NOC-AE-09002400, Technical Specification Bases Control Program

Technical Specification Bases Control Program

ML090830516
Person / Time
Site:	South Texas
Issue date:	03/16/2009
From:	Harrison A South Texas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NOC-AE-09002400
Download: ML090830516 (56)

Text

Nuclear Operating Company South Txas ProjectElectric GeneratingStation P.O. Box289 Wadsworth. Texas 77483 March 16, 2009 NOC-AE-09002400 10CFR50.36 U. S. Nuclear Regulatory Commission Attention: Document Control Desk One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738 South Texas Project Units 1 & 2 Docket Nos. STN 50-498 & 50-499 Technical Specification Bases Control Program The attached pages are submitted for your information in accordance with the South Texas Project Technical Specification Bases Control Program (Section 6.8.3.m). This submittal includes all bases pages that have been changed since the last submittal; therefore, in a few cases more than one version of a page is enclosed.

The NRC Project Manager for the South Texas Project has been added to the controlled distribution list for updates to the Technical Specifications and Bases on CD-ROM.

Page Page Page Number Number Number B 3/4 2-6 Note 1 B 3/4 7-3b Note 1 B 3/4 8-15 Note 3 B 3/4 3-2a Note 2 B 3/4 7-4 Notes 3 & 4 B 3/4 8-21 Notes 1 & 6 B 3/4 3-2b Note 3 B 3/4 7-5 Notes 3, 4 & 5 B 3/4 8-22 Notes 3 & 6 B 3/4 3-2c Note 3 B 3/4 7-6 Notes 3, 4 & 5 B 3/4 8-23 Note 1 B 3/4 3-2d Note 3 B 3/4 7-7 Notes 3, 4 & 5 B 3/4 8-26 Note 1 B 3/4 3-3 Note 3 B 3/4 8-6 Note 1 B 3/4 8-27 Note 1 B 3/4 3-4b Note 1 B 3/4 8-7 Note 1 B 3/4 8-28 Note 1 B 3/4 3-7 Note 1 B 3/4 8-8 Note 1 B 3/4 8-29 Notes 3 & 7 B 3/4 4-1 b Notes 1 & 2 B 3/4 8-9 Note 1 B 3/4 9-1a Note 1 B 3/4 4-2 Note 1 B 3/4 8-10 Note 1 B 3/4 9-1 b Note 3 B 3/4 4-4d Note 1 B 3/4 8-11 Note 1 B 3/4 9-2 Note 3 B 3/4 5-1 Note 1 B 3/4 8-12 Note 1 B 3/4 9-3 Note 3 B 3/4 5-2 Note 1 B 3/4 8-13 Note 1 B 3/4 9-3a Note 3 B 3/4 7-3a Note 1 B 3/4 8-14 Note 1 B 3/4 9-4 Note 3 Acu STI: 32436151

NOC-AE-09002400 Page 2 Note 1 Revised the Technical Specification Bases relative to the approved amendments to relocate surveillance frequencies of most surveillance tests to a licensee controlled document. [Amendments 188 Unit 1 and 175 Unit 2]

Note 2 Added information to the Technical Specification Bases to support a new requirement that addresses the condition of both channels of extended range neutron flux monitoring instrumentation being inoperable. [Amendments 187 Unit 1 and 174 Unit 2]

Note 3 Changed the Technical Specification Bases to support Technical Specification Amendment 182 for Unit 1 and 169 for Unit 2 regarding Alternate Source Term and approve the methodology for evaluating radiological consequences of design-basis accidents as described in Regulatory Guide 1.183. [Amendments 182 Unit 1 and 169 Unit 2]

Note 4 Added a new Control Room Envelope Habitability Program Requirement.

[Amendments 185 Unit 1 and 172 Unit 2]

Note 5 Revised 3.7.7 to add a clarification of the application of the Configuration Risk Management Program.

Note 6 Revised the Technical Specification Bases in conjunction with approved Technical Specification Amendments,184 for Unit 1 and 171 for Unit 2 to allow at-power battery discharge testing. [Amendments 184 Unit 1 and 171 Unit 2]

Note 7 Revised 3.8.3.1 with respect to the application of the Configuration Risk Management Program to distribution panels DPOO1 and DP002..

There are no commitments in this letter.

If you have any questions on this matter, please contact Marilyn Kistler at (361) 972-8385 or me at (361) 972-7298.

A ayne Harrison

ýM~anager, Licernssinag

Attachment:

Revised Bases Pages STI: 32436151

NOC-AE-09002400 Page 3 cc:

(paper copy) (electronic copy)

Regional Administrator, Region IV A. H. Gutterman, Esquire U. S. Nuclear Regulatory Commission Morgan, Lewis & Bockius LLP 612 East Lamar Blvd, Suite 400 Arlington, Texas 76011-4125 Mohan C. Thadani U. S. Nuclear Regulatory Commission Mohan C. Thadani Kevin Howell Senior Project Manager Catherine Callaway U.S. Nuclear Regulatory Commission Jim von Suskil One White Flint North (MS 7 D1) NRG South Texas LP 11555 Rockville Pike Rockville, MD 20852 Ed Alarcon Senior Resident Inspector J. J. Nesrsta U. S. Nuclear Regulatory Commission R. K. Temple P. 0. Box 289, Mail Code: MN1 16 Kevin Polio Wadsworth, TX 77483 City Public Service C. M. Canady Jon C. Wood City of Austin Cox Smith Matthews Electric Utility Department 721 Barton Springs Road C. Kirksey Austin, TX 78704 City of Austin Richard A. Ratliff Department of State Health Services Inspection Unit - Radiation Branch P.O. Box 149347 Austin, TX 78714-9347 STI: 32436151

POWER DISTRIBUTION LIMITS BASES 3/4.2.5 DNB PARAMETERS (continued)

The value for thermal design RCS flow rate presented in Technical Specification 3.2.5 is an analytical limit. The minimum thermal design. RCS flow rate is 392,000 gpm. To provide additional operating margin, a higher value for thermal design flow rate may be used if supported by cycle specific analysis. The minimum measured flow in the Core Operating Limits Report is the thermal design flow rate assumed for a particular cycle plus RCS flow measurement uncertainties. The RCS flow measurement uncertainty is 2.8% using the precision heat balance method or 2.1% using the elbow tap methods described in WCAP 15287, "RCS Flow Measurement for the South Texas Projects Using Elbow Tap Methodology", dated August, 1999. The elbow tap Dp measurement uncertainty presumes that elbow tap Dp measurements are obtained from either QDPS or the plant process computer.

Based on instrument uncertainty assumptions, RCS flow measurements using either the precision heat balance or the elbow tap Dp measurement methods are to be performed at greater than or equal to 90% RTP at the beginning of a new fuel cycle.

The surveillance of these parameters at a frequency found in the Surveillance Frequency Control Program through instrument readout is sufficient to ensure that the parameters are restored

!1 within their limits following load changes and other expected transient operation.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 2-6 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

INSTRUMENTATION BASES REACTOR TRIP SYSTEM and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

The Engineered Safety Features Actuation System senses selected plant parameters and determines whether or not predetermined limits are being exceeded. If they are, the signals are combined into logic matrices sensitive to combinations indicative of various accidents, events, and transients. Once the required logic combination is completed, the system sends actuation signals to those Engineered Safety Features components whose aggregate function best serves the requirements of the condition. As an example, the following actions may be initiated by the Engineered Safety Features Actuation System to mitigate the consequences of a steam line break or loss-of-coolant accident: (1) Safety Injection pumps start, (2) Reactor trip, (3) feedwater isolation, (4) startup of the standby diesel generators, (5) containment spray pumps start and automatic valves position, (6) containment isolation, (7) steam line isolation, (8) Turbine trip, (9) auxiliary feedwater pumps start and automatic valves position, (10) reactor containment fan coolers start, (11) essential cooling water pumps start and automatic valves position, (12) Control Room Ventilation Systems start, and (13) component cooling water pumps start and automatic valves position.

The function of the Extended Range, Neutron Flux instrumentation in Table 3.3-1 is to provide a shutdown monitor alarm during subcritical conditions to detect a flux increase (multiplication) and to alert the operator to a possible boron dilution event and pending loss of shutdown margin. The shutdown monitor has no trip function. Shutdown Monitors initiate a flux multiplication alarm (via QDPS) designed to alert the operator to a possible boron dilution event. This provides a minimum of 15 minutes to respond to a dilution event which is consistent with the safety analysis.

The Extended Range, Neutron Flux instrumentation denoted in LCO 3.3.1, Item 7 in Tables 3.3-1 and 4.3-1 is referring to the Gamma-Metrics Shutdown Monitors. The circuitry consists of hardware/software components which are unique to the Shutdown Monitor itself, such as the flux multiplication alarm contacts; as well as hardware which is shared with the Remote Shutdown (LCO 3.3.3.5) and the Accident Monitoring (LCO 3.3.3.6) QDPS Extended range, Neutron Flux instrumentation. Inoperability of the Shutdown Monitors does not affect the Operability of the QDPS Extended Range instrumentation except for reasons of common mode failure. Conversely, inoperability of the QDPS Extended Range instrumentation should be evaluated for common mode failure with respect to the Shutdown Monitor to verify OPERABILITY of the Shutdown Monitor. (CR 97-908-8)

ACTION 5 applies for one inoperable channel of Extended Range Neutron Flux and provides 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to restore the inoperable channel. In this condition, the second channel provides the monitoring function. If the inoperable channel is not restored to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the action requires suspending operations involving positive reactivity changes except for temperature changes or boron dilution, changes that are accounted for in the calculated SHUTDOWN MARGIN. There is no action specified for two inoperable channels of Extended Range Neutron Flux. In MODE 3 and MODE 4, TS 3.0.3 applies to this condition. In MODE 5, ACTION 5 also applies for two inoperable channels.

However, with no operable extended range channel there is inadequate neutron flux instrumentation for positive reactivity changes and there is not adequate basis for the allowance in ACTION 5 for dilution when the change is accounted for in the calculated SHUTDOWN MARGIN. The compensatory action for no operable extended range neutron flux is to suspend positive reactivity changes, increase the frequency of boron sampling to at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, secure SOUTH TEXAS -'UNITS 1 & 2 B 3/4 3-2a Unit 1 - Amendment No. 06-9892---145 187 Unit 2 - Amendment No. 06-9821-1-5 174

INSTRUMENTATION BASES REACTOR TRIP SYSTEM and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) each valve or mechanical joint used to isolate unborated water sources, and to immediately initiate action to restore a channel of extended range neutron flux to OPERABLE status.

In Modes 1, 2, 3 and 4, the radiation monitor actuation of the Control Room Ventilation and FHB HVAC Functional Units is a backup for the SI actuation. The automatic and manual radiation monitor inputs are independent of the SI relays in the SSPS.

When control rods are at the top or above the active fuel region (_>step 259), they are no longer capable of adding positive reactivity to the core, and as such, they are not capable of rod withdrawal as intended by MODE 5*. Therefore, ACTION 10 on Table 3.3-1 is not applicable in this region. This allows the Reactor Trip Breakers to be closed, without meeting the requirements of MODE 5*, while unlocking and stepping the control rods to a position no lower than 259. (CR 97-908-17)

Several ACTIONS in Tables 3.3-1 and 3.3-3 have been revised to change the allowed outage times and bypass test times in accordance with WCAP-10271 and WCAP-14333.

Additionally, some ACTIONS have been divided such that only certain requirements apply depending on whether the Functional Units have been modified with installed bypass test capability.

Regardless of whether the Functional Units have installed bypass test capability, it should be noted that in certain situations, the ACTIONS permit continued operation (for limited periods of time) with less than the minimum number of channels specified in Tables 3.3-1 and 3.3-3. For example, Table 3.3-1 Functional Unit 11 (Pressurizer Pressure - High) requires a minimum of 3 channels operable. However, since continued operation with an inoperable channel is- permitted beyond 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, provided the inoperable channel is placed in trip, and since periodic surveillance testing'of the other channels must continue to be performed, ACTION 6 permits a channel to be placed in bypass for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to permit testing. Thus, for a limited period of time (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />), 2 channels, or one less than the minimum, would be permitted to be inoperable.

During a plant shutdown for refueling, the Normal Containment Purge System is in operation.

The Supplementary Containment Purge System may be used during normal plant operation.

Redundant Class 1 E radiation monitors (i.e., the Reactor Containment Building [RCB] Purge Isolation) monitor the radiation in these purge lines. Upon either monitor sensing radiation above a preset limit, a signal is sent to the ESFAS logic trains, and the Containment ventilation isolation signal is actuated. In a LOCA, both Normal and Supplementary purge lines are isolated by a Safety Injection (SI) signal. Actuation of the purge isolation by these radiation monitors is not credited in the LOCA accident analyses, and is only a backup function for this event.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 3-2b Unit 1 - Amendment No. 08-9098-3 Unit 2- Amendment No. 08-9098-3

INSTRUMENTATION BASES REACTOR TRIP SYSTEM and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

ACTION 18.a. applies when the actuation logic for RCB Purge Radioactivity - High is inoperable because it affects both channels. The required action is to maintain the isolation valves closed. Loss of power supply to the output ESF relays of either channel of these monitors will be considered inoperable actuation logic and the isolation valves will be maintained closed in accordance with proposed ACTION 18.a. This is because this failure mode will result in the inability of the other actuation signals to close the purge valves if the initial signal is reset.

In MODE 1, 2, 3, or 4, when one of the two required channels of RCB Purge Radioactivity - High is inoperable, ACTION 18.b.1 requires restoration within 30 days. The allowed outage time is a reasonable time for easily accessible non-risk-significant instrumentation. The required action is modified by a note that allows the supplementary purge valves to be opened in MODE 1-4 under administrative control during the 30-day allowed outage time to permit operation of the supplementary purge system for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> at a time for the evolutions permitted by the Technical Specifications (containment pressure control, ALARA and respirable air quality needed for personnel entry into containment and for surveillance tests that required the valves to be open). The 2-hour allowance is adequate time for the routine pressure control purge operations during power operation. Opening the valves for purge operations is not permitted after the 30-day allowed outage time has expired.

In MODE 1 - 4, the safety analysis credits only the SI signal for actuation of CVI. As a backup, the operable radiation monitoring channel would still be available to actuate containment isolation.

Administrative control during purge evolutions with an inoperable radiation monitoring channel would include the operator ability to manually initiate CVI from the control room handswitch and typically include an assessment of plant conditions for potential actuation precursors, monitoring containment radiation and limiting purge duration.

ACTION 18.b.2 applies in MODE 1, 2, 3, and 4 when both channels of RCB Purge Radioactivity - High are inoperable. The action requires the purge isolation valves to be maintained closed and there is no provision for purge operation under administrative control.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 3-2c Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

INSTRUMENTATION BASES REACTOR TRIP SYSTEM and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

ACTION 27 for an inoperable channel of control room ventilation requires the associated train of control room ventilation to be declared inoperable and the appropriate action taken in accordance with Specification 3.7.7. Each control room ventilation system (train) is actuated by its own instrumentation channel. Consequently an inoperable channel of ventilation actuation instrumentation renders that system/train of ventilation inoperable and Specification 3.7.7 prescribes the appropriate action.

ACTION 28.a. provides 7 days to place the Control Room ventilation in the recirculation and make-up filtration mode of operation at 100% capacity (any two of the three trains of control room makeup and cleanup filtration meet the 100% capacity requirement) when one the two radioactivity-high actuation channels is inoperable. This time is acceptable because there is still an operable channel that will function to realign the control room envelope on a high radiation signalunless the failure mode is due to the output power supply. However, in that case, the operator can manually initiate the function. The 7 day allowed outage time is based on the low probability of a Design Basis Accident (DBA) occurrirng during this time period, and ability of the remaining train to provide the required capability.

ACTION 28.b. applies when both channels of control room ventilation radioactivity-high are inoperable and requires the ventilation system to be placed in recirculation and make-up filtration within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

The option to allow a 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> action time is also consistent with TS 3.7.7 for Control Room HVAC, which allows all three trains of the HVAC to be inoperable for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

ACTION 28.c. applies for MODEs 1, 2, 3, & 4. It requires the plant to be placed in a MODE where the Technical Specification does not apply.

SOUTH TEXAS - UNITS I & 2 B 3/4 3-2d Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

INSTRUMENTATION BASES REACTOR TRIP SYSTEM and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued)

The Engineered Safety Features Actuation System interlocks perform the following functions:

P-4 Reactor tripped - Actuates Turbine trip via P-I16, closes, main feedwater valves on Tavg below Setpoint, prevents the opening, of the main feedwater valves which were closed by a Safety Injection or High Steam Generator Water Level and allows Safety Injection block so that components can be reset or tripped. Reactor tripped with the source range blocked provides a non-protective function that closes the Steam Generator Blowdown isolation valves and allows reopening the valves after the source range block is reset.

Reactor not tripped - prevents manual -block of Safety Injection.

P-1 i On increasing pressurizer pressure, P-11 automatically reinstates Safety Injection actuation on low pressurizer pressure or low compensated steaniline pressure signals, reinstates steamline isolation on low compensated steamline pressure signals,'and opens the accumulator discharge isolation valves. On decreasing pressure, P-1I allows the manual block of Safety Injection actuation on tow pressurizer pressure or low compensated steamline pressure signals, allows the manual block of steamline isolation on low compensated steamline pressure signals, and enables steam line isolation on high negative steam line pressure rate (when steamline pressure is manually blocked).

P-12 'On increasing reactor coolant loop temperature, P-12 automatically provides an arming signal to the'Steam Dump System. On decreasing reactor coolant loop temperature, P-12 automatically removes the arming signal from the Steam Dump System.

P-14 On increasing steam generator water level, P-14 automatically trips the turbine and the main feedwater pumps, and closes all feedwater isolation valves and feedwater control valves.

For Table 4.3-1 Notations 3 and 6, the term ,incore" applies to either a PDMS measurement OR a moveable incore detector system measurement, because both methods represent a measurement of the reactor core power distribution.

Actuation Relays Actuation relays consist of slave relays, including the relay contacts for actuating ESF equipment. If the inoperability of a slave relay results in only one train of an ESF system function incapable of being actuated from the ESFAS and the integrated system response that accomplishes the design safety function of the applicable engineered SOUTH TEXAS - UNITS 1 & 2 B 3/4 3-3 Unit 1 -Amendment No. 08-9098-3, Unit 2 -Amendment No. 08-9098-3

INSTRUMENTATION BASES The Action is modified by a note that states that separate condition entry is allowed for each function.

The allowed outage time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

SURVEILLANCE REQUIREMENTS SR 4.3.3.5.1 requires performance of a CHANNEL CHECK at a frequency found in the Surveillance Frequency Control Program to ensure that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.

As specified in the Surveillance, a CHANNEL CHECK is only required for those channels, which are normally energized. The frequency specified in the Surveillance Frequency Control Program is based upon operating experience, which demonstrates that channel failure is rare. The provision to limit the channel check in SR 4.3.3.5.1 to normally energized instrumentation is included because it is accepted in the Standard TS NUREG-1431. None of the STP remote shutdown instrumentation is normally de-energized. The provision is retained to provide flexibility for any future design change that would replace an instrument that is normally energized with one that is not.

SR 4.3.3.5.2 verifies each required Remote Shutdown System control circuit and transfer switch performs the intended function. This verification is performed from the remote shutdown panel and locally, as appropriate. Operation of the equipment from the remote shutdown panel is not necessary.

The Surveillance can be satisfied by performance of a continuity check. This will ensure that ifthe control room becomes inaccessible, the unit can be placed and maintained in MODE 3 from the remote shutdown panel and the local control stations. The frequency specified in the Surveillance Frequency

• Control Program is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. (However, this Surveillance is not required to be performed only during a unit outage.) Operating experience demonstrates that remote shutdown control channels usually pass the Surveillance test when performed at a frequency found in the Surveillance Frequency Control Program.

SR 4.3.3.5.3 requires a CHANNEL CALIBRATION,;which is a complete check of the instrument loop and the sensor. The frequency specified in the Surveillance Frequency Control Program is based upon operating experience and consistency with the typical industry refueling cycle.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 3-4b Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

INSTRUMENTATION BASES 3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continuedl ACTION 40.a. requires restoration within 30 days ifa channel of steam line radiation monitoring or steam generator blowdown line radiation monitoring is inoperable, provided there is functional diverse channel. If the channel cannot be restored in the 30 days, a report must be submitted to the NRC outlining the preplanned alternate method of monitoring, the cause of the inoperability, and the plans and schedule for restoring the instrumentation channel to OPERABLE status. The steam line radiation monitor and the steam generator blowdown radiation monitor are considered to be functionally redundant to one another. The allowed outage time and required action are acceptable based on operating experience, the low likelihood of an event requiring the function, the available functionally redundant channel, and the pre-planned actions defined before loss of function.

ACTION 40.b. requires restoration within 7 days ifa channel of steam line radiation monitoring or steam generator blowdown line radiation monitoring is inoperable, and there is no functional diverse channel. If the channel cannot be restored in the 7 days, a report must be submitted to the NRC. The allowed outage time of 7days is based on the relatively low probability of an event requiring instrument operation and the availability of alternate means to obtain the required information. Prompt restoration of the channel is expected because the alternate indications may not fully meet all performance qualification requirements applied to the instrumentation. Therefore, requiring restoration of one inoperable channel of the function limits the risk that the function will be in a degraded condition should an accident occur.

STP's procedure for monitoring primary to secondary leakage is the pre-planned alternate method that will be implemented for this ACTION.

3/4.3.3.7 NOT USED 3/4.3.3.8 NOT USED 3/4.3.3.9 NOT USED 3/4.3.3.10 NOT USED 3/4.3.3.11 NOT USED 3/4.3.4 NOT USED 3/4.3.5 ATMOSPHERIC STEAM RELIEF VALVE INSTRUMENTATION The atmospheric steam relief valve manual controls must be OPERABLE in Modes 1, 2, 3, and 4 (Mode 4 when steam generators are being used for decay heat removal) to allow operator action needed for decay heat removal and safe cooldown in accordance with Branch Technical Position RSB 5-1.

The atmospheric steam relief valve automatic controls must be OPERABLE with a nominal setpoint of 1225 psig in Modes 1 and 2 because the safety analysis assumes automatic operation of the atmospheric steam relief valves with a nominal setpoint of 1225 psig with uncertainties for mitigation of the small break LOCA. In order to support startup and shutdown activities (including post-refueling low power physics testing), the atmospheric steam relief valves may be operated in manual and open, or in automatic operation, in Mode 2 to maintain the secondary side pressure at or below an indicated steam generator pressure of 1225 psig.

The uncertainties in the safety analysis assume a channel calibration on each atmospheric steam relief valve automatic actuation channel, including verification of automatic actuation at the nominal 1225 psig setpoint, at a frequency found in the Surveillance Frequency Control Program.

SOUTH TEXAS -UNITS 1 & 2 B 3/4 3-7 Unit 1 -Amendment No. 08-9098-11 Unit 2 -Amendment No. 08-9098-11

REACTOR COOLANT SYSTEM BASES REACTOR COOLANT LOOPS and COOLANT CIRCULATION (continued )

APPLICABILITY In MODE 5 with the loops not filled, this LCO is applicable to prevent an inadvertent boron dilution event by ensuring isolation of all sources of unborated water to the RCS.

ACTIONS The ACTIONS section allows separate ACTION entry for each unsecured unborated water source isolation valve or mechanical joint used for Isolation.

Continuation of reactivity control activities is contingent upon maintaining the unit in compliance with this LCO. With any valve or mechanical joint used to isolate unborated water sources not secured in the closed position, all operations involving that could reduce the boron concentration of the RCS below the SHUTDOWN MARGIN must be suspended immediately. The Completion Time of "immediately" for performance of the required action shall not preclude completion of movement of a component to a safe position.

The required action to confirm the boron concentration is within limit is required to be completed whenever ACTION c. is entered.

Preventing inadvertent dilution of the reactor coolant boron concentration is dependent on maintaining the unborated water isolation devices secured closed. Securing the valves or mechanical joints in the closed position ensures that the devices cannot be inadvertently opened. The Completion Time of "immediately" requires an operator to initiate actions to close an open valve or mechanical joint and secure the isolation device in the closed position immediately. Once actions are initiated, they must be continued until the devices are secured in the closed position.

Due to the potential of having diluted the boron concentration of the reactor coolant, verification of boron concentration must be performed whenever ACTION c is entered to demonstrate that the required boron concentration exists. The Completion Time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is sufficient to obtain and analyze a reactor coolant sample for boron concentration.

SURVEILLANCE REQUIREMENTS SR 4.4.1.4.2.2 These valves or mechanical joints are to be secured closed to isolate possible dilution paths. The likelihood of a significant reduction in the boron concentration during MODE 5 with the loops not filled is remote due to the fact that all unborated water sources are Isolated, precluding a dilution. This Surveillance demonstrates that the devices are closed through a system walkdown. The frequency specified in the Surveillance Frequency Control Program is based on engineering judgment and is considered reasonable in view of other administrative controls that will ensure that the device opening is an unlikely possibility.

REFERENCES

1. UFSAR, Section 15.4.6

2. NUREG-0800, Section 15.4.6 3/4.4.2 SAFETY VALVES The pressurizer Code safety valves operate to prevent the RCS from being pressurized above its Safety Limit of 2735 psig. Each safety valve is designed to relieve 504,950 lbs. per hour of saturated steam at the valve setpoint of 2500 psia.

SOUTH TEXAS - UNITS 1 &2 B 3/4 4-1b Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

REACTOR COOLANT SYSTEM BASES REACTOR COOLANT LOOPS and COOLANT CIRCULATION (continued)

APPLICABILITY In MODE 5 with the loops not filled, this LCO is applicable to prevent an inadvertent boron dilution event by ensuring isolation of all sources of unborated water to the RCS.

ACTIONS The ACTIONS section allows separate ACTION entry for each unsecured unborated water source isolation valve or mechanical joint used for isolation.

Continuation of reactivity control activities is contingent upon maintaining the unit in compliance with this LCO. With any valve or mechanical joint used to isolate unborated water sources not secured in the closed position, all operations involving that could reduce the boron concentration of the RCS below the SHUTDOWN MARGIN must be suspended immediately. The Completion Time of "immediately" for performance of the required action shall not preclude completion of movement of a component to a safe position.

The required action to confirm the SHUTDOWN MARGIN is within limit is required to be completed whenever ACTION c. is entered.

Preventing inadvertent dilution of the reactor coolant boron concentration is dependent on maintaining the unborated water isolation devices secured closed. Securing the valves or mechanical joints in the closed position ensures that the devices cannot be inadvertently opened. The Completion Time of "immediately" requires an operator to initiate actions to close an open valve or mechanical joint and secure the isolation device in the closed position immediately. Once actions are initiated, they must be continued until the devices are secured in the closed position.

Due to the potential of having diluted the boron concentration of the reactor coolant, verification of the SHUTDOWN MARGIN must be performed whenever ACTION c is entered to demonstrate that the required boron concentration exists. The Completion Time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is sufficient to obtain and analyze a reactor coolant sample for boron concentration.

SURVEILLANCE REQUIREMENTS SR 4.4.1.4.2.2 These valves or mechanical joints are to be secured closed to isolate possible dilution paths. The likelihood of a significant reduction in the boron concentration during MODE 5 with the loops not filled is remote due to the fact that all unborated water sources are isolated, precluding a dilution. This Surveillance demonstrates that the devices are closed through a system walkdown.

The 31 day Frequency is based on engineering judgment and is considered reasonable in view of other administrative controls that will ensure that the device opening is an unlikely possibility.

REFERENCES

1. UFSAR, Section 15.4.6

2. NUREG-0800, Section 15.4.6 3/4.4.2 SAFETY VALVES The pressurizer Code safety valves operate to prevent the RCS from being pressurized above its Safety Limit of 2735 psig. Each safety valve is designed to relieve 504,950 lbs. per hour of saturated steam at the valve setpoint of 2500 psia.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 4-1b Unit 1 - Amendment No. 02-1-0364 187 Unit 2- Amendment No. 02-10364 174

REACTOR COOLANT SYSTEM BASES SAFETY VALVES (Continued)

During Modes 1, 2, and 3, all pressurizer Code safety valves must be OPERABLE to prevent the RCS from being pressurized above its Safety Limit of 2735 psig. The combined relief capacity of all of these valves is greater than the maximum surge rate resulting from a complete loss-of-load assuming no Reactor trip until the first Reactor Trip System Trip Setpoint is reached (i.e., no credit is taken for a direct Reactor trip on the turbine trip resulting from loss-of-load) and also assuming no operation of the power operated relief valves or steam dump valves.

Demonstration of the safety valves' lift settings will occur only during shutdown and will be performed in accordance with the provisions of Section XI of the ASME Boiler and Pressure Code.

3/4.4.3 PRESSURIZER The surveillance is at a frequency found in the Surveillance Frequency Control Program sufficient to ensure that the parameter is restored to within its limit following expected transient operation. The maximum water volume also ensures that a steam bubble is formed and thus the RCS is not a hydraulically solid system. The requirement that a minimum number of pressurizer heaters be OPERABLE enhances the capability of the plant to control Reactor Coolant System pressure and establish natural circulation. The need to maintain subcooling in the long term during loss of offsite power, as indicated in NUREG-0737, is the reason for providing an LCO. The heaters have an automatic actuation feature for pressure control. The accident analysis conservatively considers the potential adverse effects of this -feature. However, automatic actuation is not credited for mitigation in the accident analysis and is not required for operability.

314.4.4. RELIEF VALVES The power-operated relief valves (PORVs) and steam bubble function to relief RCS pressure during all design transients up to and including the design step load decrease with steam dump. Operation of the PORVs minimizes the undesirable opening of the spring-loaded pressurizer Code safety valves. Each PORV has a remotely operated block valve to provide a positive shutoff capability should a relief valve become inoperable.

The OPERABILITY of the PORVs and block valves is determined on the basis of their being capable of performing the following functions:

A. Manual control of PORVs is used to control reactor coolant system pressure, This is a function that is used for the steam generator tube rupture accident and for plant shutdown.

Manual control of PORVs is a safety related function.

B. Maintaining the integrity of the reactor coolant pressure boundary. This is a function that is related to controlling identified leakage and ensuring the ability to detect unidentified reactor coolant pressure boundary- leakage.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 4-2 Unit 1 - Amendment No. ,9 08-9098-11 Unit 2 - Amendment No. 4468, 08-9098-11

REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued)

The Note in 4.4.6.2.1 states that this Surveillance Requirement is not applicable to primary-to-secondary leakage. This is because leakage of 150 gpd cannot be measured accurately by a RCS water inventory balance.

The frequency specified in the Surveillance Frequency Control Program is a reasonable interval to trend leakage and recognizes the importance of early leakage detection in the prevention of accidents.

4.4.6.2.2 The Surveillance Requirements for Reactor Coolant System Pressure Isolation Valves provide added assurance of valve integrity thereby reducing the probability of gross valve failure and consequent intersystem LOCA. Leakage from the RCS pressure isolation valve is IDENTIFIED LEAKAGE and will be considered as a portion of the allowed limit.

4.4.6.2.3 - This Surveillance Requirement verifies that primary-to-secondary leakage is less than or equal to *150gpd through any one steam generator. Satisfying the primary-to-secondary leakage limit ensures that the operational leakage performance criterion in the Steam Generator Program is met. If this Surveillance Requirement is not met, compliance with LCO 3.4.5 should be evaluated. The 150-gpd limit is measured at room temperature as described in Reference 1. The operational leakage rate limit applies to leakage through any one steam generator. If it is not practical to assign the leakage to an individual steam generator, all the primary-to-secondary leakage should be conservatively assumed to be from one steam generator.

The Surveillance Requirement is modified by a Note, which states that the Surveillance is not required to be performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after establishment of steady state operation. For Reactor

Coolant System primary-to-secondary leakage determination, steady state is defined as stable Reactor Coolant System pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and reactor coolant pump seal injection and return flows.

The frequency specified in the Surveillance Frequency Control Program is a reasonable interval to trend primary-to-secondary leakage and recognizes the importance of early leakage detection in the prevention of accidents. During normal operation the primary-to-secondary leakage is determined using continuous process radiation monitors or radiochemical grab sampling. In MODES 3 and 4, the primary system radioactivity level may be very low, making it difficult to measure primary-to-secondary leakage. Leakage verification is provided by chemistry procedures that provide alternate means of calculating and confirming primary-to-secondary leakage is less than or equal to 150 gpd through any one SG (Ref. 2).

References

1. NEI 97-06, "Steam Generator Program Guidelines"

2. EPRi TR-104788, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines" 3/4.4.7 NOT USED SOUTH TEXAS - UNITS 1 & 2 B 3/4 4-4d Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

3/4.5 EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.1 ACCUMULATORS The OPERABILITY of each Reactor Coolant System (RCS) accumulator ensures that a sufficient volume of borated water will be immediately forced into the reactor core through three cold legs in -the event the RCS pressure falls below the pressure of the accumulators. This initial surge of water into the core provides the initial cooling mechanism during large RCS pipe ruptures.

If one accumulator is inoperable for a reason other than boron concentration, the accumulator must be returned to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In this Condition, the required contents of two accumulators cannot be assumed to reach the core during a LOCA. The 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> minimizes the potential for exposure of the plant to a LOCA under these conditions. The CRMP may be applied to extend the allowed outage time.

If the boron concentration of one accumulator is not within limits, it must be returned to within the limits within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, ability to maintain subcriticality or minimum boron precipitation time may be reduced. The boron in the accumulators contributes to the assumption that the combined ECCS water in the partially recovered core during the early reflooding phase of a large break LOCA is sufficient to keep that portion of the core subcritical. One accumulator below the minimum boron concentration limit, however, will have no effect on available ECCS water and an insignificant effect on core subcriticality during reflood. Boiling of ECCS water in the core during reflood concentrates boron in the saturated liquid that remains in the core. In addition, current analysis techniques demonstrate that the accumulators do not discharge following a large main steam line break, for the majority of plants. Even ifthey do discharge, their impact is minor and not a design limiting event. Thus, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is allowed to return the boron concentration to within limits.

The surveillance limits on accumulator volume represent a spread about an average value used in the safety analysis and have been demonstrated by sensitivity studies to vary the peak clad temperature by less than 20 0 F. The surveillance limit on accumulator pressure ensures that the assumptions used for accumulator injection in the safety analysis are met.

The boron concentration should be verified to be within required limits for each accumulator at a frequency found in the Surveillance Frequency Control Program since the static design of the.

accumulators limits the ways in which the concentration can be changed. The frequency specified in the Surveillance Frequency Control Program is adequate to identify changes that could occur from mechanisms such as stratification or inleakage. Sampling the affected accumulator within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after a 1% volume increase will identify whether inleakage has caused a reduction in boron concentration to below the required limit. It is not necessary to verify boron concentration if the added water inventory is from the refueling water storage tank (RWST), because the water contained in the RWST iswithin the accumulator boron concentration requirements SOUTH TEXAS - UNITS 1 & 2 B 3/4 5-1 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.1 ACCUMULATORS (Continued)

Verification at a frequency found in the Surveillance Frequency Control Program that power is removed from, each accumulator isolation valve operator when the pressurizer pressure is >1000 psig ensures that an active failure could not result in the undetected closure of an accumulator motor operated isolation valve. If this were to occur, only one accumulator would be available for injection given a single failure coincident with a LOCA. Since power is removed under administrative control, the frequency specified in the Surveillance Frequency Control Program will provide adequate assurance that power is removed.

This SR allows power to be supplied to the motor operated isolation valves when pressurizer pressure is < 1000 psig, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during plant startups or shutdowns.

3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS The OPERABILITY of three independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure 'consideration. Each subsystem operating in conjunction with the accumulators is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double ended break of the largest RCS cold leg pipe downward. One.ECCS is assumed to discharge-completely through the postulated break in the RCS loop. Thus, three trains are required to satisfy the single failure criterion.

Note that the Centrifugal charging pumps are not part of ECCS and that the RHR. pumps are not used in the injection phase of the ECCS. Each ECCS subsystem and the RHR pumps and heat exchanges provide long-term core cooling capability in the recirculation mode during the accident recovery period.

When the RCS temperature is below 3500 F, the ECCS requirements are balanced between the limitations imposed by the low temperature overpressure protection and the requirements necessary to mitigate the consequences of a LOCA below 3500 F. At these temperatures, single failure considerations are not required because of the stable reactivity condition of the reactor and the limited core cooling requirements. Only a single Low Head Safety Injection pump is required to mitigate the effects of a large-break LOCA in this mode. However, two are provided to accommodate the possibility that the break occurs in a loop containing one of the Low Head pumps. Low Head Safety Injection pumps are not required to be rendered inoperable below 350OF because their shutoff head is too low to

.impact the low temperature overpressure protection limits.

In Mode 4 with an, RHR train, in service, an LHSI train is considered operable if the only impact to its operability is the associatedRHR train in service (i.e., heat exchanger bypass valves not fully closed, heat exchanger outlet valve not fully open).

Below 2000 F (MODE 5) no ECCS pumps are required, so the High Head Safety Injection pumps are locked out to prevent cold overpressure.

SOUTH TEXAS - UNITS 1 & 2 B13/4 5-2 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

PLANT SYSTEMS BASES 3/4.7.3 COMPONENT COOLING WATER SYSTEM The OPERABILITY of the Component Cooling Water System ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.

3/4.7.4 ESSENTIAL COOLING WATER SYSTEM The OPERABILITY of the Essential Cooling Water (ECW) System ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. The ECW self-cleaning strainer must be in service and functional in order for the respective ECW train to be OPERABLE. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.

When a risk-important system or component (for example ECW) is taken out of service, it is important to assure that the impact on plant risk of this and other equipment simultaneously taken out of service is assessed. The Configuration Risk Management Program evaluates the impact on plant risk of equipment out of service.

SURVEILLANCE REQUIREMENTS SR 4.7.4.a Verifying the correct alignment for manual, power operated, and automatic valves in the ECW flow path provides assurance that the proper flow paths exist for ECW operation. This SR applies to valves that assure ECW flow to required safety related equipment (to CCW heat exchangers, Standby Diesel Generators, Essential Chillers, and CCW Pump Supplemental Coolers). This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to being locked, sealed, or secured. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The frequency specified in the Surveillance Frequency Control Program is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-3a Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

PLANT SYSTEMS BASES SURVEILLANCE REQUIREMENTS (cont.)

SR 4.7.4.b.1 This SR verifies proper automatic operation of the ECW valves on an actual or simulated actuation signal. The relevant signals for the surveillance are safety-injection and loss of offsite power.

The ECW is a normally operating system that cannot be fully actuated as part of normal testing. This SR applies to valves that assure ECW flow to required safety related equipment (to CCW heat exchangers, Standby Diesel Generators, Essential Chillers, and CCW Pump Supplemental Coolers).

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The frequency specified in the Surveillance Frequency Control Program is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at a frequency found in the Surveillance Control Program. Therefore, the Frequency is acceptable from a reliability standpoint.

SR 4.7.4.b.2 This SR verifies proper automatic operation of the ECW pumps on an actual or simulated actuation signal. The relevant signals for the surveillance are safety-injection and loss of offsite power.The ECW system is a normally operating system that cannot be fully actuated as part of normal testing during normal operation. The frequency specified in the Surveillance Frequency Control Program is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient ifthe Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the frequency specified in the Surveillance Frequency Control Program. Therefore, the Frequency is acceptable from a reliability standpoint.

3/4.7.5 ULTIMATE HEAT SINK The limitations on the ultimate heat sink level and temperature ensure that sufficient cooling capacity is available either: (1) provide normal cooldown of the facility or (2) mitigate the effects of accident conditions within acceptable limits.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-3b Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

PLANT SYSTEMS BASES The limitations on minimum water level and maximum temperature are based on providing a 30-day cooling water supply to safety-related equipment without exceeding its design basis temperature and is consistent with the recommendations of Regulatory Guide 1.27, "Ultimate Heat Sink for Nuclear Plants," March 1974.

314.7.6 (NOT USED) 3/4.7.7 CONTROL ROOM MAKEUP AND CLEANUP FILTRATION SYSTEM The Control Room. Makeup and Filtration System. is comprised of three 50-percent redundant systems (trains) that share a common intake plenum and exhaust plenum. Each system/train is comprised of a makeup fan, a makeup filtration unit, a cleanup filtration unit, a cleanup fan, a control room air handling unit, a supply fan, a return fan, and associated ductwork and dampers.

Two of the three 50% design capacity trains are required to be operable during the following modes of operation: shutdown, hot standby, normal operation, postulated accident condition, and loss of offsite power. The toilet kitchen exhaust, heating, and computer room HVAC Subsystem associated with the Control Room Makeup and Filtration System are nonsafety-related and not required for operability.

The OPERABILITY of the Control Room Makeup and Cleanup Filtration System ensures that' (1) the ambient air temperature does not exceed the allowable temperature for continuous-duty rating for the equipment and instrumentation cooled'by this system, and (2) the control room will remain habitable for operations personnel during and following most credible accident conditions.

Operation of the system with the heaters operating for at least 10 continuous hours in a 92-day period is sufficient to reduce the buildup of moisture on the adsorbers and HEPA filters. The OPERABILITY of this system in conjunction with control room design provisions is based on limiting the radiation exposure to personnel occupying the control room to 5 rem total effective dose equivalent (TEDE). This limitation is consistent with the requirements of General Design Criterion 19 of Appendix A, 10 CFR Part 50. ANSI N510-1980 will be used as a procedural guide for surveillance testing.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-4 Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

PLANT SYSTEMS BASES The limitations on minimum water level and maximum temperature are based on providing a 30-day cooling water supply to safety-related equipment without exceeding its design basis temperature and is consistent with the recommendations of Regulatory Guide 1.27, "Ultimate Heat Sink for Nuclear Plants," March 1974.

3/4.7.6 (NOT USED) 3/4.7.7 CONTROL ROOM MAKEUP AND CLEANUP FILTRATION SYSTEM The Control Room Makeup and Filtration System is comprised of three 50-percent redundant systems (trains) that share a common intake plenum and exhaust plenum. Each system/train is comprised of a makeup fan, a makeup filtration unit, a cleanup filtration unit, a cleanup fan, a control room air handling unit, a supply fan, a return fan, and associated ductwork and dampers. Two of the three 50% design capacity trains are required to be operable during the following modes of operation:

shutdown, hot standby, normal operation, postulated accident condition, and loss of offsite power.

The toilet kitchen exhaust, heating, and computer room HVAC Subsystem associated with the Control Room Makeup and Filtration System are non safety-related and not required for operability.

The OPERABILITY of the Control Room Makeup and Cleanup Filtration System ensures that: (1) the ambient air temperature does not exceed the allowable temperature for continuous-duty rating for the equipment and instrumentation cooled by this system, and (2) the control room will remain habitable for operations personnel during and following most credible accident conditions. Operation of the system with the heaters operating for at least 10 continuous hours in a 92-day period is sufficient to reduce the buildup of moisture on the adsorbers and HEPA filters. The OPERABILITY of this system in conjunction with control room design provisions is based on limiting the radiation exposure to personnel occupying the control room to 5 rem total effective dose equivalent (TEDE). This limitation is consistent with the requirements of General Design Criterion 19 of Appendix A, 10 CFR Part 50.

ANSI N510-1980 will be used as a procedural guide for surveillance testing.

There is no automatic actuation or Surveillance Requirements of the Control Room Makeup and Cleanup Filtration System for toxic gas or smoke because the analysis for the South Texas Project has determined no actuation is required.

The accidents postulated to occur during core alterations, in addition to the fuel handling accident, are: inadvertent criticality (due to a control rod removal error or continuous rod withdrawal error during refueling or boron dilution) and the inadvertent loading, of, and subsequent operation with, a fuel assembly in an improper location. These events are not postulated to result in fuel cladding integrity damage. Since the only accident to occur during CORE ALTERATIONS that results in a significant radioactive release is the fuel handling accident and the accident mitigation features of the Control Room Makeup and Cleanup Filtration System are not credited in the accident analysis for a fuel handling accident, there are no OPERABILITY requirements for this system in MODES 5 and 6.

The time limits associated with the ACTIONS to restore an inoperable train to OPERABLE status are consistent with the redundancy and capability of the system and the low probability of a design basis accident while the affected train(s) is out of service. A limited allowed outage time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is allowed for all three trains to be out of service simultaneously in recognition of the fact that there are common plenums and some maintenance or testing activities require opening or entry into these common plenums, This time is reasonable to diagnose, plan, and possibly repair problems with the SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-4 Unit 1 - Amendment No. 08-9098-7 Unit 2 - Amendment No. 08-9098-7

PLANT SYSTEMS BASES The time limits associated with the ACTIONS to restore an inoperable train to OPERABLE status are consistent with the redundancy and capability of the system and the low probability of a design basis accident while the affected train(s) is out of service. A limited allowed outage time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is allowed for all three trains to be out of service simultaneously in recognition of the fact that there are common plenums and some maintenance or testing activities required opening or entry into these common plenums. This time is reasonable to diagnose, plan, and possibly repair problems with the boundary or the ventilation system. This is acceptable based on the low probability of a design basis event in that brief allowed outage time and because administrative controls impose compensatory actions that reduce the already small risk associated with being in the ACTION. The compensatory actions are consistent with the intent of GDC 19 to protect plant personnel from potential hazards such as radioactive contamination, smoke, and temperature, etc. Pre-planned measures should be available to address these concerns for intentional and unintentional entry into the condition. The compensatory actions include:

• Procedures will preclude intentionally removing multiple trains of Control Room Envelope HVAC from service if Containment Spray is not functional or intentionally making a train of Containment Spray unavailable when multiple trains of Control Room Envelope HVAC are out of service. For purposes of this compensatory action, Containment Spray is considered functional if at least one train can be manually or automatically initiated.

The plant will not make planned simultaneous entries into TS 3.7.7 ACTION c. for MODES 1, 2, 3 and 4 and TS 3.7.8 ACTION b or d.

The compensatory action may include placing fans in pull-to-lock as necessary to preclude there being a motive force to transport contaminated air to a clean environment in the event of an accident. These compensatory actions also include administrative controls on opening plenums or other openings such that appropriate communication is established with the control room to assure timely closing of the system if necessary. Since the Control Room Envelope boundary integrity also affects operability of the overall system, entry and exit is administratively controlled. Administrative control of entry and exit through doors is performed by the persons) entering or exiting the area. Extended opening of the boundary is coordinated with the control room with appropriate plans for closure and communication.

The TS 3.7.7 cooling function is modeled in the PRA and a RICT can be calculated for an inoperable train of CRHVAC cooling. The dose mitigation function is not modeled in the PRA because it has no effect on core damage frequency or large early release frequency. Consequently, there is no technical basis for calculating a RICT for an inoperable condition involving the dose mitigation function and the basis for application of the CRMP to TS 3.7.7 is that it will only be applied to the cooling function.

Although ACTIONs a, b, and c all include the option of calculating a risk-informed completion time (RICT) in accordance with the requirements of the CRMP, application of the CRMP is currently permitted only for ACTION a because STPNOC determined that application of the CRMP to TS 3.7.7 ACTION b or ACTION c would be to extend the time to restore the required redundancy for the dose mitigation function, which would not be permitted under the licensing basis. STPNOC evaluations show that with a train of CRHVAC in TS 3.7.7 Action a for loss of cooling (associated train of EW or EChW is inoperable),

the system is capable of meeting its dose mitigation function, including the ability to withstand a single failure of a train providing pressurization/filtration or a train providing cooling in support of filter efficiency despite the unavailability of the train in maintenance. Postulation of a single failure while in the action statement is used to demonstrate that the CRMP is being applied for the cooling function and is not being applied to extend the allowed outage time to restore necessary redundancy for the required dose mitigation function. Therefore, application of the CRMP to TS 3.7.7 Action a for one inoperable train of CRHVAC is permissible.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-5 Unit 1 - Amendment No. 08-9098-2 Unit 2 - Amendment No. 08-9098-2

PLANT SYSTEMS BASES The accidents postulated to occur during core alterations, in addition to the fuel handling accident, are:

inadvertent criticality (due to a control rod removal error or continuous rod withdrawal error during refueling or boron dilution) and the inadvertent loading of, and subsequent operation with, a fuel assembly in an improper location. These events are not postulated to result in fuel cladding integrity damage. Since the only accident to occur during CORE ALTERATIONS that results in a significant radioactive release is the fuel handling accident and the accident mitigation features of the Control Room Makeup and Cleanup Filtration System are not credited in the accident analysis for a fuel handling accident, there are no OPERABILITY requirements for this system in MODES 5 and 6.

The time limits associated with the ACTIONS to restore an inoperable train to OPERABLE status are consistent with the redundancy and capability of the system and the low probability of a design basis accident while the affected train(s) is out of service. A limited allowed outage time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is allowed for all three trains to be out of service simultaneously in recognition of the fact that there are common plenums and some maintenance or testing activities required opening or entry into these common plenums. This time is reasonable to diagnose, plan, and possibly repair problems with the boundary or the ventilation system. This is acceptable based on the low probability of a design basis event in that brief allowed outage time and because administrative controls impose compensatory actions that reduce the already small risk associated with being in the ACTION. The compensatory actions are consistent with the intent of GDC 19 to protect plant personnel from potential hazards such as radioactive contamination, smoke, and temperature, etc. Pre-planned measures should be available to address these concerns for intentional and unintentional entry into the condition. The compensatory actions include:

• Procedures will preclude intentionally removing multiple trains of Control Room Envelope HVAC from service if Containment Spray is not functional or intentionally making a train of Containment Spray unavailable when multiple trains of Control Room Envelope HVAC are out of service. For purposes of this compensatory action, Containment Spray is considered functional if at least one train can be manually or automatically initiated.

The compensatory action may include placing fans in pull-to-lock as necessary to preclude there being a motive force to transport contaminated air to a clean environment in the event of an accident. These compensatory actions also include administrative controls on opening plenums or other openings such that appropriate communication is established with the control room to assure timely closing of the system if necessary. Since the Control Room Envelope boundary integrity also affects operability of the overall system, entry and exit is administratively controlled.

Administrative control of entry and exit through doors is performed by the persons entering or exiting the area. Extended opening of the boundary is coordinated with the control room with appropriate plans for closure and communication.

The TS 3.7.7 cooling function is modeled in the PRA and a RICT can be calculated for an inoperable train of CRHVAC cooling. The dose mitigation function is not modeled in the PRA because it has no effect on core damage frequency or large early release frequency.

Consequently, there is no technical basis for calculating a RICT for an inoperable condition SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-5 Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

PLANT SYSTEMS BASES the boundary or the ventilation system. This is acceptable based on the low probability of a design basis event in that brief allowed outage time and because administrative controls impose compensatory actions that reduce the already small risk associated with being in the ACTION. The compensatory actions are consistent with the intent of GDC 19 to protect plant personnel from potential hazards such as radioactive contamination, smoke, and temperature, etc. Pre-planned measures should be available to address these concerns for intentional and unintentional entry into the condition. The compensatory actions include:

Procedures will preclude intentionally removing multiple trains of Control Room Envelope HVAC from service if Containment Spray is not functional or intentionally making a train of Containment Spray unavailable when multiple trains of Control Room Envelope HVAC are out of service. For purposes of this compensatory action, Containment Spray is considered functional if at least one train can be manually or automatically initiated.

The compensatory action may include placing fans in pull-to-lock as necessary to preclude there being a motive force to transport contaminated air to a clean environment in the event of an accident. These compensatory actions also include administrative controls on opening plenums or other openings such that appropriate communication is established with the control room to assure timely closing of the system if necessary. Since the Control Room Envelope boundary integrity also affects operability of the overall system, entry and exit is administratively controlled. Administrative control of entry and exit through doors is performed by the persons entering or exitingthe area.

Extended opening of the boundary is coordinated with the control room with appropriate plans for closure and communication.

The TS 3.7.7 cooling function is modeled in the PRA and a RICT can be calculated for an inoperable train of CRHVAC cooling. The dose mitigation function is not modeled in the PRA because it has no effect on core damage frequency or large early release frequency. Consequently, there is no technical basis for calculating a RICT for an inoperable condition involving the dose mitigation function and the basis for application of the CRMP to TS 3.7.7 is that it will only be applied to the cooling function.

Although ACTIONs a, b, and c all include the option of calculating a risk-informed completion time (RICT) in accordance with the requirements of the CRMP, application of the CRMP is currently permitted only for ACTION a because STPNOC determined that application of the CRMP to TS 3.7.7 ACTION b or ACTION c would be to extend the time to restore the required redundancy for the dose mitigation function, which would not be permitted under the licensing basis. STPNOC evaluations show that with a train of CRHVAC in TS 3.7.7 Action a for loss of cooling (associated train of EW or EChW is inoperable), the system is capable of meeting its dose mitigation function, including the ability to withstand a single failure of a train providing pressurization/filtration or a train providing cooling in support of filter efficiency despite the unavailability of the train in maintenance. Postulation of a single failure while in the action statement is used to demonstrate that the CRMP is being applied for the cooling function and is not being applied to extend the allowed outage time to restore necessary redundancy for the required dose mitigation function. Therefore, application of the CRMP to TS 3.7.7 Action a for one inoperable train of CRHVAC is permissible.

The option to apply the CRMP to TS 3.7.7 ACTION a applies only to the cooling function of the system supported by the Essential Chilled Water System (EchW) (TS 3.7.14) and may not be applied for conditions that affect the operability of the system with respect to dose mitigation (i.e. CRHVAC train inoperable due to inoperable fan or damper). In cases where both functions are affected (e.g., an inoperable damper or Make-up, Clean-up, Supply,or Return Fan) the dose mitigation function determines compliance and the "frontstop" completion time may not be exceeded.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-5 Unit 1 - Amendment No. 08-9098-7 Unit 2 - Amendment No. 08-9098-7

PLANT SYSTEMS BASES The option to apply the CRMP to TS 3.7.7 ACTION a applies only to the cooling function of the system supported by the Essential Chilled Water System (EchW) (TS 3.7.14) and may not be applied for conditions that affect the operability of the system with respect to dose mitigation (i.e. CRHVAC train inoperable due to inoperable fan or damper). In cases where both functions are affected (e.g., an inoperable damper or Make-up, Clean-up, Supply,or Return Fan) the dose mitigation function determines compliance and the "frontstop" completion time may not be exceeded.

Surveillance Requirement 4.7.7.e.3 verifies the integrity of the control room enclosure, and the assumed inleakage rates of the potentially contaminated air. The control room positive pressure, with respect to potentially contaminated adjacent areas, is periodically tested to verify proper functioning of the Control Room HVAC. During the emergency mode of operation, the Control Room HVAC is designed to pressurize the control room to at least 1/8 inch water gauge (in-wg) positive pressure with respect to adjacent areas in order to prevent unfiltered inleakage. The Control Room HVAC is designed to maintain this positive pressure with two trains at a makeup flow rate of 2000 cfm. The frequency of 18 months is consistent with the guidance provided in NUREG-0800. If the surveillance results are less than 1/8 in-wg and the pressure differential is not positive, the surveillance requirement is considered not met and the appropriate action of TS 3.7.7 must be applied.

The footnote for Technical Specification Surveillance Requirement 4.7.7.e.3 has expired and is no longer applicable.

3/4.7.8 FUEL HANDLING BUILDING EXHAUST AIR SYSTEM The FHB exhaust air system is comprised of two independent exhaust air filter trains and three exhaust ventilation trains. Each of the three exhaust ventilation trains has a main exhaust fan, an exhaust booster fan, and associated dampers. The main exhaust, fans share a common plenum and the exhaust booster fans share a common plenum. An OPERABLE ventilation exhaust train consists of any OPERABLE main exhaust fan, any OPERABLE exhaust booster fan, and appropriate dampers.

The OPERABILITY of the Fuel Handling Building Exhaust Air System ensures that radioactive materials leaking from the ECCS equipment within the FHB following a LOCH are filtered prior to reaching the environment. Operation of the system with the heaters operating for the least 10 continuous hours in a 31-day period is sufficient to reduce the buildup of moisture on the adsorbers and HEPA filters. The operation of this system and the resultant effect on off site dosage calculations was assumed in the safety analyses. ANSI N51 0-1980 will be used as a procedural guide for surveillance testing.

The time limits associated with the ACTIONS to restore an inoperable train to OPERABLE status are.

consistent with the redundancy and capability of the system and the low probability of a design basis accident while the affected trains) is out of service. The allowed outage time for one train of FHB exhaust ventilation or one exhaust filtration train being inoperable, or a combination of an inoperable exhaust ventilation train and an inoperable exhaust filtration train is 7 days. With more than one inoperable train of either FHB exhaust filtration or FHB exhaust ventilation, or with combinations involving more than one inoperable train of either the exhaust ventilation or the exhaust filtration, the SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-6 Unit 1 - Amendment No. 06-9821-8 Unit 2 - Amendment No. 06-9821-8

PLANT SYSTEMS BASES involving the dose mitigation function and the basis for application of the CRMP to TS 3.7.7 is that it will only be applied to the cooling function.

Although ACTIONs a, b, and c all include the option of calculating a risk-informed completion time (RICT) in accordance with the requirements of the CRMP, application of the CRMP is currently permitted only for ACTION a because STPNOC determined that application of the CRMP to TS 3.7.7 ACTION b or ACTION c would be to extend the time to restore the required redundancy for the dose mitigation function, which would not be permitted under the licensing basis. STPNOC evaluations show that with a train of CRHVAC in TS 3.7.7 Action a for loss of cooling (associated train of EW or EChW is inoperable),

the system is capable of meeting its dose mitigation function, including the ability to withstand a single failure of a train providing pressurization/filtration or a train providing cooling in support of filter efficiency despite the unavailability of the train in maintenance. Postulation of a single failure while in the action statement is used to demonstrate that the CRMP is being applied for the cooling function and is not being applied to extend the allowed outage time to restore necessary redundancy for the required dose mitigation function. Therefore, application of the CRMP to TS 3.7.7 Action a for one inoperable train of CRHVAC is permissible.

The option to apply the CRMP to TS 3.7.7 ACTION a applies only to the cooling function of the system supported by the Essential Chilled Water System (EchW) (TS 3.7.14) and may not be applied for conditions that affect the operability of the system with respect to dose mitigation (i.e. CRHVAC train inoperable due to inoperable fan or damper). In cases where both functions are affected (e.g., an inoperable damper or Make-up, Clean-up, Supply,or Return Fan) the dose mitigation function determines compliance and the "frontstop" completion time may not be exceeded.

Surveillance Requirement 4.7.7.e.3 verifies the integrity of the control room enclosure, and the assumed inleakage rates of the potentially contaminated air. The control room positive pressure, with respect to potentially contaminated adjacent areas, is periodically tested to verify proper functioning of the Control Room HVAC. During the emergency mode of operation, the Control Room HVAC is designed to pressurize the control room to at least 1/8 inch Water gauge (in-wg) positive pressure with respect to adjacent areas in order to prevent unfiltered inleakage. The Control Room HVAC is designed to maintain this positive pressure with two trains at a makeup flow rate of 2000 cfm. The frequency of 18 months is consistent with the guidance provided in NUREG-0800. If the surveillance results are less than 1/8 in-wg and the pressure differential is not positive, the surveillance requirement is considered not met and the appropriate action of TS 3.7.7 must be applied.

3/4.7.8 (Not used)

SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-6 Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

PLANT SYSTEMS BASES ACTION d:

If the unfiltered in-leakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem total effective dose equivalent (TEDE)), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.

During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. OPGPO3-ZE-0030, "Control Room Envelope Habitability Program" discusses appropriate mitigating actions.

As stated in OPGP03-ZE-0030, the mitigating actions are verified to ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time for implementation of the mitigating actions is reasonable based on the low probability of a DBA occurring during this time period, and the use of the mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.

Surveillance Requirement 4.7.7.e.3 verifies the OPERABILITY of the CRE boundary by testing for unfiltered air in-leakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program. The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem total effective dose equivalent (TEDE) and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air in-leakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air in-leakage is greater than the assumed flow rate in MODES 1, 2, 3, and 4, Action d must be entered. Action d allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident.

Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, which endorses,

.with exceptions, NEI 99-03, Section 8.4 and Appendix F. These compensatory measures may also be used as mitigating actions as required by Action d. Temporary analytical. methods may also be used as compensatory measures to restore OPERABILITY. Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions.

SOUTH TEXAS - UNITS 1 & 2 B 314 7-6 Unit 1 - Amendment No. 08-9098-7 Unit 2 - Amendment No. 08-9098-7

PLANT SYSTEMS BASES allowed outage time is 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. A limited allowed outage time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is allowed for multiple trains to'be out of service simultaneously in recognition of the fact that there are common plenums and some maintenance or testing activities required opening or entry into these common plenums. This time is reasonable to diagnose, plan, and possibly repair problems with the boundary or the ventilation system.

This is acceptable based on the low probability of a design basis event in that brief allowed outage time and because administrative controls impose compensatory actions that reduce the already small risk associated with being in the ACTION.

The compensatory actions are consistent with the intent of GDC 19, GDC 60 and Part 100 to protect plant personnel and the public from potential hazards such as radioactive contamination, smoke, and temperature, etc. Pre-planned measures should be available to address these concerns for intentional and unintentional entry into the condition. The compensatory action may include placing fans in pull-to-lock as necessary to preclude there being a motive force to transport contaminated air to a clean environment in the event of an accident. These compensatory actions include administrative controls on opening plenums or other openings such that appropriate communication is established with the control room to assure timely closing of the system if necessary. Since the Fuel Handling Building boundary integrity also affects operability of the overall system, entry and exit is administratively controlled. Administrative control of entry and exit through doors is performed by the persons) entering or exiting the area. Extended opening of the boundary is coordinated with the control room with appropriate plans for closure and communication.

3/4.7.9 NOT USED 3/4.7.10 NOT USED 3/4.7.11 NOT USED 3/4.7.12 NOT USED 3/4.7.13 NOT USED 3/4.7.14 ESSENTIAL CHILLED WATER SYSTEM The OPERABILITY of the Essential Chilled Water System ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.

When a risk-important system or component (for example Essential Chilled Water) is taken out of service, it is important to assure that the impact on plant risk of this and other equipment simultaneously taken out of service is assessed. The Configuration Risk Management Program evaluates the impact on plant risk of equipment out of service.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-7 Unit 1 - Amendment No. 06-9821-8 Unit 2 - Amendment No. 06-9821-8

PLANT SYSTEMS BASES 3/4.7.9 (Not Used) 3/4.7.10 (Not Used) 3/4.7.11 (Not used) 3/4.7.12 (Not used) 3/4.7.13 (Not used) 3/4.7.14 ESSENTIAL CHILLED WATER SYSTEM The OPERABILITY of the Essential Chilled Water System ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.

When a risk-important system or component (for example Essential Chilled Water) is taken out of service, it is important to assure that the impact on plant risk of this and other equipment simultaneously taken out of service is assessed. The Configuration Risk Management Program evaluates the impact on plant risk of equipment out of service.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-7 Unit I - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

PLANT SYSTEMS BASES Depending upon the nature of the problem and the corrective action, a full scope in-leakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.

There is no CRMCFS actuation for hazardous chemical releases or smoke and there are no surveillance requirements that verify operability for hazardous chemical or smoke. The hazardous chemical analyses for the South Texas Project do not assume any control room isolation and assumes air enters at normal makeup ventilation flow rates. No in-leakage test is required to determine unfiltered in-leakage from toxic gas since this would be a value much less than that currently assumed in the toxic gas analyses. There is no regulatory limit on the amount of smoke allowed in the control room. The plant's ability to manage smoke infiltration was assessed qualitatively. The conclusion is that the operator maintains the ability to safely shutdown the plant during a smoke event originating inside or outside the control room. Therefore, no in-leakage test is required to be conducted to measure the amount of smoke that could infiltrate into the control room.

3/4.7.8 (Not used) 3/4.7-9 (Not Used) 3/4.7.10 (Not Used) 3/4.7.11 (Not used) 3/4.7.12 (Not used) 3/4.7.13 (Not used) 3/4.7.14 ESSENTIAL CHILLED WATER SYSTEM The OPERABILITY of the Essential Chilled Water System ensures that sufficient cooling capacity is available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.

When a risk-important system or component (for example Essential Chilled Water) is taken out of service, it is important to assure that the impact on plant risk of this and other equipment simultaneously taken out of service is assessed. The Configuration Risk Management Program evaluates the impact on plant risk of equipment out of service.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 7-7 Unit I - Amendment No. 08-9098-7 Unit 2 - Amendment No. 08-9098-7

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES., D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued)

Surveillance Requirements The AC sources are designed to permit inspection and testing of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 1 B.

Periodic component tests are supplemented by extensive functional tests during refueling outages.

(under simulated accident conditions). The Technical Specification Surveillance Requirements (SRs) for demonstrating the OPERABILITY of the standby diesel generators are in accordance with the recommendations of Regulatory Guide 1.108, Regulatory Guide 1.137, as addressed in the FSAR and NUREG-1431.

Where the SRs discussed herein specify voltage and frequency tolerances, the following is applicable.

The minimum steady state output voltage of 3744 is 90% of the nominal 4160 V output voltage. This value, which is specified in ANSI C84.1, allows for voltage drop to the terminals of 4000 V motors with minimum operating voltage specified as 90% or 3600 V. It also allows for voltage drops to motors and other equipment down through the 120 V level where minimum operating voltage is also usually specified as 90% of name plate rating. The specified maximum steady state output voltage of 4576 V corresponds to the 10% upper limit for the nominal 4160 volts on the safety bus.

The specified minimum and maximum frequencies of the standby diesel generators are 58.8 Hz and 61.2 Hz, respectively. These values are equal to plus or minus 2% of the 60 Hz nominal frequency and are derived from the recommendations given in Regulatory Guide 1.108 and NUREG-1431.

SR 4.8.1.1.1.a

'This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite.

distribution network and availability, of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution busses and loads are connected to their preferred power source, and that appropriate independence of offsite circuits is maintained. The.,

frequency specified in the Surveillance Frequency Control Program is adequate since breaker position is not likely to change without the operator being awareof it and because its status is displayed in -the control room.

SR 4.8.1..1..b Transfer of each 4.16 kV ESF bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the shutdown loads. The 18 month Frequency of the Surveillance is based on engineering judgment, taking into consideration the unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that the components usually pass the SR when performed at-a frequency found in the Surveillance Frequency Control Program. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 4.8.1.1.2.a.1 This SR provides verification that the level of fuel oil in the fuel tank is at or above the required level.

SOUTH TEXAS - UNITS 1 &2 B 3/4 8-6 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D. C. SOURCES, AND.ONSITE POWER DISTRIBUTION (Continued)

SR 4.8.1.1.2.a.2 This SR helps to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note (Note 2) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading.

For purposes of this testing, the DGs are started from standby conditions. Standby condition for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.

In order to reduce stress and wear on diesel engines, some manufacturers recommend a modified start in which the starting speed of DGs is limited, warmup is limited to this lower speed, and the DGs are gradually accelerated to synchronous speed prior to loading. In addition, the modified start may involve reduced fuel (load limit). These start procedures are the intent of Note 3, which is only applicable when such modified start procedures are recommended by the manufacturer.

At a frequency found in the Surveillance Frequency Control Program, the DG starts from standby conditions and achieves required voltage and frequency within 10 seconds. The 10 second start requirement supports the assumptions of the design basis LOCA analysis in the FSAR.

The 10 second start requirement is not applicable (see Note 3) when a modified start procedure as described above is used.

The frequency specified in the Surveillance Frequency Control Program for SR 4.8.1.1.2.a is consistent with Regulatory Guide 1.108 and Generic Letter 94-01. The frequency specified in the Surveillance Frequency Control Program in Note 3 is a reduction in cold testing consistent with Generic Letter 84-15.

These Frequencies provide adequate assurance of DG OPERABILITY, while minimizing degradation resulting from testing.

SR 4.8.1.1.2.a.3 This Surveillance verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads.

A minimum run time of 60 minutes is required to stabilize engine temperature, while minimizing the time that the DG is connected to the offsite source.

The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

This SR is modified by two Notes. Note 4 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 6 states that momentary transients, because of changing bus loads, do not invalidate this test.

A successful DG start under SR 4.8.1.1.2.a.2 must precede this test to credit satisfactory performance.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-7 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D. C. SOURCES, AND ONSITE POWER DISTRIBUTION (Continued)

SR 4.8.1.1.2.b Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil tanks at a frequency found in the Surveillance Frequency Control Program' eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation, Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137. This SR is for preventative maintenance. The presence of water does not necessarily represent failure of the SR, provided the accumulated water is removed during the performance of this Surveillance.

SR 4.8.1.1.2.c The requirements will be controlled and. administered by the Diesel Fuel Oil Testing Program located in section 6.8.3 of Administrative Controls.

SR 4.8.1.1.2.e.1 NOT USED SR 4.8.1.1.2.e.2 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load (785.3 kW) without exceeding predetermined voltage and frequency. The frequency specified in the Surveillance Frequency Control Program is consistent with the recommendation of Regulatory Guide 1.108.

This SR is modified by two Notes. Note 4 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 5 allows the diesel start for this surveillance to be a modified start as stated in SR 4.8.1.1.2.a.2.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-8 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D.C. SOURCES,. and ONSITE POWER DISTRIBUTION (Continued)

SR 4.8.1.1.2.9.3 This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG does not trip upon loss of the load.

These acceptance criteria provide for DG damage protection. While the DG is not expected to experience this transient during an event and continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

The frequency specified in the Surveillance Frequency Control Program is consistent with the recommendation of Regulatory Guide 1.108 and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes. Note 4 indicates that diesel engine runs for this Surveillance may include gradual loading as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 5 allows the diesel start for this surveillance to be a modified start as stated in SR 4.8.1.1.2.a.2.

SR 4.8.1.1.2.e.4 As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a(l), this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency busses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG autostart time of 10 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The frequency should be restored to within 2% of nominal following a load sequence step. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability is achieved.

The requirement to verify the connection and power supply of permanent and autoconnected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-9 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued) potential for undesired operation. For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, or high pressure injection systems are not capable of being operated at full flow, or residual heat removal (RHR) systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG systems to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The frequency specified in the Surveillance Frequency Control Program is consistent with the recommendations of Regulatory Guide 1.108, paragraph 2.a.(1), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

SR 4.8.1.1.2.e.5 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds) from the design basis actuation signal (LOCA signal) and operates > 5 minutes. The 5 minute period provides sufficient time to demonstrate stability.

The frequency specified in the Surveillance Frequency Control Program takes into consideration unit conditions required to perform the Surveillance and is intended to be consistent with the expected fuel cycle lengths.

SR 4.8.1.1.2.e.6 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This Surveillance demonstrates the DG operation, during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

This surveillance also demonstrates that DG noncritical protective functions (e.g., high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESF actuation test signal, and critical protective functions (engine overspeed, generator differential current, and low lube oil pressure) are operable. The noncritical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-10 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued) operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.

The frequency specified in the Surveillance Frequency Control Program takes into consideration unit conditions required to perform the Surveillance and is intended to be consistent with an expected fuel cycle length of 18 months. Operating experience has shown that these components usually pass the SR when performed at a frequency found in the Surveillance Frequency Control Program. Therefore, the frequency specified in the Surveillance Frequency Control Program was concluded to be acceptable from a reliability standpoint.

SR 4.8.1.1.2.e.7 Regulatory Guide 1.108, paragraph 2.a.(3), requires demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, > 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of which is at a load equivalent to 110% of the continuous duty rating and the remainder of the time at a load equivalent to the continuous duty rating of the DG. The DG starts for this Surveillance can be performed either from standby or hot conditions.

This Surveillance also demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 10 seconds. The 10 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA. The frequency specified in the Surveillance Frequency Control Program is consistent with the recommendation of Regulatory Guide 1.108, paragraph 2.a.(5).

The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The frequency specified in the Surveillance Frequency Control Program is consistent with the recommendations of Regulatory Guide 1.108, paragraph 2.a.(3), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by three Notes. Note 4 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 5 allows the diesel start for this surveillance to be a modified start as stated in SR 4.8.1.1.2.a.2. Note 6 states that momentary transients, because of changing bus loads, do not invalidate this test.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-11 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued)

SR 4.8.1.1.2.e.8 This SR is used to verify that the loads for the diesel do not exceed the 2000 hour0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> rating approved by Cooper.

SR 4.8.1.1.2.e.9 As required by Regulatory Guide 1.108, paragraph 2.a.(6), this Surveillance ensures that the manual synchronization and automatic load transfer from the DG to the ofisite source can be made and the DG can be returned to ready to load status when offsite power is restored. It also ensures that the autostart logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready to load status when the DG is at rated speed and voltage, the output breaker is open and can receive an autoclose signal on bus undervoltage, and the load sequence times are reset.

The frequency specified in the Surveillance Frequency Control Program is consistent with the recommendations of Regulatory Guide 1.108, paragraph 2.a.(6), and takes into consideration unit conditions required to perform the Surveillance.

SR 4.8.1.1.2.e.10 Demonstration of the test mode override ensures that the DG availability under accident conditions will not be compromised as a result of testing and the DG will automatically reset to ready to load operation if a LOCA actuation signal is received during operation in the test mode. Read to load operation is defined as the DG running at rated speed and voltage with the DG output breaker open. These provisions for automatic switchover are required by IEEE-308, paragraph 6.2.6(2).

The intent in the requirement is to show that the emergency loading was not affected by the DG operation in test mode. In lieu of actual demonstration of connection, and loading of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The frequency specified in the Surveillance Frequency Control Program is consistent with the recommendation of Regulatory Guide 1.108, paragraph 2.a.(8), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-12 Unit 1 - Amendment No. 08-9098-11 Unit 2,- Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued)

SR 4.8.1.1.2.e. 11 As required by Regulatory Guide 1.108, paragraph 2.a.(2), each DG is required to demonstrate proper operation for the DBA loading sequence to ensure that voltage and frequency are maintained within the required limits. Under accident conditions, prior to connecting the DGs to their respective busses, all loads are shed except load center feeders and those motor control centers that power Class 1 E loads (referred to as "permanently connected" loads). Upon reaching 90% of rated voltage and frequency, the DGs are then connected to their respective busses.

Loads are then sequentially connected to the bus by the automatic load sequencer. This sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents. The 10% load sequence time interval tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated.

The sequencer is considered a support system for the associated diesel generator and those components actuated by a Mode 1 signal (CR 00-10707).

The frequency specified in the Surveillance Frequency Control Program is consistent with the recommendation of Regulatory Guide 1.108, paragraph 2.a.(2), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

SR 4.8.1.1.2.e.12 This SR verifies that the diesel will not start when the emergency stop lockout feature is tripped. This prevents any further damage to the diesel engine or generator.

SR 4.8.1.1.2.e.1 3 This SR verifies the requirements of Branch Technical Position PSB-1 that the load shedding scheme automatically prevents load shedding during the sequencing of the emergency loads to the bus. It also verifies the reinstatement of the load shedding feature upon completion of the load'sequencing action.

SR 4.8.1.1.2.f This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-13 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES, D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued)

The frequency specified in the Surveillance Frequency Control Program is consistent with the I recommendations of Regulatory Guide 1.108, paragraph 2.b, and Regulatory Guide 1.137, paragraph C.2.f.

SR 4.8.1.1.2.q This SR provided assurance that any accumulation of sediment over time or the normal wear on the system has not degraded the diesels.

The Surveillance Requirements for demonstrating the OPERABILITY of the diesel generators are in accordance with the recommendations of Regulatory Guides 1.9, "Selection of Diesel Generator Set Capacity for Standby Power Supplies," Revision 2, December 1979; 1.108, "Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants," Revision 1, August 1977; and ASTM D975-81, ASTM D1552-79, ASTM D262282, ASTM D4294-83, and ASTM D2276-78.

The standby diesel generators auxiliary systems are designed to circulate warm oil and water through the diesel while the diesel is not running, to preclude cold ambient starts. For the purposes of surveillance testing, ambient conditions are considered to be the hot prelube condition.

3.8.1.3 The OPERABILITY of the minimum AC sources during MODE 6 with Ž23' of water in the cavity is based on the following conditions:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status, and SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-14 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown.

In general, when the unit is shutdown, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1,2,3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.

During MODES 1, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In MODES 5 and 6, the activities are generally planned and administratively controlled. Relaxation from MODES 1, 2, 3, and 4 LCO requirements is acceptable during shutdown modes based on:

a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration.

b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both,

c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.

d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1,2, 3, and 4 OPERABILITY requirements) with systems assumed to function during an event.

In the event of an accident during shutdown, this LCO ensures the capability to support systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite diesel generator (DG) power.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-15 Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

ELECTRICAL POWER SYSTEMS BASES DC SOURCES (continued)

If one of the required DC electrical power subsystems is inoperable, the other DC electrical power subsystems have the capability to support a safe shutdown and to mitigate an accident condition. However, continued power operation should not exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The 2-hour completion time is based on Regulatory Guide 1.93 and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem. If the DC electrical power subsystem is not restored to OPERABLE status, the time allowed is sufficient to prepare to effect an orderly and safe unit shutdown.

SURVEILLANCE REQUIREMENTS S R 4.8.2. 1. a Verification of battery terminal voltage while on float charge helps to ensure the effectiveness of the battery chargers supporting the ability of the batteries to perform their intended function. Float charge is the condition in which the charger supplies the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state, while supplying the continuous steady-state loads of the associated DC subsystem. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum voltage on float charge established by the battery manufacturer (2.17 volts per cell or 128 V at the battery terminals for a 59-cell battery). This voltage maintains the battery plates in a condition that supports maintaining the grid life (expected to be approximately 20 years). The 7-day cycle is conservative with respect to manufacturer recommendations and IEEE-450 (Ref. 8).

SR 4.8.2.1 .b Not used.

SR 4.8.2.1 .c.1 This charging capacity exceeds the minimum requirements for the charger to support the required i

DC loads in analyzed accidents. The excess capability supports minimizing the operational limitations imposed on battery testing and associated recharging.

This SR provides two options. One option requires that each battery charger be capable of supplying 300 amps at 128 volts (the minimum established float voltage) for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The ampere requirements are based on the output rating of the chargers. The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time allowed is sufficient for the charger temperature to stabilize and be maintained for at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

The second option requires that each battery charger be capable of recharging the battery within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following a service test coincident with supplying the largest combined demands of the various continuous steady-state loads (regardless of the status of the plant during which these demands occur). This load level may not normally be available following the battery service test and will need to be supplemented with additional loads. The duration of this test may be longer than the charger sizing criterion since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current. The battery is recharged when the measured, charging current is less than or equal to 2 amps.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-21 Unit 1 - Amendment No. 08-9098-6 Unit 2 - Amendment No. 08-9098-6

ELECTRICAL POWER SYSTEMS BASES DC SOURCES (continued)

If one of the required DC electrical power subsystems is inoperable, the other DC electrical power subsystems have the capability to support a safe shutdown and to mitigate an accident condition.

However, continued power operation should not exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The 2-hour completion time is based on Regulatory Guide 1.93 and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem. If the DC electrical power subsystem is not restored to OPERABLE status, the time allowed is sufficient to prepare to effect an orderly and safe unit shutdown.

SURVEILLANCE REQUIREMENTS SR 4.8.2.1 .a Verification of battery terminal voltage while on float charge helps to ensure the effectiveness of the battery chargers supporting the ability of the batteries to perform their intended function. Float charge is the condition in which the charger supplies the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state, while supplying the continuous steady-state loads of the associated DC subsystem. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum voltage on float charge established by the battery manufacturer (2.17 volts per cell or 128 V at.the battery terminals for a 59-cell battery). This voltage maintains the battery plates in a condition that supports maintaining the grid life (expected to be approximately 20 years). The frequency specified in the Surveillance Frequency Control Program is conservative with respect to manufacturer recommendations and IEEE-450 (Ref. 8).

SR 4.8.2.1.b Not used.

SR 4.8.2.1.c.1 This charging capacity exceeds the minimum requirements for the charger to support the required DC loads in analyzed accidents. The excess capability supports minimizing the operational limitations imposed on battery testing and associated recharging.

This SR provides two options. One option requires that each battery charger be capable of supplying 300 amps at 128 volts (the minimum established float voltage) for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The ampere requirements are based on the output rating of the chargers. The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time allowed is sufficient for the charger temperature to stabilize and be maintained for at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

The second option requires that each battery charger be capable of recharging the battery within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following a service test coincident with supplying the largest combined demands of the various continuous steady-state loads (regardless of the status of the plant during which these demands occur).

This load level may not normally be available following the battery service test and will need to be supplemented with additional loads. The duration of this test may be longer than the charger sizing criterion since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current. The battery is recharged when the measured charging current is less than or equal to 2 amps.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-21 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES DC SOURCES (continued)

The surveillance frequency is acceptable, given the unit conditions required to perform the test and the other administrative controls existing to ensure adequate charger performance during these 18-month intervals. In addition, this frequency is intended to be consistent with expected fuel cycle lengths.

3/4.8.2.2 DC SOURCES - SHUTDOWN LIMITING CONDITION FOR OPERATION One DC electrical power subsystem consisting of one battery, at least one charger, and the corresponding control equipment and interconnecting cabling within the train are required to be OPERABLE to support one train of the distribution systems required to be OPERABLE by LCO 3.8.3.2, "Distribution Systems-Shutdown." This ensures availability of sufficient DC electrical power sources to maintain the unit in a safe condition and to mitigate the consequences of postulated events during shutdown.

APPLICABILITY The DC electrical power sources required as OPERABLE in MODES 5 and 6 provide assurance that:

" Required features to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core;

" Required features needed to mitigate the effects of events that can lead to core damage during shutdown are available; and

" Instrumentation and control capability are available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

ACTIONS By allowing the option to declare required features inoperable with the associated DC power source inoperable, appropriate restrictions will be implemented in accordance with the affected requiredfeatures LCO ACTIONS. Allowance is made for sufficiently conservative actions. The Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory, provided the required shutdown margin is maintained.

Suspension of these activities does not preclude completion of actions to establish a safe, conservative condition. The actions minimize the probability of occurrence of postulated events.

Use of "immediately" for Completion Time is consistent with the required times for actions requiring prompt attention.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-22 Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

ELECTRICAL POWER SYSTEMS BASES DC SOURCES (continued)

SR 4.8.2.1.c.2 This SR allows a modified performance discharge test to be used in lieu of a battery service test. Either the battery service test or the modified performance discharge test may be used to satisfy SR 4.8.2.1.c.2.

However, only the modified performance discharge test may be used to satisfy the requirements of SIR 4.8.2,3.f.

3/4.8,2.2 DC SOURCES - SHUTDOWN LIMITING CONDITION FOR OPERATION One DC electrical power subsystem consisting of one battery, at least one charger, and the corresponding control equipment and interconnecting cabling within the train are required to be OPERABLE to support one train of the distribution systems required to be OPERABLE by LCO 3.8.3.2, "Distribution Systems-Shutdown." This ensures availability of sufficient DC electrical power sources to maintain the unit in a safe condition and to mitigate the consequences of postulated events during shutdown.

APPLICABILITY The DC electrical power sources required as OPERABLE in MODES 5 and 6 provide assurance that:

" Required features to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core;

• Required features needed to mitigate the effects of events that can lead to core damage during shutdown are available; and

" Instrumentation and control capability are available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

ACTIONS By allowing the option to declare required features inoperable with the associated DC power source inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCO ACTIONS. Allowance is made for sufficiently conservative actions. The Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory, provided the required shutdown margin ismaintained.

Suspension of these activities does not preclude completion of actions to establish a safe, conservative condition. The actions minimize the probability of occurrence of postulated events.

Use of "immediately" for Completion Time is consistent with the required times for actions requiring prompt attention.

SOUTH TEXAS - UNITS I & 2 B 314 8-22 Unit I - Amendment No. 08-9098-6 Unit 2 - Amendment No. 08-9098-6

ELECTRICAL POWER SYSTEMS BASES DC SOURCES (continued)

SURVEILLANCE REQUIREMENT SR 4.8.2.2.a Verification of battery terminal voltage while on float charge helps to ensure the effectiveness of the battery chargers supporting the ability of the batteries to perform their intended function. Float charge is the condition in which the charger supplies the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state, while supplying the continuous steady-state loads of the associated DC subsystem. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum voltage established by the battery manufacturer (2.17 volts per cell or 128 V at the battery terminals for a 59-cell battery). This voltage maintains the battery plates in a condition that supports maintaining the grid life (expected to be approximately 20 years). The frequency specified in the Surveillance Frequency Control Program is conservative with respect to manufacturer recommendations and IEEE-450 (Ref. 8).

SR 4.8.2.2.b This charging capacity exceeds the minimum requirements for the charger to support the required DC loads in analyzed accidents. The excess capability supports minimizing the operational limitations imposed on battery testing and associated recharging.

This SR provides two options. One option requires that each battery charger be capable of supplying 300 amps at 125 volts for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The ampere requirements are based on the output rating of the chargers. The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time allowed is sufficient for the charger temperature to stabilize and be maintained for at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

The second option requires that each battery charger be capable of recharging the battery within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> following a service test coincident with supplying the largest combined demands of the various continuous steady-state loads (regardless of the status of the plant during which these demands occur).

This load level may not normally be available following the battery service test and will need to be supplemented with additional loads. The duration of this test may be longer than the charger sizing criterion since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current. The battery is recharged when the measured charging current is less than or equal to 2 amps.

The surveillance frequency is acceptable, given the unit conditions required to perform the test and the other administrative controls present to ensure adequate charger performance during the frequency specified in the Surveillance Frequency Control Program. In addition, this frequency is intended to be consistent with expected fuel cycle lengths.

SR 4.8.2.2.c This SR allows a modified performance discharge test to be used in lieu of a battery service test. Either the battery service test or the modified performance discharge test may be used to satisfy SR 4.8.2.2.c. However, only the modified performance discharge test may be used to satisfy the requirements of SR 4.8.2.3.f.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-23 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES DC SOURCES (continued)

e. Where batteries in redundant trains are found with batteries not within design limits, and one of the two associated chargers in each affected train is not operable, there is insufficient assurance that battery capacity remains sufficient to the extent that the batteries can still perform their required function. The longer completion times associated with some parameters are therefore not appropriate, and the batteries' conditions must be restored to within limits within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. No more than one battery may be exempted from the two-hour restriction if a longer completion time would otherwise apply.

f. If a battery is found with one or more battery cell float voltage less than 2.07 V, and float current is greater than 2 amps, the battery capacity may not be sufficient to perform the intended functions.

The battery must therefore be declared INOPERABLE immediately.

SURVEILLANCE REQUIREMENTS The surveillance requirements are based on:

NRC-approved Technical Specification Task Force (TSTF) Standard Technical Specification Change Traveler TSTF-360, Revision 1, "DC Electrical Rewrite," as incorporated in NUREG-1431, Revision 2, "Standard Technical Specifications, Westinghouse Plants" (June 2001), and

• IEEE 450-2002, "IEEE Recommended Practice for Maintenance, Testing, and Replacement of Large Lead Storage Batteries for Generating Stations and Substations."

The voltage requirements are based on the nominal design voltage of the battery and are consistent with the initial voltages assumed in the battery sizing calculations. The frequency specified in the Surveillance Frequency Control Program is conservative with respect to manufacturer recommendations and IEEE-450 (Ref. 8).

SR 4.8.2.3.a Verification of battery float current while on float charge is used to determine the state of charge on the battery. Float charge is the condition in which the charger is supplying continuous charge required to overcome the internal losses of a battery and maintain the battery in a charged state. Float current requirements are based on the float current indicative of a charged battery. Use of float current to determine the state of charge of the battery is consistent with IEEE-450 (Ref. 8).

This surveillance requirement is modified by a Note that states the float current requirement is not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 4.8.2.1 .a. When this float voltage is not maintained, LCO Action 3.8.2.2.a is applicable, and provides the necessary and appropriate verification of the battery condition. The float current limit of 2 amps is based on the nominal float voltage value and is not directly applicable when this voltage is not maintained.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-26 Unit I - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES DC SOURCES (continued)

SR 4.8.2.3.b and SR 4.8.2.3.c These SRs require verification that the cell voltages are equal to or greater than the short-term absolute minimum of 2.07 V.

Optimal long-term battery performance is obtained by maintaining a float voltage greater than or equal to the minimum established design limits provided by the battery manufacturer. This provides adequate over-potential, which limits formation of lead sulfate. Monitoring individual cell long-term performance is accomplished by the Battery Monitoring and Maintenance Program, which implements a program for monitoring various battery parameters based on the recommendations of IEEE 450-2002 (Ref.8).

Individual cell voltages < 2.13 V will result in increased monitoring and appropriate corrective action(s) in accordance with this program.

The minimum float voltage required by the battery manufacturer is 2.17 volts per cell, which corresponds to 128 V for 59 cells at the battery terminals. Individual cell float voltages less than 2.13 volts per cell, but greater than 2.07 volts per cell, are addressed in Technical Specification Administrative Control subsection 6.8.3.p. The frequency specified in the Surveillance Frequency Control Program for cell voltage verification is consistent with IEEE-450 (Ref. 8). The primary change to incorporate this method is that the pilot cells are no longer average cells. Pilot cells are now the cells with the lowest individual cell voltages.

SR 4.8.2.3.d The limit specified for electrolyte level ensures that the plates suffer no physical damage and maintains adequate electron transfer capability. The frequency specified in the Surveillance Frequency Control Program is consistent with IEEE-450 (Ref. 8).

SR 4.8.2.3.e This surveillance verifies that the pilot cell temperature is greater than or equal to the minimum established design limit of 65"F. Pilot cell electrolyte temperature is maintained above this temperature to assure the battery can provide the required current and voltage to meet the design requirements.

Temperatures lower than assumed in battery sizing calculations act to inhibit or reduce battery capacity.

The frequency specified in the Surveillance Frequency Control Program is consistent with IEEE-450 (Ref. 8).

SR 4.8.2.3.f if the battery shows degradation, or if the battery has reached 85% of its expected life and capacity is <

100% of the manufacturer's rating, the surveillance cycle is reduced to 12 months. Degradation is indicated, according to IEEE-450 (Ref. 8), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is > 10% below the manufacturer's rating.

These frequencies are consistent with the recommendations in IEEE-450 (Ref. 8).

SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-27 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES DC SOURCES (continued)

A modified performance discharge test of battery capacity is given to any battery reaching 85% of the service life with capacity at least equal to the manufacturer's rating. The interval between tests is to be no longer than 24 months.

A modified performance discharge test is performed at a frequency specified in the Surveillance Frequency Control Program. The acceptance criteria for this surveillance are consistent with IEEE-450 (Ref. 8) and IEEE-485 (Ref. 9). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.

Furthermore, the battery is sized to meet the assumed duty cycle loads when the battery design capacity reaches this 80% limit.

A battery performance discharge test is a test of constant current capacity of a battery to detect any change in the capacity determined by the acceptance test. This test is intended to determine overall battery degradation due to age and usage.

A modified performance discharge test is a test of the battery capacity and its ability to provide the highest rate of the duty cycle. This confirms the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for the service test.

The modified performance test consists of just two rates, the one-minute rate for the largest current load of the duty cycle, followed by the test rate employed for the performance test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a one-minute discharge represent a very small portion of the battery capacity, the test rate can be changed to that for the performance test without compromising the results of the performance discharge test. The battery terminal voltage for the modified performance discharge test must remain above the minimum battery terminal voltage specified in the battery service test for the duration of time equal to that of the service test.

Either the battery performance discharge test or the modified battery performance discharge test is acceptable for satisfying SR 4.8.2.2.c; however, only the modified performance discharge test may be used to satisfy the battery service test requirements of SR 4.8.2.3.f.3.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. Regulatory Guide 1.6, March 10, 1971.

3. IEEE-308

4. UFSAR, Chapter 8

5. UFSAR, Chapter 6

6. UFSAR, Chapter 15

7. Regulatory Guide 1.93, December 1974

8. IEEE 450-2002

9. IEEE 485-1983

10. Regulatory Guide 1.32, February 1997 SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-28 Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

ELECTRICAL POWER SYSTEMS BASES ONSITE POWER DISTRIBUTION 3.8.3.1 ACTIONs c and d of TS 3.8.3.1 allow the option of calculating risk-informed completion time (RICT) in accordance with the requirements of the CRMP.

3.8.3.2 The OPERABILITY of the required DC sources and electrical distribution system during shutdown is based on the following conditions:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.

In general, when the unit is shutdown, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.

The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences.

These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.

Specifications 3.8.2.2 and 3.8.3.2 require DC power sources and specified electric power distribution for equipment required to be operable during shutdown. If the DC sources or distribution system is inoperable, then the Specifications require the affected components to be declared inoperable or that core alterations and positive reactivity changes be stopped. For a required system or component to be operable, the definition of OPERABLE/OPERABILITY requires the availability of necessary support systems, instrumentation, and electrical power for the required system to meet the design basis requirements. In MODES 5 and 6, the design basis does not include single failure coincident with loss of off-site power. Consequently, where two trains or channels of equipment are required by the SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-29 Unit 1 - Amendment No. 08-9098-1 Unit 2 - Amendment No. 08-9098-1

ELECTRICAL POWER SYSTEMS BASES ONSITE POWER DISTRIBUTION 3.8.3.1 ACTIONs c and d of TS 3.8.3.1 allow the option of calculating risk-informed completion time (RICT) in accordance with the requiremeats-of the CRMP.

3.8.3.2 The OPERABILITY of the required DC sources and electrical distribution system .during shutdown is based on the following conditions:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown.

In general, when the unit is shutdown, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.

The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences.

These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.

Specifications 3.8.2.2 and 3.8.3.2 require DC power sources and specified electric power distribution for equipment required to be operable during shutdown. If the DC sources or distribution system is inoperable, then the Specifications require the affected components to be declared inoperable or that core alterations and positive reactivity changes be stopped. For a required system or component to be operable, the definition of OPERABLE/OPERABILITY requires the availability of necessary support systems, instrumentation, and electrical power for the required system to meet the design basis requirements. In MODES 5 and 6, the design basis does not include single failure coincident with loss of off-site power. Consequently, where two trains or channels of equipment are required by the SOUTH TEXAS - UNITS 1 & 2 B 3/4 8-29 Unit 1 - Amendment No. 08-9098-3A Unit 2 - Amendment No. 08-9098-3A

3/4.9 REFUELING OPERATIONS BASES 3/4.9.1 BORON CONCENTRATION (Continued)

APPLICABILITY In MODE 6, this LCO is applicable to prevent an Inadvertent boron dilution event by ensuring isolation of all sources of unborated water to the RCS.

ACTIONS The ACTIONS are modified to allow separate ACTION entry for each unborated water source isolation valve.

Continuation of CORE ALTERATIONS is contingent upon maintaining the unit in compliance with this LCO. With any valve or mechanical joint required to isolate unborated water sources not secured in the closed position, all operations involving CORE ALTERATIONS must be suspended immediately. The Completion Time of "immediately" for performance the required action shall not preclude completion of movement of a component to a safe position.

ACTION b. includes a requirement that the verification that rboron concentration is within limit be completed whenever ACTION b. is entered.

Preventing inadvertent dilution of the reactor coolant boron concentration is dependent on maintaining the unborated water isolation devices secured closed. Securing the valves or mechanical joints in the closed position ensures that the devices cannot be inadvertently opened. The Completion Time of "immediately" requires an operator to initiate actions to close an open valve or mechanical joint and secure the isolation device in the closed position immediately. Once actions are initiated, they must be continued until the devices are secured in the closed position.

Due to the potential of having diluted the boron concentration of the reactor coolant, verification of boron concentration per SR 4.9.1.2 must be performed whenever ACTION b. is entered to demonstrate that the required boron concentration exists. The Completion Time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is sufficient to obtain and analyze a reactor coolant sample for boron concentration.

SURVEILLANCE REQUIREMENTS SR 4.9.1.3 These valves or mechanical joints are to be secured closed to isolate possible dilution paths. The likelihood of a significant reduction in the boron concentration during MODE 6 operations is remote due to the large mass of borated water in the refueling cavity and the fact that all unborated water sources are isolated, precluding a dilution. The boron concentration is checked at a frequency found in the Surveillance Frequency Control Program during MODE 6 under SR 4.9.1.2. This Surveillance demonstrates that the devices are closed through a system walkdown. The frequency specified in the Surveillance Frequency Control Program is based on engineering judgment and is considered reasonable in view of other administrative controls that will ensure that the valve opening is an unlikely possibility.

REFERENCES

1. UFSAR, Section 15.4.6

2. NUREG-0800, Section 15.4.6 SOUTH TEXAS - UNITS 1 & 2 B 3/4 9-1a Unit 1 - Amendment No. 08-9098-11 Unit 2 - Amendment No. 08-9098-11

3/4.9 REFUELING OPERATIONS 1BASES 3/4.9.2 INSTRUMENTATION The OPERABILITY of the Source Range and/or Extended Range Neutron Flux Monitors ensures that redundant monitoring capability is available to detect changes in the reactivity condition of the core.

ACTION a. requires suspending the introduction into the RCS of coolant with boron concentration less than required to meet the refueling boron concentration limit necessary to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what Would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes, including temperature increases when operating with a positive moderator temperature coefficient, must also be evaluated to not result in operation below the required refueling boron concentration limit. Control rod withdrawal is not allowed except that it is permissible to unlock the control rods for rapid refueling. To unlock the control rods, they must be withdrawn at least one step. However, since the control rods are above the active fuel when the unlocking process occurs, there is no reactivity addition.

3/4.9.3 (Not Used) 3/4.9.4 (Not Used)

SOUTH TEXAS - UNITS 1 & 2 B 3/4 9-1b Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

3/4.9 REFUELING OPERATIONS BASES 3/4.9.5 (Not Used) 3/4.9.6 (Not Used) 314.9.7 (Not Used)

SOUTH TEXAS - UNITS 1 & 2 B 3/4 9-2 Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

REFUELING OPERATIONS BASES 3/4.9.8 RESIDUAL HEAT REMOVAL AND COOLANT CIRCULATION As many as three residual heat removal (RHR) loops may be in operation, but at least one loop must be in operation at all times. One loop in operation ensures that: (1) sufficient cooling capacity is available to remove decay heat and maintain the water in the reactor vessel below 140'F as required during the REFUELING MODE, and (2) sufficient coolant circulation is maintained through the core to minimize the effect of a boron dilution incident and prevent boron stratification.

The requirement to have two RHR loops OPERABLE when there is less than 23 feet of water above the reactor vessel flange ensures that a single failure of the operating RHR loop will not result in a complete loss of residual heat removal capability. With the reactor vessel head removed and at least 23 feet of water above the reactor pressure vessel flange, a large heat sink is available for core cooling. Thus, in the event of a failure of the operating RHR loop, adequate time is provided to initiate emergency procedures to cool the core.

ACTIONS applicable when no RHR loop is in operation require suspending the introduction into the RCS of coolant with boron concentration less than required to meet the refueling boron concentration limit necessary to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes, including temperature increases when operating with a positive moderator temperature coefficient, must be evaluated to not result in operation below the required refueling boron concentration limit.

The 3000 gpm flow rate in 4.9.8.2 refers to total RHR flow through the core, i.e., Cold leg injection flow. (CR 97-908-5) 3/4.9.9 (Not used) 3/4.9.10 and 3/4.9.11 WATER LEVEL - REFUELING CAVITY AND STORAGE POOLS The restrictions on minimum water level ensure that sufficient water depth is available to remove 99% of the assumed iodine gap activity released from the rupture of an irradiated fuel assembly. The minimum water depth is consistent with the assumptions of the safety analysis.

SOUTH TEXAS - UNITS I & 2 B 3/4 9-3 Unit I - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

REFUELING OPERATIONS 3/4.9.12 (Not used)

SOUTH TEXAS - UNITS 1 & 2 B 3/4 9-3a Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3

REFUELING OPERATIONS BASES 3/4.9.13 SPENT FUEL POOL MINIMUM BORON CONCENTRATION The spent fuel racks have been analyzed in accordance with the methodology contained in WCAP-14416-NP-A, "Westinghouse Spent Fuel Rack Criticality Analysis Methodology", Revision 1, November, 1996. This methodology ensures that the spent fuel rack multiplication factor, kI, is less than or equal to 0.95, as recommended by ANSI 57.2-1983 and the guidance contained in NRC Letter to All Power Reactor Licensees from B. K. Grimes, "OT Position for Review and Acceptance of Spent Fuel Storage and Handling Applications," April 14, 1978. The codes, methods, and techniques contained in the methodology are used to satisfy this' k~e criterion. The spent fuel storage racks are analyzed to allow storage of 17XI7XL fuel assemblies with nominal enrichments up to 4.95 wio U-235 utilizing credit for checkerboard configurations, burnup, Integral Fuel Burnable Absorbers, decay time, RCCAs, and soluble boron, to ensure that k,, is maintained < 0.95, including uncertainties, tolerances, and accident conditions. In addition, the spent fuel pool k.,, is maintained < 1.0 including uncertainties and tolerances on a 95/95 basis without soluble boron. The inadvertent withdrawal of an RCCA from a required location in a Region 2 checkerboard is bounded by the misloading of a 4.95 w/o fuel assembly in the same checkerboard pattern at the location of the assembly with the inadvertently'withdrawn RCCA.

The soluble boron concentration required to maintain keff< 0.95 under normal conditions is 700 PPM.

Specifications 5.6.1.3 and 5.6.1.4 ensure that fuel assemblies are stored in the spent fuel racks in accordance with the configurations assumed in the spent fuel rack criticality analysis.,

The most limiting accident with respect to the storage configurations assumed in the spent fuel rack criticality analysis is the misplacement of a nominal 4.95 w/o U-235 fuel assembly into a storage cell location in the Region 2 RCCA checkerboard #2 storage arrangement. The amount of soluble boron required to maintain kf less than or equal to 0.95 due to this fuel misload accident is 2200 ppm. The 2500 ppm limit specified in the LCO bounds the 2200 ppm required for a fuel misload accident.

A spent fuel pool boron dilution analysis was performed to determine that sufficient time is available to detect and mitigate dilution of the spent fuel pool prior to exceeding the kef design basis limit of 0.95.

The spent fuel pool boron dilution analysis concluded that an inadvertent or unplanned event that would result in a dilution of the spent fuel pool boron concentration from 2500 ppm to 700 ppm is not a credible event.

SOUTH TEXAS - UNITS 1 & 2 B 3/4 9-4 Unit 1 - Amendment No. 08-9098-3 Unit 2 - Amendment No. 08-9098-3