAY PLANT B 3.7.5-9 Revision 16

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.2 (continued)

REQUIREMENTS

a. The acceptance criteria for the MDAFPs (see Reference 9) have been calculated using a limiting performance curve. The acceptance criteria, given as a table below, have been determined based on the Loss of Normal Feedwater (LONF) or Loss of Non-emergency AC Power (LOAC) events.

MOTOR-DRIVEN PUMPS ACCEPTANCE CRITERIA (using performance curve)

Recirc. Flow (gpm) Diff. Pressure (psid) 130 1431 150 1432

b. The acceptance criteria for the TDAFP have been calculated using a limiting performance curve. The acceptance criteria given as a table below, have been determined based on the Small Break Loss of Coolant Accident (SBLOCA) event.

TURBINE-DRIVEN PUMP ACCEPTANCE CRITERIA (using performance curve)

Recirc. Flow (gpm) Diff. Pressure (psid) 120 1628 140 1626 This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test.

SR 3.7.5.3 This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

The Frequency is based on the need to perform this Surveillance (continued)

CALLAWAY PLANT B 3.7.5-10 Revision 16

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.3 (continued)

REQUIREMENTS under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

This SR includes the requirement to verify that each AFW motor-operated discharge valve (ALHV0005 and ALHV0007 for PAL01B; and ALHV0009 and ALHV0011 for PAL01A), limits the flow from associated motor-driven pump to each steam generator to 300 gpm (Reference 6) and that valves ALHV0030, 31, 32, 33, 34, 35 and 36 actuate to the required position upon receipt of an Auxiliary Feedwater Pump suction Pressure-Low signal.

SR 3.7.5.4 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an AFAS by demonstrating that each AFW pump starts automatically on an actual or simulated auxiliary feedwater actuation signal. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The Note indicates that the SR be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test.

SR 3.7.5.5 This SR verifies that the AFW system is properly aligned by verifying the flow paths from the CST to each steam generator prior to entering MODE 2 after more than 30 days in MODE 5 or 6.

OPERABILITY of AFW flow paths must be verified before sufficient core heat is generated that would require the operation of the AFW System during a subsequent shutdown. The Frequency is reasonable, based on engineering judgement and other administrative controls that ensure that flow paths remain OPERABLE. To further ensure AFW System alignment, flow path OPERABILITY is verified following extended outages to determine no misalignment of valves has occurred. This SR ensures (continued)

CALLAWAY PLANT B 3.7.5-11 Revision 16

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.5 (continued)

REQUIREMENTS that the flow path from the CST to the steam generators is properly aligned.

REFERENCES 1. FSAR, Section 10.4.9, Auxiliary Feedwater System.

2. ASME Code for Operation and Maintenance of Nuclear Power Plants.

3. FSAR, Section 9.3.1, Compressed Air System.

4. Amendment No. 55 to Facility Operating License No. NPF-30, dated 7/27/90.

5. FSAR, Section 15.2.8, Feedwater System Pipe Break.

6. Request for Resolution (RFR) 21816A.

7. WCAP-16265-P, "Callaway Replacement Steam Generator Program NSSS Licensing Report," September 2004.

8. FSAR, Sections 15.2.6 and 15.2.7, Loss of Non-emergency AC Power and Loss of Normal Feedwater.

9. Calculations AL-29 Revision 3 and AL-30 Revision 6.

CALLAWAY PLANT B 3.7.5-12 Revision 16

CST B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Condensate Storage Tank (CST)

BASES BACKGROUND The CST provides a nonsafety grade source of water to the steam generators for removing decay heat and the stored thermal energy of the reactor coolant system from the Reactor Coolant System (RCS). The CST provides a passive flow of water, by gravity, to the Auxiliary Feedwater (AFW) System (LCO 3.7.5). The steam produced is released to the atmosphere by the main steam safety valves or the atmospheric steam dump valves. The AFW pumps operate with a continuous recirculation to the CST.

When the main steam isolation valves are open, the preferred means of heat removal is to discharge steam to the condenser by the nonsafety grade path of the condenser steam dump valves. The condensed steam can be returned to the CST by the condensate pumps. This has the advantage of conserving condensate while minimizing releases to the environment.

The CST capacity allows the plant to remove decay heat from the primary system during a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Station Blackout event (Ref. 3). However, the CST is not the safety-related source of water to the AFW pumps. The safety-related source is provided by the essential service water (ESW) system (LCO 3.7.8).

A description of the CST is found in the FSAR, Section 9.2.6 (Ref. 1).

APPLICABLE The CST is the preferred suction supply to the Auxiliary Feedwater SAFETY Pumps (AFP) due to the quality of the water. However, the CST is a ANALYSES nonseismic structure and thus cannot be relied upon for all accident scenarios. In order to ensure a safety grade supply of water is available to supply the suction of the AFPs for all credible accident conditions, the Essential Service Water System has been designed to provide the backup emergency supply to the AFPs.

The CST is credited as the AFP suction source during a Station Blackout event since automatic swapover to ESW system is not assumed to occur.

Therefore, the CST must have sufficient capacity to remove decay heat during a 4-hour Station Blackout event (Ref. 3). The CST is also the desired AFP suction source for post-trip decay heat removal at hot standby conditions and RCS cooldown to RHR entry conditions. Safe shutdown criteria for extended decay heat removal at hot standby prior to cooldown apply only to safety-related suction sources (ESW) for the AFW (continued)

CALLAWAY PLANT B 3.7.6-1 Revision 11

CST B 3.7.6 BASES APPLICABLE system (Ref. 4). Additional details regarding the design of the AFW SAFETY system can be found in FSAR 10.4.9.

ANALYSES (continued) The CST satisfies Criterion 3 and 4 of 10 CFR 50.36 (c)(2)(ii).

LCO To satisfy analysis assumptions, the CST must contain sufficient cooling water to remove decay heat and cooldown the RCS during a four-hour Station Blackout event. The water volume needed for this event is 160,000 gallons plus that volume necessary for AFP minimum NPSH.

The basis is established in Reference 3. This required volume does not include CST water volume for Low Suction Pressure Swapover to the ESW System since it is not expected to occur during a Station Blackout event.

Since the CST is the preferred AFP suction source, the minimum required CST contained water volume is maintained as 281,000 gallons to accommodate extended post-trip decay heat removal in hot standby followed by a cooldown to RHR entry conditions. This total volume accounts for AFP minimum NPSH and Low Suction Pressure Swapover water volume allowances within the CST.

The OPERABILITY of the CST is determined by maintaining the tank contained water volume at or above the minimum required volume.

APPLICABILITY In MODES 1, 2, and 3, the CST is required to be OPERABLE.

In MODES 4, 5, or 6, the CST is not required because the AFW system is not required.

ACTIONS A.1 and A.2 If the CST contained water volume is not within limits, the OPERABILITY of the backup ESW supply should be verified by administrative means within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter. OPERABILITY of the backup ESW supply must include verification that the flow paths from the backup water supply (ESW system) to the AFW pumps are OPERABLE, and that the backup supply has the required volume of water available (UHS water level is within limits). The CST must be restored to OPERABLE status within 7 days. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is reasonable, based on operating experience, to verify the OPERABILITY (continued)

CALLAWAY PLANT B 3.7.6-2 Revision 11

CST B 3.7.6 BASES ACTIONS A1 and A.2 (continued) of the backup ESW supply. Additionally, verifying the backup water supply every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is adequate to ensure the backup water supply continues to be available. The 7 day Completion Time is reasonable, based on an OPERABLE backup water supply being available, and the low probability of an event occurring during this time period requiring the CST.

B.1 and B.2 If the CST cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.6.1 REQUIREMENTS This SR verifies that the CST contains the required volume of cooling water.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 9.2.6, Condensate Storage and Transfer System.

2. FSAR 10.4.9, Auxiliary Feedwater System.

3. FSAR 8.3A, Station Blackout.

4. FSAR, Appendix 5.4A, Safe Shutdown.

CALLAWAY PLANT B 3.7.6-3 Revision 11

CCW System B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Component Cooling Water (CCW) System BASES BACKGROUND The CCW system provides a heat sink for the removal of process and operating heat from safety-related components during a Design Basis Accident (DBA) or transient. During normal operation, the CCW system also provides this function for various nonessential components (such as those in the radwaste system), as well as the spent fuel storage pool. The CCW system serves as a barrier to the release of radioactive byproducts between potentially radioactive systems and the Essential Service Water system, and thus to the environment. The safety-related function associated with the mitigation of DBAs and transients analyzed in FSAR Chapters 6 and 15 is covered by this LCO.

The CCW system is arranged as two independent, full capacity cooling loops, and has isolatable nonsafety-related components. Each safety-related train includes two full capacity pumps, surge tank, heat exchanger, piping, valves, and instrumentation. Each safety-related train is powered from a separate bus. A vented surge tank in each loop functions to ensure that sufficient net positive suction head is available and to accommodate volumetric changes due to thermal transients or leakage. One pump in each train is automatically started on receipt of a safety injection signal, and all nonessential components are isolated.

In the event of a hazard that could compromise the integrity of the non-safety, non-seismic piping to the radwaste service loads, such as a seismically induced pipe break or crack or a non-mechanistic malfunction in the moderate energy piping, no safety injection signal would be generated for the automatic isolation of the non-safety related radwaste service loads (via closure of valves EGHV0069A/B and EGHV0070A/B).

For such an event, the low-low level signal from the CCW surge tank levels channels (initiated by transmitters EGLT0001 and EGLT0002) will isolate the radwaste service loads. However, hazard event mitigation functions do not satisfy any of the 10 CFR 50.36(c)(2)(ii) criteria for inclusion within the scope of the Technical Specifications. Functionality of the CCW surge tank level channels is, therefore, addressed in Reference 4.

Additional information on the design and operation of the CCW system, along with a list of the components served, is presented in the FSAR, Section 9.2.2 (Ref. 1). The principal safety-related function of the CCW system is the removal of decay heat from the reactor via the Residual Heat (continued)

CALLAWAY PLANT B 3.7.7-1 Revision 10

CCW System B 3.7.7 BASES BACKGROUND Removal (RHR) system. This may be during a normal or post accident (continued) cooldown and shutdown.

APPLICABLE The design basis of the CCW system is for one CCW train to remove the SAFETY heat from components important to mitigating the consequences of a loss ANALYSES of coolant accident (LOCA) or a main steam line break (MSLB). The maximum CCW temperature post LOCA is 131°F (Ref. 2).

The CCW system is designed to perform its function with a single failure of any active component, assuming a loss of offsite power.

The CCW system also functions to cool the unit from RHR entry conditions (Tavg. < 350°F), to MODE 5 (Tavg. 200°F), during normal and post-accident operations. The CCW system is required to mitigate FSAR Chapter 6 and 15 DBAs and transients that generate a safety injection signal or rely on RHR for safe shutdown. The time required to cool from 350°F to 200°F is a function of the number of CCW and RHR trains operating. One CCW train is sufficient to remove decay heat during subsequent operations with Tavg. 200°F. This assumes a maximum service water temperature of 95°F occurring simultaneously with the maximum heat loads on the system.

The CCW system satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO The CCW trains are independent of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a DBA, one CCW train is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two trains of CCW must be OPERABLE.

At least one CCW train will operate assuming the worst case single active failure occurs coincident with a loss of offsite power.

A CCW train is considered OPERABLE when:

a. One pump and associated surge tank are OPERABLE; and

b. The required piping, valves, heat exchanger, and instrumentation and controls needed to perform safety-related functions necessary to mitigate DBAs and transients analyzed in FSAR Chapters 6 and 15 are OPERABLE (Ref. 3).

(continued)

CALLAWAY PLANT B 3.7.7-2 Revision 10

CCW System B 3.7.7 BASES LCO A CCW train is rendered inoperable when one or more associated ESW (continued) emergency makeup valves are closed, inoperable and not capable of being remotely opened from the Control Room. CCW Train A emergency makeup valves include EGHV0011 and EGHV0013. CCW Train B emergency makeup valves include EGHV0012 and EGHV0014.

The isolation of CCW flow to other components or systems not required for safety may render those components or systems non-functional, but does not affect the OPERABILITY of the CCW System. Further, non-functionality of the CCW surge tank level channels (driven by transmitters EGLT0001 and EGLT0002) does not affect OPERABILITY of the CCW system.

APPLICABILITY In MODES 1, 2, 3, and 4, the CCW system is a normally operating system, which must be prepared to perform its post accident safety functions, primarily RCS heat removal, which is achieved by cooling the RHR heat exchanger.

In MODES 5 and 6, requirements for the CCW system are determined by the systems it supports.

ACTIONS A.1 If one CCW train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining OPERABLE CCW train is adequate to perform the heat removal function.

Required Action A.1 is modified by a Note indicating that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4,"

shall be entered if an inoperable CCW train results in an inoperable RHR loop. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period.

B.1 and B.2 If the CCW train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which (continued)

CALLAWAY PLANT B 3.7.7-3 Revision 10

CCW System B 3.7.7 BASES ACTIONS B.1 and B.2 (continued) the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of CCW flow to individual components may render those components inoperable or non-functional, but does not affect the OPERABILITY of the CCW system.

Verifying the correct alignment for manual, power operated, and automatic valves in the CCW flow path servicing safety-related equipment provides assurance that the proper flow paths exist for CCW operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown (which may include the use of local or remote indicators), that those valves capable of being mispositioned are in the correct position. When either of the series isolation valves in the supply or return lines to/from the radwaste building loads (EGHV0069A or EGHV0070A in the supply line, EGHV0069B or EGHV0070B in the return line) is closed with power removed, this Surveillance no longer applies to the affected isolation valves since the valves would no longer be in the flow path. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves and relief valves. Additionally, vent and drain valves are not within the scope of this SR.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

(continued)

CALLAWAY PLANT B 3.7.7-4 Revision 10

CCW System B 3.7.7 BASES SURVEILLANCE SR 3.7.7.2 REQUIREMENTS (continued) This SR verifies proper automatic operation of the CCW valves, servicing safety-related components or isolating non-safety related components, on an actual or simulated actuation signal. This SR applies only to the CCW valves (EGHV0069A, EGHV0069B, EGHV0070A, EGHV0070B, EGTV0029 and EGTV0030) that automatically close upon receipt of a safety injection signal and the RCP thermal barrier valves (BBHV0013, BBHV0014, BBHV0015, BBHV0016, and EGHV0062) that automatically close upon receipt a high CCW return flow signal. When either of the series isolation valves in the supply or return lines to/from the radwaste building loads is closed with power removed, this Surveillance no longer applies to the affected isolation valves since the valves would no longer be in the flow path. The CCW system is a normally operating system that cannot be fully actuated as part of routine testing during normal operation.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.7.3 This SR verifies proper automatic operation of the CCW pumps on an actual or simulated actuation signal. These actuation signals include Safety Injection and Loss of Power. The CCW system is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 9.2.2, Cooling System for Reactor Auxiliaries.

2. RFR 010060A.

3. TSTF-GG-05-01, Writers Guide for Plant-Specific Improved Technical Specifications, June 2005, Sections 4.1.3.b and 4.1.6.e.

4. FSAR, Section 16.7.5, CCW System.

5. MP 10-0042.

CALLAWAY PLANT B 3.7.7-5 Revision 10

ESW B 3.7.8 B 3.7 PLANT SYSTEMS B 3.7.8 Essential Service Water (ESW) System BASES BACKGROUND The ESW system provides a heat sink for the removal of process and operating heat from safety-related components during a Design Basis Accident (DBA) or transient. During normal operation, and a normal shutdown, the ESW system also provides this function for various safety-related and non-safety related components and receives coolant flow from the non-safety related Service Water system. The safety-related function associated with the mitigation of DBAs and transients analyzed in FSAR Chapters 6 and 15 is covered by this LCO.

The ESW system consists of two separate, 100% capacity, safety-related, cooling water trains. Each train consists of a self cleaning strainer, prelube tank, one 100% capacity pump, piping, valving, and instrumentation. The pumps and valves are remote and manually aligned, except in the unlikely event of a loss of coolant accident (LOCA). The pumps are automatically started upon receipt of a safety injection signal, low suction pressure to the auxiliary feedwater pumps coincident with an auxiliary feedwater actuation signal (AFAS), or loss of offsite power. Upon receipt of one of these signals, the automatically actuated essential valves are aligned to their post-accident positions as required. The ESW system also provides emergency makeup to the spent fuel pool and CCW system and is the backup water supply to the Auxiliary Feedwater system.

Each ESW train also services a non-safety related air compressor and associated aftercooler via non-safety related, non-seismic lines downstream of safety-related, air-operated isolation valves (EFHV0043 in A train and EFHV0044 in B train). In the event of a hazard that could compromise the integrity of the non-safety, non-seismic piping to the air compressors and aftercoolers, such as a seismically induced pipe break or crack or a non-mechanistic malfunction in the moderate energy piping, isolation of the non-safety piping would occur by one of several means, depending on the size of the leak or break and the availability of offsite power. The non-safety related piping would be automatically isolated by signals from the ESW differential pressure channels (EFPDT0043 and EFPDSH0043 in A train; EFPDT0044 and EFPDSH0044 in B train) which send automatic isolation signals in response to a high differential pressure (high flow) between the safety-related ESW piping and the non-safety related piping associated with the air compressors and aftercoolers, or by operator action for smaller leaks prior to impacting the available UHS inventory, or by a loss of air supply to the isolation valve solenoids.

(continued)

CALLAWAY PLANT B 3.7.8-1 Revision 12

ESW B 3.7.8 BASES BACKGROUND However, hazard event mitigation functions do not satisfy any of the 10 (continued) CFR 50.36(c)(2)(ii) criteria for inclusion within the scope of the Technical Specifications. Functionality of the ESW differential pressure channels is, therefore, addressed in Reference 5.

Additional information about the design and operation of the ESW system, along with a list of the components served, is presented in the FSAR, Section 9.2.1.2 (Ref. 1). The principal safety-related function of the ESW system is the removal of decay heat from the reactor via the CCW system and removal of containment heat loads via the containment coolers.

APPLICABLE The ESW system is required to mitigate FSAR Chapter 6 and 15 DBAs SAFETY and transients that occur either with or without offsite power available. The ANALYSES design basis of the ESW system is for one ESW train, in conjunction with the CCW system and a 100% capacity containment cooling system, to remove accident generated and core decay heat following a design basis LOCA as discussed in the FSAR, Section 6.2 (Ref. 2). This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant system by the ECCS pumps. The ESW system is designed to perform its function with a single failure of any active component, assuming the loss of offsite power.

The ESW system, in conjunction with the CCW system, also cools the unit from residual heat removal (RHR) entry conditions, as discussed in FSAR Section 5.4.7 (Ref. 3), to MODE 5 during post-accident operations or during a cooldown using only safety grade equipment. One ESW system train is sufficient to remove decay heat during subsequent operations in MODES 5 and 6.

The time required to cool from 350°F to 200°F is a function of the number of ESW pumps, CCW heat exchangers, and RHR system trains that are operating. The cooldown analyses in Reference 3 assume a maximum ESW supply temperature of 92.3°F occurring simultaneously with maximum heat loads on the system.

The ESW system satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO Two ESW system trains are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post-accident heat loads, assuming that the worst case single active failure occurs coincident with the loss of offsite power.

(continued)

CALLAWAY PLANT B 3.7.8-2 Revision 12

ESW B 3.7.8 BASES LCO An ESW system train is considered OPERABLE during MODES 1, 2, 3, (continued) and 4 when:

a. The pump is OPERABLE;

b. The required piping, valves, and instrumentation and controls needed to perform safety-related functions necessary to mitigate DBAs and transients analyzed in FSAR Chapters 6 and 15 are OPERABLE (Ref. 4); and

c. The pump room supply fan is OPERABLE.

The prelube storage tanks, TEF01A and TEF01B, are not required for OPERABILITY of the ESW pumps. The ESW pumps will start and run satisfactorily with dry bearings in an emergency should prelube water supply from the prelube storage tank not be present. Once the pump starts, lube water will be supplied by the pump.

The isolation of ESW flow to the Service Air (KA) system air compressors may render them non-functional, but does not affect the OPERABILITY of the ESW system. Further, non-functionality of the ESW differential pressure channel in either (or both) ESW train (driven by transmitters EFPDT0043 and EFPDT0044) does not affect OPERABILITY of the ESW system.

APPLICABILITY In MODES 1, 2, 3, and 4, the ESW system is a standby system that is required to support the OPERABILITY of the equipment serviced by the ESW system and required to be OPERABLE in these MODES.

In MODES 5 and 6, requirements for the ESW system are determined by the systems it supports.

ACTIONS A.1 If one ESW train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining OPERABLE ESW system train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE ESW system train could result in loss of ESW function.

Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.8.1, "AC (continued)

CALLAWAY PLANT B 3.7.8-3 Revision 12

ESW B 3.7.8 BASES ACTIONS A.1 (continued)

Sources - Operating," shall be entered if an inoperable ESW train results in an inoperable emergency diesel generator. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," shall be entered if an inoperable ESW system train results in an inoperable residual heat removal train. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period. The Completion Time is modified by a Note that allows a one-time Completion Time of 14 days to support the planned replacement of ESW B train piping prior to April 30, 2009.

B.1 and B.2 If the ESW system train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.8.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of ESW flow to individual components or systems may render those components inoperable or non-functional, but does not affect the OPERABILITY of the ESW system.

Verifying the correct alignment for manual, power operated, and automatic valves in the ESW system flow path servicing safety-related components provides assurance that the proper flow paths exist for ESW system operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will (continued)

CALLAWAY PLANT B 3.7.8-4 Revision 12

ESW B 3.7.8 BASES SURVEILLANCE SR 3.7.8.1 (continued)

REQUIREMENTS automatically reposition within the proper stroke time. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown (which may include the use of local or remote indicators), that those valves capable of being mispositioned are in the correct position. When either of the series isolation valves in the supply or return lines to/from the normal service water system is closed with power removed, this Surveillance no longer applies to the affected isolation valves since the valves would no longer be in the flow path. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves and relief valves. Additionally, vent and drain valves are not within the scope of this SR.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.8.2 This SR verifies proper automatic operation of the ESW system valves servicing safety-related components or isolating the non-safety related components on an actual or simulated actuation signal. These actuation signals include Loss of Power, SIS, Low AFW Suction Pressure coincident with an AFAS, and the temperature signals that automatically close the UHS cooling tower bypass valves (EFHV0065 and EFHV0066).

The last set of automatic actuation signals includes ESW return temperature (UHS inlet) signals from EFTSL0067A (EFTSL0068A), and ESW pump discharge (ESW supply) temperature signals from EFTSL0061 (EFTSL0062) enabled by hand switches EFHS0067 (EFHS0068), to close UHS cooling tower bypass valves EFHV0065 (EFHV0066) which direct ESW return flow over the UHS cooling tower fill.

The ESW system is a standby emergency system that cannot be fully actuated as part of normal testing. When either of the series isolation valves in the supply or return lines to/from the normal service water system is closed with power removed, this Surveillance no longer applies to the affected isolation valves since the valves would no longer be in the flow path.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

(continued)

CALLAWAY PLANT B 3.7.8-5 Revision 12

ESW B 3.7.8 BASES SURVEILLANCE SR 3.7.8.2 (continued)

REQUIREMENTS The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.8.3 This SR verifies proper automatic operation of the ESW system pumps on an actual or simulated actuation signal. These actuation signals include SIS, Low AFW Suction Pressure coincident with an AFAS, and Loss of Power. The ESW system is a standby emergency system that cannot be fully actuated as part of normal testing during normal operation. The ESW pump start on low AFW Suction Pressure Surveillance is performed under the conditions that apply during a unit outage and has the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 9.2.1.2, Essential Service Water System.

2. FSAR, Section 6.2, Containment Systems.

3. FSAR, Section 5.4.7, Residual Heat Removal System.

4. TSTF-GG-05-01, Writers Guide for Plant-Specific Improved Technical Specifications, June 2005, Sections 4.1.3.b and 4.1.6.e.

5. FSAR, Section 16.7.6, ESW System.

CALLAWAY PLANT B 3.7.8-6 Revision 12

UHS B 3.7.9 B 3.7 PLANT SYSTEMS B 3.7.9 Ultimate Heat Sink (UHS)

BASES BACKGROUND The UHS provides a heat sink for processing and operating heat from safety related components during a transient or accident, as well as during normal operation. This is done by utilizing the Essential Service Water (ESW) system.

The two principal functions of the UHS are the dissipation of residual heat after reactor shutdown and dissipation of residual heat after an accident.

The UHS consists of a 4-cell seismic Category I mechanical draft cooling tower and a seismic Category I source of makeup water (retention pond) for the tower. Heat from the ESW system as discussed in Standard Plant FSAR Section 9.2.5 (Reference 1), is rejected to the UHS to permit a safe shutdown of the plant following an accident. The UHS enables the ESW system to supply approximately 15,000 gpm of cooling water per train to remove the heat loads of the components listed in Reference 1.

The mechanical draft cooling tower is a safety related, seismic Category I structure sized with 100 percent redundancy to provide heat dissipation for safe shutdown following an accident. The cooling tower is protected from horizontal and vertical tornado missiles. (Additional details regarding tornado missile protection and methods of analysis for that are provided in Standard Plant FSAR Section 3.5 (Reference 3).) The supply headers and spray pipes for each train of the ESW system from the Power Block are separated by interior walls. A passive failure of the spray pipe for one train will not affect the opposite train.

The approximate dimensions of the UHS retention pond are 330 by 680 feet, and the side slopes are 3 horizontal to 1 vertical. The side slopes are protected by riprap from the surrounding grade elevation. Two open-air channels transmit water from the mechanical draft cooling tower to the retention pond. A reinforced concrete outlet structure is provided for outflow from the pond.

Additional information on the design and operation of the system, along with a list of components served, can be found in Reference 1.

(continued)

CALLAWAY PLANT B 3.7.9-1 Revision 18

UHS B 3.7.9 BASES (Continued)

APPLICABLE The UHS is sized to dissipate the maximum heat loads listed in SAFETY Reference 1. It is assumed that the design basis accident occurs at the ANALYSES time that the most adverse meteorological conditions for tower performance prevail. The UHS pond temperature reached under these conditions will not exceed 92.3°F. The design-basis maximum ESW supply temperature from the UHS retention pond is 95°F. That value was used in the design of the UHS cooling tower cells (as described in FSAR Site Addendum Table 9.2-4 of Reference 1) and is the assumed ESW inlet temperature to all loads served by ESW except for the electrical penetration room coolers. However, the maximum ESW supply and UHS retention pond temperature of 92.3°F establishes the upper acceptance criterion in the minimum heat transfer and maximum evaporation cases in the analysis supporting the 30-day UHS inventory requirement per Regulatory Guide 1.27 (Ref. 2). In addition, an ESW inlet temperature of 92.3°F is also assumed in the analysis of the electrical penetration room temperatures (room coolers supplied by ESW). The 92.3°F value is the maximum temperature allowed in these analyses to support UHS OPERABILITY assuming an initial maximum temperature of 89°F.

The minimum required level is 16.0 feet from the bottom of the UHS pond (48.2 acre-feet). A pond water volume of 40.9 acre-feet is needed to provide a 30-day supply of cooling and makeup water post LOCA under the maximum evaporation condition assumed for this period. The total pond water volume remaining after 30 days is 7.3 acre-feet. The useable portion of this volume is 4.97 acre-feet, which is the volume of water above the minimum level needed to maintain the NPSH for the ESW pumps. The remaining volume provides a margin that is 12% of the total water volume requirement. The UHS was analyzed for the design basis LOCA in accordance with Regulatory Guide 1.27 (Ref. 2).

The UHS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The UHS is required to be OPERABLE and is considered OPERABLE when the retention pond contains a sufficient volume of water at a temperature below the maximum allowed temperature, and the mechanical draft cooling tower can dissipate the heat contained in the ESW system. Two UHS cooling tower trains (2 cells per train) are required for the mechanical draft cooling tower to be OPERABLE.

The maximum allowed retention pond temperature is the temperature that would allow the ESW system to operate for at least 30 days following the design basis LOCA without the loss of net positive suction head (NPSH) for the ESW pumps and without exceeding the maximum design temperature of the equipment served by the ESW system. To meet this (continued)

CALLAWAY PLANT B 3.7.9-2 Revision 18

UHS B 3.7.9 BASES LCO condition, the UHS retention pond temperature should not exceed 89 F (continued) and the level should not fall below 16.0 feet from the bottom of the pond (834.0 ft mean sea level) during normal unit operation.

An inoperable UHS cooling tower electrical room supply fan renders its associated UHS cooling tower train inoperable.

APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of the ESW system and required to be OPERABLE in these MODES.

ACTIONS A.1 If one cooling tower train is inoperable, action must be taken to restore the inoperable cooling tower train to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable based on the low probability of an accident occurring during the 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> that one cooling tower train is inoperable, the number of available systems, and the time required to reasonably complete the Required Action.

B.1 and B.2 If the cooling tower train cannot be restored to OPERABLE status within the associated Completion Time, or if the UHS is inoperable for reasons other than Condition A, such as when both cooling tower trains are inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.9.1 REQUIREMENTS This SR verifies that adequate long term (30-day) cooling can be maintained. The specified level also ensures that sufficient NPSH is available to operate the ESW system pumps. This SR verifies that the UHS water level is 16.0 feet from the bottom of the UHS pond or 834 ft mean sea level.

(continued)

CALLAWAY PLANT B 3.7.9-3 Revision 18

UHS B 3.7.9 BASES SURVEILLANCE SR 3.7.9.1 (continued)

REQUIREMENTS The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.9.2 This SR verifies that the UHS is available to cool the ESW System to at least its maximum design temperature with the maximum accident or normal design heat loads for 30 days following a Design Basis Accident.

This SR verifies that the average water temperature of the UHS is 89°F.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.9.3 Operating each cooling tower fan in both the fast and slow speeds for 15 minutes ensures that all fans are OPERABLE and that all associated controls are functioning properly. It also ensures that fan or motor failure can be detected for corrective action.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.9.4 This SR verifies that each cooling tower fan starts and operates in slow speed on an actual or simulated actuation signal from its train-associated high ESW return (UHS inlet) temperature signal (EFTSH0067A and EFTSH0068A) and automatically shifts to fast speed on an actual or simulated signal from its train-associated high-high ESW retun (UHS inlet) temperature signal (EFTSHH0067A and EFTSHH0068A).

During the course of post-LOCA recovery, the cooling tower fans are manually transferred from a control scheme based on ESW return temperature to one based on ESW pump discharge temperature via hand switches EFHS0067 and EFHS0068. This SR also verifies that each cooling tower fan starts and operates in slow speed on an actual or (continued)

CALLAWAY PLANT B 3.7.9-4 Revision 18

UHS B 3.7.9 BASES SURVEILLANCE SR 3.7.9.4 (continued)

REQUIREMENTS simulated actuation signal from its train-associated high ESW pump discharge temperature signal (EFTSH0061 and EFTSH0062) and automatically shifts to fast speed on an actual or simulated signal from its train-associated high-high ESW pump discharge temperature signal (EFTSHH0061 and EFTSHH0062A).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Standard Plant and Site Addendum Section 9.2.5, Ultimate Heat Sink.

2. Regulatory Guide 1.27, Ultimate Heat Sink.

3. FSAR Standard Plant Section 3.5, Missile Protection.

CALLAWAY PLANT B 3.7.9-5 Revision 18

CREVS B 3.7.10 B 3.7 PLANT SYSTEMS B 3.7.10 Control Room Emergency Ventilation System (CREVS)

BASES BACKGROUND The CREVS provides a protected environment from which operators can control the unit following an uncontrolled release of radioactivity. The CREVS consists of two independent, redundant trains that pressurize, recirculate, and filter the control room air. Each CREVS train consists of a filtration system train and a pressurization system train. Each filtration system train consists of a fan, a prefilter, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a second HEPA filter follows the adsorber section to collect carbon fines. Each pressurization system train consists of a fan, a moisture separator, an electric heater, a HEPA filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a second HEPA filter follows the adsorber section to collect carbon fines. Ductwork, valves or dampers, and instrumentation also form part of the CREVS system.

The CREVS is an emergency system which may also operate during normal unit operations. Upon receipt of the actuating signal, normal air supply and exhaust to the control room envelope (CRE) is isolated, a portion of the ventilation air is recirculated through the system filter trains, and the pressurization system is started. The prefilters remove any large particles in the air, and a moisture separator removes any entrained water droplets present, to prevent excessive loading of the HEPA filters and charcoal adsorbers. Continuous operation of each pressurization system train for at least 15 minutes per month, with the heaters functioning, reduces moisture buildup on the HEPA filters and adsorbers. The heaters are important to the effectiveness of the charcoal adsorbers.

Actuation of the CREVS by a Control Room Ventilation Isolation Signal (CRVIS), places the system in the emergency mode of operation.

Actuation of the system to the emergency mode of operation closes the unfiltered outside air intake and unfiltered exhaust dampers, and aligns the system for recirculation of the air within the CRE through the redundant trains of HEPA and the charcoal filters. The emergency (CRVIS) mode also initiates pressurization and filtered ventilation of the air supply to the CRE.

The control room pressurization system draws in outside air, processing it through a particulate filter charcoal adsorber train for cleanup. This outside air is diluted with air drawn from the cable spreading rooms and the electrical equipment floor levels within the control building and distributed back into those spaces for further dilution. The control room filtration units take a portion of air from the exhaust side of the (continued)

CALLAWAY PLANT B 3.7.10-1 Revision 12

CREVS B 3.7.10 BASES BACKGROUND system, upstream of the outside air intake, for dilution with portions of the (continued) exhaust air from the control room air-conditioning system and processes it through the control room filtration system adsorption train for additional cleanup. This air is then further diluted with the remaining control room air-conditioning system return air, cooled, and supplied to the CRE. This process will maintain the CRE under a positive pressure of 1/8 inch water gauge (min.) with respect to the outside atmosphere. This will assure exfiltration from the CRE, thus preventing any unprocessed contaminants from entering the CRE.

The air entering the control building pressure boundary during normal operation is continuously monitored by radiation, carbon dioxide/

monoxide, and smoke detectors. A high radiation signal initiates the emergency (CRVIS) mode of operation; the other detectors provide an alarm in the control room. A CRVIS is initiated by the radiation monitors (GKRE0004 and GKRE0005), Fuel Building Ventilation Isolation Signal, Containment Isolation Phase A, the containment purge exhaust radiation monitors (GTRE0022 and GTRE0033), and manually. The instrumentation associated with actuation of the CREVS is addressed in LCO 3.3.7, "Control Room Emergency Ventilation System (CREVS) Actuation Instrumentation."

A single CREVS train will pressurize the CRE to about 0.125 inches water gauge relative to the outside environment. The 0.125 inches water gauge positive pressure is obtained based on a nominal flowrate of 2000 cfm through the filtration filter, which includes 400 cfm of control building envelope (CBE) air. The CREVS operation in maintaining the control room habitable is discussed in the FSAR, Section 6.4 and 9.4 (Ref. 1 and 9).

Redundant pressurization and filtration trains provide the required filtration should an excessive pressure drop develop across the other filter train. Normally open isolation dampers are arranged in series pairs so that the failure of one damper to shut will not result in a breach of isolation. The CREVS is designed in accordance with Seismic Category I requirements.

The CREVS is designed to maintain a habitable environment in the CRE for 30 days of continuous occupancy after a Design Basis Accident (DBA) without exceeding a 5 rem whole body dose or its equivalent to any part of the body.

By operation of the control room pressurization trains and the control room filtration units, the CREVS pressurizes, recirculates and filters air within the CRE as well as the CBE that generally surrounds the CRE. The boundaries of these two distinct but related volumes are credited in the analysis of record for limiting the inleakage of unfiltered outside air.

(continued)

CALLAWAY PLANT B 3.7.10-2 Revision 12

CREVS B 3.7.10 BASES BACKGROUND The plant CRE design is unique. The Control Building by and large (continued) surrounds the CRE. The Control Building is also designed to be at a positive pressure with respect to its surrounding environment although not positive with respect to the CRE. In the emergency pressurization and filtration mode, the control room air volume receives air through a filtration system that takes suction on the Control Building. The Control Building is turn receives filtered air from the outside environment.

The CRE is the area within the confines of the CRE boundary that contains the spaces that CRE occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.

The CBE is an area that largely surrounds the CRE. Occupancy of the CBE is not required to control the unit during normal and accident conditions. The CBE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CBE.

The CBE boundary must be maintained to ensure that the inleakage of unfiltered air into the CBE will not exceed the inleakage assumed in the licensing basis analysis of DBA consequences to CRE occupants. The CBE and its boundary are defined in the Control Room Envelope Habitability Program.

APPLICABLE The CREVS components are arranged in redundant, safety related SAFETY ventilation trains. The location of components and ducting within the CRE ANALYSES ensures an adequate supply of filtered air to all areas requiring access.

The CREVS provides airborne radiological protection for the CRE occupants, as demonstrated by the CRE occupant dose analyses for the most limiting design basis accident, fission product release presented in the FSAR, Chapter 15A.3 (Ref. 2).

The worst case single active failure of a component of the CREVS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.

(continued)

CALLAWAY PLANT B 3.7.10-3 Revision 12

CREVS B 3.7.10 BASES APPLICABLE The CREVS provides protection from smoke and hazardous chemicals to SAFETY the CRE occupants. The analysis of hazardous chemical releases (Ref. 7)

ANALYSES determined that hazardous chemicals are not stored or used onsite in (continued) quantities sufficient to necessitate CRE protection as required by Regulatory Guide 1.78 (Ref. 8). The evaluation of a smoke challenge demonstrates that such an event will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 1). The analysis for smoke and hazardous chemical releases accordingly assumes no CREVS actuation for such events.

The CREVS satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO Two independent and redundant CREVS trains are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other train. Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE or CBE boundary, could result in exceeding a dose of 5 rem whole body or its equivalent to any part of the body to the CRE occupants in the event of a large radioactive release.

Each CREVS train is considered OPERABLE when the individual components necessary to limit CRE occupants exposure are OPERABLE.

A CREVS train is OPERABLE when the associated:

a. Control Room Air Conditioner, filtration and pressurization fans are OPERABLE;

b. HEPA filters and charcoal adsorbers are not excessively restricting flow, and are capable of performing their filtration functions;

c. Heater, moisture separator, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

In order for the CREVS trains to be considered OPERABLE, the CRE and CBE boundaries must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs.

The LCO is modified by a Note allowing the CRE and CBE boundaries to be opened intermittently under administrative controls. This Note only applies to openings in the CRE and CBE boundaries that can be rapidly restored to the intended design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings these controls should be (continued)

CALLAWAY PLANT B 3.7.10-4 Revision 12

CREVS B 3.7.10 BASES LCO proceduralized and consist of stationing a dedicated individual at the (continued) opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and thereby restore the affected envelope boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

Note that the Control Room Air Conditioning System (CRACS) forms a subsystem to the CREVS. The CREVS remains capable of performing its safety function provided the CRACS air flow path is intact and air circulation can be maintained. Isolation or breach of the CRACS air flow path can also render the CREVS flow path inoperable. In these situations, LCOs 3.7.10 and 3.7.11 may be applicable.

APPLICABILITY In MODES 1, 2, 3, and 4, the CREVS must be OPERABLE to ensure that the CRE will remain habitable during and following a LOCA or SGTR.

During movement of irradiated fuel assemblies, the CREVS must be OPERABLE to cope with the release from a design basis fuel handling accident inside containment or in the fuel building.

ACTIONS A.1 When one CREVS train is inoperable for reasons other than an inoperable CRE or CBE boundary, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CREVS train is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE CREVS train could result in loss of CREVS function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.

B.1, B.2, and B.3 If the unfiltered inleakage of potentially contaminated air past a CRE or CBE boundary credited in the accident analysis and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem whole body or its equivalent to any part of the body), actions must be taken to restore the affected boundary (or boundaries) to OPERABLE status within 90 days.

(continued)

CALLAWAY PLANT B 3.7.10-5 Revision 12

CREVS B 3.7.10 BASES ACTIONS B.1, B.2, and B.3 (continued)

During the period that a CRE or CBE boundary credited in the accident analysis is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological event. Actions must be taken within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE or CBE boundary of an envelope credited in the accident analysis) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional.

The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan, and possibly repair and test most conditions adversely affecting the CRE or CBE boundary credited in the accident analysis.

C.1 and C.2 In MODE 1, 2, 3, or 4, if the inoperable CREVS train or inoperable CRE or CBE boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

D.1, D.2.1, and D.2.2 During movement of irradiated fuel assemblies, if the inoperable CREVS train cannot be restored to OPERABLE status within the required Completion Time, action must be taken to immediately place the OPERABLE CREVS train in the CRVIS mode. This action ensures (continued)

CALLAWAY PLANT B 3.7.10-6 Revision 12

CREVS B 3.7.10 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued) that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure would be readily detected.

An alternative to Required Action D.1 is to immediately suspend activities that could result in a release of radioactivity that might require isolation of the CRE. Required Actions D.2.1 and D.2.2 would place the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

E.1 and E.2 During movement of irradiated fuel assemblies, with two CREVS trains inoperable or one or more CREVS trains inoperable due to an inoperable CRE or CBE boundary, action must be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes accident risk. This does not preclude the movement of fuel to a safe position.

F.1 If both CREVS trains are inoperable in MODE 1, 2, 3, or 4, for reasons other than an inoperable CRE and CBE boundary (i.e., Condition B), the CREVS may not be capable of performing the intended function and the unit is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.7.10.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not severe, testing each train periodically, by initiating from the control room, flow through the HEPA filters and charcoal adsorbers of both the filtration and pressurization systems, provides an adequate check of this system.

Periodic heater operations dry out any moisture accumulated in the charcoal from humidity in the ambient air. Each pressurization system (continued)

CALLAWAY PLANT B 3.7.10-7 Revision 12

CREVS B 3.7.10 BASES SURVEILLANCE SR 3.7.10.1 (continued)

REQUIREMENTS train must be operated for 15 continuous minutes with the heaters functioning. Functioning heaters will not necessarily have the heating elements energized continuously for 15 minutes; but will cycle depending on the air temperature. Each filtration system train need only be operated for 15 minutes continuously to demonstrate the function of the system.

The 15-minute run time is based on Position C.6.1 of Reference 10. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.10.2 This SR verifies that the required CREVS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP).

The CREVS filter tests use the test procedure guidance in Regulatory Guide 1.52 (Ref. 3). The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal. Specific test Frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.10.3 This SR verifies that each CREVS train starts and operates on an actual or simulated actuation signal. The actuation signal includes Control Room Ventilation Isolation or Fuel Building Ventilation Isolation. The CREVS train automatically switches on an actual or simulated CRVIS signal into a CRVIS mode of operation with flow through the HEPA filters and charcoal adsorber banks. The Surveillance Requirement also verifies that a control room ventilation isolation signal (CRVIS) will be received by the LOCA sequencer to enable an automatic start of the Diesel Generator loads that are associated with a CRVIS. Verification that these loads will start and operate at the appropriate step in the LOCA sequencer and that other auto-start signals for these loads will be inhibited until the LOCA sequencer is reset is accomplished under Surveillance Requirement SR 3.8.1.12. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

(continued)

CALLAWAY PLANT B 3.7.10-8 Revision 12

CREVS B 3.7.10 BASES SURVEILLANCE SR 3.7.10.4 REQUIREMENTS (continued) This SR verifies the OPERABILITY of the CRE and CBE boundaries credited in the accident analysis by testing for unfiltered air inleakage past the credited envelope boundaries and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.

The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem whole body or its equivalent to any part of the body and the CRE occupants are protected from hazardous chemicals and smoke. For Callaway, there is no CREVS actuation for hazardous chemical releases or smoke and there are no Surveillance Requirements that verify OPERABILITY for hazardous chemicals or smoke. This SR verifies that the unfiltered air inleakage into CRE and CBE boundaries credited in the accident analysis is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences.

When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows time to restore the envelope boundary credited in the accident analysis to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 4) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref 5). These compensatory measures may also be used as mitigating actions as required by Required Action B.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 6). Options for restoring the envelope boundary credited in the accident analysis to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the envelope boundary credited in the accident analysis, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the envelope boundary credited in the accident analysis has been restored to OPERABLE status.

REFERENCES 1. FSAR, Section 6.4, Habitability Systems.

2. FSAR, Chapter 15A.3, Control Room Radiological Consequences Calculation Models.

3. Regulatory Guide 1.52, Rev. 2, Design, Testing, and Maintenance Criteria for Atmospheric Cleanup System Air Filtration and Adsorption Units of Light Water Cooled Nuclear Power Plants.

(continued)

CALLAWAY PLANT B 3.7.10-9 Revision 12

CREVS B 3.7.10 BASES REFERENCES 4. Regulatory Guide 1.196, Control Room Habitability at Light-Water (continued) Nuclear Power Reactors, Revision 1.

5. NEI 99-03, Control Room Habitability Assessment, June 2001.

6. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability. (ADAMS Accession No. ML040300694).

7. FSAR Section 2.2, Nearby Industrial, Transportation, and Military Facillities.

8. Regulatory Guide 1.78, Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release, Rev. 0.

9. FSAR Section 9.4, Air Conditioning, Heating, Cooling, and Ventilation.

10. Regulatory Guide 1.52 (Rev. 3), Design, Inspection and Testing Criteria for Air Filtration and Adsorption Units of Post-Accident Engineered-Safety-Feature Atmosphere Cleanup Systems in Light-Water-Cooled Nuclear Power Plants.

CALLAWAY PLANT B 3.7.10-10 Revision 12

CRACS B 3.7.11 B 3.7 PLANT SYSTEMS B 3.7.11 Control Room Air Conditioning System (CRACS)

BASES BACKGROUND The CRACS provides temperature control for the control room.

The CRACS consists of two independent and redundant trains that provide cooling of recirculated control room air. Each train consists of a prefilter, self-contained refrigeration system (using essential service water as a heat sink), centrifugal fans, instrumentation, and controls to provide for control room temperature control. The CRACS is a subsystem to the CREVS, described in LCO 3.7.10, providing air temperature control for the control room.

The CRACS is an emergency system, which also operates during normal unit operations. A single train will provide the required temperature control to maintain the control room 84°F. The CRACS operation in maintaining the control room temperature is discussed in the FSAR, Section 9.4.1 (Ref. 1).

APPLICABLE The design basis of the CRACS is to maintain the control room SAFETY temperature for 30 days of continuous occupancy.

ANALYSES The CRACS components are arranged in redundant, safety related trains.

During normal or emergency operations, the CRACS maintains the temperature 84°F. A single active failure of a component of the CRACS, with a loss of offsite power, does not impair the ability of the system to perform its design function. Redundant detectors and controls are provided for control room temperature control. The CRACS is designed in accordance with Seismic Category I requirements. The CRACS is capable of removing sensible and latent heat loads from the control room, which include consideration of equipment heat loads and personnel occupancy requirements, to ensure equipment OPERABILITY.

The CRACS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two independent and redundant trains of the CRACS are required to be OPERABLE to ensure that at least one is available, assuming a single failure disabling the other train. Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident.

(continued)

CALLAWAY PLANT B 3.7.11-1 Revision 10

CRACS B 3.7.11 BASES LCO The CRACS is considered to be OPERABLE when the individual (continued) components necessary to maintain the control room temperature are OPERABLE in both trains. These components include the refrigeration compressors, heat exchangers, cooling coils, fans, and associated temperature control instrumentation. In addition, the CRACS must be operable to the extent that air circulation can be maintained. Isolation or breach of the CRACS air flow path can also render the CREVS flowpath inoperable. In these situations, LCO 3.7.10 would also be applicable.

APPLICABILITY In MODES 1, 2, 3, 4, 5, and 6, and during movement of irradiated fuel assemblies, the CRACS must be OPERABLE to ensure that the control room temperature will not exceed equipment operational requirements.

ACTIONS A.1 With one CRACS train inoperable, action must be taken to restore OPERABLE status within 30 days. In this Condition, the remaining OPERABLE CRACS train is adequate to maintain the control room temperature within limits. However, the overall reliability is reduced because a single failure in the OPERABLE CRACS train could result in a loss of CRACS function. The 30 day Completion Time is based on the low probability of an event requiring control room isolation and the consideration that the remaining train can provide the required protection.

B.1 and B.2 In MODE 1, 2, 3, or 4, if the inoperable CRACS train cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes the risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1. C.2.1, and C.2.2 In MODE 5 or 6, or during movement of irradiated fuel, if the inoperable CRACS train cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE CRACS train must be placed in operation immediately. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, (continued)

CALLAWAY PLANT B 3.7.11-2 Revision 10

CRACS B 3.7.11 BASES ACTIONS C.1.1, C.1.2, C.2.1, and C.2.2 (continued) and that active failures will be readily detected.

An alternative to Required Action C.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes accident risk. This does not preclude the movement of fuel to a safe position.

D.1 and D.2 In MODE 5 or 6, or during movement of irradiated fuel assemblies, with two CRACS trains inoperable, action must be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk. This does not preclude the movement of fuel to a safe position.

E.1 If both CRACS trains are inoperable in MODE 1, 2, 3, or 4, the CRACS may not be capable of performing its intended function. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.7.11.1 REQUIREMENTS This SR verifies that the heat removal capability of the CRACS air conditioning units is adequate to remove the heat load assumed in the control room during design basis accidents. This SR consists of verifying the heat removal capability of the condenser heat exchanger (either through performance testing or inspection), ensuring the proper operation of major components in the refrigeration cycle and verification of unit air flow capacity. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 9.4.1, Control Building HVAC.

CALLAWAY PLANT B 3.7.11-3 Revision 10

B 3.7.12 B 3.7 PLANT SYSTEMS B 3.7.12 Not used.

CALLAWAY PLANT B 3.7.12-1 Revision 0

Emergency Exhaust System B 3.7.13 B 3.7 PLANT SYSTEMS B 3.7.13 Emergency Exhaust System (EES)

BASES BACKGROUND The Emergency Exhaust System serves both the auxiliary building and the fuel building. Following a safety injection signal (SIS), safety related dampers isolate the auxiliary building, and the Emergency Exhaust System exhausts potentially contaminated air due to leakage from ECCS systems. The Emergency Exhaust System also can filter airborne radioactive particulates from the area of the fuel pool following a fuel handling accident.

The Emergency Exhaust System consists of two independent and redundant trains. Each train consists of a heater, a prefilter, a high efficiency particulate air (HEPA) filter bank, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, dampers, and instrumentation also form part of the system. A second bank of HEPA filters follows the adsorber section to collect carbon fines.

The Emergency Exhaust System is on standby for an automatic start following receipt of a fuel building ventilation isolation signal (FBVIS) or a safety injection signal (SIS). Initiation of the SIS mode of operation takes precedence over any other mode of operation. In the SIS mode, the system is aligned to exhaust the auxiliary building. The instrumentation associated with actuation of the SIS mode of operation is addressed in LCO 3.3.2, ESFAS Instrumentation.

Upon receipt of a fuel building ventilation isolation signal generated by gaseous radioactivity monitors in the fuel building exhaust line, normal air discharges from the building are terminated, the fuel building is isolated, the stream of ventilation air discharges through the system filter trains, and a control room ventilation isolation signal (CRVIS) is generated. The instrumentation associated with actuation of the FBVIS mode of operation is addressed in LCO 3.3.8, EES Actuation Instrumentation.

The Emergency Exhaust System is discussed in the FSAR, Sections 6.5.1, 9.4.2, 9.4.3, and 15.7.4 (Refs. 1, 2, 3 and 4 respectively) because it may be used for normal, as well as post accident, atmospheric cleanup functions.

(continued)

CALLAWAY PLANT B 3.7.13-1 Revision 12

Emergency Exhaust System B 3.7.13 BASES (Continued)

APPLICABLE The Emergency Exhaust System design basis is established by the SAFETY consequences of two Design Basis Accidents (DBAs), which are a loss of ANALYSES coolant accident (LOCA) and a fuel handling accident (FHA). The analysis of the fuel handling accident, given in Reference 4, assumes that all fuel rods in an assembly are damaged. The analysis of the LOCA assumes that radioactive materials leaked from the Emergency Core Cooling System (ECCS) and Containment Spray System during the recirculation mode are filtered and adsorbed by the Emergency Exhaust System. The DBA analysis of the fuel handling accident and of the LOCA assumes that only one train of the Emergency Exhaust System is functional due to a single failure that disables the other train. The accident analysis accounts for the reduction in airborne radioactive material provided by the one remaining train of this filtration system. The amount of fission products available for release from the fuel building is determined for a fuel handling accident and for a LOCA. These assumptions and the analysis follow the guidance provided in Regulatory Guides 1.4 (Ref. 6) and 1.25 (Ref. 5).

The Emergency Exhaust System satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO Two independent and redundant trains of the Emergency Exhaust System are required to be OPERABLE to ensure that at least one train is available, assuming a single failure that disables the other train. Total system failure could result in the atmospheric release from the auxiliary building or fuel building exceeding regulatory release limits in the event of a LOCA or fuel handling accident.

In MODES 1, 2, 3 and 4 the Emergency Exhaust System (EES) is considered OPERABLE when the individual components necessary to control releases from the auxiliary building are OPERABLE in both trains (i.e., the components required for the SIS mode of operation and the auxiliary building pressure boundary). During movement of irradiated fuel assemblies in the fuel building, the EES is considered OPERABLE when the individual components necessary to control releases from the fuel building are OPERABLE in both trains (i.e. the components required for the FBVIS mode of operation and the fuel building pressure boundary).

An Emergency Exhaust System train is considered OPERABLE when its associated:

a. Fan is OPERABLE; (continued)

CALLAWAY PLANT B 3.7.13-2 Revision 12

Emergency Exhaust System B 3.7.13 BASES LCO b. HEPA filter and charcoal adsorber are not excessively restricting (continued) flow, and are capable of performing their filtration function, and

c. Heater, ductwork, and dampers are OPERABLE, and air circulation can be maintained.

The LCO is modified by a Note allowing the auxiliary or fuel building boundary to be opened intermittently under administrative controls. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings these controls consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual will have a method to rapidly close the opening when a need for auxiliary or fuel building isolation is indicated. Plant administrative controls address the breached pressure boundary.

APPLICABILITY In MODE 1, 2, 3, or 4, the Emergency Exhaust System is required to be OPERABLE to support the SIS mode of operation to provide fission product removal associated with ECCS leaks due to a LOCA and leakage from containment and annulus.

In MODE 5 or 6, the Emergency Exhaust System is not required to be OPERABLE since the ECCS is not required to be OPERABLE.

During movement of irradiated fuel in the fuel building, the Emergency Exhaust System is required to be OPERABLE to support the FBVIS mode of operation to alleviate the consequences of a fuel handling accident.

The Applicability is modified by a Note. The Note clarifies the Applicability for the two safety-related modes of operation of the Emergency Exhaust System, i.e., the Safety Injection Signal (SIS) mode and the Fuel Building Ventilation Isolation Signal (FBVIS) mode. The SIS mode which aligns the system to the auxiliary building is applicable when the ECCS is required to be OPERABLE. In the FBVIS mode the system is aligned to the fuel building. This mode is applicable while handling irradiated fuel in the fuel building.

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable to the FBVIS mode of operation. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action.

If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, (continued)

CALLAWAY PLANT B 3.7.13-3 Revision 12

Emergency Exhaust System B 3.7.13 BASES ACTIONS during movement of irradiated fuel assemblies in the fuel building while in (continued) MODE 1, 2, 3, or 4, would require the unit to be shutdown unnescessarily.

A.1 With one Emergency Exhaust System train inoperable, action must be taken to restore OPERABLE status within 7 days. During this period, the remaining OPERABLE train is adequate to perform the Emergency Exhaust System function. The 7 day Completion Time is based on the risk from an event occurring requiring the inoperable Emergency Exhaust System train, and the remaining Emergency Exhaust System train providing the required protection.

B.1 If the auxiliary building boundary is inoperable in MODE 1, 2, 3, and 4 such that neither EES train can establish the required negative pressure, action must be taken to restore an OPERABLE auxiliary building boundary within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. During the period that the auxiliary building boundary is inoperable, appropriate compensatory measures (consistent with the intent, as applicable, of GDC 19, 60, 61, 63, 64, and 10CFR Part 100) should be utilized to protect plant personnel from potential hazards such as radioactive contamination and physical security. Compensatory measures address entries into Condition B. See also the LCO Bases above. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is reasonable based on the low probability of a DBA occurring during this time period, the availability of the EES to provide a filtered environment (albiet with potential auxiliary building exfiltration), and the use of compensatory measures. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is a reasonable time to diagnose, plan, repair, and test most problems with the auxiliary building boundary.

C.1 and C.2 In MODE 1, 2, 3, or 4, when Required Action A.1 or B.1 cannot be completed within the associated Completion Time, or when both Emergency Exhaust System trains are inoperable for reasons other than due to an inoperable auxiliary building boundary (i.e., Condition B), the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. This condition only applies to the EES components required to support the SIS mode of operation. The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

CALLAWAY PLANT B 3.7.13-4 Revision 12

Emergency Exhaust System B 3.7.13 BASES ACTIONS D.1 and D.2 (continued)

When Required Action A.1 cannot be completed within the associated Completion Time during movement of irradiated fuel assemblies in the fuel building, the OPERABLE Emergency Exhaust System train must be immediately started in the FBVIS mode per Required Action D.1. This action ensures that no undetected failures preventing system operation exist, and that any active failure will be readily detected.

An alternative to Required Action D.1 is to immediately suspend movement of irradiated fuel assemblies in the fuel building per Required Action D.2. This precludes activities that could result in a fuel handling accident and the associated release of radioactivity that might require operation of the Emergency Exhaust System. This action does not preclude the movement of fuel assemblies to a safe position.

E.1 When two trains of the Emergency Exhaust System are inoperable during movement of irradiated fuel assemblies in the fuel building, action must be taken to place the unit in a condition in which the LCO does not apply.

Action must be taken immediately to suspend movement of irradiated fuel assemblies in the fuel building. This does not preclude the movement of fuel to a safe position. This condition only applies to the EES components required to support the FBVIS mode of operation, including the fuel building pressure boundary.

SURVEILLANCE SR 3.7.13.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environmental and normal operating conditions on this system are not severe, testing each train periodically, by initiating from the Control Room flow through the HEPA filters and charcoal adsorbers, provides an adequate check on this system.

Periodic heater operation dries out any moisture accumulated in the charcoal from humidity in the ambient air. Each Emergency Exhaust System train must be operated for 15 continuous minutes with the heaters functioning. Functioning heaters would not necessarily have the heating elements energized continuously for 15 minutes, but will cycle depending on the temperature. This SR can be satisfied with the EES in the SIS or FBVIS lineup during testing. The 15-minute run time is based on Position C.6.1 of Reference 10.

(continued)

CALLAWAY PLANT B 3.7.13-5 Revision 12

Emergency Exhaust System B 3.7.13 BASES SURVEILLANCE SR 3.7.13.1 (continued)

REQUIREMENTS The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.13.2 This SR verifies that the required Emergency Exhaust System filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The Emergency Exhaust System filter tests are in accordance with Regulatory Guide 1.52 (Ref. 7). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal.

Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.13.3 This SR verifies that each Emergency Exhaust System train starts and operates on an actual or simulated actuation signals. These actuation signals include a Safety Injection Signal (applicable in MODE 1, 2, 3 and 4) and high radiation signal from the Fuel Building Exhaust Radiation

- Gaseous channels (applicable during movement of irradiated fuel in the fuel building).

During emergency operations the Emergency Exhaust System will automatically start in either the SIS or FBVIS lineup depending on the initiating signal. In the SIS lineup, the fans operate with dampers aligned to exhaust from the Auxiliary Building and prevent unfiltered leakage. In the FBVIS lineup, which is initiated on a high radiation signal from the Fuel Building Exhaust Radiation - Gaseous channels, the fans operate with the dampers aligned to exhaust from the Fuel Building to prevent unfiltered leakage. Normal exhaust air from the Fuel Building is continuously monitored by radiation detectors. One detector output will automatically align the Emergency Exhaust System in the FBVIS mode of operation. This surveillance requirement demonstrates that each Emergency Exhaust System train can be automatically started and properly configured to the FBVIS or SIS alignment, as applicable, upon receipt of an actual or simulated SIS signal and an FBVIS signal. It is not required that each Emergency Exhaust System train be started from both actuation signals during the same surveillance test provided each actuation signal is tested independently. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

(continued)

CALLAWAY PLANT B 3.7.13-6 Revision 12

Emergency Exhaust System B 3.7.13 BASES SURVEILLANCE SR 3.7.13.4 REQUIREMENTS (continued) This SR verifies the integrity of the auxiliary building enclosure. The ability of the auxiliary building to maintain negative pressure with respect to potentially uncontaminated adjacent areas is periodically tested to verify proper function of the Emergency Exhaust System. During the SIS mode of operation, the Emergency Exhaust System is designed to maintain a slight negative pressure in the auxiliary building, to prevent unfiltered leakage. The Emergency Exhaust System is designed to maintain a negative pressure 0.25 inches water gauge with respect to atmospheric pressure at the flow rate specified in the VFTP. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.13.5 This SR verifies the integrity of the fuel building enclosure. The ability of the fuel building to maintain negative pressure with respect to potentially uncontaminated adjacent areas is periodically tested to verify proper function of the Emergency Exhaust System. During the FBVIS mode of operation, the Emergency Exhaust System is designed to maintain a slight negative pressure in the fuel building, to prevent unfiltered leakage.

The Emergency Exhaust System is designed to maintain a negative pressure 0.25 inches water gauge with respect to atmospheric pressure at the flow rate specified in the VFTP. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.5.1, Engineered Safety Features (ESF) Filter Systems.

2. FSAR, Section 9.4.2, Fuel Building HVAC.

3. FSAR, Section 9.4.3, Auxiliary Building HVAC.

4. FSAR, Section 15.7.4, Fuel Handling Accidents.

5. Regulatory Guide 1.25, Rev. 0, Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors.

(continued)

CALLAWAY PLANT B 3.7.13-7 Revision 12

Emergency Exhaust System B 3.7.13 BASES REFERENCES 6. Regulatory Guide 1.4, Rev. 2, Assumptions Used for Evaluating (continued) the Potential Radiological Consequences of a Loss of Coolant Accident from Pressurized Water Reactors.

7. Regulatory Guide 1.52 (Rev. 2), Design, Testing and Maintenance Criteria for Atmospheric Cleanup System Air Filtration and Adsorption Units of Light Water Cooled Nuclear Power Plants.

8. NUREG-0800, Section 6.5.1, Rev. 2, July 1981, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants.

9. Procedure EDP-ZZ-04107, HVAC Pressure Boundary and Watertight Door Control.

10. Regulatory Guide 1.52 (Rev. 3), Design, Inspection and Testing Criteria for Air Filtration and Adsorption Units of Post-Accident Engineered-Safety-Feature Atmosphere Cleanup Systems in Light-Water-Cooled Nuclear Power Plants.

CALLAWAY PLANT B 3.7.13-8 Revision 12

B 3.7.14 B 3.7 PLANT SYSTEMS B 3.7.14 Not used.

CALLAWAY PLANT B 3.7.14-1 Revision 0

Fuel Storage Pool Water Level B 3.7.15 B 3.7 PLANT SYSTEMS B 3.7.15 Fuel Storage Pool Water Level BASES BACKGROUND The minimum water level in the fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident. The specified water level shields and minimizes the general area dose when the storage racks are filled to their maximum capacity. The water also provides shielding during the movement of spent fuel.

A general description of the fuel storage pool design is given in the FSAR, Section 9.1.2 (Ref. 1). A description of the Spent Fuel Pool Cooling and Cleanup System is given in the FSAR, Section 9.1.3 (Ref. 2). The assumptions of the fuel handling accident are given in the FSAR, Section 15.7.4 (Ref. 3).

APPLICABLE During movement of irradiated fuel in the fuel building, the water level in SAFETY the fuel storage pool is an initial condition design parameter in the ANALYSES analysis of the fuel handling accident as postulated by Reg. Guide 1.25 (Ref. 4). Irradiated fuel being moved is assumed to be from a reactor core which has been subcritical for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. A minimum water level of 23 feet (Regulatory Position C.1.c of Ref. 4) allows a decontamination factor of 100 (Regulatory Position C.1.g) of Ref. 4 to be used in the accident analysis for iodine. This relates to the assumption that 99% of the total iodine released from the pellet to cladding gap of the damaged rods is retained by the fuel storage pool water. The fission product release point is assumed to be at the point of impact at the top of the spent fuel storage racks. The fuel pellet to cladding gap is assumed to contain 10% of the total fuel rod iodine inventory (Ref. 4).

The fuel handling accident inside the fuel building is described in Reference 3. With a minimum water level of 23 feet and a minimum decay time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and offsite doses are maintained well within the limits of 10 CFR 100 (Refs. 4 and 5).

The fuel storage pool water level satisfies Criterion 2 and 3 of 10 CFR 50.36(c)(2)(ii).

(continued)

CALLAWAY PLANT B 3.7.15-1 Revision 11

Fuel Storage Pool Water Level B 3.7.15 BASES (Continued)

LCO The fuel storage pool water level is required to be 23 ft over the top of the storage racks. The specified water level preserves the assumptions of the fuel handling accident analysis (Ref. 3). As such, it is the minimum required for fuel movement within the fuel storage pool.

APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the fuel storage pool, since the potential for a release of fission products exists.

The reconstitution of irradiated fuel assemblies is also considered movement of irradiated fuel.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.

When the initial conditions for prevention of an accident cannot be met, steps should be taken to preclude the accident from occurring. When the fuel storage pool water level is lower than the required level, the movement of irradiated fuel assemblies in the fuel storage pool is immediately suspended. This action effectively precludes the occurrence of a fuel handling accident. This does not preclude movement of a fuel assembly to a safe position.

If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODES 1, 2, 3, and 4, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.7.15.1 REQUIREMENTS This SR verifies sufficient fuel storage pool water is available in the event of a fuel handling accident. The water level in the fuel storage pool must be checked periodically. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

During refueling operations, the level in the fuel storage pool is in equilibrium with the refueling pool, and the level in the refueling pool is checked in accordance with SR 3.9.7.1.

(continued)

CALLAWAY PLANT B 3.7.15-2 Revision 11

Fuel Storage Pool Water Level B 3.7.15 BASES (Continued)

REFERENCES 1. FSAR, Section 9.1.2, Spent Fuel Storage.

2. FSAR, Section 9.1.3, Fuel Pool Cooling and Cleanup System.

3. FSAR, Section 15.7.4, Fuel Handling Accidents.

4. Regulatory Guide 1.25, Rev. 0, Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility For Boiling and Pressurized Water Reactors.

5. 10 CFR 100.11.

6. NUREG-0800, Section 15.7.4, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants.

CALLAWAY PLANT B 3.7.15-3 Revision 11

Fuel Storage Pool Boron Concentration B 3.7.16 B 3.7 PLANT SYSTEMS B 3.7.16 Fuel Storage Pool Boron Concentration BASES BACKGROUND In the High Density Rack (HDR) design (Refs. 1 and 2), each fuel pool storage rack location is designated as either Region 1, Region 2, Region 3, or empty (in the checkerboarding configuration). Numerous configurations of region designation are possible. Criteria are established for determining an acceptable configuration (Ref. 1). The HDRs will store a maximum of 2363 fuel assemblies in the spent fuel pool and potentially an additional 279 fuel assemblies in the cask loading pool (with racks installed). Full-core offload capability will be maintained. The fuel storage pool consists of the spent fuel pool and the cask loading pool (with racks installed). Region 1 locations are designed to accommodate new fuel with a nominal maximum enrichment of 4.6 wt% U-235 with no integral fuel burnable absorber (IFBA); or up to a nominal maximum enrichment of 5.0 wt% U-235 with 16 IFBA; or spent fuel which meets the requirements of paragraph 4.3.1.1 in Section 4.3. Region 2 and 3 locations are designed to accommodate fuel of various initial enrichments which have accumulated minimum burnups within the acceptable domain according to Figure 3.7.17-1, in the accompanying LCO. Fuel assemblies not meeting the criteria of Figure 3.7.17-1 shall be stored in accordance with paragraph 4.3.1.1 in Section 4.3, Fuel Storage. Locations designated as empty cells shall contain no fuel assemblies.

The water in the fuel storage pool normally contains soluble boron, which results in large subcriticality margins under actual operating conditions.

However, the NRC guidelines, based upon the accident condition in which all soluble poison is assumed to have been lost, specify that the limiting keff of 0.95 be evaluated in the absence of soluble boron. Hence, the HDR design is based on the use of unborated water, which maintains fuel storage pool in a subcritical condition during normal operation with the fuel storage pool racks fully loaded. The double contingency principle discussed in ANSI N-16.1-1975 and the April 1978 NRC letter (Ref. 3) allows credit for soluble boron under other abnormal or accident conditions, since only a single accident need be considered at one time.

For example, the most severe accident scenario is associated with the accidental misloading of multiple fuel assemblies in non-region 1 locations. This could potentially increase the reactivity of the fuel storage pool. To mitigate these postulated criticality related accidents, boron is dissolved in the pool water. Safe operation of the HDR with no movement of assemblies may therefore be achieved by controlling the location of each assembly in accordance with LCO 3.7.17, "Spent Fuel Assembly (continued)

CALLAWAY PLANT B 3.7.16-1 Revision 10

Fuel Storage Pool Boron Concentration B 3.7.16 BASES BACKGROUND Storage." Prior to movement of an assembly, it is necessary to perform (continued) SR 3.7.16.1.

APPLICABLE Accidents can be postulated that could increase the reactivity of the fuel SAFETY storage pool which are unacceptable with unborated water in the fuel ANALYSES storage pool. Thus, for these accident occurrences, the presence of soluble boron in the storage pool maintains subcriticality with Keff of 0.95 or less. The postulated accidents are basically of two types. Multiple fuel assemblies could be incorrectly transferred to non-region 1 locations (e.g., unirradiated fuel assemblies or insufficiently depleted fuel assemblies). The second type of postulated accidents is associated with a fuel assembly which is dropped adjacent to the fully loaded storage rack. The negative reactivity effect of the soluble boron compensates for the increased reactivity caused by either one of the two postulated accident scenarios. The accident analyses is provided in the FASR, Appendix 9.1A (Ref. 1). Safety analyses assume a B-10 enrichment of 19.9 a/o (Ref. 1). Administrative controls on the soluble boron concentration in the fuel storage pool ensure that there is equivalent B-10 concentration.

The concentration of dissolved boron in the fuel storage pool satisfies Criterion 2 of 10 CFR 50.36 (c)(2)(ii).

LCO The fuel storage pool boron concentration is required to be 2165 ppm.

The fuel storage pool consists of the spent fuel pool and cask loading pool (with racks installed). The specified concentration of dissolved boron in the fuel storage pool preserves the assumptions used in the analyses of the potential critical accident scenarios as described in Reference 1.

This concentration of dissolved boron is the minimum required concentration for non-inventoried fuel assembly storage and movement within the fuel storage pool.

APPLICABILITY This LCO applies whenever fuel assemblies are stored in the fuel storage pool, until a complete fuel storage pool verification has been performed following the last movement of fuel assemblies in the fuel storage pool.

This LCO does not apply following the verification, since the verification would confirm that there are no misloaded fuel assemblies. With no further fuel assembly movements in progress, there is no potential for misloaded fuel assemblies or a dropped fuel assembly.

(continued)

CALLAWAY PLANT B 3.7.16-2 Revision 10

Fuel Storage Pool Boron Concentration B 3.7.16 BASES (Continued)

ACTIONS A.1, A.2.1. and A.2.2 The Required Actions are modified by a Note indicating that LCO 3.0.3 does not apply.

When the concentration of boron in the fuel storage pool is less than required, immediate action must be taken to preclude the occurrence of an accident or to mitigate the consequences of an accident in progress.

This is most efficiently achieved by immediately suspending the movement of fuel assemblies. The concentration of boron is restored simultaneously with suspending movement of fuel assemblies. An acceptable alternative is to verify by administrative means that the fuel storage pool verification has been performed since the last movement of fuel assemblies in the fuel storage pool. However, prior to resuming movement of fuel assemblies, the concentration of boron must be restored. This does not preclude movement of a fuel assembly to a safe position.

If the LCO is not met while moving fuel assemblies in MODE 5 or 6, LCO 3.0.3 would not be applicable. If moving fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operation. Therefore, inability to suspend movement of fuel assemblies is not sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.7.16.1 REQUIREMENTS This SR verifies that the concentration of boron in the fuel storage pool is within the required limit. As long as this SR is met, the analyzed accidents are fully addressed. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Callaway FSAR, Appendix 9.1A, "The High Density Rack (HDR)

Design Concept."

2. Amendment No. 129 dated January 19, 1999 to the Callaway Operating License.

3. Double contingency principle of ANSI N16.1-1975, as specified in the April 14, 1978 NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).

CALLAWAY PLANT B 3.7.16-3 Revision 10

Spent Fuel Assembly Storage B 3.7.17 B 3.7 PLANT SYSTEMS B 3.7.17 Spent Fuel Assembly Storage BASES BACKGROUND The high density rack modules for the fuel storage pool are designed for storage of both new fuel and spent fuel. Spent fuel storage is designated into Regions based upon initial enrichment and accumulated burnup.

Region 1 is designed to accommodate new fuel with a maximum nominal enrichment of 4.6 wt% U-235 with no burnable absorbers or up to 5.0 wt% U-235 with integral absorbers. Region 2 and Region 3 are designed to accommodate fuel of up to 5.0 wt% U-235 initial enrichments which have accumulated minimum burnups within the acceptable domain according to Figure 3.7.17-1, in the accompanying LCO.

Prior to storage of fuel assemblies in the fuel storage pool, overall pool storage configurations are prepared in accordance with administrative controls. The pool layouts include sufficient Region 1 storage to accommodate new and discharged fuel assemblies with low burnup. Fuel storage utilizes either a Mixed Zone Three Region configuration and/or a checkerboarding configuration. A combination of the Mixed Zone Three Region (MZTR) configuration and checkerboard pattern within the same rack is not allowed.

In a Mixed Zone Three Region configuration, Region 1 storage cells are only located along the outside periphery of the rack modules and must be separated by one or more Region 2 storage cells. Region 1 storage cells may be located directly across from one another when separated by a water gap. The outer rows of alternating Region 1 and 2 storage cells must be further separated from the internal Region 3 storage cells by one or more Region 2 storage cells.

In the checkerboarding configuration, fuel assemblies are placed in an alternating checkerboard style pattern with empty storage cells (i.e., fuel assemblies are surrounded on all four sides by empty storage cells except at the checkerboard boundary). Region 1 fuel assemblies may not be located directly across from one another, even when separated by a water gap. This arrangement may be used anywhere in the fuel storage area if the checkerboarding pattern is maintained in a linear array equal to or greater than 2 x 2. A checkerboard area may be bounded by either a water gap, empty cells, Region 2 fuel assemblies or Region 3 fuel assemblies.

The water in the fuel storage pool normally contains soluble boron, which results in large subcriticality margins under actual operating conditions.

However, the NRC guidelines, based upon the accident condition in which all soluble poison is assumed to have been lost, (continued)

CALLAWAY PLANT B 3.7.17-1 Revision 2

Spent Fuel Assembly Storage B 3.7.17 BASES BACKGROUND specify that the limiting keff of 0.95 be evaluated in the absence of soluble (continued) boron. Hence, the design of all three regions is based on the use of unborated water, which maintains the fuel storage pool in a subcritical condition during normal operation with the regions fully loaded. The double contingency principle discussed in ANSI N-16.1-1975 and the April 1978 NRC letter (Ref. 2) allows credit for soluble boron under other abnormal or accident conditions, since only a single accident need be considered at one time. For example, the most severe accident scenarios, for which boron credit is taken, are:

a. Inadvertent loading of 5.0 wt% U-235 new fuel assemblies in a Region 2 or Region 3 storage cell in a Mixed Zone Three Region configuration, or in an empty cell in a checkerboard configuration.

b. Mis-location of a new fuel assembly in the gap between the rack modules and the concrete wall in the spent fuel pool.

APPLICABLE The hypothetical accidents can only take place during or as a result of the SAFETY movement of assemblies (Ref. 1). For these accident occurrences, the ANALYSES presence of soluble boron in the fuel storage pool maintains subcriticality with a Keff of 0.95 or less.

The configuration of fuel assemblies in the fuel storage pool satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The restrictions on the placement of fuel assemblies within the fuel storage pool, in accordance with Figure 3.7.17-1 or Specification 4.3.1.1 in Section 4.3, in the accompanying LCO, ensures the keff of the fuel storage pool will always remain 0.95, assuming the pool to be flooded with unborated water. The fuel storage pool consists of the spent fuel pool and the cask loading pool (with racks installed).

APPLICABILITY This LCO applies whenever any fuel assembly is stored in the fuel storage pool.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.

When the configuration of fuel assemblies stored in the fuel storage pool is not in accordance with Figure 3.7.17-1, or paragraph 4.3.1.1, the (continued)

CALLAWAY PLANT B 3.7.17-2 Revision 2

Spent Fuel Assembly Storage B 3.7.17 BASES ACTIONS A.1 (continued) immediate action is to initiate action to make the necessary fuel assembly movement(s) to bring the configuration into compliance with Figure 3.7.17-1 or Specification 4.3.1.1.

If unable to move irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not be applicable. If unable to move irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the action is independent of reactor operation. Therefore, inability to move fuel assemblies is not sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.7.17.1 REQUIREMENTS This SR verifies by administrative means that the initial enrichment and burnup of the fuel assembly is in accordance with Figure 3.7.17-1 in the accompanying LCO. For fuel assemblies in the unacceptable range of Figure 3.7.17-1, performance of this SR will ensure compliance with Specification 4.3.1.1. The burnup of each spent fuel assembly stored in Region 2 or 3 shall be ascertained by analysis, and independently verified prior to storage in Region 2 or 3. Shuffling of fuel within a Region does not require performance of this surveillance.

REFERENCES 1. FSAR, Appendix 9.1A, Spent Fuel Storage Rack Analysis.

2. Double contingency principle of ANSI N16.1-1975, as specified in the April 14, 1978 NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).

CALLAWAY PLANT B 3.7.17-3 Revision 2

Secondary Specific Activity B 3.7.18 B 3.7 PLANT SYSTEMS B 3.7.18 Secondary Specific Activity BASES BACKGROUND Activity in the secondary coolant results from steam generator tube outleakage from the Reactor Coolant System (RCS). Under steady state conditions, the activity is primarily iodines with relatively short half lives and, thus, indicates current conditions. During transients, I-131 spikes have been observed as well as increased releases of some noble gases.

Other fission product isotopes, as well as activated corrosion products in lesser amounts, may also be found in the secondary coolant.

A limit on secondary coolant specific activity during power operation minimizes releases to the environment because of normal operation, anticipated operational occurrences, and accidents.

This limit is lower than the activity value that might be expected from a 1 gpm tube leak (LCO 3.4.13, "RCS Operational LEAKAGE") of primary coolant at the limit of 1.0 Ci/gm (LCO 3.4.16, "RCS Specific Activity").

The steam line failure is assumed to result in the release of the noble gas and iodine activity contained in the steam generator inventory, the feedwater, and the reactor coolant LEAKAGE. Most of the iodine isotopes have short half lives, (i.e., < 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />).

Operating a unit at the allowable secondary coolant specific activity will assure that the potential 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> exclusion area boundary (EAB) exposure is limited to a small fraction of the 10 CFR 100 (Ref. 1) limits.

APPLICABLE The accident analysis of the main steam line break (MSLB), as discussed SAFETY in the FSAR, Chapter 15.1.5 (Ref. 2) assumes the initial secondary ANALYSES coolant specific activity to have a radioactive isotope concentration greater than 0.10 Ci/gm DOSE EQUIVALENT I-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accident. The accident analysis, based on this and other assumptions, shows that the radiological consequences of an MSLB do not exceed a small fraction of the unit EAB limits (Ref. 1) for wholebody and thyroid dose rates.

With the loss of offsite power, the remaining steam generators are available for core decay heat dissipation by venting steam to the atmosphere through the MSSVs and steam generator atmospheric steam dump valves (ASDs). The Auxiliary Feedwater System supplies the necessary makeup to the steam generators. Venting continues until the (continued)

CALLAWAY PLANT B 3.7.18-1 Revision 10

Secondary Specific Activity B 3.7.18 BASES APPLICABLE reactor coolant temperature and pressure have decreased sufficiently for SAFETY the Residual Heat Removal System to complete the cooldown.

ANALYSES (continued) In the evaluation of the radiological consequences of this accident, the activity released from the steam generator connected to the failed steam line is assumed to be released directly to the environment. The unaffected steam generator is assumed to discharge steam and any entrained activity through the MSSVs and (ASDs) during the event. Since no credit is taken in the analysis for activity plateout or retention, the resultant radiological consequences represent a conservative estimate of the potential integrated dose due to the postulated steam line failure.

Secondary specific activity limits satisfy Criterion 2 of 10 CFR 50.36 (c)(2)(ii).

LCO As indicated in the Applicable Safety Analyses, the specific activity of the secondary coolant is required to be 0.10 Ci/gm DOSE EQUIVALENT I-131 to limit the radiological consequences of a Design Basis Accident (DBA) to a small fraction of the required limit (Ref. 1).

Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the unit in an operational MODE that would minimize the radiological consequences of a DBA.

APPLICABILITY In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere.

In MODES 5 and 6, both the RCS and the steam generators are at reduced pressure or are depressurized, and primary to secondary LEAKAGE is minimal. Therefore, monitoring of secondary specific activity is not required.

ACTIONS A.1 and A.2 DOSE EQUIVALENT I-131 exceeding the allowable value in the secondary coolant, is an indication of a problem in the RCS and contributes to increased post accident doses. If the secondary specific activity cannot be restored to within limits within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed (continued)

CALLAWAY PLANT B 3.7.18-2 Revision 10

Secondary Specific Activity B 3.7.18 BASES ACTIONS A.1 and A.2 (continued)

Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.18.1 REQUIREMENTS This SR verifies that the secondary specific activity is within the limits of the accident analysis. A gamma isotopic analysis of the secondary coolant, which determines DOSE EQUIVALENT I-131, confirms the validity of the safety analysis assumptions as to the source terms in post accident releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or LEAKAGE. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 100.11.

2. FSAR, Chapter 15.1.5, Steam System Piping Failure.

CALLAWAY PLANT B 3.7.18-3 Revision 10

Secondary System Isolation Valves (SSIVs)

B 3.7.19 B 3.7 PLANT SYSTEMS B 3.7.19 Secondary System Isolation Valves (SSIVs)

BASES BACKGROUND Closure of secondary system isolation valves (SSIVs) ensures that the assumptions used in the plant accident and containment analyses remain valid. In accident conditions, SSIVs close to terminate the blowdown from the faulted steam generator and isolate the intact steam generators, and to isolate the plant secondary side in order to prevent possible diversion of auxiliary feedwater flow.

The accident analyses assume that the steam generators are isolated after secondary system isolation valves receive an isolation signal.

Following receipt of the steam line isolation signal (SLIS) and auxiliary feedwater actuation signal (AFAS), the intact steam generators are assumed to be isolated, except for the steam supply valves to the turbine-driven auxiliary feedwater pump (governed by Technical Specification 3.7.5, Auxiliary Feedwater System). There are also analysis cases that evaluate the single failure of a main steam or main feedwater isolation valve. In addition to the valves governed by Technical Specification 3.7.2 (Main Steam Isolation Valves, Main Steam Isolation Valve Bypass Valves, and Main Steam Low Point Drain Isolation Valves) and Technical Specification 3.7.3 (Main Feedwater Isolation Valves, Main Feedwater Regulating Valves, and Main Feedwater Regulating Valve Bypass Valves),

the analysis assumptions require that the steam generator blowdown and sample line isolation valves are closed and the steam generator chemical injection flow path is isolated.

When plant accident conditions require delivery of auxiliary feedwater, the normally closed steam supply isolation valves to the turbine-driven auxiliary feedwater pump (TDAFP) open on the turbine-driven AFAS. This ensures availability of the TDAFP. The motor-driven AFAS signal closes the steam generator blowdown and sample isolation valves in order to isolate the plants secondary side.

The steam generator blowdown system (SGBS) helps to maintain the steam generator secondary side water within chemical specifications.

Heat is recovered from the blowdown and returned to the feedwater system. Portions of the SGBS are safety-related and are required to function following a design basis accident. One blowdown isolation valve (SGBSIV) is installed in each of the four blowdown lines outside the containment.

(continued)

CALLAWAY PLANT B 3.7.19-1 Revision 16

Secondary System Isolation Valves (SSIVs)

B 3.7.19 BASES BACKGROUND These valves prevent uncontrolled blowdown from more than one steam (continued) generator and isolate nonsafety-related portions from the safety-related portions of the system. These valves are air-operated globe valves which fail closed. For emergency closure, either of two safety-related solenoid valves is de-energized to dump air supplied to the valve actuator. The electrical solenoid valves are energized from separate Class 1E sources and are tripped upon receipt of an SGBSIS (AFAS) signal.

The SGBS also includes safety-related sample isolation valves (SGBSSIVs). Three SGBSSIVs are installed in each of the sample line flow paths for each steam generator. Two valves are located inside the containment (one from each sample point), and one valve is located outside containment. The SGBSSIVs prevent uncontrolled blowdown from more than one steam generator and isolate the nonsafety-related portions from the safety-related portions of the system. The SGBSSIVs are solenoid-operated globe valves which fail closed. The inside containment solenoid valves are energized from separate Class 1E sources from the outside containment solenoid valves. These valves are also closed upon receipt of an SGBSIS (AFAS) signal.

When plant accident conditions require feedline isolation, a feedwater isolation signal (FWIS) trips the main feedwater pumps and closes the main feedwater isolation valves, the main feedwater regulating valves, and the main feedwater regulating valve bypass valves. Required features for these automatic trip functions are covered by Technical Specifications 3.3.2 and 3.7.3. The FWIS also provides a signal to close the air-operated chemical injection isolation valve located in the chemical injection flow path associated with each main feedwater line. The valves automatically close when an FWIS is received.

The steam generator chemical injection system delivers chemicals to the steam generators via chemical addition through lines that tap directly into the feedwater lines, downstream of the main feedwater isolation valve.

For each or any of the four feedwater lines, a positive displacement metering pump delivers the chemicals from a supply tank into the associated feedwater line via an injection flow path that includes an automatic air-operated globe isolation valve, a check valve, and a manual valve prior to entering into the feedwater system. The manual valve in each line is addressed by this LCO.

The steam generator chemical injection system is used to maintain proper system pH and scavenge oxygen present in the steam generators to minimize corrosion during plant shutdown conditions. The system is normally not in use during plant power operation, except during plant conditions in hot standby or cold layup. However, during plant operation at (continued)

CALLAWAY PLANT B 3.7.19-2 Revision 16

Secondary System Isolation Valves (SSIVs)

B 3.7.19 BASES BACKGROUND full power, an infrequently performed test (Steam Generator Moisture (continued) Carryover Measurement) utilizes the chemical injection flow path to determine the average moisture carryover content in steam from the steam generators using a radioactive tracer method. The steam generator chemical injection system is infrequently used during the Applicability of this Specification.

The manual valve located in each chemical injection flow path is maintained locked closed until the system is used. When the system is used, the manual valve is opened under administrative controls. These controls include the presence of a dedicated operator who has constant communication with the control room while the flow path is open.

Therefore crediting the locked closed manual valve in the chemical injection flow path for isolation capability is warranted when it is only opened under administrative controls.

The SGBSIS (AFAS) isolates the steam generator blowdown and sample lines. An SGBSIS (AFAS) is generated by an SIS, motor-driven AFAS, or under voltage on Switchgear 4.16 KV buses NB01 or NB02 (Ref. 4).

Descriptions of SSIVs are found in the FSAR, Section 10.4.7 (Ref.1) and Section 10.4.8 (Ref. 2).

APPLICABLE The accident analyses assume that the steam generators are isolated SAFETY after secondary system isolation valves receive an isolation signal. The ANALYSES postulated design basis accidents include the main steam line break, the feed water line break, and steam generator tube rupture. Further discussions of these design basis accidents can be found in the FSAR, Chapters 6 and 15.

The secondary system isolation valves function to ensure the primary success path for steamline and feedline isolation and for delivery of required auxiliary feedwater flow. These valves therefore satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO ensures the secondary system isolation valves will isolate the plants secondary side and ensures the required flow of auxiliary feedwater to the intact steam generators. The automatic secondary system isolation valves are considered OPERABLE when their isolation times are within limits and they are capable of closing on an automatic isolation signal. OPERABILITY of the automatic SSIVs also requires the OPERABILITY of the auxiliary relays downstream of the Balance of Plant (BOP) Engineered Safety Feature Actuation System (ESFAS) cabinets.

(continued)

CALLAWAY PLANT B 3.7.19-3 Revision 16

Secondary System Isolation Valves (SSIVs)

B 3.7.19 BASES LCO (The auxiliary relays in the RP system cabinets are considered to be part (continued) of the end devices covered by this LCO.)

The locked closed manual valves in the chemical injection flow path are considered OPERABLE when they are locked closed (or open under administrative control). The applicable valves are the steam generator chemical injection isolation valves (AEV0128, AEV0129, AEV0130, and AEV0131).

Automatic secondary system isolation valves include: the steam generator blowdown isolation valves (BMHV0001, BMHV0002, BMHV0003, and BMHV0004) and steam generator blowdown sample line isolation valves (BMHV0019, BMHV0020, BMHV0021, BMHV0022, BMHV0035, BMHV0036, BMHV0037, BMHV0038, BMHV0065, BMHV0066, BMHV0067, AND BMHV0068).

The LCO is modified by a NOTE to allow the locked closed chemical injection valves to be opened under administrative controls. The administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room.

In this way, the valve can be rapidly isolated when a need for isolation is indicated.

APPLICABILITY The SSIVs in each secondary system flow path must be OPERABLE in MODES 1, 2, and 3, when there is significant mass and energy in the RCS and steam generators. Exceptions to the Applicability are allowed for the automatic SSIVs when isolation of the potential flow path is assured, such as when at least one SSIV in a flow path is closed and de-activated, or is closed and isolated by a closed manual valve, or the SSIV flow path is isolated by two closed manual valves, or two closed de-activated automatic valves, or a combination of a closed manual valve and a closed de-activated automatic valve. An air-operated SSIV is de-activated when power or air is removed from its actuation solenoid valves, and a solenoid-operated SSIV is de-activated when power is removed from its associated solenoid valve.

In MODE 4, 5, or 6, the steam generator energy is low. Therefore, the SSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.

(continued)

CALLAWAY PLANT B 3.7.19-4 Revision 16

Secondary System Isolation Valves (SSIVs)

B 3.7.19 BASES (Continued)

ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each secondary system flow path.

A.1 and A.2 With one or more SSIVs inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable valves within 7 days.

The 7 day Completion Time takes into account the low probability of an event occurring during this time period that would require isolation of the plants secondary side. The 7 day Completion Time is reasonable, based on operating experience.

Inoperable SSIVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the accident analyses remain valid. The 7 day Completion Time is reasonable based on engineering judgment, the availability of valve status indications in the control room, and other administrative controls to ensure that these valves are in the closed position or isolated.

If the SSIVs are closed and de-activated, or closed and isolated by a closed manual valve, or the SSIV flow path is isolated by two closed valves, this LCO does not apply as discussed in the Applicability section of these Bases.

The Required Actions have been modified by a Note that allows the closed or isolated automatic SSIV to be opened or unisolated under administrative controls. The administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the valve may be closed or the flow path may be isolated rapidly when a need for isolation is indicated.

B.1 and B.2 If the Required Action and associated Completion Time of Condition A are not met, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed at least in MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience and the time to reach the required unit conditions in an orderly manner and without challenging unit systems.

(continued)

CALLAWAY PLANT B 3.7.19-5 Revision 16

Secondary System Isolation Valves (SSIVs)

B 3.7.19 BASES SURVEILLANCE SR 3.7.19.1 REQUIREMENTS This SR verifies that the isolation time of each automatic SSIV is within limits when tested pursuant to the INSERVICE TESTING (IST)

PROGRAM. The specific limits are documented in the IST PROGRAM.

The SSIV isolation times are less than or equal to those assumed in the accident and containment analyses. This surveillance does not include verifying a closure time for the steam generator chemical addition injection isolation valves since it is not applicable to normally locked closed manual valves. These valves are not included in the IST PROGRAM because the valves are passive (not required to actuate to their safety position) and they contain a locking device and a check valve in their flow path.

For the SSIVs, performance of this surveillance may be done during plant operation (or as required for post-maintenance testing), but it may also be required to be performed upon returning the unit to operation following a refueling outage.

The Frequency for this SR is in accordance with the INSERVICE TESTING PROGRAM.

SR 3.7.19.2 This SR verifies that each automatic SSIV in the flow path is capable of closure on an actual or simulated actuation signal. This surveillance is routinely performed during plant operation, but may also be performed upon returning the unit to operation following a refueling outage.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

(continued)

CALLAWAY PLANT B 3.7.19-6 Revision 16

Secondary System Isolation Valves (SSIVs)

B 3.7.19 BASES (Continued)

REFERENCES 1. FSAR, Section 10.4.7, Condensate and Feedwater System

2. FSAR, Section 10.4.8, Steam Generator Blowdown System

3. FSAR Figure 10.4-8, Sheet 1, Note 9

4. FSAR Figure 7.2-1, Sheet 2 CALLAWAY PLANT B 3.7.19-7 Revision 16

Class 1E Electrical Equipment Air-Conditioning (A/C) System B 3.7.20 B 3.7 PLANT SYSTEMS B 3.7.20 Class 1E Electrical Equipment Air Conditioning (A/C) System BASES BACKGROUND The Class 1E electrical equipment air conditioning (A/C) trains provide a suitable environment for the Class 1E electrical equipment. These air-conditioning trains provide temperature control for the Engineered Safety Features (ESF) switchgear room components, DC switchboard room components, and NK battery room components. The specific rooms supplied by the Class 1E electrical equipment A/C trains are:

SGK05A SGK05B SWBD RM No. 1 (3408) SWBD RM No. 4 (3404)

SWBD RM No. 3 (3414) SWBD RM No. 2 (3410)

Battery RM No. 1 (3407) Battery RM No. 4 (3405)

Battery RM No. 3 (3413) Battery RM No. 2 (3411)

ESF SWGR RM No. 1 (3301) ESF SWGR RM No. 2 (3302)

The Class 1E electrical equipment A/C system consists of two independent trains such that each train provides cooling of recirculated air in the rooms normally dedicated to that train. Each train consists of a prefilter, self-contained refrigeration unit (using normal service water or essential service water (ESW) as a heat sink), centrifugal fans, instrumentation, and controls to provide for electrical equipment room temperature control.

The Class 1E electrical equipment A/C trains have emergency operation functions and also operate during normal unit operation. Each train is normally aligned to cool only the equipment associated with its emergency load group. The Class 1E electrical equipment A/C trains are operated in a continuous recirculation mode to maintain the ESF switchgear rooms, the battery rooms, and the DC switchboard rooms to a temperature of 90°F (Ref. 1).

Additional recirculation capability is provided via the Class 1E electrical equipment A/C supplemental cooling system consisting of two trains of standby fans and dampers. Either train may be actuated via operator action. With one Class 1E electrical equipment A/C train inoperable, the additional recirculation capability afforded by either supplemental cooling train may be utilized in conjunction with the remaining Class 1E electrical equipment A/C train to provide adequate area cooling to both trains of Class 1E electrical equipment during normal and accident conditions.

(continued)

CALLAWAY PLANT B 3.7.20-1 Revision 18

Class 1E Electrical Equipment Air-Conditioning (A/C) System B 3.7.20 BASES (Continued)

APPLICABLE The design basis of the Class 1E Electrical Equipment A/C System is to SAFETY maintain temperatures in the Class 1E electrical equipment rooms within ANALYSES limits to assure OPERABILITY of the associated electrical equipment.

This support function for the Class 1E electrical equipment in turn supports the Engineered Safety Feature (ESF) systems that are required to be OPERABLE consistent with the assumptions and initial conditions of the design-basis accident (DBA) and transient analyses in the FSAR (Chapters 6 and 15), including the unavailability of offsite power, as applicable. The Class 1E Electrical Equipment A/C System is designed so that the single failure of an active component coincident with a design basis accident (DBA) cannot impair the ability of the supported systems powered by the electrical equipment to fulfill their safety functions.

During normal operations each Class 1E electrical equipment A/C train maintains the temperature in its associated electrical equipment rooms at a temperature 90°F. For DBA conditions, a Class 1E electrical equipment A/C train is required to maintain the associated electrical equipment room temperatures 104°F. The Class 1E electrical equipment A/C trains are designed in accordance with Seismic Category I requirements.

The Class 1E Electrical Equipment A/C System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two independent Class 1E electrical equipment A/C trains are required to be OPERABLE to ensure adequate cooling to their associated electrical equipment rooms during normal operation. Each Class 1E electrical equipment A/C train is considered to be OPERABLE when the individual components necessary to maintain associated electrical equipment room temperatures within acceptable limits are OPERABLE. These components include (for each train) the refrigeration compressor, heat exchanger, cooling coils, ESW or normal service water flow, fans and associated temperature control instrumentation. In addition each Class 1E electrical equipment A/C train must be OPERABLE to the extent that air circulation can be maintained.

APPLICABILITY In MODES 1, 2, 3, and 4, the Class 1E Electrical Equipment A/C System is a normally operating system with both trains in operation. Both trains must be OPERABLE to ensure that temperature in the protected rooms will not exceed equipment design limits.

(continued)

CALLAWAY PLANT B 3.7.20-2 Revision 18

Class 1E Electrical Equipment Air-Conditioning (A/C) System B 3.7.20 BASES APPLICABILITY Although the LCO for the Class 1E Electrical Equipment A/C System is not (continued) applicable in MODES 5 and 6, the capability of the Class 1E Electrical Equipment A/C System to perform its necessary related support functions may be required for OPERABILITY of supported systems.

ACTIONS A.1, A.2, and A.3 With one Class 1E electrical equipment A/C train inoperable, acceptable room temperatures for both trains of electrical equipment can be maintained if action is initiated immediately to implement mitigating actions. These include placing into service either train of the Class 1E electrical equipment A/C supplemental cooling system to provide additional recirculation capability, as initiated via operator action. This mitigating action is proceduralized for prompt implementation upon entry into the Condition.

The room area temperature limit of 90°F is based on the normal operating maximum steady-state environmental condition and a plant specific calculation for a single Class 1E electrical equipment A/C train maintaining both Class 1E electrical equipment train rooms at a temperature of 104°F during design basis accident conditions. The plant specific calculation assumes the affected room area temperatures are 90°F at the onset of the design basis accident.

With one Class 1E electrical equipment A/C train inoperable, the overall reliability of the cooling function is reduced. However, the remaining OPERABLE train can provide the required cooling function if mitigating actions are taken, including placing the Class 1E electrical equipment A/C supplemental cooling system into service, assuming the OPERABLE Class 1E electrical equipment A/C train is capable of operating at full capacity.

Verifying the room area temperatures within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> thereafter is adequate to ensure temperatures remain below 90°F. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is reasonable based on the minimal increase in room temperatures expected during this time period, with the mitigating actions in place.

The inoperable Class 1E electrical equipment A/C train must be restored to OPERABLE status within 30 days. The 30 day Completion Time is based on the capability of the remaining OPERABLE Class 1E electrical equipment A/C train to provide adequate area cooling for both trains of electrical equipment during normal and accident conditions (with mitigating actions implemented).

(continued)

CALLAWAY PLANT B 3.7.20-3 Revision 18

Class 1E Electrical Equipment Air-Conditioning (A/C) System B 3.7.20 BASES ACTIONS If the room area temperatures are not verified to be within limits as (continued) required once per 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, or if the inoperable Class 1E electrical equipment A/C train cannot be restored to OPERABLE status within 30 days, Condition B must be entered.

B.1 and B.2 When the Required Actions of Condition A cannot be completed within the required Completion Times, the unit must be placed in a MODE that minimizes accident risk. To achieve this status, the unit must be placed in MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1 If both Class 1E electrical equipment A/C trains are inoperable in MODE 1, 2, 3 or 4, the capability to maintain acceptable temperatures for the Class 1E electrical equipment is significantly degraded. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.7.20.1 REQUIREMENTS This SR verifies that each Class 1E electrical equipment A/C train starts and operates on an actual or simulated actuation signal. The actuation signal includes the Control Room Ventilation Isolation Signal (CRVIS). A CRVIS is generated by the inputs discussed in the Bases for LCO 3.3.7, CREVS Actuation Instrumentation. The Surveillance Requirement also verifies that a control room ventilation isolation signal (CRVIS) will be received by the LOCA sequencer to enable an automatic start of the diesel generator loads that are associated with a CRVIS. Verification that these loads will start and operate at the appropriate step in the LOCA sequencer and that other auto-start signals for these loads will be inhibited until the LOCA sequencer is reset is accomplished under Surveillance Requirement SR 3.8.1.12. The Surveillance Frequency is based on industry operating experience, equipment reliability and plant risk, and is controlled under the Surveillance Frequency Control Program.

(continued)

CALLAWAY PLANT B 3.7.20-4 Revision 18

Class 1E Electrical Equipment Air-Conditioning (A/C) System B 3.7.20 BASES SURVEILLANCE SR 3.7.20.2 REQUIREMENTS (continued) This SR verifies that the heat removal capability of the air conditioning units is adequate to remove the heat load assumed in the Class 1E electrical equipment rooms during design basis accidents. The surveillance uses a combination of monitoring and inspection methods, which include (1) verifying the heat removal capability of the condenser heat exchanger by water flow measurement, pressure loss monitoring, and visual inspection; (2) visual inspection monitoring of the evaporator heat exchanger coils; (3) ensuring the proper operation of major components in the refrigeration cycle; (4) verification of unit air flow capacity; and (5) verification that the tube plugging limits are met.

The Surveillance Frequency is based on operating experience (which shows that significant degradation of the Class 1E Electrical Equipment A/C typically occurs gradually and in a self-revealing manner.) The surveillance frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 9.4.1.

2. Letter from C.F Lyon, USNRC, to F. Diya, Union Electric Company, Callaway Plant, Unit 1 - Interpretation of Technical Specification Surveillance Requirement 3.7.11.1, Verify Each CRACS Train Has The Capability to Remove The Assumed Heat Load (TAC NO.

MF3665), May 28, 2014.

3. LDCN 16-0013, Incorporate new Technical Specification 3.7.20 into OL Appendix A, and update FSAR and TSB accordingly.

CALLAWAY PLANT B 3.7.20-5 Revision 18