Text

Part B - Revisions 58 -76 to River Bend Station Technical Requirements Manual & Technical Specification Bases
	ML021050507
Person / Time
Site:	River Bend
Issue date:	04/10/2002
From:	King R; Entergy Operations
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	RBF1-02-0053, RBG-45935
	Download: ML021050507 (169)
	v • d • e

Recirculation Loops Operatirg B 3.4.1 BASES ACT ONS (continued) 8.1 Should a LOCA or transient occur with THERMAL POWER > 79% RTP, during single loop operation the core response may not be by the safety analyses. bounded Therefore, only a limited time allowed to reduce THERMAL POWER is to

79% RTP.

The I hour Completion Time is based on the low probability accident occuring during this of an time period, on a reasonable to complete the Required Action, time and on frequent core monitoring by operators allowing changes in THERMAL POWER to be quickly detected.

(continued)

RIVER BEND . . . .

0 J.4-5 Revision-No. 6-4

RCS P/T Limits 3 3. 4. 1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.11 RCS Pressure and Temperature (PIT) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes.

These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.

Figure 3.4.11-1 contains P/T limit curves for heatup and cooldown. The curves provide limits for inservice leak and hydrostatic test, core not critical. and core critical operation.

Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.

The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure. Therefore, the LCO limits apply mainly to the vessel.

10 CFR 50, Appendix G (Ref. 1), requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials. Reference I requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code,Section III. Appendix G (Ref. 2).

The actual shift in the RTNT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3) and 10 CFR 50. Appendix H (Ref. 4).

(continued)

RIVER BEND B 3.4-53 Revision No. 6-4

RCS P/T Limits B 3.4.11 BASES BACKGROUND The operating P/T limit curves will be adjusted, (continued) as necessary, based on the evaluation findings and the recommendations of Reference 5.

The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and. thus, the curves are composites of the most restrictive regions.

Figure 3.4.11-1 shows a set of P-T curves for the heat-up and cool-down operating conditions. These curves apply for both the VT and 3/4T locations. When -ýmbining pressure and thermal stresses, it is usually necessary to evaluate stresses at the 'T location (inside surface flaw) and the 3/4T location (outside surface flaw). This is because the thermal gradient tensile stress of interest is in the inner wall during cool-down and is in the outer wall during heatup. However, as a conservative simplification, the thermal gradient stress at the '4T is assumed to be tensile for both heatup and cooldown. This results in the approach of applying the maximum tensile stress at the T 4

location. This approach is conservative for two reasons: 1) tne maximum stress is used regardless of flaw location, and 2) the irradiation effects cause the allowable toughness, KIa at /T to be less than that at 3T for a given metal temperature. This approach causes no operational difficulties since the BWR is at steam saturation conditions during normal operation, satisfying the heatup/cooldown curve limits.

The core critical limits include the Reference 1 requirement that they be at least 40°F above the heatup curve or the cooldown curve and not lower than the minimum permissible temperature for the inservice leak and hydrostatic testing.

The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB. possibly leading to a nonisolable leak or loss of coolant accident, In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components. The ASME Code,Section XI, Appendix E (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.

(continued)

RIVER BEND B 3.4-54 Revision No. 6-4

RCS P/T Limits B 3.4.11 APPLICABLE The P/T limits are not derived from Design Basis Accident SAFETY ANALYSES (DBA) analyses. They are prescribed during normal operation avoid encountering pressure, temperature, and to temperature rate of change conditions that might cause undetected'flaws to propagate and cause nonductile failure of the RCPB, a condition that is unanalyzed. Reference 7 establishes the methodology for determining the P/T limits. Since the P/T limits are not derived from any DBA, there are no acceptance limits related to the PiT limits. Rather, the P/T limits are acceptance limits themselves since they preclude operation in an unanalyzed condition.

RCS P/T limits satisfy Criterion 2 of the NRC Policy Statement.

LCO The elements of this LCO are:

a. RCS pressure, temperature, and heatup or cooldown rate are within the limits, during RCS heatup, cooldown, and inservice leak and hydrostatic testing.

b. The temperature difference between the reactor vessel bottom head coolant and the reactor pressure vessel (RPV) coolant is within the limit during recirculation startup, and during increases in THERMAL POWER or pump loop flow while operating at low THERMAL POWER or loop flow.

c. The temperature difference between the reactor coolant in the respective recirculation loop and in the reactor meets the limit during recirculation pump startup, vessel and during increases in THERMAL POWER or loop flow while operating at low THERMAL POWER or loop flow.

d. RCS pressure and temperature are within the core critical limits prior to achieving criticality.

e. The reactor vessel flange and the head flange temperatures are within limits when tensioning the reactor vessel head bolting studs.

These limits define allowable operating regions and permit a large number of operating cycles while also providing a wide margin to nonductile failure.

The rate of change of temperature limits control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and inservice leak and (continued)

RIVER BEND _

0 .+- Z Revision No. 6-4

RCS P/T Limits B 3.4.11 BASES LCO hydrostatic testing P/T limit curves. Thus, the LCO for the (continued) rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.

Violation of the limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCS components. The consequences depend on several factors, as follows:

a. The severity of the departure from the allowable operating pressure temperature regime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and

c. The existences, sizes, and orientations of flaws in the vessel material.

APPLICABILITY The potential for violating a P/T limit exists at all times.

For example, P/T limit violations could result from ambient temperature conditions that result in the reactor vessel metal temperature being less than the minimum allowed temperature for boltup. Therefore, this LCO is applicable even when fuel is not loaded in the core.

ACTIONS A.1 and A.2 Operation outside the P/T limits while in MODE 1, 2, or 3 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.

The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.

Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed if continued operation is desired.

(continued)

B 3.4-56 Revision No. 0 RIVER BEND

RCS P/T Limits B 3.4.11 BASES SURVEILLANCE SR 3.4.11.8 and SR 3.4.11.9 (continued)

REQUIREMENTS Plant sDecific test data has determined that the bottom head is not subject to temperature stratification with natural circulation at power levels as low as 36% of RTP or with any single loop flow rate when the recirculation pump is on high speed operation. Therefore. SR 3.4.11.8 and SR 3.4.11.9 have been modified by a Note that requires the Surveillance to be met only when THERMAL POWER or loop flow is being increased when the above conditions are not met. The Note for SR 3.4.11.9 further limits the requirement for this Surveillance to exclude comparison of the idle loop temperature if the idle loop is isolated from the RPV since the water in the loop can not be introduced into the remainder of the reactor coolant system.

REFERENCES 1. 10 CFR 50, Appendix G.

2. ASME. Boiler and Pressure Vessel Code,Section III.

Appendix G.

3. ASTM E 185-82, "Standard Practice for Conducting Surveillance Tests For Light-Water Cooled Nuclear Power Reactor Vessels," July 1982.

4. 10 CFR 50. Appendix H.

5. Regulatory Guide 1.99, Revision 2, May 1988.

6. ASME. Boiler and Pressure Vessel Code,Section XI.

Appendix E.

7. R.G. Carey and B.J. Branlund, "105% Power Uprate Evaluation Report for Entergy Operations Inc. River Bend Station GE Task No. 12.0 Reactor Vessel Fracture Toughness," GE-NE, San Jose. CA, February 1999. (GE-NE-A22-00081-12).

8. USAR, Section 15.4.4.

RIVER BEND B 3.4-61 Revision No. 6-4

Reactor Steam Dome Pressure B 3.4.12 8 3.4 REACTOR COOLANT SYSTEM (RCS) 8 3.4.12 Reactor Steam Dome Pressure BASES BACKGROUND The reactor steam dome pressure is an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria and is also an assumed initial condition of Design Basis Accidents (DBAs) and transients.

APPLICABLE The reactor steam dome pressure of : 1045 psig is an SAFETY ANALYSES initial condition of the vessel overpressure protection analysis of Reference 1. This analysis assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system, primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance with the overpressure criteria is dependent on the initial reactor steam dome pressure; therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved. Reference 2 also assumes an initial reactor steam dome pressure for the analysis of DBAs and transients used to determine the limits for fuel cladding integrity MCPR (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1% cladding plestic strain (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)").

Reactor steam dome pressure satisfies the requirements of Criterion 2 of the NRC Policy Statement.

LCO The specified reactor steam dome pressure limit of

1045 psig ensures the plant is operated within the assumptions of the vessel overpressure protection analysis.

Operation above the limit may result in a transient response more severe than analyzed.

APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam, and events which may challenge the overpressure limits are possible.

(continued)

RIVER BEND 8 3.4-62 Revision No. 0

Main Turbine Bypass System B375 B 3.7 PLANT SYSTEMS B 3.7.5 Main Turbine Bypass System BASES BACKGROUND The Main Turbine Bypass System is designed to control steam pressure when reactor steam generation exceeds turbine requirements during unit startup, sudden load reduction, and cooldown. It allows excess steam flow from the reactor to the condenser without going through the turbine.

The bypass capacity of the system is 9.5% of the Nuclear Steam Supply System rated steam flow. Sudden load reductions within the capacity of the steam bypass can be accommodated without reactor scram. The Main Turbine Bypass System consists of a two valve chest connected to the main steam lines between the main steam isolation valves and the turbine stop valves. Each of these valves is sequentially operated by hydraulic cylinders. The bypass valves are controlled by the pressure regulation function of the Turbine Pressure Regulator and Control System, as discussed in the USAR, Section 7.7.1.4 (Ref. 1). The bypass valves are normally closed, and the pressure regulator controls the turbine control valves.

directing all steam flow to the turbine.

If the speed governor or the load limiter restricts steam flow to the turbine, the pressure regulator controls the system pressure by opening the bypass valves. When the bypass valves open, the steam flows from the bypass chest, through connecting piping, to the pressure breakdown assemblies, where a series of orifices are used to further reduce the steam pressure before the steam enters the condenser.

APPLICABLE The Main Turbine Bypass System is assumed SAFETY ANALYSES to function during the design basis feedwater controller failure, maximum demand event, described in the USAR, Section 15.1.2 (Ref. 2). Opening the bypass valves during the pressurization event mitigates the increase in reactor vessel pressure, which affects the MCPR during the event. An inoperable Main Turbine Bypass System may result in an MCPR penalty.

The Main Turbine Bypass System Satisfies Criterion 3 of the NRC Policy Statement.

(continued)

I RIVER BEND B 3.7-25 Revision No. 6-4

Main Turbine Bypass System B 3.7.5 BASES (continued)

LCO The Main Turbine Bypass System is required to be OPERABLE to limit peak pressure in the main steam lines and maintain reactor pressure within acceptable limits during events that cause rapid pressurization, such that the Safety Limit MCPR is not exceeded.

An OPERABLE Main Turbine Bypass System requires the bypass valves to open in response to increasing main steam line pressure. This response is within the assumptions of the applicable analysis (Ref. 2).

APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at a 25% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated during the feedwater controller failure, maximum demand event. As discussed in the Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," sufficient margin to these limits exists < 25% RTP. Therefore, these requirements are only necessary when operating at or above this power level.

ACTIONS A.1 If the Main Turbine Bypass System is inoperable (one or more bypass valves inoperable), the assumptions of the design basis transient analysis may not be met. Under such circumstances, prompt action should be taken to restore the Main Turbine Bypass System to OPERABLE status. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is reasonable, based on the time to complete the Required Action and the low probability of an event occurring during this period requiring the Main Turbine Bypass System.

B.1 If the Main Turbine Bypass System cannot be restored to OPERABLE status within the associated Completion Time, THERMAL POWER must be reduced to < 25% RTP. As discussed in the Applicability section, operation at < 25% RTP results in (continued)

RIVER BEND B 3.7-26 Revision No. 0

Primary Containment and Orywell Isolation Instrumentation B 3.3.6.1 BASES REFERENCES 6. NEDC-30851-P-A, Supplement 2, "Technical (continued) Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation," March 1989.

7. RBS Technical Requirements Manual.

8. NEDO-32291-A, "System Analyses for Elimination of Selected Response Time Testing Requirements," January 1994.

RIVER BEND 8 3.3-169 Revision No. 0

Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 B 3.3 INSTRUMENTATION B 3.3.6.2 Secondary Containment and Fuel Building Isolation Instrumentation BASES BACKGROUND The secondary containment isolation instrumentation automatically initiates closure of appropriate secondary containment isolation dampers (SCIDs) and starts appropriate ventilation subsystems.

Similarly. the fuel building isolation instrumentation automatically initiates closure of appropriate fuel building isolation dampers (FBIDs) and initiates fuel building ventilation flow through the filtration system. The function of these systems, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Ref. 1). such that offsite radiation exposures are maintained within the requirements of 10 CFR 100 that are part of the NRC staff approved licensing basis. Secondary containment isolation and establishment of vacuum within the assumed time limits ensures that fission products that leak from primary containment following a DBA. or are released outside primary containment or during certain operations when primary containment is not required to be OPERABLE are maintained within applicable limits. Fuel building isolation ensures that fission products released due to fuel uncovery or a dropped fuel assembly are also maintained within regulatory limits.

The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of secondary containment isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logic are (a) reactor vessel water level, (b) drywell pressure, and (c) fuel building ventilation exhaust radiation. Redundant sensor input signals from each parameter are provided for initiation of isolation parameters. In addition, manual initiation of the logic is provided.

(conti nued)

RIVER BEND B 3.3-170 Revision No. 6-5

Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE The isolation signals generated by the secondary containment SAFETY ANALYSES, isolation instrumentation are implicitly assumed in the LCO. and safety analyses of References 1 and 2 to initiate closure of APPLICABILITY dampers and start appropriate ventilation subsystems to limit offsite doses. The isolation signals generated by the fuel building isolation instrumentation ensure that the ventilation system is properly aligned for filtration to limit offsite doses.

Refer to LCO 3.6.4.2, "Secondary Containment Isolation Dampers (SCIDs) and Fuel Building Isolation Dampers (FBIDs)." and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System," Applicable Safety Analyses Bases for more detail of the safety analyses.

The secondary containment isolation instrumentation and fuel building isolation instrumentation satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the isolation instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions. Each Function must have the required number of OPERABLE channels with their setpoints set within the specified Allowable Values, as shown in Table 3.3.6.2-1. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Each channel must also respond within its assumed response time, where appropriate.

Allowable Values are specified for each Function specified in the Table. Nominal trip setpoints are specified in setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Values between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g.. reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The (continued)

RIVER BEND 8 3.3-171 Revision No. 6-5

Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE trip setpoints are then determined accounting for the remaining SAFETY ANALYSES, instrument errors (e.g., drift). The trip setpoints derived in LCO. and this manner provide adequate protection because instrumentation APPLICABILITY uncertainties, process effects, calibration tolerances, instrument (continued) drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions when SCIDs, FBIDs and the SGT System are required.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Vessel Water Level-Low Low, Level 2 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The Reactor Vessel Water Level-Low Low, Level 2 Function is one of the Functions assumed to be OPERABLE and capable of providing isolation and initiation signals. The isolation and initiation of systems on Reactor Vessel Water Level-Low Low, Level 2 support actions to ensure that any offsite releases are within the limits calculated in the safety analysis.

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the High Pressure Core Spray (HPCS)/Reactor Core Isolation Cooling (RCIC) Reactor Vessel Water Level-Low Low, Level 2 Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation," and LCO 3.3.5.2, "Reactor Core Isolation Cooling (RCIC) System Instrumentation"),

since this could indicate the capability to cool the fuel is being threatened.

(continued)

RIVER BEND B 3.3-172 Revision No. 6-5

Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 1. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES. (continued)

LCO. and APPLICABILITY The Reactor Vessel Water Level-Low Low. Level 2 Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the Reactor Coolant System (RCS); thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5. the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, this Function is not required.

2. Drywell Pressure-High High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The isolation of high drywell pressure supports actions to ensure that any offsite releases are within the limits calculated in the safety analysis. However, the Drywell Pressure-High Function associated with isolation is not assumed in any USAR accident or transient analysis. It is retained for the secondary containment isolation instrumentation as required by the NRC approved licensing basis.

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Four channels of Drywell Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was chosen to be the same as the ECCS Drywell Pressure-High Function Allowable Value (LCO 3.3.5.1) since this is indicative of a loss of coolant accident.

The Drywell Pressure-High Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the RCS: thus, there is a probability of pipe breaks resulting in significant releases of radioactive (continued)

RIVER BEND B 3.3-173 Revision No. 6-5

_-L, Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 2. Drywell Pressure-High SAFETY ANALYSES, (continued)

LCO. and APPLICABILITY steam and gas. This Function is not required in MODES 4 and 5 because the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES.

3 and 4. Fuel Building Ventilation Exhaust Radiation-High High fuel building exhaust radiation is an indication of possible gross failure of the fuel cladding. The release may have originated from the primary ccntainment due to a break in the RCPB or the fuel building due to a fuel handling accident. When Exhaust Radiation-High is detected, fuel building isolation and actuation of the associated ventilation filtration system are initiated to limit the release of fission products as assumed in the USAR safety analyses (Ref. 1).

The Exhaust Radiation-High signals are initiated from radiation detectors that are located on the ventilation exhaust duct coming from the fuel building ventilation. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding.

The Exhaust Radiation-High Function is required to be OPERABLE during movement of recently irradiated fuel assemblies in the fuel building because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies) must be provided to ensure that offsite dose limits are not exceeded. "Recently irradiated fuel" is fuel that has occupied part of a critical reactor core within the previous 11 days.

(continued)

RIVER BEND B 3.3-174 Revision No. 6-5

Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 5. Manual Initiation SAFETY ANALYSES, LCO, and The Manual Initiation push button channels introduce signals APPLICABILITY into the secondary containment and fuel building isolation logic (continued) that are redundant to the automatic protective instrumentation channels, and provide manual isolation capability. There is no specific USAR safety analysis that takes credit for this Function.

It is retained for the isolation instrumentation as required by the NRC approved licensing basis.

There are four push buttons for the logic, two manual initiation push buttons per trip system. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

Four channels of the Manual Initiation Function are available and are required to be OPERABLE in MODES 1, 2. and 3, since these are the MODES and other specified conditions in which the Secondary Containment Isolation automatic Functions are required to be OPERABLE.

Moving recently irradiated fuel assemblies in the fuel building requires only that portion of the Manual Initiation Function associated with the fuel building to be OPERABLE.

ACTIONS A Note has been provided to modify the ACTIONS related to isolation instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable secondary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable isolation instrumentation channel.

(continued)

RIVER BEND B 3.3-175 Revision No. 6-5

Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 BASES ACTIONS A.1 (continued)

Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design. an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , depending on the Function. has been shown to be acceptable (Refs. 3 and 4) to permit restoration of any inoperable channel to OPERABLE status.

Functions that share common instrumentation with the RPS have a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed out of service time consistent with the time provided for the associated RPS instrumentation channels. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.I. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately. if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation), Condition C must be entered and its Required Actions taken.

B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic isolation capability for the associated penetration flow path(s) or a complete loss of automatic initiation capability for the various ventilation subsystems. A Function is considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two SCIDs or FBIDs in the associated penetration flow path and one ventilation subsystem can be initiated on an isolation signal from the given Function. For the Functions with two two-out-of-two logic trip systems (Functions 1 and 2), this would require one trip system to have two channels, each OPERABLE or in trip. The Condition does not include the Manual Initiation Function (Function 5), since it is not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action A.1) is allowed.

(continued)

RIVER BEND 8 3.3-176 Revision No. 6-5

Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 BASES ACTIONS C.1.1, C.1.2, C.2.1, and C.2.2 (continued)

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

If any Required Action and associated Completion Time of Condition A or B are not met, the ability to isolate the associated secondary containment or fuel building and start the associated ventilation subsystems cannot be ensured. Therefore, further actions must be performed to ensure the ability to maintain the secondary containment function. Isolating the associated penetration flow path(s) and starting the associated ventilation subsystems (Required Actions C.1.1 and C.2.1) performs the intended function of the instrumentation and allows operations to continue.

Alternatively, declaring the associated SCIDs, or FBIDs or associated ventilation subsystem inoperable (Required Actions C.1.2 and C.2.2) is also acceptable since the Required Actions of the respective LCOs (LCO 3.6.4.2, LCO 3.6.4.3, LCO 3.6.4.4, and LCO 3.6.4.7) provide appropriate actions for the inoperable components.

One hour is sufficient for plant operations personnel to establish required plant conditions or to declare the associated components inoperable without challenging plant systems.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each Isolation REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.6.2-1.

The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains secondary containment isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Action(s) taken.

(continued)

RIVER BEND 8 3.3-177 Revision No. 6-5

Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE This Note is based on the reliability analysis (Refs. 3 REQUIREMENTS and 4) assumption of the average time required to perform (continued) channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the SCIDs will isolate the associated penetration flow paths and the associated ventilation subsystems will initiate when necessary.

SR 3.3.6.2.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the indicated parameter for one instrument channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure: thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.6.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

(continued)

RIVER BEND B 3.3-178 Revision No. 6-5

Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE SR 3.3.6.2.2 (continued)

REQUIREMENTS Any setpoint adjustment shall be left set consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of 92 days is based upon the reliability analysis of References 3 and 4.

SR 3.3.6.2.3 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.2-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of References 3 and 4.

SR 3.3.6.2.4 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency is based upon the assumption of the magnitude of equipment drift in the setpoint analysis.

(continued)

RIVER BEND B 3.3-179 Revision No. 6-5

Secondary Containment and Fuel Building Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE SR 3.3.6.2.5 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing, performed on SCIDs and the associated ventilation subsystems in LCO 3.6.4.2. LCO 3.6.4.3. LCO 3.6.4.4, LCO 3.6.4.6, and LCO 3.6.4.7. respectively, overlaps this Surveillance to provide complete testing of the assumed safety function.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency.

REFERENCES 1. USAR. Section 6.3.

2. USAR. Chapter 15.

3. NEDC-31677-P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"

July 1990.

4. NEDC-30851-P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentations Common to RPS and ECCS Instrumentation." March 1989.

RIVER BEND B 3.3-180 Revision No. 6-5

Secondary Containment- Operating B 3.6.4.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.1 Secondary Containment- Operating BASES BACKGROUND The function of the secondary containment is to contain, dilute.

and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment (SGT)

System and closure of certain valves whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment and to isolate and contain fission products that are released during certain operations that take place inside primary containment, when primary containment is not required to be OPERABLE, or that take place outside primary containment.

The secondary containment consists of the shield building and auxiliary building, and completely encloses the primary containment and those components that may be postulated to contain primary system fluid. This structure forms a control volume that serves to hold up and dilute the fission products.

It is possible for the pressure in the control volume to rise relative to the environmental pressure (e.g., due to pump/motor heat load additions). To prevent ground level exfiltration while allowing the secondary containment to be designed as a conventional structure, the secondary containment requires support systems to maintain the control volume pressure at less than the external pressure. Requirements for these systems are specified separately in LCO 3.6.4.2, "Secondary Containment Isolation Dampers (SCIDs) and Fuel Building Isolation Dampers (FBIDs)," LCO 3.6.4.3, "Standby Gas Treatment (SGT) System," and LCO 3.6.4.4. "Shield Building Annulus Mixing System."

The isolation devices for the penetrations in the secondary containment boundary are a part of the secondary containment barrier. To maintain this barrier:

a. All Auxiliary Building penetrations and Shield Building annulus penetrations required to be closed during accident conditions are either:

(continued)

RIVER BEND B 3.6-83 Revision No. 6-5

Secondary Containment- Operating B 3.6.4.1 BASES BACKGROUND 1. Capable of being closed by an OPERABLE secondary (continued) containment automatic isolation signal, or

2. Closed by at least one manual valve, blind flange, or deactivated automatic valve or damper, as applicable, secured in its closed position, except as provided in LCO 3.6.4.2;

b. All Auxiliary Building and Shield Building Annulus equipment hatches are closed and sealed:

c. The Standby Gas Treatment System is OPERABLE, except as provided in LCO 3.6.4.3: and

d. At least one door in each access to the Auxiliary Building and Shield Building Annulus is closed, except for routine entry and exit of personnel and equipment.

APPLICABLE The principal accident for which credit is taken for secondary SAFETY ANALYSES containment OPERABILITY is a LOCA (Ref. 1). The secondary containment performs no active function in response to this limiting event; however, its leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage paths and associated leakage rates assumed in the accident analysis, and that fission products entrapped within the secondary containment structures will be treated by the SGT System prior to discharge to the environment.

Secondary containment--operating satisfies Criterion 3 of the NRC Policy Statement, LCO An OPERABLE secondary containment provides a control volume into which fission products that bypass or leak from primary containment, or are released from the reactor coolant pressure boundary components located in the shield building or (continued)

RIVER BEND B 3.6-84 Revision No. 6-5

Secondary Containment- Operating B 3.6.4.1 BASES LCO auxiliary building, can be diluted and processed prior to (continued) release to the environment. For the secondary containment to be considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained.

APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, secondary containment OPERABILITY is required during the same operating conditions that require primary containment OPERABILITY.

In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5 to ensure a control volume, except for other situations for which significant releases of radioactive material can be postulated, such as during movement of irradiated fuel assemblies in the fuel building. The fuel building OPERABILITY during irradiated fuel handling is addressed in LCO 3.6.4.7. "Fuel Building Ventilation Systems- Fuel Handling."

ACTIONS A.1 If secondary containment is inoperable, it must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during MODES 1, 2. and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal.

B.1 and B.2 If the secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating (continued)

RIVER BEND B 3.6-85 Revision No. 6-5

Secondary Containment--Operating B 3.6.4.1 BASES ACTIONS B.1 and B.2 (continued) experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.4.1.1 REQUIREMENTS This SR ensures that the shield building annulus and auxiliary building is sufficiently leak tight to preclude exfiltration under expected wind conditions. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of this SR was developed based on operating experience related to secondary containment vacuum variations during the applicable MODES and the low probability of a DBA occurring between surveillances.

Furthermore, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal secondary containment vacuum condition.

SR 3.6.4.1.2 and SR 3.6.4.1.3 Verifying that secondary containment equipment hatches are closed/installed and access doors are closed ensures infiltration of outside air of such a magnitude that the as to prevent maintaining the desired negative pressure does not occur.

Verifying that all such openings are closed provides adequate assurance that exfiltration from the secondary containment will not occur. In this application the term "sealed" has no connotation of leak tightness, rather inadvertent opening is prevented. Maintaining secondary containment OPERABILITY requires verifying each door in the access opening is closed, except when the access opening is being used for entry and exit.

Verifying the main plant exhaust duct drain loop seal and the turbine building/auxiliary building exhaust duct drain loop seals are full of water also prevents infiltration of outside air and exfiltration from the secondary containment. The Frequency for these SRs has been shown to be adequate31 day based on operating experience, and is considered adequate in view of the other controls on secondary containment access openings.

(continued)

RIVER BEND 8 3.6-86 Revision No. 6-5

Secondary Containment- Operating B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.4 and SR 3.6.4.1.6 REQUIREMENTS The SGT System exhausts the shield building annulus and auxiliary building atmosphere to the environment through appropriate treatment equipment. To ensure that all fission products are treated, SR 3.6.4.1.4 verifies that the SGT System will rapidly establish and maintain a pressure in the shield building annulus and auxiliary building that is less than the lowest postulated pressure external to the secondary containment boundary. This is confirmed by demonstrating that one SGT subsystem will draw down the shield building annulus and auxiliary building to Ž 0.5 and

0.25 inches of vacuum water gauge in

18.5 and

13.5 seconds, respectively. This cannot be accomplished if the secondary containment boundary is not intact. SR 3.6.4.1.6 demonstrates that each SGT subsystem can maintain ; 0.5 and

Ž 0.25 inches of vacuum water gauge for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months test period allows shield building annulus and auxiliary building to be in thermal equilibrium at steady state conditions. Therefore, these two tests are used to ensure the integrity of this portion of the secondary containment boundary. Since these SRs are secondary containment tests, they need not be performed with each SGT subsystem. The SGT subsystems are tested on a STAGGERED TEST BASIS, however, to ensure that in addition to the requirements of LCO 3.6.4.3, either SGT subsystem will perform this test.

Operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. USAR, Section 15.6.5.

2. USAR, Section 15.7.4.

RIVER BEND B 3.6-87 Revision No. 6-5

Secondary Containment- Operating B 3.6.4.1 THIS PAGE INTENTIONALLY LEFT BLANK RIVER BEND B 3.6-88 Revision No. 6-5

SCIDs/FBIDs B 3.6.4.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.2 Secondary Containment Isolation Dampers (SCIDs) and Fuel Building Isolation Dampers (FBIDs)

BASES I BACKGROUND The function of the SCIDs and FBIDs. in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Ref. 1). Secondary containment isolation within the time limits specified for those isolation dampers designed to close automatically ensures that fission products that leak from primary containment following a DBA, that are released during certain operations when primary containment is not required to be OPERABLE, or that take place outside primary containment.

are maintained within the secondary containment boundary. The fuel building isolation dampers that are designed to close automatically ensure that fission products following a fuel handling accident (FHA) are maintained within the fuel building boundary.

The OPERABILITY requirements for SCIDs and FBIDs help ensure that an adequate secondary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. Isolation barrier(s) for the penetration are discussed in Reference 2. The isolation devices addressed by this LCO are either passive or active (automatic). Manual dampers. de-activated automatic dampers secured in their closed position, check dampers with flow through the damper secured, and blind flanges are considered passive devices. Check dampers and other automatic dampers designed to close without operator action following an accident are considered active devices.

Automatic SCIDs close on a secondary containment isolation signal to establish a boundary for untreated radioactive material within secondary containment following a DBA. Similarly. automatic FBIDs close on a fuel building isolation signal to establish a boundary for untreated radioactive material within the fuel building following a FHA.

Other penetrations are isolated by the use of dampers or valves in the closed position or blind flanges.

APPLICABLE The SCIDs and FBIDs must be OPERABLE to ensure the barrier to SAFETY ANALYSES fission product releases is established. The principal accident for which the secondary containment boundary is required is a loss of coolant accident (Ref. 1). The principal accident for which the fuel building barrier is required is the fuel handling accident (FHA) in the fuel building (Ref. 3). The secondary (continued)

RIVER BEND B 3.6-89 Revision No. 6-5

SCIOs/FBIDs B 3.6.4.2 BASES APPLICABLE containment and fuel building do not perform an active function SAFETY ANALYSES in response to these limiting events. However, the boundary (continued) established by SCIDs and FBIDs are required to ensure that fission products are processed by the ventilation systems before being released to the environment.

Maintaining SCIDs and FBIDs OPERABLE with isolation times within limits ensures that fission products will remain trapped inside secondary containment so that they can be treated by the SGT System (following a LOCA) or Fuel Building Ventilation System (following a FHA) prior to discharge to the environment.

SCIDs and FBIDs satisfy Criterion 3 of the NRC Policy Statement.

LCO SCIDs form a part of the secondary containment boundary. The SCID safety function is related to control of offsite radiation releases resulting from DBAs.

FBIDs form a part of the fuel building boundary. The FBID safety function is related to control of offsite radiation releases resulting from a fuel handling accident.

The power operated isolation dampers are considered OPERABLE when their isolation times are within limits. Additionally, power operated automatic dampers are required to actuate on an automatic isolation signal.

The normally closed isolation dampers or blind flanges are considered OPERABLE when manual dampers are closed or open in accordance with appropriate administrative controls, automatic dampers are de-activated and secured in their closed position, or blind flanges are in place. The SCIDs and FBIDs covered by this LCO, along with their associated stroke times, if applicable, are listed in Reference 4.

APPLICABILITY In MODES 1, 2. and 3, a DBA could lead to a fission product release to the primary containment that leaks to the secondary containment. Therefore, OPERABILITY of SCIDs is required.

In MODES 4 and 5, the probability and consequences of these events are reduced due to pressure and temperature limitations in these MODES. Therefore, maintaining SCIDs OPERABLE is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated.

(continued)

RIVER BEND B 3. 6-90 Revision No. 6-5

SCIDs/FBIDs B 3.6.4.2 BASES APPLICABILITY such as during movement of recently irradiated fuel assemblies (continued) (i.e., fuel that has occupied part of a critical core within the previous 11 days). Moving irradiated fuel assemblies in the Primary Containment is addressed adequately in LCO 3.6.1.10, "Primary Containment--Shutdown."

Moving recently irradiated fuel assemblies in the fuel building will require only the FBIDs associated with the fuel building to be OPERABLE.

ACTIONS The ACTIONS are modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator. who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when the need for secondary containment isolation is indicated.

The second Note provides clarification that for the purpose of this LCO separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SCID or FBID. Complying with the Required Actions may allow for continued operation. and subsequent inoperable SCIDs or FBIDs are governed by subsequent Condition entry and application of associated Required Actions.

The third Note ensures appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable SCID or FBID.

A.1 and A.2 In the event that there are one or more penetration flow paths with one SCID or one FBID inoperable, the affected penetration flow path(s) must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criteria are a closed and de-activated automatic damper, a closed manual damper or a blind flange. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available device to the applicable isolation boundary. This Required Action must be completed within the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion (continued)

RIVER BEND B 3.6-91 Revision No. 6-5

SCiDs/FBIDs B 3.6.4.2 BASES ACTIONS A.1 and A.2 (continued)

Time. The specified time period is reasonable considering the time required to isolate the penetration and the low probability of a DBA, which requires the SCIDs or FBIDs to close, occurring during this short time.

For affected penetrations that have been isolated in accordance with Required Action A.1. the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that secondary containment or fuel building penetrations required to be isolated following an accident, but no longer capable of being automatically isolated, will be isolated should an event occur. This Required Action does not require any testing or isolation device manipulation. Rather, it involves verification that the affected penetration remains isolated.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable.

since access to these areas is typically restricted. Therefore.

the probability of misalignment once they have been verified to be in the proper position, is low.

B._1 With two SCIDs or two FBIDs in one or more penetration flow paths inoperable (Condition A is entered if one SCID or one FBID is inoperable in each of two penetrations), the affected penetration flow path must be isolated within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic damper, a closed manual damper, and a blind flange. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, considering the time required to isolate the penetration and the low probability of a DBA, which requires the SCIDs or FBIDs to close, occurring during this short time.

(continued)

RIVER BEND B 3.6-92 Revision No. 6-5

SCIDs/FBIDs B 3.6.4.2 BASES ACTIONS C.1 and C.2 (continued)

If any Required Action and associated Completion Time cannot be met for SCIDs. the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1. D.2. and D.3 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LCO does not apply. When applicable, movement of recently irradiated fuel assemblies in the fuel building must be immediately suspended. Suspension of this activity shall not preclude completion of movement of a component to a safe position.

Required Action D.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1. 2, or 3. the fuel movement is independent of reactor operations.

Therefore, in either case, inability to suspend movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.4.2.1 REQUIREMENTS Verifying the isolation time of each required power operated automatic SCID and FBID is within limits is required to demonstrate OPERABILITY. The isolation time test ensures that the SCIDs and FBIDs will isolate in a time period less than or equal to that assumed in the safety analyses. The Frequency of this SR is 92 days.

(continued)

RIVER BEND B 3.6-93 Revision No. 6-5

SCIDs/FBIDs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.2 REQUIREMENTS (continued) Verifying that each required automatic SCID and FBID closes on an isolation signal is required to prevent leakage of radioactive material from secondary containment or fuel building following a DBA or other accidents. This SR ensures that each automatic SCID will actuate to the isolation position on a secondary containment isolation signal and that each FBID will actuate on a fuel building isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide complete testing of the safety function. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. USAR, Section 15.6.5.

2. USAR, Section 6.2.3.

3. USAR. Section 15.7.4.

4. TRM, Table 3.6.4.2-1.

RIVER BEND B 3.6-94 Revision No. 6-5

SCIDs/FBIDs B 3.6.4.2 THIS PAGE INTENTIONALLY LEFT BLANK RIVER BEND B 3.6-95 Revision No. 6-5

SGT System 8 3 64.3 B 3 6 CONTAINMNT SYSTEMS B 3 6 4 3 Standby Gas Treatment (SGT) System 3ASES BACKGROUND The SGT System is required by 10 CFR 50. Appendix A. GDC 41.

"Containment Atmosphere Cleanup" (Ref- 1). The function of the SGT System is to ensure that radioactive materials that leak from the primary containment into the secondary containment following a Design Basis Accident (DBA) are filtered and adsorbed prior to exhausting to the environment.

The SGT System consists of two fully redundant subsystems, each with its own set of ductwork. dampers, charcoal filter train, and controls.

Each charcoal filter train consists of (components listed in order of the direction of the air flow):

a. A moisture separator:

b An electric heater; c A prefilter:

d. A high efficiency particulate air (HEPA) filter:

e. A charcoal adsorber:

f. A second HEPA filter: and

g. A centrifugal fan.

The SGT System serves as a backup non-ESF system to the Annulus Pressure Control System (APCS) during normal operation. Upon loss of the APCS. or upon an ESF signal (i.e.. LOCA). the annulus air and air from the shielded compartments in the auxiliary building are automatically diverted through the SGT System filter trains.

(conti nued)

RIVER BEND B 3.6-96 Revision No. 0

Annulus Mixing System B 3.6.4.4 BASES (continued)

SURVEILLANCE SR 3.6.4.4.1 REQUIREMENTS Operating each shield building annulus mixing subsystem for a 15 minutes ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action.

The 31 day Frequency was developed in consideration of the known reliability of fan motors and controls and the redundancy available in the system.

SR 3.6.4.4.2 This SR requires verification that each shield building annulus mixing subsystem starts upon receipt of an actual or simulated initiation signal. The LOGIC'SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide complete testing of the safety function. While this Surveillance can be performed with the reactor at power, operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. USAR, Section 15.6.5.

RIVER BEND 8 3.6-103 Revision No. 0

Fuel Building B 3.6.4.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.5 Fuel Building BASES BACKGROUND The function of the fuel building is to contain, dilute, and hold up fission products that are released from a design basis accident. In conjunction with operation of the Fuel Building Charcoal Filtration (FBCF) System and closure of certain valves whose lines penetrate the fuel building, the fuel building is designed to reduce the activity level of the fission products prior to release to the environment.

The fuel building is a structure that houses the spent fuel pool.

This structure forms a control volume that serves to hold up and dilute the fission products. To prevent ground level exfiltration, the fuel building requires support systems to maintain the control volume pressure at less than the external pressure. Requirements for these systems are specified separately in LCO 3.6.4.2, "Secondary Containment Isolation Dampers (SCIDs)." and LCO 3.6.4.7, "Fuel Building Ventilation System - Fuel Handling."

APPLICABLE The principal accident for which credit is taken for the fuel SAFETY ANALYSES building OPERABILITY is a Fuel Handling Accident (FHA) inside the fuel building (Ref. 1). The fuel building performs no active function in response to this event: however, its leak tightness is required to ensure that the release of radioactive materials is restricted to those leakage rates assumed in the accident analysis.

The fuel building satisfies Criterion 3 of the NRC Policy Statement.

LCO An OPERABLE fuel building provides a control volume into which fission products can be diluted and processed prior to release.

For the fuel building to be considered OPERABLE. it must have adequate leak tightness to ensure the required vacuum can be established and maintained.

(continued)

RIVER BEND B 3.6-104 Revision No. 6-5

Fuel Building B 3.6.4.5 BASES (continued)

APPLICABILITY Regardless of the plant operating MODE, anytime recently irradiated fuel is being handled there is the potential for a FHA and the fuel building OPERABILITY is required to mitigate the consequences.

ACTIONS A.1 With the fuel building inoperable the plant must be brought to a condition in which the LCO does not apply since it is incapable of performing its required accident mitigation function. To achieve this, handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical core within the previous 11 days) must be suspended immediately. Suspension shall not preclude completion of fuel movement to a safe position.

SURVEILLANCE SR 3.6.4.5.1 REQUIREMENTS This SR ensures that the fuel building boundary is sufficiently leak tight to preclude exfiltration under expected wind conditions. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of this SR was developed based on operating experience related to fuel building vacuum variations during the applicable MODES and the low probability of a FHA occurring between surveillances.

Furthermore, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal fuel building vacuum condition.

SR 3.6.4.5.2 and SR 3.6.4.5.3 Verifying that fuel building equipment hatches are installed and access doors are closed ensures that the infiltration of outside air of such a magnitude as to prevent maintaining the desired negative pressure does not occur. Verifying that all such openings are closed provides adequate assurance that exfiltration from the fuel building will not occur. Maintaining fuel building OPERABILITY requires verifying each door in the access opening is closed, except when the access opening is being used for entry and exit.

(continued)

RIVER BEND B 3.6-105 Revision No. 6-5

Fuel Building B 3.6.4.5 BASES SURVEILLANCE SR 3.6.4.5.2 and SR 3.6.4.5.3 (continued)

REQUI REMENTS The 31 day Frequency for these SRs has been shown to be adequate based on operating experience, and is considered adequate in view of the other indications of door and hatch status that are available to the operator.

REFERENCES 1. USAR, Chapter 15.

RIVER BEND B 3.6-106 Revision No. 0

Fuel Building Ventilation System- Operating B 3.6.4.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.6 Deleted RIVER BEND B 3.6-107 Revision No. 6-5

Fuel Building Ventilation System-Operating B 3.6.4.6 THIS PAGE INTENTIONALLY LEFT BLANK RIVER BEND B 3.6-108 Revision No. 6-5

Fuel Building Ventilation System-Operating B 3.6.4.6 THIS PAGE INTENTIONALLY LEFT BLANK RIVER BEND B 3.6-109 Revision No. 6-5

Fuel Building Ventilation System-Operating B 3.6.4.6 THIS PAGE INTENTIONALLY LEFT BLANK RIVER BEND B 3.6-110 Revision No- 6-S

Fuel Building Ventilation System-Operating B 3.6.4,6 THIS PAGE INTENTIONALLY LEFT BLANK RIVER BEND B 3.6-111 Revision No. 6-5

Fuel Building Ventilation System-Fuel BHandling 3.6.4.7 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.7 Fuel Building Ventilation System-Fuel Handling BASES BACKGROUND The Fuel Building Ventilation System is required by 10 CFR 50, Appendix A, GDC 41, "Containment Atmosphere Cleanup" (Ref. 1). The function of the Fuel Building Ventilation System is to ensure that radioactive materials that escape from fuel assemblies damaged following a design basis Fuel Handling Accident (FHA) are filtered and adsorbed prior to exhausting to the environment.

The Fuel Building Ventilation System consists of two fully redundant subsystems, each with its own set of ductwork, dampers, charcoal filter train, and controls.

Each charcoal filter train consists of (components listed in order of the direction of the air flow):

a. A moisture separator;

b. An electric heater;

c. A prefilter;

d. A high efficiency particulate air (HEPA) filter;

e. A charcoal adsorber;

f. A second HEPA filter; and

g. A centrifugal fan with inlet flow control vanes.

The moisture separator is provided to remove entrained water in the air, while the electric heater reduces the relative humidity of the airstream to less than 70% (Ref. 2). The prefilter removes large particulate matter, while the HEPA filter is provided to remove fine particulate matter and protect the charcoal from fouling. The charcoal adsorber removes gaseous elemental iodine and organic iodides, and the final HEPA filter is provided to collect any carbon fines exhausted from the charcoal adsorber.

(continued)

RIVER BEND B 3.6-112 Revision No. 0

Fuel Building Ventilation System-- Fuel Handling B 3.6.4.7 BASES BACKGROUND The Fuel Building Ventilation System automatically starts (continued) and operates in response to actuation signals indicative of conditions or an accident that could require operation of the system.

APPLICABLE The design basis for the Fuel Building Ventilation System is SAFETY ANALYSES to mitigate the consequences of a fuel handling accident (Ref. 3). For all events analyzed, the Fuel Building Ventilation System is shown to reduce, via filtration and adsorption, the radioactive material released to the environment. Since the system is assumed to filter all releases, with the analysis not accounting for any delay in system startup, at least one subsystem must be in operation while handling recently irradiated fuel (i.e., fuel that has occupied part of a critical core within the previous 11 days).

The Fuel Building Ventilation System satisfies Criterion 3 of the NRC Policy Statement.

LCO Following a FHA involving recently irradiated fuel, a minimum of one Fuel Building Ventilation subsystem is required to maintain the fuel building at a negative pressure with respect to the environment and to process gaseous releases. Meeting the LCO requirements for two operable subsystems ensures operation of at least one Fuel Building Ventilation subsystem in the event of a single active failure. Requiring one subsystem to be in operation ensures no releases occur that are not filtered and adsorbed.

APPLICABILITY Regardless of the plant operating MODE, anytime recently irradiated fuel (i.e., fuel that has occupied part of a critical core within the previous 11 days) is being handled there is the potential for a FHA and the Fuel Building Ventilation System is required to mitigate the consequences.

(continued)

RIVER BEND B 3.6-113 Revision No. 6-5

Fuel Building Ventilation System- Fuel Handling B 3.6.4.7 BASES ACTIONS A.I With one fuel building ventilation charcoal filtration subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE fuel building ventilation charcoal filtration subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is reduced because a single failure in the OPERABLE subsystem could result in the radioactivity release control function not being adequately performed. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant fuel building ventilation charcoal filtration subsystem and the low probability of a FHA occurring during this period.

B.1 and B.2 If the fuel building ventilation charcoal filtration subsystem cannot be restored to OPERABLE status within the required Completion Time the plant must be brought to a condition in which the LCO does not apply. Additionally, if both subsystems are inoperable or if the one required subsystem not in operation the system is incapable of performing its required accident mitigation function and the plant must be brought to a condition in which the LCO does not apply. To achieve this, recently irradiated fuel handling must be suspended immediately.

Suspension shall not preclude completion of fuel movement to a safe position.

SURVEILLANCE SR 3.6.4.7.1 REQUIREMENTS This Surveillance demonstrates that one fuel building ventilation charcoal filtration subsystem is in operation and filtering the fuel building atmosphere. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient in view of other visual and audible indications available to the operator for monitoring the fuel building ventilation charcoal filtration subsystem in the control room.

(continued)

RIVER BEND B 3.6-114 Revision No. 6-5

Control Rod Block Instrumentation B 3.3.2.1 BASES BACKGROUND The purpose of the RPC is to ensure control rod patterns (continued) during startup are such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 20% RTP. The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA. The RPC, in conjunction with the RCIS, will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the specified sequence. The rod block logic circuitry is the same as that described above. The RPC also uses the turbine first stage pressure to determine when reactor power is above the power at which the RPC is automatically bypassed (Ref. 1).

With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This function prevents criticality resulting from inadvertent control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. The reactor mode switch has two channels, with each providing inputs into a separate rod block circuit. A rod block in either circuit will provide a control rod block to all control rods.

APPLICABLE 1.a. Rod Withdrawal Limiter SAFETY ANALYSES.

LCO, and The RWL is designed to prevent violation of the MCPR SL APPLICABILITY and the cladding 1% plastic strain fuel design limit that may result from a single control rod withdrawal error (RWE) event.

The analytical methods and assumptions used in evaluating the RWE event are summarized in Reference 2. A statistical analysis of RWE events was performed to determine the MCPR response as a function of withdrawal distance and initial operating conditions.

From these responses, the fuel thermal performance was determined as a function of RWL allowable control rod withdrawal distance and power level.

The RWL satisfies Criterion 3 of the NRC Policy Statement. Two channels of the RWL are available and are required to be OPERABLE to ensure that no single instrument failure can preclude a rod block from this Function. The RWL high power function channels are OPERABLE when control rod withdrawal is limited to no more than two notches. The RWL low power function channels are OPERABLE when control rod withdrawal is limited to no more than four notches. An exception to the rod withdrawal limits is possible for a single control rod that is selected, subsequently inserted, to be withdrawn back to its original position without a rod block and withdrawn 1 or 2 feet beyond its original position (continued)

RIVER BEND B 3.3-41 Revision No. 6-6

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE 1.a. Rod Withdrawal Limiter (continued)

SAFETY ANALYSES.

LCO, and as limited by the RWL. For this situation administrative APPLICABILITY controls are utilized to ensure that assumptions for the RWL design remain consistent with existing analysis that supports the Rod Withdrawal Error event described in USAR section 15.4.2.

Nominal trip set points are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Values between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor power), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drive, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

The RWL is assumed to mitigate the consequences of an RWE event when operating > 35% RTP. Below this power level, the consequences of an RWE event will not exceed the MCPR. and therefore the RWL is not required to be OPERABLE (Ref. 3).

1.b. Rod Pattern Controller The RPC enforces the banked position withdrawal sequence (BPWS) to ensure that the initial conditions of the CRDA analysis are not violated. The analytical methods and assumptions used in evaluating the CRDA are summarized in References 4. 5, and 6.

The BPWS requires that control rods be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions. Requirements that the control rod sequence is in compliance with BPWS are specified in LCO 3.1.6, "Control Rod Pattern."

(continued)

RIVER BEND B 3.3-42 Revision No. 6-6

AC Sources-Operating B 3.8.1 BASES ACTIONS F.1 and F.2 (continued)

If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

G.1 Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and REQUIREMENTS testing of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, GDC 18 (Ref. 8). Periodic component tests are supplemented by extensive functional tests during refueling outages under simulated accident conditions. The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 (Ref. 3),

Regulatory Guide 1.108 (Ref. 9), and Regulatory Guide 1.137 (Ref. 10).

Where the SRs discussed herein specify voltage and frequency tolerances, the minimum and maximum steady state output voltage of 3740 V and 4580 V respectively, are equal to

10% of the nominal 4160 V output voltige. The specified minimum and maximum frequencies of the DG of 58.8 Hz and 61.2 Hz, respectively, are equal to +/- 2% of the 60 Hz nominal frequency. The specified steady state voltage and frequency ranges are derived from the recommendations given in Regulatory Guide 1.9 (Ref. 3).

(continued)

RIVER BEND 8 3.8-13 Revision No. 0

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.1 REQUIREMENTS (continued) This SR ensures proper circuit continuity for the two qualified circuits between the offsite transmission network and the onsite Class 1E Distribution System and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that Division 1 and 2 distribution buses and loads are connected to their preferred power source and that appropriate independence of offsite circuits is maintained. The 7 day Frequency is adequate since breaker position is not likely to change without the operator being aware of it and because its status is displayed in the control room.

SR 3.8.1.2 This SR helps to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, this SR is modified by a Note to indicate that all OG starts for this Surveillance may be preceded by an engine prelube period and followed by a warmup period prior to loading.

For the purposes of this testing, the DGs are started from standby conditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations for DG 1A and DG 1B. For DG 1C, standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation.

SR 3.8.1.2 requires that the DG starts from standby conditions, achieves and maintains the required steady-state (i.e., after any overshoot) voltage and frequency within 10 seconds for DG 1A and DG 1B and 13 seconds for DG IC. The start requirements for each DG support the assumptions in the design basis LOCA analysis (Ref. 5).

(continued)

RIVER BEND 8 3.8-14 Revision No. 6-6

RPS Instrumentation B 3.3-1.1 BASES BACKGROUND The RPS is comprised of two independent trip systems (A (continued) and B), with two logic channels in each trip system (logic channels A, B. C, and D), as shown in Reference 1. The outputs of the logic channels in a trip system are combined in a one-out-of-two logic so either channel can trip the associated trip system. The tripping of both trip systems will produce a reactor scram. This logic arrangement is referred to as one-out-of-two taken twice logic. Each trip system can be reset by use of a reset switch. If a full scram occurs (both trip systems trip), a relay prevents reset of the trip systems for 10 seconds after the full scram signal is received. This 10 second delay on reset ensures that the scram function will be completed.

One scram pilot valve is located in the hydraulic control unit (HCU) for each control rod drive (CRD). Each scram pilot valve is solenoid operated, with two normally energized solenoids. The scram pilot valves control the air supply to the scram inlet and outlet valves for the associated CRD. When either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram. The scram valves control the supply and discharge paths for the CRD water during a scram. One of the scram pilot valve solenoids for each CRD is controlled by trip system A, and the other solenoid is controlled by trip system B. Any trip of trip system A in conjunction with any trip in trip system B results in de-energizing both solenoids, air bleeding off, scram valves opening, and control rod scram The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS. Additionally, the RPS System controls the SDV vent and drain valves such that when both trip systems trip, the SDV vent and drain valves close to isolate the SDV.

APPLICABLE The actions of the RPS are assumed in the safety analyses SAFETY ANALYSES, of References 2, 3, and 4. The RPS initiates a reactor LCO. and scram when monitored parameter values exceed the Allowable APPLICABILITY Values specified by the setpoint methodology and listed in Table 3.3.1.1-1 to preserve the integrity of the fuel cladding, the reactor coolant pressure boundary (RCPB), and (continued)

RIVER BEND B 3.3-2 Revision No. 6-7

Jet Pumps B 3.4.3 BAS ES SURVEILLANCE SR 3.4.3.1 (continued)

REQUIREMENTS Individual jet pumps in a recirculation loop typically do not have the same flow. The unequal flow is due to the drive flow manifold, which does not distribute flow equally to all risers. The flow (or jet pump diffuser to lower plenum differential pressure) pattern or relationship of one jet pump to the loop average is repeatable. An appreciable change in this relationship is an indication that increased (or reduced) resistance has occurred in one of the jet pumps. This may be indicated by an increase in the relative flow for a jet pump that has experienced beam cracks.

The deviations from normal are considered indicative of a potential problem in the recirculation drive flow or jet pump system (Ref. 2).

Normal flow ranges and established jet pump flow and differential pressure patterns are established by plotting historical data as discussed in Reference 2.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency has been shown by operating experience to be adequate to verify jet pump OPERABILITY and is consistent with the Frequency for recirculation loop OPERABILITY verification.

This SR is modified by two Notes. Note 1 allows this Surveillance not to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the associated recirculation loop is in operation, since these checks can only be performed during jet pump operation. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is an acceptable time to establish conditions appropriate for data collection and evaluation.

Note 2 allows this SR not to be performed when THERMAL POWER is S23.8% RTP. During low flow conditions, jet pump noise approaches the threshold response of the associated flow instrumentation and precludes the collection of repeatable and meaningful data, REFERENCES 1. USAR, Section 6.3.

2. GE Service Information Letter No. 330, "Jet Pump Beam Cracks," June 9, 1980.

3. NUREG/CR-3052, "Closeout of IE Bulletin 80-07: BWR Jet Pump Assembly Failure," November 1984.

RIVER BEND B 3ý4-16 Revision No. 6-7

Main Turbine Bypass System B 3.7.5 BASES (continued)

LCO The Main Turbine Bypass System is required to be OPERABLE to limit peak pressure in the main steam lines and maintain reactor pressure within acceptable limits during events that cause rapid pressurization, such that the Safety Limit MCPR is not exceeded.

An OPERABLE Main Turbine Bypass System requires the bypass valves to open in response to increasing main steam line pressure. This response is within the assumptions of the applicable analysis (Ref. 2).

APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at

>23.8% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated I

during the feedwater controller failure, maximum demand event.

As discussed in the Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," sufficient margin to these limits exists

< 23.8% RTP. Therefore, these requirements are only necessary when operating at or above this power level.

ACTIONS A. 1 If the Main Turbine Bypass System is inoperable (one or more bypass valves inoperable), the assumptions of the design basis transient analysis may not be met. Under such circumstances, prompt action should be taken to restore the Main Turbine Bypass System to OPERABLE status. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is reasonable, based on the time to complete the Required Action and the low probability of an event occurring during this period requiring the Main Turbine Bypass System.

B.1 If the Main Turbine Bypass System cannot be restored to OPERABLE status within the associated Completion Time, THERMAL POWER must be reduced to < 23.8% RTP. As discussed in the Applicability section, operation at < 23.8% RTP results in I (continued)

I RIVER BEND B 3.7-26 Revision No. 6-7

PCIVs 8 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.1 (continued)

REQUIREMENTS Note 3 to this SR ensures that both SGT subsystems are not damaged should a primary containment pressurization event occur and that one is always available for its' design function.

SR 3.6.1.3.2 This SR verifies that each primary containment isolation manual valve and blind flange that is located outside primary containment, drywell, and steam tunnel, and is required to be closed during accident conditions, is closed.

The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the primary containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those devices outside primary containment, drywell, and steam tunnel, and capable of being mispositioned, are in the correct position. Since verification of position for devices outside primary containment is relatively easy, the 31 day Frequency was chosen to provide added assurance that the devices are in the correct positions.

Three Notes are added to this SR. Note 1 provides an exception to meeting this SR in MODES other than MODES 1, 2, and 3. When not operating in MODES 1, 2, or 3, the primary containment boundary, including verification that required penetration flow paths are isolated, is addressed by LCO 3.6.1.10, "Primary Containment-Shutdown" (SR 3.6.1.10.1).

The second Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is low. A third Note is included to clarify that PCIVs open under administrative controls are not required to meet the SR during the time the PCIVs are open.

(continued)

RIVER BEND B 3.6-23 Revision No. 0

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.3 REQUIREMENTS (continued) This SR verifies that each primary containment manual isolation valve and blind flange located inside primary containment.

drywell. or steam tunnel, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. For devices inside primary containment. drywell, or steam tunnel, the Frequency of "prior to entering MODE 2 or 3 from MODE 4. if not performed within the previous 92 days." is appropriate since these devices are operated under administrative controls and the probability of their misalignment is low.

Four Notes are added to this SR. Note I provides an exception to meeting this SR in MODES other than MODES 1, 2. and 3. When not operating in MODES 1. 2. or 3. the primary containment boundary, including verification that required penetration flow paths are isolated, is addressed by LCO 3.6.1.10, "Primary Containment-Shutdown" (SR 3.6.1.10.1). The second Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since access to these areas is typically restricted during MODES 1. 2. and 3. Therefore. the probability of misalignment of these devices, once they have been verified to be in their proper position, is low. A third Note is included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open. A fourth note is added to allow for removal of the Inclined Fuel Transfer System (IFTS) blind flange when primary containment operability is required. This provides the option of performing limited testing and maintenance of the IFTS system during MODE 1, 2. or

3. Requiring the fuel building spent fuel storage pool water level to be > el. 108'-4" (23 feet above the top of the fuel in the lower pool) ensures a sufficient depth of water over the outlet of the transfer tube bottom valve. This water prevents direct communication between the containment building atmosphere and the fuel building atmosphere via the inclined fuel transfer tube under DBA LBLOCA conditions. The spent fuel storage pool gate to the IFTS transfer pool will remain open. in order for the (continued)

RIVER BEND B 3.6-24 Revision No. 6-8

PCIVs B 3.6.1.3 BAS ES SURVEILLANCE SR 3.6.1.3.3 (continued)

REQUIREMENTS (continued) safety-related spent fuel storage pool instrumentation to provide level indication for the transfer pool. The bottom valve is to remain closed while the blind flange is removed during MODE 1, 2, or 3, in order to ensure containment integrity during higher pressure transients (e.g., under severe accidents). Since the IFTS transfer tube drain line is not isolated in a manner similar to the transfer tube, and the motor-operated drain valve may be opened while the blind flange is removed, administrative controls are required to ensure the drain line flow path is quickly isolated in the event of a LOCA. In this instance, administrative control of the IFTS transfer tube drain line isolation valve includes stationing a dedicated individual, who is in continuous communication with the control room, in the vicinity of the IFTS drain tank in the fuel building. This individual will initiate closure of the IFTS transfer tube drain line motor-operated isolation valve (F42-MOVFO03) if a need for primary containment isolation is indicated. Removal of the blind flange is limited to 60 days per operating cycle while in Modes 1, 2, or 3 to reduce the risk significance of this activity. The pressure integrity of the IFTS transfer tube, the seal created by water depth of the fuel building spent fuel storage pool, the administrative control of the drain line flow path, and the time limit for blind flange removal create an acceptable barrier to prevent the post-DBA LOCA containment building atmosphere from leaking into the fuel building.

SR 3.6.1.3.4 Verifying the isolation time of each power operated and each automatic PClV is within limits is required to demonstrate OPERABILITY. MSIVs may be excluded from this SR since MSIV full closure isolation time is demonstrated by SR 3.6.1.3.6. The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analysis.

The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

(continued)

RIVER BEND B 3.6-24a Revision No. 6-8

RCIC System B 3.5.3 BASES BACKGROUND The RCIC pump is provided with a minimum flow bypass line.

(continued) which discharges to the suppression pool. The valve in this line automatically opens to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects. the RCIC System discharge line "keep fill" system is designed to maintain the pump discharge line filled with water.

APPLICABLE The function of the RCIC System is to respond to transient SAFETY ANALYSES events by providing makeup coolant to the reactor. The RCIC system is not an Engineered Safety Feature system, and the safety analysis does not consider RCIC to be a system needed to mitigate the consequences of a control rod drop accident. Based on its contribution to the reduction of overall plant risk, however, the system is included in the Technical Specifications as required by the NRC Policy Statement.

LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity to maintain RPV inventory during an isolation event.

APPLICABILITY The RCIC System is required to be OPERABLE in MODE 1, and MODES 2 and 3 with reactor steam dome pressure > 150 psig since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure

150 psig, and in MODES 4 and 5.

RCIC is not required to be OPERABLE since the ECCS injection/spray subsystems can provide sufficient flow to the vessel.

ACTIONS A.1 and A.2 If the RCIC System is inoperable during MODE 1, or MODES 2 or 3 with reactor steam dome pressure > 150 psig, and the HPCS System is verified to be OPERABLE, the RCIC System must be restored to OPERABLE status within 14 days. In this Condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high (conti nued)

RIVER BEND B 3.5-21 Revision No. 6-9

RCIC System B 3.5.3 BASES ACTIONS A.1 and A.2 (continued)

RPV pressure since the HPCS System is the only high pressure system assumed to function during a loss of coolant accident (LOCA). OPERABILITY of the HPCS is therefore verified within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months when the RCIC System is inoperable. This may be performed as an administrative check, by examining logs or other information, to determine if the HPCS is out of service for maintenance or other reasons. Verification does not require performing the Surveillances needed to demonstrate the OPERABILITY of the HPCS System. If the OPERABILITY of the HPCS System cannot be verified, however, Condition B must be immediately entered. For transients and certain abnormal events with no LOCA, RCIC (as opposed to HPCS) is the preferred source of makeup coolant because of its relatively small capacity, which allows easier control of RPV water level. Therefore, a limited time is allowed to restore the inoperable RCIC to OPERABLE status.

The 14 day Completion Time is based on a reliability study (Ref. 3) that evaluated the impact on ECCS availability, assuming that various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (AOTs). Because of the similar functions of the HPCS and RCIC, the AOTs (i.e., Completion Times) determined for the HPCS are also applied to RCIC.

B.1 and B.2 If the RCIC System cannot be restored to OPERABLE status within the associated Completion Time, or if the HPCS System is simultaneously inoperable, the plant must be brought to a condition in which the LCO does not appl.y. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure reduced to s 150 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

RIVER BEND B 3.5-22 Revision No. 0

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS C.1, C.2, and C.3 (continued) failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed) primary containment remains OPERABLE, yet only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (according to LCO 3.6.1.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits. Required Action C.2 requires that one door in the affected primary containment air locks must be verified closed. This Required Action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status considering that at least one door is maintained closed in each affected air lock.

D.1 and D.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time while operating in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1. E.2. and E.3 If the inoperable primary containment airlock cannot be restored to OPERABLE status within the associated Completion Time during operations with a potential for draining the reactor vessel (OPORVs) or during movement of recently irradiated fuel assemblies in the primary containment, action is required to immediately suspend activities that represent a potential for releasing radioactive material, (continued)

RIVER BEND B 3.6-11 Revision No. 2-3

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS E.1, E.2. and E.3 (continued) thus placing the unit in a Condition that minimizes risk. If applicable, movement of recently irradiated fuel assemblies in the primary containment must be immediately suspended.

Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Action must continue until OPDRVs are suspended.

SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining primary containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Primary Containment Leakage Rate Testing Program (Ref. 5). This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria (i.e.. *13.500 cc/hr for the combination of all annulus bypass leakage paths that are required to be meeting leak tightness) ensures that the combined leakage rate of annulus bypass leakage paths is less than the specified leakage rate. This provides assurance in MODES 1. 2, and 3 that the assumptions in the radiological evaluations are met. The leakage rate of each bypass leakage path is assumed to be the maximum pathway leakage (e.g., leakage through the air lock door with the highest leakage) unless the penetration is isolated by use of (for this Specification) one closed and locked air lock door. The leakage rate of the isolated bypass leakage path is assumed to be the actual pathway leakage through the isolation devices (e.g., air lock door). If both air lock doors are closed, the actual leakage rate is the lesser leakage rate of the two barriers (doors). This method of quantifying maximum pathway leakage is only to be used for this SR (i.e.. Appendix J, Option B, maximum pathway leakage limits used to evaluate Type A, B and C limits are to be quantified in accordance with Appendix J. Option B).

During the operational conditions of moving irradiated fuel assemblies in the primary containment, CORE ALTERATIONS, or OPDRVS.

(continued)

RIVER BEND' B 3.6-12 Revision No. 6-10

Primary Containment Air Locks B 3.6.1.2 BASES SURVEILLANCE SR 3.6.1.2.1 (continued)

REQUIREMENTS the reactor coolant system is not pressurized and specific primary containment leakage limits are not imposed. However, due to the size of the air lock penetration. leakage limits are imposed to assure an OPERABLE barrier. In these conditions the leakage limits are not related to radiological evaluations, but only reflect engineering judgment of an acceptable barrier. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall primary containment leakage rate. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.

This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR, requiring the results to be evaluated against the acceptance criteria of SR 3.6.1.1.1 during operation in MODES 1, 2, and 3. This ensures that air lock leakage is properly accounted for in determining the overall primary containment leakage rate. Since the overall primary containment leakage rate is only applicable in MODE 1, 2. and 3 operation, the Note 2 requirement is imposed only during these MODES.

SR 3.6.1.2.2 The seal air flask pressure is verified to be at - 90 psig every 7 days to ensure that the seal system remains viable. It must be checked because it could bleed down during or following access through the air lock, which occurs regularly. The 7 day Frequency has been shown to be acceptable through operating experience and is considered adequate in view of the other indications available to operations personnel that the seal air flask pressure is low.

(continued)

RIVER BEND B 3.6-13 Revision No. 6-10

Primary Containment Air Locks B 3.6.1.2 BASES SURVEILLANCE SR 3.6.1.2.3 REQUIREMENTS (continued) The air lock interlock mechanism is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident primary containment pressure (Ref. 3), closure of either door will support primary containment OPERABILITY. Thus, the interlock feature supports primary containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. Due to the nature of this interlock, and given that the interlock mechanism is only challenged when the primary containment airlock door is opened, this test is only required to be performed upon entering or exiting a primary containment air lock, but is not required more frequently than once per 184 days. The 184 day Frequency is based on engineering judgment and is considered adequate in view of other administrative controls.

SR 3.6.1.2.4 A seal pneumatic system test to ensure that pressure does not decay at a rate equivalent to> 1.28 psig for a period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from an initial pressure of 90 psig is an effective leakage rate test to verify system performance.

The 18 month Frequency is based on the fact that operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES I. USAR, Section 3.8.

2. 10 CFR 50, Appendix J, Option B.

3. USAR, Table 6.2-1.

4. USAR, 15.7.4.

5. Regulatory Guide 1.163, "Performance-Based Containment Leak-Test Program," dated September 1995.

RIVER BEND 8 3.6-14 Revision No. 2-3

PC !Vs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.1 (continued)

REQUIREMENTS Note 3 to this SR ensures that both SGT subsystems are not damaged should a primary containment pressurization event occur and that one is always available for its' design function.

SR 3.6.1.3.2 This SR verifies that each primary containment isolation manual valve and blind flange that is located outside primary containment, drywell, and steam tunnel, and is required to be closed during accident conditions, is closed.

The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the primary containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those devices outside primary containment, drywell, and steam tunnel, and capable of being mispositioned, are in the correct position. Since verification of position for devices outside primary containment is relatively easy, the 31 day Frequency was chosen to provide added assurance that the devices are in the correct positions.

Three Notes are added to this SR. Note 1 provides an exception to meeting this SR in MODES other than MODES 1, 2, and 3. When not operating in MODES 1, 2, or 3, the primary containment boundary, including verification that required penetration flow paths are isolated, is addressed by LCO 3.6.1.10, "Primary Containment-Shutdown" (SR 3.6.1.10.1).

The second Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is low. A third Note is included to clarify that PCIVs open under administrative controls are not required to meet the SR during the time the PCIVs are open.

(continued)

RIVER BEND 8 3.6-23 Revision No. 0

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.3 REQUIREMENTS (continued) This SR verifies that each primary containment manual isolation valve and blind flange located inside primary containment.

drywell. or steam tunnel, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. For devices inside primary containment, drywell. or steam tunnel, the Frequency of "prior to entering MODE 2 or 3 from MODE 4, if not performed within the previous 92 days." is appropriate since these devices are operated under administrative controls and the probability of their misalignment is low.

Four Notes are added to this SR. Note 1 provides an exception to meeting this SR in MODES other than MODES 1, 2. and 3. When not operating in MODES 1. 2, or 3. the primary containment boundary.

including verification that required penetration flow paths are isolated, is addressed by LCO 3.6.1.10. "Primary Containment-Shutdown" (SR 3.6.1.10.1). The second Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since access to these areas is typically restricted during MODES 1. 2. and 3. Therefore. the probability of misalignment of these devices, once they have been verified to be in their proper position, is low. A third Note is included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open. A fourth note is added to allow for removal of the Inclined Fuel Transfer System (IFTS) blind flange when primary containment operability is required. This provides the option of performing testing and maintenance of the IFTS system during MODE 1, 2. or 3. Requiring the fuel building spent fuel storage pool water level to be

> el. 108'-4" (23 feet above the top of the fuel in the lower pool) ensures a sufficient depth of water over the outlet of the transfer tube bottom valve. This water prevents direct communication between the containment building atmosphere and the fuel building atmosphere via the inclined fuel transfer tube under DBA LBLOCA conditions. The spent fuel storage pool gate to the IFTS transfer pool will remain open. in order for the (continued)

RIVER BEND B 3.6-24 Revision No. 6-11

PCIVs B 3.6.1.3 BAS ES SURVEILLANCE SR 3.6.1.3.3 (continued)

REQUIREMENTS (continued) safety-related spent fuel storage pool instrumentation to provide level indication for the transfer pool. Since the IFTS transfer tube drain line is not isolated in a manner similar to the transfer tube, and the motor-operated drain valve may be opened while the blind flange is removed, administrative controls are required to ensure the drain line flow path is quickly isolated in the event of a LOCA. In this instance, administrative control of the IFTS transfer tube drain line isolation valve includes stationing a dedicated individual, who is in continuous communication with the control room, in the vicinity of the IFTS drain tank in the fuel building. This individual will initiate closure of the IFTS transfer tube drain line motor-operated isolation valve (F42-MOVFO03) if a need for primary containment isolation is indicated. Removal of the blind flange is limited to 60 days per operating cycle while in Modes 1, 2, or 3 to reduce the risk significance of this activity. The pressure integrity of the IFTS transfer tube, the seal created by water depth of the fuel building spent fuel storage pool, the administrative control of the drain line flow path, and the time limit for blind flange removal create an acceptable barrier to prevent the post-DBA LOCA containment building atmosphere from leaking into the fuel building.

SR 3.6.1.3.4 Verifying the isolation time of each power operated and each automatic PCIV is within limits is required to demonstrate OPERABILITY. MSIVs may be excluded from this SR since MSIV full closure isolation time is demonstrated by SR 3.6.1.3.6. The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analysis.

The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

(continued)

RIVER BEND B 3.6-24a Revision No. 6-11

Control Rod Pattern B 3.1.6 BASES APPLICABLE Control rod patterns analyzed in Reference 2 follow the SAFETY ANALYSES banked position withdrawal sequence (BPWS) described in (continued) Reference 8. The BPWS is applicable from the condition of all control rods fully inserted to 10% RTP (Ref. 1). For the BPWS, the control rods are required to be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions (e.g., between notches 08 and 12). The banked positions are defined to minimize the maximum incremental control rod worths without being overly restrictive during normal plant operation. The generic BPWS analysis (Ref. 8) also evaluated the effect of fully inserted, inoperable control rods not in compliance with the sequence, to allow a limited number (i.e., eight) and distribution of fully inserted, inoperable control rods.

Rod pattern control satisfies the requirements of Criterion 3 of the NRC Policy Statement.

LCO Compliance with the prescribed control rod sequences minimizes the potential consequences of a CRDA by limiting the initial conditions to those consistent with the BPWS. This LCO only applies to OPERABLE control rods. For inoperable control rods required to be inserted, separate requirements are specified in LCO 3.1.3, "Control Rod OPERABILITY," consistent with the allowances for inoperable control rods in the BPWS.

APPLICABILITY In MODES 1 and 2, when THERMAL POWER is

10% RTP, the CRDA is a Design Basis Accident (DBA) and, therefore, compliance with the assumptions of the safety analysis is required. When THERMAL POWER is > 10% RTP, there is no credible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA (Ref. 1). In MODES 3, 4, and 5, since the reactor is shut down and only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will.remain subcritical with a single control rod withdrawn.

(conti nued)

RIVER BEND B 3. 1-33 Revision Z. 6-13

Control Rod Pattern B 3.1.6 BASES (continued)

ACTIONS A.1 and A.2 With one or more OPERABLE control rods not in compliance with the prescribed control rod sequence, action may be taken to either correct the control rod pattern or declare the associated control rods inoperable within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Noncompliance with the prescribed sequence may be the result of "double notching," drifting from a control rod drive cooling water transient, leaking scram valves.

or a power reduction to

10% RTP before establishing the correct control rod pattern. The number of OPERABLE control rods not in compliance with the prescribed sequence is limited to eight to prevent the operator from attempting to correct a control rod pattern that significantly deviates from the prescribed sequence.

When the control rod pattern is not in compliance with the prescribed sequence, all control rod movement should be stopped except for moves needed to correct the control rod pattern, or scram if warranted.

Required Action A.1 is modified by a Note, which allows control rods to be bypassed in Rod Action Control System (RACS) to allow the affected control rods to be returned to their correct position. This ensures that the control rods will be moved to the correct position. A control rod not in compliance with the prescribed sequence is not considered inoperable except as required by Required Action A.2. OPERABILITY of control rods is determined by compliance with LCO 3.1.3; LCO 3.1.4, "Control Rod Scram Times"; and LCO 3.1.5, "Control Rod Scram Accumulators."

The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable, considering the restrictions on the number of allowed out of sequence control rods and the low probability of a CRDA occurring during the time the control rods are out of sequence.

B.1 and B.2 If nine or more OPERABLE control rods are out of sequence, the control rod pattern significantly deviates from the prescribed sequence. Control rod withdrawal should be suspended immediately to prevent the potential for further deviation from the prescribed sequence. Control rod insertion to correct control rods withdrawn beyond their allowed position is allowed since, in general, insertion of control rods has less impact on control rod worth than (continued)

RIVER BEND B 3.1-34 Revision Ne. 6-13

Control Rod Pattern B 3.1.6 BASES ACTIONS B.1 and B.2 (continued) withdrawals have. Required Action B.1 is modified by a Note that allows the affected control rods to be bypassed in RACS in accordance with SR 3.3.2.1.9 to allow insertion only.

With nine or more OPERABLE control rods not in compliance with BPWS, the reactor mode switch must be placed in the shutdown position within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . With the reactor mode switch in shutdown, the reactor is shut down, and therefore does not meet the applicability requirements of this LCO. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable to allow insertion of control rods to restore compliance, and is appropriate relative to the low probability of a CRDA occurring with the control rods out of sequence.

SURVEILLANCE SR 3.1.6.1 REQUIREMENTS The control rod pattern is verified to be in compliance with the BPWS at a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency, ensuring the assumptions of the CRDA analyses are met. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of this Surveillance was developed considering that the primary check of the control rod pattern compliance with the BPWS is performed by the RPC (LCO 3.3.2.1). The RPC provides control rod blocks to enforce the required control rod sequence and is required to be OPERABLE when operating at

10% RTP.

REFERENCES 1. NEDE-24011-P-A, "GE Standard Application for Reactor Fuel, GESTAR II" (latest approved revision).

2. USAR, Section 15.4.9.

3. NUREG-0979, "NRC Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design. Docket No. 50-447," Section 4.2.1.3.2, April 1983.

4. NUREG-0800. "Standard Review Plan," Section 15.4.9, "Radiological Consequences of Control Rod Drop Accident (BWR)." Revision 2, July 1981.

(continued)

RIVER BEND B 3. 1-35 Revision N". 6-13

Control Rod Pattern B 3.1.6 BASES REFERENCES 5. 10 CFR 100.11, "Determination of Exclusion Area, Low (continued) Population Zone, and Population Center Distance."

6. NEDO-21778-A, "Transient Pressure Rises Affected Fracture Toughness Requirements for Boiling Water Reactors," December 1978.

7. ASME, Boiler and Pressure Vessel Code.

8. NEDO-21231, "Banked Position Withdrawal Sequence,"

January 1977.

RIVER BEND B, 3.1-36 Revision.-No. 0

Control Rod Block Instrumentation B 3.3.2.1 BASES BACKGROUND The purpose of the RPC is to ensure control rod patterns (continued) during startup are such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 10% RTP. The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA. The RPC, in conjunction with the RCIS, will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the specified sequence. The rod block logic circuitry is the same as that described above. The RPC also uses the turbine first stage pressure to determine when reactor power is above the power at which the RPC is automatically bypassed (Ref. 1).

With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This function prevents criticality resulting from inadvertent control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. The reactor mode switch has two channels, with each providing inputs into a separate rod block circuit. A rod block in either circuit will provide a control rod block to all control rods.

APPLICABLE 1.a. Rod Withdrawal Limiter SAFETY ANALYSES, LCO, and The RWL is designed to prevent violation of the MCPR SL APPLICABILITY and the cladding 1% plastic strain fuel design limit that may result from a single control rod withdrawal error (RWE) event.

The analytical methods and assumptions used in evaluating the RWE event are summarized in Reference 2. A statistical analysis of RWE events was performed to determine the MCPR response as a function of withdrawal distance and initial operating conditions.

From these responses, the fuel thermal performance was determined as a function of RWL allowable control rod withdrawal distance and power level.

The RWL satisfies Criterion 3 of the NRC Policy Statement. Two channels of the RWL are available and are required to be OPERABLE to ensure that no single instrument failure can preclude a rod block from this Function. The RWL high power function channels are OPERABLE when control rod withdrawal is limited to no more than two notches. The RWL low power function channels are OPERABLE when control rod withdrawal is limited to no more than four notches. An exception to the rod withdrawal limits is possible for a single control rod that is selected, subsequently inserted, to be withdrawn back to its original position without a rod block and withdrawn 1 or 2 feet beyond its original position (continued)

RIVER BEND B 3.3-41 Revisi.on No. 6-13

tý--

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE 1.a. Rod Withdrawal Limiter (continued)

SAFETY ANALYSES, LCO. and as limited by the RWL. For this situation administrative APPLICABILITY controls are utilized to ensure that assumptions for the RWL design remain consistent with existing analysis that supports the Rod Withdrawal Error event described in USAR section 15.4.2.

Nominal trip set points are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Values between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint. but within its Allowable Value, is acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g.. reactor power), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.. trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g.. drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects. calibration tolerances.

instrument drive, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

The RWL is assumed to mitigate the consequences of an RWE event when operating > 35% RTP. Below this power level, the consequences of an RWE event will not exceed the MCPR. and therefore the RWL is not required to be OPERABLE (Ref. 3).

1.b. Rod Pattern Controller The RPC enforces the banked position withdrawal sequence (BPWS) to ensure that the initial conditions of the CRDA analysis are not violated. The analytical methods and assumptions used in evaluating the CRDA are summarized in References 4, 5. and 6.

The BPWS requires that control rods be moved in groups. with all control rods assigned to a specific group required to be within specified banked positions. Requirements that the control rod sequence is in compliance with BPWS are specified in LCO 3.1.6.

"Control Rod Pattern."

(continued)

RIVER BEND B 3.3-42 Revision No. 6-6

Control Rod Block Instrumentation BASES B 3.3.2.1 APPLICABLE 1.b. Rod Pattern Controller (continued)

SAFETY ANALYSES, LCO. and The Rod Pattern Controller Function satisfies Criterion 3 of APPLICABILITY the NRC Policy Statement. Since the RPC is a backup to operator control of control rod sequences, only a single channel would be required OPERABLE to satisfy Criterion 3 (Ref. 6). However, the RPC is designed as a dual channel system and will not function without two OPERABLE channels. Required Actions of LCO 3.1.3, "Control Rod OPERABILITY," and LCO 3.1.6 may necessitate bypassing individual control rods in the Rod Action Control System (RACS) to allow continued operation with inoperable control rods or to allow correction of a control rod pattern not in compliance with the BPWS. The individual control rods may be bypassed as required by the conditions, and the RPC is not considered inoperable provided SR 3.3.2.1.9 is met.

Compliance with the BPWS, and therefore OPERABILITY of the RPC, is required in MODES 1 and 2 with THERMAL POWER

10% RTP. When THERMAL POWER is > 10% RTP, there is no possible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA. In MODES 3 and 4, all control rods are required to be inserted in the core. In MODE 5. since only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will be subcritical.

2. Reactor Mode Switch-Shutdown Position During MODES 3 and 4, and during MODE 5 when the reactor mode switch is required to be in the shutdown position, the core is assumed to be subcritical; therefore, no positive reactivity insertion events are analyzed. The Reactor Mode Switch-Shutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.

The Reactor Mode Switch-Shutdown Position Function satisfies Criterion 3 of the NRC Policy Statement.

(continued)

RIVER BEND B 3.3-43 Revision No. 6-13

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE 2. Reactor Mode Switch-Shutdown Position (continued)

SAFETY ANALYSES, LCO, and Two channels are required to be OPERABLE to ensure that no APPLICABILITY single channel failure will preclude a rod block when required. No Allowable Value is applicable for this Function since the channels are mechanically actuated based solely on reactor mode switch position.

During shutdown conditions (MODE 3, 4, or 5) no positive reactivity insertion events are analyzed because assumptions are that control rod withdrawal blocks are provided to prevent criticality. Therefore, when the reactor mode switch is in the shutdown position, the control rod withdrawal block is required to be OPERABLE. During MODE 5, with the reactor mode switch in the refueling position, the required position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") provides the required control rod withdrawal blocks.

ACTIONS A.1 If either RWL channel is inoperable, the RWL may not be capable of performing its intended function. In most cases, with an inoperable channel, the RWL will initiate a control rod withdrawal block because the two channels will not agree. To ensure erroneous control rod withdrawal does not occur, however, Required Action A.1 requires that further control rod withdrawal be suspended immediately.

B.1 If either RPC channel is inoperable, the RPC may not be capable of performing its intended function even though, in most cases, all control rod movement will be blocked. All control rod movement should be suspended under these conditions until the RPC is restored to OPERABLE status.

This action does not preclude a reactor scram. The RPC is not considered inoperable if individual control rods are bypassed in the RACS as required by LCO 3.1.3 or LCO 3.1.6.

Under these conditions, continued operation is allowed if the bypassing of control rods and movement of control rods is verified by a second licensed operator or other qualified member of the technical staff per SR 3.3.2.1.9.

(continued)

RIVER BEND B 3.3-44 Revision No. 0

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.6 (continued)

REQUIREMENTS in the nonbypassed condition, the SR is met and the RWL would not be considered inoperable. Because main turbine bypass steam flow can affect the HPSP nonconservatively for the RWL, the RWL is considered inoperable with any main turbine bypass valve open. The Frequency of 92 days is based on the setpoint methodology utilized for these channels.

SR 3.3.2.1.7 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency is based upon the assumption of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.2.1.8 The CHANNEL FUNCTIONAL TEST for the Reactor Mode Switch Shutdown Position Function is performed by attempting to withdraw any control rod with the reactor mode switch in the shutdown position and verifying a control rod block occurs.

As noted in the SR, the Surveillance is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable limits. This allows entry into MODES 3 and 4 if the 18 month Frequency is not met per SR 3.0.2.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency.

(continued)

RIVER BEND- B, 3.3-47 Revision No. 0

.-1, Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.9 REQUIREMENTS (continued) LCO 3.1.3 and LCO 3.1.6 may require individual control rods to be bypassed in RACS to allow insertion of an inoperable control rod or correction of a control rod pattern not in compliance with BPWS. With the control rods bypassed in the RACS, the RPC will not control the movement of these bypassed control rods. Individual control rods may also be required to be bypassed to allow continuous withdrawal for determining the location of leaking fuel assemblies, adjustment of control rod speed, or control rod scram time testing. To ensure the proper bypassing and movement of those affected control rods, a second licensed operator or other qualified member of the technical staff must verify the bypassing and movement of these control rods is in conformance with applicable analyses. Compliance with this SR allows the RPC and RWL to be OPERABLE with these control rods bypassed.

REFERENCES 1. USAR. Section 7.6.1.7.

2. USAR, Section 15.4.2.

3. NEDE-24011-P-A, "General Electric Standard Application for Reload Fuel" (latest approved revision).

4. "Modifications to the Requirements for Control Rod Drop Accident Mitigating Systems," BWR Owners Group, July 1986.

5. NEDO-21231, "Banked Position Withdrawal Sequence,"

January 1977.

6. NRC SER, Acceptance of Referencing of Licensing Topical Report NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17,"

December 27, 1987.

7. NEDC-30851-P-A, "Technical Specification Improvement Analysis for BWR Control Rod Block Instrumentation,"

October 1988.

8. GE-NE-A71-00019-01, "Reduction of Low Power Set Point for RBS Rod Pattern Control System," May 1996.

RIVER BEND B 3.3-48 Revision No. 6-13

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE I.c. 1.d. 2.c, and 2.d. Low Pressure Coolant Injection SAFETY ANALYSES, Pump A, B. and C and LPCS Pump Start-Time Delay Relay LCO, and (continued)

APPLICABILITY complete before starting the second pump on the same 4.16 kV emergency bus and short enough so that ECCS operation is not degraded.

Each LPCS/LPCI Pump Start-Time Delay Relay Function is only required to be OPERABLE when the associated LPCS/LPCI subsystem is required to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the LPCI subsystems.

I.e. 2.e. Reactor Vessel Pressure-Low (Injection Permissive)

Low reactor vessel pressure signals are used as permissives for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure. The Reactor Vessel Pressure-Low is one of the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS during the transients analyzed in References 1 and 3.

In addition, the Reactor Vessel Pressure-Low Function is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

The Reactor Vessel Pressure-Low signals are initiated from four pressure transmitters that sense the reactor dome pressure. The four pressure transmitters each drive a master and two slave trip units (for a total of eight slave trip units).

The Allowable Value is low enough to prevent overpressurizing the equipment in the low pressure ECCS, but high enough to ensure that the ECCS injection prevents the fuel peak cladding temperature from exceeding the limits of 10 CFR 50.46.

Four channels of Reactor Vessel Pressure-Low Function per associated Division are required to be OPERABLE when the (continued)

RIVER BEND B 3.3-95 Revision No. 0

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.e. 2.e. Reactor Vessel Pressure-Low (Iniection SAFETY ANALYSES, Permissive) (continued)

LCO, and APPLICABILITY associated ECCS is required to be OPERABLE to ensure that no single instrument failure can preclude ECCS initiation. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure ECCS subsystems.

1if. 1.q, 2.f. Low Pressure Coolant Injection and Low Pressure Core Spray Pump Discharqe Flow-Low (Bypass)

The minimum flow instruments are provided to protect the associated low pressure ECCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow is sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump. The LPCI and LPCS Pump Discharge Flow-Low Functions are assumed to be OPERABLE and capable of closing the minimum flow valves to ensure that the low pressure ECCS flows assumed during the transients and accidents analyzed in References 1, 2, and 3 are met. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

One flow transmitter per ECCS pump is used to detect the associated subsystems' flow rates. The logic is arranged such that each transmitter causes its associated minimum flow valve to open. The logic will close the minimum flow valve once the closure setpoint is exceeded. The LPCI minimum flow valves are time delayed such that the valves will not immediately open after the switches detect low flow. The time delay is provided to limit reactor vessel inventory loss during the startup of the RHR shutdown cooling mode (for RHR A and RHR B). The Pump Discharge Flow-Low Allowable Values are high enough to ensure that the pump flow rate is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core.

Each channel of Pump Discharge Flow-Low Function (one LPCS channel and three LPCI channels) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE, to ensure that no single instrument failure can preclude the ECCS function.

Refer to LCO 3.5.1 and (continued)

RIVER BEND B 3.3-96 Revision No. 6-12

CRFA System Instrumentation B 3.3.7.1 BASES APPLICABLE 2. Drywell Pressure-High (continued)

SAFETY ANALYSES, LCO, and Drywell Pressure-High signals are initiated from four APPLICABILITY pressure transmitters that sense drywell pressure. Four channels of Drywell Pressure-High Function are available (two channels per trip system) and are required to be OPERABLE to ensure that no single instrument failure can preclude CRFA System initiation.

The Drywell Pressure-High Allowable Value was chosen to be the same as the Secondary Containment Isolation Drywell Pressure-High Allowable Value (LCO 3.3.6.2).

The Drywell Pressure-High Function is required to be OPERABLE in MODES 1, 2, and 3 to ensure that control room personnel are protected during a LOCA. In MODES 4 and 5, the Drywell Pressure-High Function is not required since there is insufficient energy in the reactor to pressurize the drywell to the Drywell Pressure-High setpoint.

3. Control Room Local Intake Ventilation Radiation Monitors The Control Room Local Intake Ventilation Radiation Monitors measure radiation levels exterior to the inlet ducting of the MCR. A high radiation level may pose a threat to MCR personnel:

thus, a detector indicating this condition automatically signals initiation of the CRFA System.

The Control Room Local Intake Ventilation Radiation Monitors Function consists of two independent monitors. Two channels of Control Room Local Intake Ventilation Radiation Monitors are available and are required to be OPERABLE to ensure that no single instrument failure can preclude CRFA System initiation.

The Allowable Value was selected to ensure protection of the control room personnel.

The Control Room Local Intake Ventilation Radiation Monitors Function is required to be OPERABLE in MODES 1. 2, and 3, and during operations with a potential for draining the reactor vessel (OPDRVs) and movement of irradiated fuel in the primary containment or fuel building to ensure that control room personnel are protected during a LOCA, fuel handling event, or a vessel draindown event. During MODES 4 and 5, when these specified conditions are not in progress (e.g., OPDRVs), the probability of a LOCA or fuel damage is low: thus, the Function is not required.

(continued)

RIVER BEND B 3.3-201 Revision No. 6-13

,. IL CRFA System Instrumentation B 3.3.7.1 BASES (continued)

ACTIONS A Note has been provided to modify the ACTIONS related to CRFA System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable CRFA System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable CRFA System instrumentation channel.

A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.7.1-1. The applicable Condition specified in the Table is Function dependent.

Each time an inoperable channel is discovered, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

B.1 and B.2 Because of the diversity of sensors available to provide initiation signals and the redundancy of the CRFA System design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Refs. 4 and 5) to permit restoration of any inoperable channel to OPERABLE status.

However, this out of service time is only acceptable provided the associated Function is still maintaining CRFA System initiation capability. A Function is considered to be maintaining CRFA System initiation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate an initiation signal from the given Function on a valid signal. This would require one trip system to have two channels, each OPERABLE or in trip.

In this situation (loss of CRFA System initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.2 is not appropriate. If the Function is not maintaining CRFA System initiation capability, both CRFA subsystems must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of discovery of loss of (continued)

RIVER BEND B 3.3-202 Revision No. 0

RCS pit

?m/ts B 3.4.11 B 3.4 REACTOR COOLANT SYSTEM (ROS)

B 3 4 11 RCS Pressure and Temperature (PIT) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes.

These loads are introduced by startup (heatup) and shutdown (cooldown) operations. power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown. within the design assumptions and the stress limits for cyclic operation.

Figure 3.4.11-1 contains P/T limit curves for heatup and cooldown. The curves provide limits for inservice leak and hydrostatic test. core not critical, and core critical operation.

Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.

The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure. Therefore, the LCO limits apply mainly to the vessel.

10 CFR 50. Appendix G (Ref. 1). requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials. Reference I requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code,Section II, Appendix G (Ref. 2).

The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3) and 10 CFR 50, Appendix H (Ref. 4).

(continued)

RIVER BEND B 3.4-53 Revision No. 6-4

RCS P/T Limits B 3.4.11 BASES BACKGROUND The operating P/T limit curves will be adjusted, (continued) as necessary, based on the evaluation findings and the recommendations of Reference 5.

The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.

Figure 3.4.11-1 shows a set of P-T curves for the heat-up and cool-down operating conditions. These curves apply for both the

'T and 3/4T locations. When combining pressure and thermal stresses, it is usually necessary to evaluate stresses at the VT location (inside surface flaw) and the 3T location (outside surface flaw). This is because the thermal gradient tensile stress of interest is in the inner wall during cool-down and is in the outer wall during heatup. However, as a conservative simplification, the thermal gradient stress at the JT is assumed to be tensile for both heatup and cooldown. This results in the approach of applying the maximum tensile stress at the 3/4T location. This approach is conservative for two reasons: 1) the maximum stress is used regardless of flaw location, and 2) the irradiation effects cause the allowable toughness, K1, at VT to be less than that at 3T for a given metal temperature (Reference 9).

This approach causes no operational difficulties since the BWR is at steam saturation conditions during normal operation, satisfying the heatup/cooldown curve limits.

The core critical limits include the Reference 1 requirement that they be at least 40°F above the heatup curve or the cooldown curve and not lower than the minimum permissible temperature for the inservice leak and hydrostatic testing.

The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components. The ASME Code,Section XI, Appendix E (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.

(continued)

RIVER BEND B 3.4-54 Revision No. 6-13

RCS P/T Limits B 3.4.11 BASES SURVEILLANCE SR 3.4.11.8 and SR 3.4.11.9 (continued)

REQUIREMENTS Plant specific test data has determined that the bottom head is not subject to temperature stratification with natural circulation at power levels as low as 36% of RTP or with any single loop flow rate when the recirculation pump is on high speed operation. Therefore, SR 3.4.11.8 and SR 3.4.11.9 have been modified by a Note that requires the Surveillance to be met only when THERMAL POWER or loop flow is being increased when the above conditions are not met. The Note for SR 3.4.11.9 further limits the requirement for this Surveillance to exclude comparison of the idle loop temperature if the idle loop is isolated from the RPV since the water in the loop can not be introduced into the remainder of the reactor coolant system.

REFERENCES 1. 10 CFR 50. Appendix G.

2. ASME, Boiler and Pressure Vessel Code,Section III, Appendix G.

3. ASTM E 185-82, "Standard Practice for Conducting Surveillance Tests For Light-Water Cooled Nuclear Power Reactor Vessels," July 1982.

4. 10 CFR 50, Appendix H.

5. Regulatory Guide 1.99, Revision 2, May 1988.

6. ASME, Boiler and Pressure Vessel Code,Section XI, Appendix E.

7. R.G. Carey and B.J. Branlund, "105% Power Uprate Evaluation Report for Entergy Operations Inc. River Bend Station GE Task No. 12.0 Reactor Vessel Fracture Toughness," GE-NE, San Jose, CA, February 1999, (GE-NE-A22-00081-12).

8. USAR, Section 15.4.4.

9. GE-NE-B13-02094-00-01, Revision 0, Class III January 2001, "Pressure-Temperature Curves for Entergy Operations, Inc.

(EOI) using K1, Methodology - River Bend."

RIVER BEND B 3.4-61 Revision No. 6-13

Reactor Steam Dome Pressure B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 Reactor Steam Dome Pressure BASES BACKGROUND The reactor steam dome pressure is an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria and is also an assumed initial condition of Design Basis Accidents (DBAs) and transients.

APPLICABLE The reactor steam dome pressure of s 1045 psig is an SAFETY ANALYSES initial condition of the vessel overpressure protection analysis of Reference 1. This analysis assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system, primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance with the overpressure criteria is dependent on the initial reactor steam dome pressure; therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved. Reference 2 also assumes an initial reactor steam dome pressure for the analysis of DBAs and transients used to determine the limits for fuel cladding integrity MCPR (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1% cladding pl1stic strain (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)").

Reactor steam dome pressure satisfies the requirements of Criterion 2 of the NRC Policy Statement.

LCO The specified reactor steam dome pressure limit of s 1045 psig ensures the plant is operated within the assumptions of the vessel overpressure protection analysis.

Operation above the limit may result in a transient response more severe than analyzed.

APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam, and events which may challenge. the overpressure limits are possible.

(continued)

RIVER BEND 8 3.4-62 Revision No. 0

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES ACTION A.1 (continued)

Required Action A.1 has been modified by a Note indicating the provisions of LCO 3.0.4 are not applicable. As a result, a MODE change is allowed when one hydrogen igniter division is inoperable. The allowance is provided because of the low probability of the occurrence of an event that would generate hydrogen in amounts capable of exceeding the flammability limit, the low probability of the failure of the OPERABLE hydrogen igniter division and the amount of time available after the event for operator action to prevent exceeding the flammability limit.

B.1 and B.2 With two primary containment and drywell igniter divisions inoperable, the ability to perform the hydrogen control function via alternate capabilities must be verified by administrative means within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The alternate hydrogen control capabilities are provided by at least one hydrogen recombiner and one hydrogen mixing subsystem. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time allows a reasonable period of time to verify that a loss of hydrogen control function does not exist.

The verification may be performed as an administrative check by examining logs or other information to determine the availability of the alternate hydrogen control capabilities.

It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of the alternate hydrogen control capabilities. If the ability to perform the hydrogen control function is maintained, continued operation is permitted with two igniter divisions inoperable for up to 7 days. Seven days is a reasonable time to allow two igniter divisions to be inoperable because the hydrogen control function is maintained and because of the low probability of the occurrence of a LOCA that would generate hydrogen in the amounts capable of exceeding the flammability limit.

If any Required Action and required Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on (continued)

RIVER BEND 8 3.6-75 Revision No. 0

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES ACTIONS C.1 (continued) operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.3.2.1 and SR 3.6.3.2.2 REQUIREMENTS These SRs verify that there are no physical problems that could affect the igniter operation. Since the igniters are mechanically passive, they are not subject to mechanical failure.

The only credible failures are loss of power or burnout. The verification that each required igniter is energized is performed by circuit current versus voltage measurement of each circuit.

The Frequency of 184 days has been shown to be acceptable through operating experience because of the low failure occurrence, and provides assurance that hydrogen burn capability exists between the more rigorous 18 month Surveillances. Operating experience has shown these components usually pass the Surveillance when performed at a 184 day Frequency. Additionally, these surveillances must be performed every 92 days if four or more igniters in any division are inoperable. The 92 day Frequency was chosen.

recognizing that the failure occurrence is higher than normal.

Thus, decreasing the Frequency from 184 days to 92 days is a prudent measure, since only two more inoperable igniters (for a total of six) will result in an inoperable igniter division.

SR 3.6.3.2.2 is modified by a Note that indicates that the Surveillance is not required to be performed until 92 days after four or more igniters in the division are discovered to be inoperable.

SR 3.6.3.2.3 and SR 3.6.3.2.4 These functional tests are performed every 18 months to verify system OPERABILITY. The current draw to develop a surface temperature of - 1700'F is verified for igniters in inaccessible areas. Inaccessible areas are defined as areas that have high radiation levels during the entire refueling outage period.

These areas are the heat exchanger, filter demineralizer, backwash, and holding pump rooms of the RWCU system.

Additionally, the surface temperature of each accessible igniter is verified to be t 1700°F to demonstrate (continued)

RIVER BEND B 3.6-76 Revision No. 6-12

MS-PLCS B 3.6.1.9 BASES SURVEILLANCE SR 3.6.1.9.1 (continued)

REQUIREMENTS from the PVLCS accumulators. Due to the support system function of PVLCS for S/RV actuator air, however, the specified minimum pressure of 101 psig is required, which provides sufficient air for intermediate and long term post-LOCA S/RV actuations. This minimum air pressure alone is sufficient for PVLCS to support the OPERABILITY of these S/RV systems and is verified every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is considered adequate in view of other indications available in the control room, such as alarms, to alert the operator to an abnormal PVLCS air pressure condition.

SR 3.6.1.9.2 Each PVLCS compressor is operated for a 15 minutes to verify MS-PLCS OPERABILITY. The 31 day Frequency was developed considering the known reliability of the PVLCS compressor and controls, the two subsystem redundancy, and the low probability of a significant degradation of the MS-PLCS subsystem occurring between surveillances and has been shown to be acceptable through operating experience.

SR 3.6.1.9.3 A system functional test is performed to ensure that the MS-PLCS will operate through its operating sequence. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. USAR, Section 6.7.

2. USAR, Section 15.6.5.

RIVER BEND B 3.6-49 Revision No. 0

Primary Contai nment-Shutdown B 3.6.1.10 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.10 Primary Containment-Shutdown BASES BACKGROUND The function of the primary containment is to isolate and contain fission products released from the Reactor Primary System following a Design Basis Accident (DBA) and to confine the postulated release of radioactive material to within limits. The primary containment consists of a steel lined, reinforced concrete vessel, which surrounds the Reactor Primary System and provides an essentially leak tight barrier against an uncontrolled release of radioactive material to the environment.

Additionally, this structure provides shielding from the fission products that may be present in the primary containment atmosphere following accident conditions.

The isolation devices for the penetrations in the primary containment boundary are a part of the primary containment leak tight barrier. To maintain this leak tight barrier for accidents during shutdown conditions:

a. All penetrations required to be closed during accident conditions are closed by manual valves, blind flanges, or de-activated power operated or automatic valves secured in their closed positions, or the equivalent, except as provided in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)";

b. Primary containment air locks are OPERABLE, except as provided in LCO 3.6.1.2, "Primary Containment Air Locks":

and

c. All equipment hatches are closed.

This Specification ensures that the performance of the primary containment, in the event of a fuel handling accident (FHA) involving handling recently irradiated fuel, inadvertent criticality, or reactor vessel draindown, provides an acceptable leakage barrier to contain fission products, thereby minimizing offsite doses.

APPLICABLE The safety design basis for the primary containment is that SAFETY ANALYSES it contain the fission products from a FHA inside the (continued)

RIVER BEND B 3.6-50 Revision 6-13

Primary Containment-Shutdown B 3.6.1.10 BASES APPLICABLE primary containment (Ref.2), to limit doses at the site SAFETY ANALYSES boundary to within limits. The primary containment performs (continued) no active function in response to this event; however, its leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage rates assumed in safety analyses.

The FHA inside the primary containment is assumed to occur only after t 80 hours9.259259e-4 days 0.0222 hours 1.322751e-4 weeks 3.044e-5 months since the reactor was last critical.

The fission product release is, in turn, based on an assumed leakage rate from vent and drain valves with a combined flow rate of 70.2 cfm (based on an assumed 0.367 inch water gauge differential pressure). This assumed pressure reflects the fact that the FHA does not produce elevated containment pressures as is the case for the OBA LOCA. However, as an added conservatism, the analysis assumes a non-mechanistic additional leakage of 0.26% of the containment volume per day.

Primary containment satisfies Criterion 3 of the NRC Policy Statement.

LCO Primary containment OPERABILITY is maintained by providing a contained volume to limit fission product escape following a FHA or other unanticipated reactivity or water level excursion. Compliance with this LCO will ensure a primary containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis. Since no credit is assumed for automatic isolation valve closure, and any leakage which would occur prior to valve closure is similarly not accounted for, all penetrations which could communicate gaseous fission products to the environment must remain closed.

However, a limited number of primary containment penetration vent and drain valves may remain opened, and the primary containment considered OPERABLE provided the calculated leakage flow rate through the open vent and drain valves is less 1 70.2 cfm.

Leakage rates specified for the primary containment and not air locks, addressed in LCO 3.6.1.1 and LCO 3.6.1.2 are directly applicable during the shutdown conditions addressed in this LCO.

(co~nti nued)

RIVER BEND B 3.6751 Revision 2-1

Primary Contai nment-Shutdown B 3.6.1.10 BASES (continued)

APPLICABILITY In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining an OPERABLE primary containment in MODE 4 or 5 to ensure a control volume, is only required during situations for which significant releases of radioactive material can be postulated: such as during operations with a potential for draining the reactor vessel (OPDRVs) or during movement of recently irradiated fuel assemblies in the primary containment. Due to radioactive decay, the primary containment is only required to be OPERABLE during fuel handling involving recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 11 days).

Requirements for ECCS OPERABILITY during MODES 1, 2, and 3 are discussed in the Applicability section of the Bases for LCO 3.5.1.

ACTIONS A.1 and A.2 In the event that primary containment is inoperable, action is required to immediately suspend activities that represent a potential for releasing radioactive material, thus placing the unit in a Condition that minimizes risk. If applicable, movement of recently irradiated fuel assemblies must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Action must continue until OPDRVs are suspended.

SURVEILLANCE SR 3.6.1.10.1 REQUIREMENTS This SR verifies that each primary containment penetration that could communicate gaseous fission products to the environment during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive gases outside of the primary containment boundary is within design limits. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Single isolation barriers that meet this criterion are a closed and de-activated power operated or automatic valve, a closed manual valve, a blind flange, or equivalent. This does not preclude the use of two active (ie, power operated and/or automatic) valves in the closed position for a given penetration.

This SR does not require any testing or valve manipulation.

(conti nued)

RIVER BEND B 3.6-52 Revision 6-13

CRFA System B 3.7.2 BASES APPLICABLE and 15 (Refs. 3 and 4, respectively). The isolation mode SAFETY ANALYSES of the CRFA System is assumed to operate following a loss (continued) of coolant accident, main steam line break, fuel handling accident, and control rod drop accident. The radiological doses to control room personnel as a result of the various DBAs are summarized in Reference 4. No single active or passive failure will cause the loss of outside or recirculated air from the control room.

The CRFA System satisfies Criterion 3 of the NRC Policy Statement.

LCO Two redundant subsystems of the CRFA System are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other subsystem.

Total system failure could result in a failure to meet the dose requirements of GDC 19 in the event of a DBA.

The CRFA System is considered OPERABLE when the individual components necessary to control operator exposure are OPERABLE in both subsystems. A subsystem is considered OPERABLE when its associated:

a. Fan is OPERABLE;

b. HEPA filter and charcoal adsorber are not excessively restricting flow and are capable of performing their filtration functions; and

c. Heater, demister, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

In addition, the control room boundary must be maintained, including the integrity of the walls, floors, ceilings, ductwork, and access doors.

APPLICABILITY In MODES 1, 2, and 3, the CRFA System must be OPERABLE to control operator exposure during and following a DBA, since the DBA could lead to a fission product release.

In MODES 4 and 5, the probability and consequences of a DBA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the CRFA System (continued)

RIVER BEND 8 3.7-11 Revisiom No. 0

CRFA System B 3.7.2 BASES APPLICABILITY OPERABLE is not required in MODE 4 or 5. except for the (continued) following situations under which significant radioactive releases can be postulated:

a. During operations with a potential for draining the reactor vessel (OPDRVs): and

b. During movement of irradiated fuel assemblies in the primary containment or fuel building.

ACTIONS A.1 With one CRFA subsystem inoperable, the inoperable CRFA subsystem must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE CRFA subsystem is adequate to perform control room radiation protection. However.

the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in loss of CRFA System function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and that the remaining subsystem can provide the required capabilities.

B.1 and B.2 In MODE 1, 2, or 3, if the inoperable CRFA subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE that minimizes risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1. C.2.1. and C.2.2 The Required Actions of Condition C are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the (continued)

RIVER BEND B 3.7-12 Revision No. 6-13

CRFA System B 3.7.2 BASES ACTIONS C.1, C.2.1, and C.2.2 (continued) fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

During movement of irradiated fuel assemblies in the primary containment or fuel building or during OPDRVs, if the inoperable CRFA subsystem cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE CRFA subsystem may be placed in the emergency mode. This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent automatic actuation will occur, and that any active failure will be readily detected.

An alternative to Required Action C.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk.

If applicable, movement of irradiated fuel assemblies in the primary containment and fuel building must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

D.1 If both CRFA subsystems are inoperable in MODE 1, 2, or 3, the CRFA System may not be capable of performing the intended function and the unit is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

(continued)

RIVER BEND B 3.7-13 Revision No. 6-13

CRFA System B 3.7.2 BASES ACTIONS E.1 and E.2 (continued)

During movement of irradiated fuel assemblies in the primary containment or fuel building or during OPDRVs, with two CRFA subsystems inoperable, action must be taken immediately to suspend activities that present a potential for releasing radioactivity that might require isolation of the control room.

This places the unit in a condition that minimizes risk.

If applicable, movement of irradiated fuel assemblies in the primary containment and fuel building must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. If applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that a subsystem in a standby mode starts on demand from the control room and continues to operate with flow through the HEPA filters and charcoal adsorbers. Standby systems should be checked periodically to ensure that they start and function properly. As the environmental and normal operating conditions of this system are not severe, testing each subsystem once every month provides an adequate check on this system.

Monthly heater operation dries out any moisture accumulated in the charcoal from humidity in the ambient air. Systems with heaters must be operated for m 10 continuous hours with the heaters energized to demonstrate the function of the system.

Furthermore, the 31 day Frequency is based on the known reliability of the equipment and the two subsystem redundancy available.

(continued)

RIVER BEND B 3.7-14 Revision No. 6-13

Control Room AC System B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Control Room Air Conditioning (AC) System BASES BACKGROUND The Control Room AC System provides temperature control for the control room following.

The Control Room AC System consists of two independent, redundant subsystems that provide cooling and heating of recirculated control room air. Each subsystem consists of heating coils, cooling coils, fans, chillers, compressors.

ductwork, dampers, and instrumentation and controls to provide for control room temperature control.

The Control Room AC System is designed to provide a controlled environment under both normal and accident conditions. The Control Room AC System operation in maintaining the control room temperature is discussed in the USAR, Sections 6.4 and 9.4.1 (Refs. 1 and 2. respectively).

Dependent upon weather conditions, the heating coils may be required for Control Room AC System to maintain humidity within design specification.

APPLICABLE The design basis of the Control Room AC System is to SAFETY ANALYSES maintain the control room temperature for a 30 day continuous occupancy.

The Control Room AC System components are arranged in redundant safety related subsystems. During emergency operation, the Control Room AC System maintains a habitable environment and ensures the OPERABILITY of components in the control room. A single active failure of a component of the Control Room AC System. assuming a loss of offsite power, does not impair the ability of the system to perform its design function. Redundant detectors and controls are provided for control room temperature control. The Control Room AC System is designed in accordance with Seismic Category I requirements. The Control Room AC System is capable of removing sensible and latent heat loads from the control room., including consideration of equipment heat loads and personnel occupancy requirements to ensure equipment OPERABILITY.

The Control Room AC System satisfies Criterion 3 of the NRC Policy Statement.

(conti nued)

RIVER BEND B 3.7-17 Revision No. 4-4

Control Room AC System B 3.7.3 BASES (continued)

LCO Two independent and redundant subsystems of the Control Room AC System are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other subsystem. Total system failure could result in the equipment operating temperature exceeding limits.

The Control Room AC System is considered OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in both subsystems. These components include the cooling coils, fans, chillers, compressors, ductwork, dampers, and associated instrumentation and controls.

APPLICABILITY In MODE 1, 2. or 3. the Control Room AC System must be OPERABLE to ensure that the control room temperature will not exceed equipment OPERABILITY limits.

In MODES 4 and 5, the probability and consequences of a Design Basis Accident are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the Control Room AC System OPERABLE is not required in MODE 4 or 5, except for the following situations under which significant radioactive releases can be postulated:

a. During operations with a potential for draining the reactor vessel (OPDRVs) and;

b. During movement of irradiated fuel assemblies in the primary containment or fuel building.

ACTIONS A.1 With one control room AC subsystem inoperable, the inoperable control room AC subsystem must be restored to OPERABLE status within 30 days. With the unit in this condition, the remaining OPERABLE control room AC subsystem is adequate to perform the control room air conditioning function, However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in loss of the control room air conditioning (continued)

RIVER BEND B 3.7-18 Revision No. 6-13

Control Room AC System B 3.7.3 BASES ACTIONS A.l (continued) function. The 30 day Completion Time is based on the low probability of an event occurring requiring control room isolation, the consideration that the remaining subsystem can provide the required protection, and the availability of alternate cooling methods.

B.1 and B.2 If both control room AC subsystems are inoperable, the Control Room AC System may not be capable of performing its intended function. Therefore, the control room area temperature is required to be monitored once per 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to ensure that temperature is being maintained low enough that equipment in the control room is not adversely affected. With the control room temperature being maintained within the temperature limit, 7 days is allowed to restore a control room AC subsystem to OPERABLE status. These Completion Times are reasonable considering that the control room temperature is being maintained within limits, the low probability of an event occuring requiring control room isolation, and the availability of alternate cooling methods.

C.1 and C.2 In MODE 1. 2, or 3, if the control room area temperature cannot be maintained

104 0 F or if the inoperable control room AC subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE that minimizes risk. To achieve this status the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

DJ1, D.2.1, and D.2.2 The Required Actions of Condition C are modified by a Note indicating that LCO 3.0.3 does not apply.

(continued)

RIVER BEND B 3.7-19 Revision No. 6-13

Control Room AC System B 3.7.3 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued)

If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

During movement of irradiated fuel assemblies in the primary containment or fuel building or during OPDRVs, if Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE control room AC subsystem may be placed immediately in operation. This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent actuation will occur, and that any active failure will be readily detected.

An alternative to Required Action D.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk.

If applicable, movement of irradiated fuel assemblies in the primary containment and fuel building must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

E.1 and E.2 During movement of irradiated fuel assemblies in the primary containment or fuel building or during OPDRVs if the Required Action and associated Completion Time of Condition B is not met, action must be taken to immediately suspend activities that present a potential for releasing radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes risk.

If applicable, handling of irradiated fuel in the primary containment or fuel building must be suspended immediately.

Suspension of these activities shall (conti nued)

RIVER BEND B 3.7-20 Revision No. 6-13

Control Room AC System B 3.7.3 BASES ACTIONS E.1 and E.2 (continued) not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to remove the control room heat load assumed in the safety analysis. The SR consists of a combination of testing and calculation. The 18 month Frequency is appropriate since significant degradation of the Control Room AC System is not expected over this time period.

REFERENCES 1. USAR, Section 6.4.

2. USAR, Section 9.4.1.

RIVER BEND B 3.7-21 Revision No. 6-13

Main Condenser Offgas B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Main Condenser Offgas BASES BACKGROUND During unit operation, steam from the low pressure turbine is exhausted directly into the condenser. Air and noncondensible gases are collected in the condenser, then exhausted through the steam jet air ejectors (SJAEs) to the Main Condenser Offgas System. The offgas from the main condenser normally includes radioactive gases.

The Main Condenser Offgas System has been incorporated into the unit design to reduce the gaseous radwaste emission.

This system uses a catalytic recombiner to recombine radiolytically dissociated hydrogen and oxygen. The gaseous mixture is cooled by the offgas condenser; the water and condensibles are stripped out by the offgas condenser and moisture separator. The radioactivity of the remaining gaseous mixture (i.e., the offgas recombiner effluent) is monitored downstream of the moisture separator prior to entering the holdup line.

APPLICABLE The main condenser offgas gross gamma activity rate is an SAFETY ANALYSES initial condition of the Main Condenser Offgas System failure event as discussed in the USAR, Section 15.7.1 (Ref. 1). The analysis assumes a gross failure in the Main Condenser Offgas System that results in the rupture of the Main Condenser Offgas System pressure boundary. The gross gamma activity rate is controlled to ensure that during the event, the calculated offsite doses will be well within the limits (NUREG-0800, Ref. 2) of 10 CFR 100 (Ref. 3), or the NRC staff approved licensing basis.

The main condenser offgas limits satisfy Criterion 2 of the NRC Policy Statement.

LCO To ensure compliance with the assumptions of the Main Condenser Offgas System failure event (Ref. 1), the fission product release rate should be consistent with a noble gas release to the reactor coolant of 100 pCi/MWt-second after decay of 30 minutes. The LCO.is conservatively established at (2894 MWt x 100 pCi/MWt-second - 290 mCi/second).

(conti nued)

RIVER BEND 8 3.7-22 Revision No. 0

Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS A.1 and A.2 (continued) would already be considered "slow" and the further degradation of scram performance with an inoperable accumulator could result in excessive scram times. In this event, the associated control rod is declared inoperable (Required Action A.2) and LCO 3.1.3 entered. This would result in requiring the affected control rod to be fully inserted and disarmed, thereby satisfying its intended function in accordance with ACTIONS of LCO 3.1.3.

The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is considered reasonable, based on the large number of control rods available to provide the scram function and the ability of the affected control rod to scram only with reactor pressure at high reactor pressures.

B.1, B.2.1, and B.2.2 With two or more control rod scram accumulators inoperable and reactor steam dome pressure Ž 600 psig, adequate pressure must be supplied to the charging water header. With inadequate charging water pressure, all of the accumulators could become inoperable, resulting in a potentially severe degradation of the scram performance. Therefore, within 20 minutes from discovery of charging water header pressure < 1540 psig concurrent with Condition B, adequate charging water header pressure must be restored. The allowed Completion Time of 20 minutes is considered a reasonable time to place a CRD pump into service to restore the charging header pressure, if required. This Completion Time also recognizes the ability of the reactor pressure alone to fully insert all control rods.

The control rod may be declared "slow," since the control rod will still scram using only reactor pressure, but may not satisfy the times in Table 3.1.4-1. Required Action B.2.1 is modified by a Note indicating that declaring the control rod "slow" is only applicable if the associated control scram time was within the limits of Table 3.1.4-1 during the last scram time test.

Otherwise, the control rod would already be considered "slow" and (continued)

RIVER BEND B 3.1-29 Revision No. 6-14

Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS B.1, B.2.1, and B.2.2 (continued) the further degradation of scram performance with an inoperable accumulator could result in excessive scram times. In this event, the associated control rod is declared inoperable (Required Action B.2.2) and LCO 3.1.3 entered. This would result in requiring the affected control rod to be fully inserted and disarmed, thereby satisfying its intended function in accordance with ACTIONS of LCO 3.1.3.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is considered reasonable, based on the ability of only the reactor pressure to scram the control rods and the low probability of a DBA or transient occurring while the affected accumulators are inoperable.

C.1 and C.2 With one or more control rod scram accumulators inoperable and the reactor steam dome pressure < 600 psig, the pressure supplied to the charging water header must be adequate to ensure that accumulators remain charged. With the reactor steam dome pressure

< 600 psig, the function of the accumulators in providing the scram force becomes much more important since the scram function could become severely degraded during a depressurization event or at low reactor pressures. Therefore, immediately upon discovery of charging water header pressure < 1540 psig, concurrent with Condition C, all control rods associated with inoperable accumulators must be verified to be fully inserted. Withdrawn control rods with inoperable scram accumulators may fail to scram under these low pressure conditions. The associated control rods must also be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable for Required Action C.2, considering the low probability of a DBA or transient occurring during the time the accumulator is inoperable.

(continued)

RIVER BEND B 3.1-30 Revision No. 6-14

Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS D.1 (continued)

The reactor mode switch must be immediately placed in the shutdown position if either Required Action and associated Completion Time associated with the loss of the CRD pump (Required Actions B.1 and C.1) cannot be met. This ensures that all insertable control rods are inserted and that the reactor is in a condition that does not require the active function (i.e.. scram) of the control rods.

This Required Action is modified by a Note stating that the Required Action is not applicable if all control rods associated with the inoperable scram accumulators are fully inserted, since the function of the control rods has been performed.

SURVEILLANCE SR 3.1.5.1 REQUIREMENTS SR 3.1.5.1 requires that the accumulator pressure be checked every 7 days to ensure adequate accumulator pressure exists to provide sufficient scram force. The primary indicator of accumulator OPERABILITY is the accumulator pressure. A minimum accumulator pressure is specified, below which the capability of the accumulator to perform its intended function becomes degraded and the accumulator is considered inoperable. The minimum accumulator pressure of 1540 psig is well below the expected pressure of 1750 psig (Ref. 2). Declaring the accumulator inoperable when the minimum pressure is not maintained ensures that significant degradation in scram times does not occur. The 7 day Frequency has been shown to be acceptable through operating experience and takes into account indications available in the control room.

REFERENCES 1. USAR, Section 4.3.2.5.5.

2. USAR. Section 4.6.1.1.2.5.3.

3. USAR, Section 5.2.2.2.3.

4. USAR, Section 15.4.1.

RIVER BEND B 3. 1-31 Revision No. 6-14

Control Rod Pattern B 3.1.6 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 Control Rod Pattern BASES BACKGROUND Control rod patterns during startup conditions are controlled by the operator and the rod pattern controller (RPC) (LCO 3.3.2.1, "Control Rod Block Instrumentation"), so that only specified control rod sequences and relative positions are allowed over the operating range of all control rods inserted up to the low power setpoint (LPSP).

The sequences effectively limit the potential amount of reactivity addition that could occur in the event of a control rod drop accident (CRDA).

This Specification assures that the control rod patterns are consistent with the assumptions of the CRDA analyses of References 1 and 2.

APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the CRDA are summarized in References I and 2. CRDA analyses assume that the reactor operator follows prescribed withdrawal sequences. These sequences define the potential initial conditions for the CRDA analysis. The RPC (LCO 3.3.2.1) provides backup to operator control of the withdrawal sequences to ensure that the initial conditions of the CRDA analysis are not violated.

Prevention or mitigation of positive reactivity insertion events is necessary to limit the energy deposition in the fuel, thereby preventing significant fuel damage, which could result in undue release of radioactivity. Since the failure consequences for U02 have been shown to be insignificant below fuel energy depositions of 300 cal/gm (Ref. 3), the fuel damage limit of 280 cal/gm provides a margin of safety from significant core damage, which would result in release of radioactivity (Refs. 4 and 5). Generic evaluations (Ref. 6) of a design basis CRDA (i.e., a CRDA resulting in a peak fuel energy deposition of 280 cal/gm) have shown that if the peak fuel enthalpy remains below 280 cal/gm, then the maximum reactor pressure will be less than the required ASME Code limits (Ref. 7) and the calculated offsite doses will be well within the required limits (Ref. 5).

(continued)

RIVER BEND B 3.1-32 Revision No. 0

SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.7 REQUIREMENTS (continued) Demonstrating each SLC System pump develops a flow rate > 41.2 gpm at a discharge pressure > 1250 psig ensures that pump performance has not degraded during the fuel cycle. This minimum pump flow rate requirement ensures that, when combined with the sodium pentaborate solution concentration requirements. the rate of negative reactivity insertion from the SLC System will adequately compensate for the positive reactivity effects encountered during power reduction, cooldown of the moderator, and xenon decay. This test confirms one point on the pump design curve, and is indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this Surveillance is in accordance with the Inservice Testing Program.

SR 3.1.7.8 This Surveillance ensures that there is a functioning flow path from the boron solution storage tank to the RPV, including the firing of an explosive valve. The replacement charge for the explosive valve shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of that batch successfully fired. Other administrative controls, such as those that limit the shelf life of the explosive charges, must be followed. The pump and explosive valve tested should be alternated such that both complete flow paths are tested every 36 months, at alternating 18 month intervals. The Surveillance may be performed in separate steps to prevent injecting boron into the RPV. An. acceptable method for verifying flow from the pump to the RPV is to pump demineralized water from a test tank through one SLC subsystem and into the RPV. In order to pump this water, the test valve 1C41*F031 is open. A system initiation signal (which normally signals the 1C41*F001 storage tank suction valve) is generated with the test valve open and verification is made that the storage tank suction valve remains closed. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these (continued)

RIVER BEND B 3. 1-43 Revision No. 6-14

SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.8 (continued)

REQUIREMENTS components usually pass the Surveillance test when performed at the 18 month Frequency; therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.1.7.9 Enriched sodium pentaborate solution is made by mixing granular, enriched sodium pentaborate with water. Isotopic tests on the sodium pentaborate solution to determine the actual B-10 enrichment must be performed once within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after boron is added to the solution in order to ensure that the B-10 enrichment is adequate. Enrichment testing is only required when boron addition is made since enrichment change cannot occur by any other process.

REFERENCES 1. 10 CFR 50.62.

2. USAR, Section 9.3.5.3.

RIVER BEND B 3.1-44 Revision No. 1

S/RVs B 3.4.4 BASES LCO +/-36 psig of the nominal setpoint to account for potential (continued) setpoint drift to provide an added degree of conservatism.

Operation with fewer valves OPERABLE than specified, or with setpoints outside the ASME limits, could result in a more severe reactor response to a transient than predicted, possibly resulting in the ASME Code limit on reactor pressure being exceeded.

APPLICABILITY In MODES 1, 2, and 3, the specified number of S/RVs must be OPERABLE since there may be considerable energy in the reactor core and the limiting design basis transients are assumed to occur. The S/RVs may be required to provide pressure relief to discharge energy from the core until such time that the Residual Heat Removal (RHR) System is capable of dissipating the heat.

In MODE 4, decay heat is low enough for the RHR System to provide adequate cooling, and reactor pressure is low enough that the overpressure limit is unlikely to be approached by assumed operational transients or accidents. In MODE 5, the reactor vessel head is unbolted or removed and the reactor is at atmospheric pressure. The S/RV function is not needed during these conditions.

ACTIONS A.1 and A.2 With less than the minimum number of required S/RVs OPERABLE, a transient may result in the violation of the ASME Code limit on reactor pressure. If one or more required S/RVs are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.4.1 REQUIREMENTS This Surveillance demonstrates that the required S/RVs will open at the pressures assumed in the safety analysis of Reference 2. The "as-left" SRV safety function lift setpoints are required to be within +/- 1% of the specified nominal lift setpoint. Additionally, the sample size will be increased by two valves for each valve found outside of the "as-found" +/- 3% safety lift setpoint. These requirements formed a portion of the basis for increasing the "as-found" lift setpoint tolerance to +/- 3%of the safety function lift setpoint. The demonstration of the S/RV safety function (continued)

RIVER BEND B 3.4-19 Revision No. 6-14

'ASES 9v:SAc SR 3 4,4ý 1 1'cort~ruea) i ft settings must ýe Qerformed curlng shutdown. since tn's 's "Tench test, and - accordance with the ýnserviCe Test:og P~ogr

"-elift setting pressure shall correspond to ambient ccrc-:':ns of týhe valves at nominal operating temperatures arc pressures.

The Frequency was selected because this Surveillarce must .e performed during shutdown conditions and is 'ased on the t',e between refuelings.

SR 3.4 4 2 The required relief function S/RVs are required to actuate automatically upon receipt of specific initiation signals A system functional test is performed to verify the mechanical portions of the automatic relief function operate as lesigned when initiated either by an actual or simulated initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.4.4 overlaps this SR to provide complete testing of the safety function.

The 18 month Frequency is based on the need to perform thls Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the SR wnen performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint This SR is modified by a Note that excludes valve actuation This prevents an RPV pressure blowdown.

SR 3.4.4.3 A manual actuation of each required S/RV is performed to verify that the valve is functioning properly and no blockage exists in the valve discharge line. This can be demonstrated by the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g.. tail-pipe temperature or acoustic monitor). Adequate reactor (continued)

RIVER BEND B 3.4-20 Revision No 1

RCS P/T Limits B 3.4.11 BASES SURVEILLANCE- SR 3.4.11.8 and SR 3.4.11.9 (continued)

REQUIREMENTS Plant specific test data has determined that the bottom head is not subject to temperature stratification with natural circulation at power levels as low as 36% of RTP or with any single loop flow rate when the recirculation pump is on high speed operation. Therefore, SR 3.4.11.8 and SR 3.4.11.9 have been modified by a Note that requires the Surveillance to be met only when THERMAL POWER or loop flow is being increased when the above conditions are not met. The Note for SR 3.4.11.9 further limits the requirement for this Surveillance to exclude comparison of the idle loop temperature if the idle loop is isolated from the RPV since the water in the loop can not be introduced into the remainder of the reactor coolant system.

REFERENCES 1. 10 CFR 50. Appendix G.

2. ASME. Boiler and Pressure Vessel Code.Section III, Appendix G.

3. ASTM E 185-82. "Standard Practice for Conducting Surveillance Tests For Light-Water Cooled Nuclear Power Reactor Vessels," July 1982.

4. 10 CFR 50. Appendix H.

5. Regulatory Guide 1.99, Revision 2. May 1988.

6. ASME. Boiler and Pressure Vessel Code,Section XI.

Appendix E.

7. R.G. Carey and B.J. Branlund. "105% Power Uprate Evaluation Report for Entergy Operations Inc. River Bend Station GE Task No. 12.0 Reactor Vessel Fracture Toughness," GE-NE, San Jose. CA, February 1999, (GE-NE-A22-00081-12).

8. USAR. Section 15.4.4.

9. GE-NE-BI3-02094-00-01. Revision 0. Class III January 2001.

"Pressure-Temperature Curves for Entergy Operations. Inc.

(EOI) using K1c Methodology - River Bend."

RIVER BEND B 3.4-61 Revision No. 6-13

Reactor Steam Dome Pressure B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 Reactor Steam Dome Pressure BASES BACKGROUND The reactor steam dome pressure is an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria and is also an assumed initial condition of Design Basis Accidents (DBAs) and transients.

APPLICABLE The reactor steam dome pressure of g 1075 psig is an SAFETY ANALYSES initial condition of the vessel overpressure protection analysis of Reference 1. This analysis assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system, primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance with the overpressure criteria is dependent on the initial reactor steam dome pressure: therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved. Reference 2 also assumes an initial reactor steam dome pressure for the analysis of DBAs and transients used to determine the limits for fuel cladding integrity MCPR (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1% cladding plastic strain (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)").

Reactor steam dome pressure satisfies the requirements of Criterion 2 of the NRC Policy Statement.

LCO The specified reactor steam dome pressure limit of : 1075 psig ensures the plant is operated within the assumptions of the vessel overpressure protection analysis. Operation above the limit may result in a transient response more severe than analyzed.

APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam, and events which may challenge the overpressure limits are possible.

(continued)

RIVER BEND B 3.4-62 Revision No. 6-14

Reactor Steam Dome Pressure B 3.4.12 BASES APPLICABILITY In MODES 3, 4, and 5, the limit is not applicable because (continued) the reactor is shut down. In these MODES, the reactor pressure is well below the required limit, and no anticipated events will challenge the overpressure limits.

ACTIONS A.1 With the reactor steam dome pressure greater than the limit, prompt action should be taken to reduce pressure to below the limit and return the reactor to operation within the bounds of the analyses. The 15 minute Completion Time is reasonable considering the importance of maintaining the pressure within limits. This Completion Time also ensures that the probability of an accident while pressure is greater than the limit is minimal.

B.1 If the reactor steam dome pressure cannot be restored to within the limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.12.1 REQUIREMENTS Verification that reactor steam dome pressure is

1075 psig ensures that the initial conditions of the vessel overpressure protection analysis are met. Operating experience has shown the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency to be sufficient for identifying trends and verifying operation within safety analyses assumptions.

REFERENCES 1. USAR, Section 5.2.2.1.

2. USAR, Section 15.

RIVER BEND B 3.4-63 Revision No. 6-14

ECCS - Operating B 3.5.1 BASES BACKGROUND suppression pool to inject into the core. A discharge test (continued) line is provided to route water from and to the suppression pool to allow testing of each LPCI pump without injecting water into the RPV.

The HPCS System (Ref. 3) consists of a single motor driven pump, a spray sparger above the core, and piping and valves to transfer water from the suction source to the sparger. Suction piping is provided from the CST and the suppression pool. Pump suction is normally aligned to the CST source to minimize injection of suppression pool water into the RPV. However, if the CST water supply is low or the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the HPCS System. The HPCS System is designed to provide core cooling over a wide range of RPV pressures (0 psid to 1231 psid, vessel to suction source).

Upon receipt of an initiation signal, the HPCS pump automatically starts after AC power is available and valves in the flow path begin to open. Since the HPCS System is designed to operate over the full range of expected RPV pressures, HPCS flow begins as soon as the necessary valves-are open. A full flow test line is provided to route water from and to the CST to allow testing of the HPCS System during normal operation without spraying water into the RPV.

The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when other discharge line valves are closed or RPV pressure is greater than the LPCS or LPCI pump discharge pressures following system initiation. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the ECCS discharge line "keep fill" systems are designed to maintain all pump discharge lines filled with water.

The ADS (Ref. 4) consists of 7 of the 16 S/RVs. It is designed to provide depressurization of the primary system during a small break LOCA if HPCS fails or is unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (LPCS and LPCI), so that these subsystems can provide core cooling. Each ADS (continued)

RIVER BEND B 3.5-3 Revision No. 6-14

ECCS - Operating B 3.5.1 BASES BACKGROUND valve is supplied with pneumatic power from an air storage (continued) system, which consists of air accumulators located in the drywell.

APPLICABLE The ECCS performance is evaluated for the entire spectrum of SAFETY ANALYSES break sizes for a postulated LOCA. The accidents for which ECCS operation is required are presented in References 5, 6, and 7. The required analyses and assumptions are defined in 10 CFR 50 (Ref. 8), and the results of these analyses are described in Reference 9.

This LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46 (Ref. 10), will be met following a LOCA assuming the worst case single active component failure in the ECCS:

a. Maximum fuel element cladding temperature is

2200°F;

b. Maximum cladding oxidation is 1 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from zirconium water reaction is : 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding theplenum volume, were to react;

d. The core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The limiting single failures are discussed in Reference 11.

For a large break LOCA, HPCS system failure is, in general, the most severe failure. For a small break LOCA, HPCS System failure is the most severe failure. One ADS valve failure is analyzed as a limiting single failure for events requiring ADS operation. The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damage.

The ECCS satisfy Criterion 3 of the NRC Policy Statement.

(continued)

RIVER BEND B 3.5-4 Revision No. 3-7

ECCS -Shutdown B 3.5.2 BASES SURVEILLANCE SR 3.5.2.3, SR 3.5.2.5. and SR 3.5.2.6 REQUIREMENTS (continued) The Bases provided for SR 3.5.1.1, SR 3.5.1.4, and SR 3.5.1.5 are applicable to SR 3.5.2.3, SR 3.5.2.5, and SR 3.5.2.6. respectively.

SR 3.5.2,4 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The 31 day Frequency is appropriate because the valves are operated under procedural control and the probability of their being mispositioned during this time period is low.

In MODES 4 and 5, the RHR System may operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. Therefore. RHR valves that are required for LPCI subsystem operation may be aligned for decay heat removal.

This SR is modified by a Note that allows one LPCI subsystem of the RHR System to be considered OPERABLE for the ECCS function if all the required valves in the LPCI flow path can be manually realigned (remote or local) to allow injection into the RPV and the system is not otherwise inoperable. This will ensure adequate core cooling if an inadvertent vessel draindown should occur.

REFERENCES 1. USAR, Section 6.3.3.4.

RIVER BEND B 3.5-19 Revision No. 0

4--

RCIC System B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.3 RCIC System BASES BACKGROUND The RCIC System is not part of the ECCS; however, the RCIC System is included with the ECCS section because of their similar functions.

The RCIC System is designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of coolant flow from the feedwater system to provide adequate core cooling and control of RPV water level.

Under these conditions, the High Pressure Core Spray (HPCS) and RCIC systems perform similar functions, The RCIC System design requirements ensure that the criteria of Reference 1 are satisfied.

The RCIC System (Ref. 2) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the Feedwater System piping. Suction piping is provided from the condensate storage tank (CST) and the suppression pool. Pump suction is normally aligned to the CST to minimize injection of suppression pool water into the RPV.

However, if the CST water supply is low, or the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the RCIC System. The steam supply to the turbine is piped from main steam line A, upstream of the inboard main steam line isolation valve.

The RCIC System is designed to provide core cooling for a wide range of reactor pressures, 150 psig to 1231 psig. Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed. As the RCIC flow increases, the turbine control valve is automatically adjusted to maintain design flow. Exhaust steam from the RCIC turbine is discharged to the suppression pool. A full flow test line is provided to route water from and to the CST to allow testing of the RCIC System during normal operation without injecting water into the RPV.

(continued)

RIVER BEND B 3.5-20 Revision No. 6-14

Main Turbine Bypass System B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Main Turbine Bypass System BASES BACKGROUND The Main Turbine Bypass System is designed to control steam pressure when reactor steam generation exceeds turbine requirements during unit startup, sudden load reduction, and cooldown. It allows excess steam flow from the reactor to the condenser without going through the turbine. The bypass capacity of the system is 10% of the Nuclear Steam Supply System rated steam flow. Sudden load reductions within the capacity of the steam bypass can be accommodated without reactor scram. The Main Turbine Bypass System consists of a two valve chest connected to the main steam lines between the main steam isolation valves and the turbine stop valves. Each of these valves is sequentially operated by hydraulic cylinders. The bypass valves are controlled by the pressure regulation function of the Turbine Pressure Regulator and Control System, as discussed in the USAR, Section 7.7.1.4 (Ref. 1). The bypass valves are normally closed, and the pressure regulator controls the turbine control valves, directing all steam flow to the turbine. If the speed governor or the load limiter restricts steam flow to the turbine, the pressure regulator controls the system pressure by opening the bypass valves. When the bypass valves open, the steam flows from the bypass chest, through connecting piping, to the pressure breakdown assemblies, where a series of orifices are used to further reduce the steam pressure before the steam enters the condenser.

APPLICABLE The Main Turbine Bypass System is assumed to function during SAFETY ANALYSES the design basis feedwater controller failure, maximum demand event, described in the USAR. Section 15.1.2 (Ref. 2). Opening the bypass valves during the pressurization event mitigates the increase in reactor vessel pressure, which affects the MCPR during the event. An inoperable Main Turbine Bypass System may result in an MCPR penalty.

The Main Turbine Bypass System satisfies Criterion 3 of the NRC Policy Statement.

(conti nued)

RIVER BEND B 3.7-25 Revision No. 6-14

Main Turbine Bypass System 8 3.7.5 BASES (continued)

LCO The Main Turbine Bypass System is required to be OPERABLE to limit peak pressure in the main steam lines and maintain reactor pressure within acceptable limits during events that cause rapid pressurization, such that the Safety Limit MCPR is not exceeded.

An OPERABLE Main Turbine Bypass System requires the bypass valves to open in response to increasing main steam line pressure. This response is within the assumptions of the applicable analysis (Ref. 2).

APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at

- 23.8% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated during the feedwater controller failure, maximum demand event.

As discussed in the Bases for LCO 3.2.1. "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)." sufficient margin to these limits exists

< 23.8% RTP. Therefore, these requirements are only necessary when operating at or above this power level.

ACTIONS If the Main Turbine Bypass System is inoperable (one or more bypass valves inoperable), the assumptions of the design basis transient analysis may not be met. Under such circumstances.

prompt action should be taken to restore the Main Turbine Bypass System to OPERABLE status. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is reasonable, based on the time to complete the Required Action and the low probability of an event occurring during this period requiring the Main Turbine Bypass System.

If the Main Turbine Bypass System cannot be restored to OPERABLE status within the associated Completion Time, THERMAL POWER must be reduced to < 23.8% RTP. As discussed in the Applicability section. operation at < 23.8% RTP results in (continued)

I RIVER BEND 8 3.7-26 Revision No. 6-7

Control Rod OPERABILITY- Refueling B 3.9.5 BASES (continued)

LCO Each withdrawn control rod must be OPERABLE. The withdrawn control rod is considered OPERABLE if the scram accumulator pressure is Ž 1540 psig and the control rod is capable of being automatically inserted upon receipt of a scram signal.

Inserted control rods have already completed their reactivity control function, and therefore are not required to be OPERABLE.

APPLICABILITY During MODE 5, withdrawn control rods must be OPERABLE to ensure that in a scram the control rods will insert and provide the required negative reactivity to maintain the reactor subcritical.

For MODES 1 and 2, control rod requirements are found in LCO 3.1.2, "Reactivity Anomalies," LCO 3.1.3, "Control Rod OPERABILITY," LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod Scram Accumulators." During MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate requirements for control rod OPERABILITY during these conditions.

ACTIONS A.1 With one or more withdrawn control rods inoperable, action must be immediately initiated to fully insert the inoperable control rod(s). Inserting the control rod(s) ensures that the shutdown and scram capabilities are not adversely affected. Actions must continue until the inoperable control rod(s) is fully inserted.

SURVEILLANCE SR 3.9.5.1 and SR 3.9.5.2 REQUIREMENTS During MODE 5, the OPERABILITY of-control rods is primarily required to ensure that a withdrawn control rod will automatically insert if a signal requiring a reactor shutdown occurs. Because no explicit analysis exists for automatic shutdown during refueling, the shutdown function is satisfied if the withdrawn control rod is capable of automatic insertion and the associated CRD scram accumulator pressure is Ž 1540 psig.

(continued)

RIVER BEND B 3.9-17 Revision No. 6-14

Control Rod OPERABILITY-Refueling B 3.9.5 BASES SURVEILLANCE SR 3.9.5.1 and SR 3.9.5.2 (continued)

REQUIREMENTS The 7 day Frequency takes into consideration equipment reliability, procedural controls over the scram accumulators, and control room alarms and indicating lights that indicate low accumulator charge pressures.

SR 3.9.5.1 is modified by a Note that allows 7 days after withdrawal of the control rod to perform the Surveillance.

This acknowledges that the control rod must first be withdrawn before performance of the Surveillance and therefore avoids potential conflicts with SR 3.0.3 and SR 3.0.4.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. USAR, Section 15.4.1.1.

RIVER BEND B 3.9-18 Revision No. 0

SDM Test-Refueling B 3.10.8 BASES (continued)

SURVEILLANCE SR 3.10.8.1, SR 3.10.8.2 and SR 3.10.8.3 REQUIREMENTS The other LCOs made applicable in this Special Operations LCO are required to have applicable Surveillances met to establish that this Special Operations LCO is being met.

However, the control rod withdrawal sequences during the SDM tests may be enforced by the RPC (LCO 3.3.2.1, Function ib, MODE 2 requirements) or by a second licensed operator or other qualified member of the technical staff. As noted, either the applicable SRs for the RPC (LCO 3.3.2.1) must be satisfied according to the applicable Frequencies (SR 3.10.8.2), or the proper movement of control rods must be verified (SR 3.10.8.3). This latter verification (i.e.,

SR 3.10.8.3) must be performed during control rod movement to prevent deviations from the specified sequence. These surveillances provide adequate assurance that the specified test sequence is being followed.

SR 3.10.8.4 Periodic verification of the administrative controls established by this LCO will ensure that the reactor is operated within the bounds of the safety analysis. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is intended to provide appropriate assurance that each operating shift is aware of and verifies compliance with these Special Operations LCO requirements.

SR 3.10.8.5 Coupling verification is performed to ensure the control rod is connected to the control rod drive mechanism and will perform its intended function when necessary. The verification is required to be performed any time a control rod is withdrawn to the "full out" notch position or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not being moved as well as operating experience related to uncoupling events.

(continued)

RIVER BEND B 3.10-37 Revision No. 0

SDM Test -- Refueling B 3.10.8 BASES SURVEILLANCE SR 3.10.8.6 REQUIREMENTS (continued) CRD charging water header pressure verification is performed to ensure the motive force is available to scram the control rods in the event of a scram signal. A minimum accumulator pressure is specified, below which the capability of the accumulator to perform its intended function becomes degraded and the accumulator is considered inoperable. The minimum accumulator pressure of 1540 psig is well below the expected pressure of 1750 psig. The 7 day Frequency has been shown to be acceptable through operating experience and takes into account indications available in the control room.

REFERENCES 1. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, GESTAR II" (latest approved revision).

2. Letter, T.A. Pickens (BWROG) to G.C. Lainas (NRC),

"Amendment 17 to General Electric Licensing Topical Report NEDE-24011-P-A," August 15, 1986.

RIVER BEND B 3.10-38 Revision No. 6-14

Control Rod OPERABILITY B 3.1.3 BASES ACTIONS D.1 and D.2 (continued)

Out of sequence control rods may increase the potential reactivity worth of a dropped control rod during a CRDA. At

10% RTP, the generic banked position withdrawal sequence (BPWS) analysis (Ref. 7) requires inserted control rods not in compliance with BPWS to be separated by at least two OPERABLE control rods in all directions, including the diagonal.

Therefore, if two or more inoperable control rods are not in compliance with BPWS and not separated by at least two OPERABLE control rods, action must be taken to restore compliance with BPWS or restore the control rods to OPERABLE status. A Note has been added to the Condition to clarify that the Condition is not applicable when > 10% RTP since the BPWS is not required to be followed under these conditions, as described in the Bases for LCO 3.1.6. The allowed Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is acceptable, considering the low probability of a CRDA occurring.

E.1 If any Required Action and associated Completion Time of Condition A, C. or D are not met or nine or more inoperable control rods exist, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This ensures all insertable control rods are inserted and places the reactor in a condition that does not require the active function (i.e., scram) of the control rods. The number of control rods permitted to be inoperable when operating above 10% RTP (i.e., no CRDA considerations) could be more than the value specified, but the occurrence of a large number of inoperable control rods could be indicative of a generic problem, and investigation and resolution of the potential problem should be undertaken. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

RIVER BEND B 3. 1-17 Revision No- 6-13

Control Rod OPERABILITY B 3.1.3 BASES (continued)

SURVEILLANCE SR 3.1.3.1 REQUIREMENTS The position of each control rod must be determined, to ensure adequate information on control rod position is available to the operator for determining control rod OPERABILITY and controlling rod patterns. Control rod position may be determined by the use of OPERABLE position indicators, by moving control rods to a position with an OPERABLE indicator, or by the use of other appropriate methods. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of this SR is based on operating experience related to expected changes in control rod position and the availability of control rod position indications in the control room.

SR 3.1.3.2 and SR 3.1.3.3 Control rod insertion capability is demonstrated by inserting each partially or fully withdrawn control rod at least one notch and observing that the control rod moves.

The control rod may then be returned to its original position. This ensures the control rod is not stuck and is free to insert on a scram signal. These Surveillances are modified by Notes identifying that the Surveillances are not required to be performed when THERMAL POWER is less than or equal to the actual LPSP of the RPC since the notch insertions may not be compatible with the requirements of the BPWS (LCO 3.1.6) and the RPC (LCO 3.3.2.1). These Notes also provide a time allowance such that the Surveillances are not required to be performed until the next scheduled control rod testing for control rods of the same class (i.e., fully withdrawn or partially withdrawn). These Notes provide this allowance to prevent-unnecessary perturbations in reactor operation to perform this on a control rod whose surveillance class (i.e., fully withdrawn or partially withdrawn) has changed. The 7 day Frequency of SR 3.1.3.2 is based on operating experience related to the changes in CRD performance and the ease of performing notch testing for fully withdrawn control rods. Partially withdrawn control rods are tested at a 31 day Frequency, based on the potential power reduction required to allow the control rod movement, and considering the large testing sample of SR 3.1.3.2. Furthermore, the 31 day Frequency takes into account operating experience related to changes in CRD performance. At any time, if a control rod is immovable, a (continued)

RIVER BEND B 3.1-18 Revision.No. 0

Reactor Core SLs B 2.1.1 BASES BACKGROUND Operation above the boundary of the nucleate boiling regime (continued) could result in excessive cladding temperature because of the onset of transition boiling and the resultant sharp reduction in heat transfer coefficient. Inside the steam film. high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form.

This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.

APPLICABLE The fuel cladding must not sustain damage as a result of SAFETY ANALYSES normal operation and AOOs. The reactor core SLs are established to preclude violation of the fuel design criterion that an MCPR SL is to be established, such that at least 99.9% of the fuel rods in the core would not be expected to experience the onset of transition boiling.

The Reactor Protection System setpoints (LCO 3.3.1.1. "Reactor Protection System (RPS) Instrumentation"). in combination with other LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System water level, pressure, and THERMAL POWER level that would result in reaching the MCPR SL.

2.1.1.1 Fuel Claddinq Integrity The use of the fuel vendor's critical power correlations are valid for critical power calculations at pressures : 785 psig and core flows k 10% of rated flow (Ref. 2. 7 & 8). For operation at low pressures or low flows, another basis is used. as follows:

Since the pressure drop in the bypass region is essentially all elevation head. the core pressure drop at low power and flows will always be

> 4.5 psi. Analyses (Ref. 2) show that with a bundle flow of 28 x 10i lb/hr. bundle pressure drop is nearly independent of bundle power and has a value of 3.5 psi. Thus. the bundle flow with a 4.5 psi driving head will be > 28 x 10i lb/hr. Full scale ATLAS test data taken at pressures from 14.7 psia to 800 psia indicate that the fuel (continued)

RIVER BEND B 2.0-2 Revision No. 6-15

Reactor Core SLs B 2.1.1 BASES APPLICABLE 2.1.1.1 Fuel Cladding Integrity SAFETY ANALYSES (continued) assembly critical power at this flow is approximately 3.35 MWt. With the design peaking factors, this corresponds to a THERMAL POWER > 50%

of original RTP. Thus, a THERMAL POWER limit of 23.8% RTP for reactor pressure < 785 psig is conservative. Because of the design thermal hydraulic compatibility of the reload fuel designs with the cycle 10 fuel, this justification and the associated low pressure and low flow limits remain applicable for future cycles of cores containing these fuel designs.

2.1.1.2 MCPR The MCPR SL ensures sufficient conservatism in the operating limit MCPR that, in the event of an AOO from the limiting condition of operation, at least 99.9% of the fuel rods in the core would be expected to avoid boiling transition. The margin between calculated boiling transition (i.e., MCPR = 1.00) and the MCPR SL is based on a detailed statistical procedure that considers the uncertainties in monitoring the core operating state. One specific uncertainty included in the SL is the uncertainty inherent in the critical power correlation.

Reference 6 describes the methodology used in determining the MCPR SL.

The calculated MCPR safety limit is reported to the customary three significant digits (i.e., X.XX); the MCPR operating limit is developed based on the calculated MCPR safety limit to ensure that at least 99.9% of the fuel rods in the core are expected to avoid boiling transition.

The fuel vendor's critical power correlations are based on a significant body of practical test data, providing a high degree of assurance that the critical power, as evaluated by the correlation, is within a small percentage of the actual critical power being estimated. As long as the core pressure and flow are within the range of validity of the correlations, the assumed reactor conditions used in defining the SL introduce conservatism into the limit because bounding high radial power factors and bounding flat local peaking distributions are used to estimate the number of rods in boiling transition. These conservatisims and the inherent accuracy of the fuel vendor's correlation provide a reasonable degree of assurance that 99.9% of the rods in the core would not be susceptible to transition boiling during (continued)

RIVER BEND B 2.0-3 Revision No. 6-15

Reactor Core SLs B 2.1.1 BASES sustained operation at the MCPR SL. If boiling transition were to occur, there is reason to believe that the integrity of the fuel would not be compromised. Significant test data accumulated by the NRC and private organizations indicate that the use of a boiling transition limitation to protect against cladding failure is a very conservative approach. Much of the data indicate that BWR fuel can survive for an extended period of time in an environment of boiling transition.

2.1.1.3 Reactor Vessel Water Level During MODES 1 and 2. the reactor vessel water level is required to be above the top of the active fuel to provide core cooling capability. With fuel in the reactor vessel during periods when the reactor is shut down. consideration must be given to water level requirements due to the effect of decay heat. If the water level should drop below the top of the active irradiated fuel during this period, the ability to remove decay heat is reduced. This reduction in cooling capability could lead to elevated cladding temperatures and clad perforation in the event that the water level becomes less than two-thirds of the core height. The reactor vessel water level SL has been established at the top of the active irradiated fuel to provide a point that can be monitored and to also provide adequate margin for effective action.

SAFETY LIMITS The reactor core SLs are established to protect the integrity of the fuel clad barrier to the release of radioactive materials to the environs. SL 2.1.1.1 and SL 2.1.1.2 ensure that the core operates within the fuel design criteria. SL 2.1.1.3 ensures that the reactor vessel water level is greater than the top of the active irradiated fuel in order to prevent elevated clad temperatures and resultant clad perforations.

APPLICABILITY SLs 2.1.1.1. 2.1.1.2, and 2.1.1.3 are applicable in all MODES.

SAFETY LIMIT 2-2-1 VIOLATIONS If any SL is violated, the NRC Operations Center must be notified within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . in accordance with 10 CFR 50.72 (Ref. 3).

(continued)

RIVER BEND B 2.0-4 Revision No. 6-15

Reactor Core SLs B 2.1.1 BASES SAFETY LIMIT 2.2.2 VIOLATIONS (continued) Exceeding an SL may cause fuel damage and create a potential for radioactive releases in excess of 10 CFR 100, "Reactor Site Criteria." limits (Ref. 4). Therefore, it is required to insert all insertable control rods and restore compliance with the SL within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time ensures that the operators take prompt remedial action and also ensures that the probability of an accident occurring during this period is minimal.

2.2.3 If any SL is violated, the General Manager and the Vice President shall be notified within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period provides time for plant operators and staff to take the appropriate immediate action and assess the condition of the unit before reporting to the senior management.

2.2.4 If any SL is violated, a Licensee Event Report shall be prepared and submitted within 30 days to the NRC in accordance with 10 CFR 50.73 (Ref. 5). A copy of the report shall also be provided to the General Manager and the Vice President.

2.2.5 If any SL is violated, restart of the unit shall not commence until authorized by the NRC. This requirement ensures the NRC that all necessary reviews, analyses, and actions are completed before the unit begins its restart to normal operation.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10.

2. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, GESTAR-II," (latest approved revision).

3. 10 CFR 50.72.

4. 10 CFR 100.

5. 10 CFR 50.73.

6. ANF-524(P)(A), Revision 2, Supplements 1 and 2, November 1990.

7. EMF-2209(P)(A), Revision 1. July 2000.

8. Letter: CEXO-2000-00293, J. B. Lee (EOI) to K. V. Walker (SPC),

"Grand Gulf Nuclear Station Unit 1 and River Bend Station Unit 1, Reload Transition Data - GEl1 Additive Constants", July 25, 2000.

RIVER BEND B 2.0-5 Revision No. 6-15

mr PR B 3.2 POWER DISTRIBUTION LIMITS 8 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR)

BASES BACKGROUND MCPR is a ratio of the fuel assembly power that would result in the onset of boiling transition to the actual fuel assembly power. The MCPR Safety Limit (SL) is set such that 99.9% of the fuel rods avoid boiling transition if the limit is not violated (refer to the Bases for SL 2.1.1.2). The operating limit MCPR is established to ensure that no fuel damage results during anticipated operational occurrences (AOOs). Although fuel damage does not necessarily occur if a fuel rod actually experiences boiling transition (Ref. 1),

the critical power at which boiling transition is calculated to occur has been adopted as a fuel design criterion.

The onset of transition boiling is a phenomenon that is readily detected during the testing of various fuel bundle designs. Based on these experimental data, correlations.

have been developed to predict critical bundle power (i.e.,

the bundle power level at the onset of transition boiling) for a given set of plant parameters (e.g., reactor vessel pressure, flow, and subcooling). Because plant operating conditions and bundle power levels are monitored and determined relatively easily, monitoring the MCPR is a convenient way of ensuring that fuel failures due to inadequate cooling do not occur.

APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the A0Os to establish the operating limit MCPR are presented in the USAR, Chapters 4, 6, and 15, and References 2, 3, and

4. To ensure that the MCPR SL is not exceeded during any transient event that occurs with moderate frequency, limiting transients have been analyzed to determine the largest reduction in critical power ratio (CPR). The types of transients evaluated are loss of flow, increase in pressure and power, positive reactivity insertion, and coolant temperature decrease. The limiting transient yields the largest change in CPR (ACPR). When the largest ACPR is added to the MCPR SL, the required operating limit MCPR is obtained.

(Conti nuedl B 3.2-S Revision No. 0 RIVER SEND

MCPR B 3.2.2 BASES APPLICABLE The MCPR operating limits derived from the transient SAFETY ANALYSES analysis are dependent on the operating core flow and power (continued) state (MCPRf and MCPRp, respectively) to ensure adherence to fuel design limits during the worst transient that occurs with moderate frequency. Flow dependent MCPR limits (MCPRf ) are determined by steady state thermal hydraulic methods using the three dimensional BWR simulator code (Ref. 5) and the multi channel thermal hydraulic code (Ref. 2). MCPRf curves are provided based on the maximum credible flow runout transient for Non Loop Manual operation. Non Loop Manual operation bounds Loop Manual because Non Loop Manual operation can result in a more severe flow runout transient. The result of a single failure or single operator error during Loop Manual operation is the runout of only one loop because both recirculation loops are under independent control. Non Loop Manual operational modes allow simultaneous runout of both loops because a single controller regulates core flow.

Power dependent MCPR limits (MCPR, ) are determined by the three dimensional BWR simulator code and the one dimensional transient code (Ref. 2). The MCPR limits are established for a set of exposure intervals. The limiting transients are analyzed at the limiting exposure for each interval. Due to the sensitivity of the transient response to initial core flow levels at power levels below those at which the turbine stop valve closure and turbine control valve fast closure scram trips are bypassed, high and low flow MCPR, operating limits are provided for operating between 23.8% RTP and the previously mentioned bypass power level.

The MCPR satisfies Criterion 2 of the NRC Policy Statement.

LCO The MCPR operating limits specified in the COLR are the result of the Design Basis Accident (DBA) and transient analysis. The MCPR operating limits are determined by the larger of the MCPRf and MCPR, limits.

APPLICABILITY The MCPR operating limits are primarily derived from transient analyses that are assumed to occur at high power levels. Below 23.8% RTP. the reactor is operating at a slow recirculation pump speed and the moderator void ratio is small. Surveillance of thermal limits below 23.8% RTP is unnecessary due to the large inherent margin that ensures that the MCPR SL is not exceeded even if a limiting transient occurs.

Studies of the variation of limiting transient behavior have (continued)

RIVER BEND B 3.2-6 Revision No. 6-15

MCPR B 3.2.2 BASES APPLICABILITY (continued) been performed over the range of power and flow conditions.

These studies encompass the range of key actual plant parameter values important to typically limiting transients. The results of these studies demonstrate that a margin is expected between performance and the MCPR requirements, and that margins increase as power is reduced to 23.8% RTP. This trend is expected to continue to the 5% to 15% power range when entry into MODE 2 occurs. When in MODE 2. the intermediate range monitor (IRM) provides rapid scram initiation for any significant power increase transient, which effectively eliminates any MCPR compliance concern. Therefore. at THERMAL POWER levels

< 23.8% RTP. the reactor is operating with substantial margin to the MCPR limits and this LCO is not required.

ACTIONS At.

If any MCPR is outside the required limit, an assumption regarding an initial condition of the design basis transient analyses may not be met. Therefore. prompt action should be taken to restore the MCPR(s) to within the required limit(s) such that the plant remains operating within analyzed conditions. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is normally sufficient to restore the MCPR(s) to within its limit and is acceptable based on the low probability of a transient or 0BA occurring simultaneously with the MCPR out of specification.

If the MCPR cannot be restored to within the required limit within the associated Completion Time. the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status. THERMAL POWER must be reduced to

< 23.8% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable. based on operating experience, to reduce THERMAL POWER to c 23.8% RTP in an orderly manner and without challenging plant systems.

(conti nued)

RIVER BEND B 3.2-7 Revision No. 6-4

MCPR B 3.2.2 BASES (continued)

SURVEILLANCE SR 3.2.2.1 REQUIREMENTS The MCPR is required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is

23.8% RTP and then every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. It is compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution during normal operation. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after THERMAL POWER reaches ? 23.8% RTP is acceptable given the large inherent margin to operating limits at low power levels.

REFERENCES 1. NUREG-0562. "Fuel Rod Failures As A Consequence of Nucleate Boiling or Dry Out," June 1979.

2. XN-NF-80-19(P)(A) Volume 3. Revision 2, "Exxon Nuclear Methodology for Boiling Water Reactors THERMEX: Thermal Limits Methodology Summary Description," January 1987.

3. USAR, Chapter 4. Appendix 4B.

4. USAR, Chapter 15, Appendix 15B.

5. XN-NF-80-19(P)(A) Volume 1. "Exxon Nuclear Methodology for Boiling Water Reactors - Neutronic Methods for Design and Analysis," March 1983 (As Supplemented).

RIVER BEND B 3.2-8 Revision No. 6-15

RPS Instrumentation B 3.3.1.1 BASES (continued)

SURVEILLANCE SR 3.3.1.1.6 and SR 3.3.1.1.7 (continued)

REQUIREMENTS required prior to withdrawing SRMs from the fully inserted position since indication is being transitioned from the SRMs to the IRMs.

The overlap between IRMs and APRMs is of concern when reducing power into the IRM range. On power increases, the system design will prevent further increases (initiate a rod block) if adequate overlap is not maintained.

Overlap between IRMs and APRMs exists when sufficient IRMs and APRMs concurrently have onscale readings such that the transition between MODE 1 and MODE 2 can be made without either APRM downscale rod block, or IRM upscale rod block. Overlap between SRMs and IRMs similarly exists when, prior to withdrawing the SRMs from the fully inserted position, IRMs are above 2/40 on Range 1 before SRMs have reached the upscale rod block.

As noted, SR 3.3.1.1.7 is only required to be met during entry into MODE 2 from MODE 1. That is. after the overlap requirement has been met and indication has transitioned to the IRMs, maintaining overlap is not required (APRMs may be reading downscale once in MODE 2).

If overlap for a group of channels is not demonstrated (e.g.,

IRM/APRM overlap), the reason for the failure of the Surveillance should be determined and the appropriate channel(s) declared inoperable. Only those appropriate channel(s) that are required in the current MODE or condition should be declared inoperable.

A Frequency of 7 days is reasonable based on engineering judgment and the reliability of the IRMs and APRMs.

SR 3.3.1.1.8 LPRM gain settings are determined from the local flux profiles measured by the Traversing Incore Probe (TIP) System. This establishes the relative local flux profile for appropriate representative input to the APRM System. The 2000 MWD/T Frequency is based on NA 200 and NA 300 LPRM operating experience. Nuclear Instrumentation, power distribution and other uncertainties are combined in Framatome-ANP's analysis to determine the MCPR Safety Limit (Ref. USAR Section 4.4).

(continued)

RIVER BEND B 3.3-27 Revision No. 6-15

Battery Cell Parameters 8 3.8.6 BASES SURVEILLANCE Table 3.8.6-1 (continued)

REQUIREMENTS Because of specific gravity gradients that are produced during the recharging process, delays of several days may occur while waiting for the specific gravity to stabilize.

A stabilized charger current is an acceptable alternative to specific gravity measurement for determining the state of charge. This phenomenon is discussed in IEEE-450 (Ref. 3).

Footnote c to Table 3.8.6-1 allows the float charge current to be used as an alternate to specific gravity for up to 31 days following a battery recharge. Within 31 days each connected cell's specific gravity must be measured to confirm the state of charge. Following a minor battery recharge (such as equalizing charge that does not follow a deep discharge) specific gravity gradients are not significant, and confirming measurements may be made in less than 31 days.

REFERENCES 1. USAR, Chapter 6.

2. USAR, Chapter 15.

3. IEEE Standard 450, 1987.

I%

8 3.8-69 Revision No. I RIVER BEND

Inverters - Operating B 3.8.7 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Inverters -Operating BASES BACKGROUND The inverters are the preferred source of power for the AC vital buses because of the stability and reliability they achieve.

There is one inverter for Division I and two inverters for Division II. making a total of three inverters. The function of the inverter is to provide AC electrical power to the vital buses. The inverters are powered from both AC and DC sources.

Specific details on inverters can be found in the USAR, Chapter 8 (Ref. 1).

APPLICABLE The initial conditions of Design Basis Accident (OBA)

SAFETY ANALYSES and transient analyses in the USAR, Chapter 6 (Ref. 2) and Chapter 15 (Ref. 3). assume Engineered Safety Feature systems are OPERABLE. The inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to portions of the ESF instrumentation and controls so that the fuel. Reactor Coolant System. and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2.

Power Distribution Limits: Section 3.4. Reactor Coolant System (RCS): and Section 3.6. Containment Systems.

The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining electrical power sources OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC or all onsite AC electrical power: and

b. A worst case single failure.

Inverters are a part of the distribution system and, as such, satisfy Criterion 3 of the NRC Policy Statement.

(continued)

RIVER BEND B 3.8-70 Revision No. 6-15

Inverters - Operating B 3.8.7 BASES (continued)

LCO The inverters ensure the availability of AC electrical power for the instrumentation for the reactor and maintain it in systems required to shut a safe condition after an down the operational occurrence (AOO) anticipated or a postulated DBA.

Maintaining the required inverters redundancy incorporated into OPERABLE ensures that the instrumentation and controls the design of the ESF is maintained. The three powered inverters ensure an battery uninterruptible supply of electrical power to the AC AC vital buses even if the 4.16 buses are de-energized. kV safety Division II has two totally redundant inverters installed.

Through the use of a manual inverters may be aligned to transfer switch, either of these two Bus. Thus, only one of the supply power to the 120 Volt Division II units is required Vital OPERABLE. to be OPERABLE inverteirs require that the powered by the inverter via associated vital bus is Class 1E battery or from an inverted DC voltage from the required with the battery available internal AC source via a as backup, with the output rectifier design voltage and frequency within the tolerances.

APPLICABILITY The inverters are required to be OPERABLE in MODES 1.

2. and 3 to ensure that:

a. Acceptable fuel design limits and boundary limits are not exceeded reactor coolant pressure as a result of AOOs or abnormal transients: and

b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in event of a postulated DBA. the Inverter requirements for MODES 4 and 5 are covered for LCO 3.8.8. "Inverters -- in the Bases Shutdown."

ACTIONS With a required inverter inoperable.

its associated AC vital bus is inoperable if not energized.from sources. LCO 3.8.9 addresses one of its Class 1E voltage LCO 3.0.6, these actions would this action; however, pursuant to vital bus were de-energized. not be entered even if the Therefore. the ACTIONS are AC by a Note stating that ACTIONS modified immediately. This ensures for LCO 3.8.9 must be entered the vital bus is re-energized 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . within (continued)

RIVER BEND 0 J.8-/1 Revision No. 6-15

Inverters - Operating B 3.8.7 BASES ACTIONS A.1 (continued)

Required Action A.1 allows 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to fix the inoperable inverter and return it to service or in the case of Division II, align an OPERABLE inverter to the Vital Bus. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months limit is based upon engineering judgment, taking into consideration the time required to repair an inverter and the additional risk to which the plant is exposed because of the inverter inoperability.

This risk has to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems that such a shutdown might entail. When the AC vital bus is powered from one of its Class 1E sources, it is relying upon interruptible AC electrical power sources (offsite and onsite).

The uninterruptible inverter source to the AC vital buses is the preferred source for powering instrumentation trip setpoint devices.

If the inoperable devices or components cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience.

to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.8.7.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation connected to the AC vital buses. The 7 day Frequency takes into account the redundant capability of the inverters and other indications available in the control room that alert the operator to inverter malfunctions.

(continued)

RIVER BEND B 3.8-72 Revision No. 6-15

PBDS BASES B 3.3.1.3 ACTIONS A.1 If at any time while in the Restricted Region or Monitored Region, an OPERABLE PBDS instrumentation channel indicates a valid Hi-Hi DR Alarm, the operator is required to initiate an immediate reactor scram. Verification that the Hi-Hi DR Alarm is valid may be performed without delay against another output from a PBDS card observable from the reactor controls in the control room prior to the manual reactor scram. This provides assurance that core conditions leading to neutronic/thermal hydraulic instability will be mitigated. This Required Action and associated Completion Time does not allow for evaluation of circumstances leading to the Hi-Hi DR Alarm prior to manual initiation of reactor scram.

B.1 and B.2 Operation with the APRM Flow Biased Simulated Thermal Power-High Function (refer to LCO 3.3.1.1, Table 3.3.1.1-1. Function 2.b.)

"Setup" requires the stability control applied in the Restricted Region (refer to LCO 3.2.5) to be met. Requirements for operation with the stability control met are established to prevent reactor thermal hydraulic instability during operation in the Restricted Region. With the required PBDS channel inoperable, the ability to monitor conditions indicating the potential for imminent onset of neutronic/thermal hydraulic instability as a result of unexpected transients is lost.

Therefore, action must be immediately initiated to exit the Restricted Region. While the APRM Flow Biased Control Rod Block upscale alarm setpoints are "Setup," operation in the Restricted Region may be confirmed by use of plant parameters such as reactor power and core flow available at the reactor controls.

Exit of the Restricted Region can be accomplished by control rod insertion and/or recirculation flow increases. Actions to restart an idle recirculation loop, withdraw control rods or reduce recirculation flow may result in unstable reactor conditions and are not allowed to be used to comply with this Required Action.

The time required to exit the Restricted Region will depend on existing plant conditions. Provided efforts are begun without delay and continued until the Restricted Region is exited, operation is acceptable based on the low probability of a transient which degrades stability performance occurring simultaneously with the required PBDS channel inoperable.

(continued)

RIVER BEND B 3.3-39e Revision No. 101

Primary Containment Air Locks B83.6.1.2 BASES ACTIONS C.I. C.2. and C.3 (continued) failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed) primary containment remains OPERABLE, yet only I hour (according to LCO 3.6.1.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits. Required Action C.2 requires that one door in the affected primary containment air locks must be verified closed. This Required Action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within I hour.

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status considering that at least one door is maintained closed in each affected air lock.

0.Iand D.2 If the Inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time while operating in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.I. E.2. and E.3 If the inoperable primary containment airlock cannot be restored to OPERABLE status within the associated Completion Time during operations with a potential for draining the reactor vessel (OPORVs) or during movement of recently irradiated fuel assemblies in the primary containment, action is required to Immedlately suspend activities that represent a potential for releasing radioactive material, (continued)

RIVER SEND 8 3.6-11 Revision No. 2-3

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS E.1. E.2. and E.3 (continued) thus placing the unit in a Condition that minimizes risk. If applicable, movement of recently irradiated fuel assemblies in the primary containment must be immediately suspended.

Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Action must continue until OPDRVs are suspended.

SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining primary containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Primary Containment Leakage Rate Testing Program (Ref. 5). This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The specified acceptance criteria (i.e.. *13,500 cc/hr for the combination of all annulus bypass leakage paths that are required to be meeting leak tightness) is applicable to primary containment air lock IJRB*DRA1 and ensures that the combined leakage rate of annulus bypass leakage paths is less than the specified leakage rate.

Following the removal of the fuel building as a secondary containment boundary in accordance with License Amendment 113.

the leakage from primary containment air lock 1JRB*DRA2 represents secondary containment bypass leakage and is applied to the secondary containment bypass leakage limit of 170,000 cc/hr.

This provides assurance in MODES 1. 2, and 3 that the assumptions in the radiological evaluations are met. The leakage rate of each bypass leakage path is assumed to be the maximum pathway leakage (e.g., leakage through the air lock door with the highest leakage) unless the penetration is isolated by use of (for this Specification) one closed and locked air lock door. The leakage rate of the isolated bypass leakage path is assumed to be the actual pathway leakage through the isolation devices (e.g., air lock door). If both air lock doors are closed, the actual leakage rate is the lesser leakage rate of the two barriers (doors). This method of quantifying maximum pathway leakage is only to be used for this SR (i.e.. Appendix J, Option B. maximum pathway leakage limits used to evaluate Type A, B and C limits are to be quantified in accordance with Appendix J. Option B).

During the operational conditions of moving irradiated fuel assemblies in the primary containment. CORE ALTERATIONS. or OPDRVS.

(continued)

RIVER BEND 8 3.6-12 Revision No. 101

Dryweil B 3.6.5.1 BASES SURVEILLANCE SR 3.6.5.1.4 (continued)

REQUIREMENTS performing its intended function. This SR ensures that drywell structural integrity is maintained. The Frequency was chosen so that the interior and exterior surfaces of the drywell can be inspected in conjunction with the inspections of the primary containment required by 10 CFR 50, Appendix J (Ref. 2). Due to the passive nature of the drywell structure, the specified Frequency is sufficient to identify component degradation that may affect drywell structural integrity.

SR 3.6.5.1.5 This SR requires a test be performed to verify seal leakage of the drywell air lock doors at 3.0 psid. An administrative seal leakage rate limit has been established in plant procedures to ensure the integrity of the seals. The Surveillance is only required to be performed once within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after each closing.

The Frequency of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is based on operating experience.

SR 3.6.5.1.6 This SR requires a test to be performed to verify air lock leakage of the drywell air lock at pressures Ž 3 psid. Prior to the performance of this test, the air lock is pressurized to 19.2 psid. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for violating the drywell boundary. Operating experience has shown these components usually pass the Surveillance and requires the SR to be performed once each refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. USAR, Chapter 6 and Chapter 15.

RIVER BEND B 3.6-121 Revision No. 101

Drywell Air Lock B 3.6.5.2 B 3.6 CONTAINMENT SYSTEMS 8 3.6.5.2 Drywell Air Lock BASES BACKGROUND The drywell air lock forms part of the drywell boundary and provides a means for personnel access during MODES 2 and 3 during low power phase of unit startup. For this purpose, one double door drywell air lock has been provided, which maintains drywell isolation during personnel entry and exit from the drywell. Under the normal unit operation, the drywell air lock is kept sealed. The air pressure in the seals is maintained > 60 psig by the seal air flask and pneumatic system, which is maintained at a pressure i 75 psig.

The drywell air lock is designed to the same standards as the drywell boundary. Thus, the drywell air lock must withstand the pressure and temperature transients associated with the rupture of any primary system line inside the drywell and also the rapid reversal in pressure when the steam in the drywell is condensed by the Emergency Core Cooling System flow following loss of coolant accident flooding of the reactor pressure vessel (RPV). It is also designed to withstand the high temperature associated with the break of a small steam line in the drywell that does not result in rapid depressurization of the RPV.

The air lock is nominally a right circular cylinder, 10 ft in diameter, with doors at each end that are interlocked to prevent simultaneous opening. During periods when the drywell is not required to be OPERABLE, the air lock interlock mechanism may be disabled, allowing both doors of the air lock to remain open for extended periods when frequent drywell entry is necessary. Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA).

The air lock is provided with limit switches on both doors that provide control room indication of door position.

The drywell air lock forms part of the drywell pressure boundary. Not maintaining air lock OPERABILITY may result in degradation of the pressure suppression capability, which is assumed to be functional in the unit safety analyses.

(continued)

IRIVER BEND B 3.6-122 Revision No. 2-4

AC Sources-Operating B 3.8.1 BASES ACTIONS (continued)

If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

LiL Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is r6quired by LCO 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and REQUIREMENTS testing of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, GOC 18 (Ref. 8). Periodic component tests are supplemented by extensive functional tests during refueling outages under simulated accident conditions. The SRs for demonstrating the OPERABILITY of the O0s are in accordance with the recomendations of Regulatory Guide 1.9 (Ref. 3),

Regulatory Guide 1.108 (Ref. 9), and Regulatory Guide 1.137 (Ref. 10).

Where the SRs discussed herein specify voltage and frequency tolerances, the minimum and maxim steady state output voltage of 3740 V and 4580 V respectively, are equal to

10% of the nominal 4160 V output volt&ge. The specified minima and maximum frequencies of the 06 of 58.8 Hz and 61.2 Hz, respectively, are equal to

2% of the 60 Hz nominal frequency. The specified steady state voltage and frequency ranges are derived from the recomendations given in Regulatory Guide 1.9 (Ref. 3).

(conti nued)

RIVER SED ' B 3.8-13 Revision No. 0

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) This SR ensures proper circuit continuity for the two qualified circuits between the offsite transmission network and the onsite Class 1E Distribution System and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that Division 1 and 2 distribution buses and loads are connected to their preferred power source and that appropriate independence of offsite circuits is maintained. The 7 day Frequency is adequate since breaker position is not likely to change without the operator being aware of it and because its status is displayed in the control room.

SR 3.8.1.2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running. these SRs have been modified by Notes (the Note for SR 3.8.1.7 and Note 2 for SR 3.8.1.2) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading.

For the purposes of this testing, the DGs are started from standby conditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations for DG 1A and DG 1B. For DG 1C. standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation.

In order to reduce stress and wear on diesel engines, the manufacturer recommends that the DGs be gradually accelerated to synchronous speed prior to loading. These modified start procedures are the intent of Note 3. which is only applicable when such procedures are used.

(continued)

RIVER BEND B 3.8-14 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 (continued)

REQUIREMENTS SR 3.8.1.7 requires that. at a 184 day Frequency. the DG starts from standby conditions, achieves and maintains the required steady-state (i.e.. after any overshoot) voltage and frequency within 10 seconds for DG 1A and DG lB and 13 seconds for DG 1C.

The start requirements for each DG support the assumptions in the design basis LOCA analysis (Ref. 5). The start requirements may not be applicable to 3.8.1.2 (see Note 3 of SR 3.8.1.2), when a modified start procedure as described above is used. If a modified start is not used. the start requirements of SR 3.8.1.7 apply. Since SR 3.8.1.7 does require a 10 second start for DG 1A and DG 1B and 13 seconds for DG 1C. it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2. This is the intent of Note 1 of SR 3.8.1.2. Similarly, the performance of SR 3.8.1.12 or SR 3.8.1.19 also satisfies the requirements of SR 3.8.1.2 and SR 3.8.1.7.

The normal 31 day Frequency for SR 3.8.1.2 is consistent with the industry guidelines for assessment of diesel generator performance (Refs. 14 and 15). The 184 day Frequency for SR 3.8.1.7 is a reduciton in cold testing consistent with Generic Letter 84-15 (Ref. 7). These Frequencies provide adequate assurance of DG OPERABILITY. while minimizing degradation resulting from testing.

SR 3.8.1.3 This Surveillance demonstrates that the DGs are capable of synchronizing and accepting the surveillance test load of 3.000 3.100 kW. These Technical Specification load values were selected in view of human engineering considerations that the smallest graduation on the watt meter is 100 kW. The minimum run time of 60 minutes is required to stabilize engine temperatures.

while minimizing the time that the DG is connected to the offsite source.

Although no power factor requirements are established by this SR.

the DG is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine.

while 1.0 is an operational limitation to ensure circulating (continued)

RIVER BEND B 3.8-15 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued)

REQUIREMENTS currents are minimized. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The 31 day Frequency for this Surveillance is consistent with the industry guidelines for assessment of diesel generator performance (Refs. 14 and 15).

Note 1 modifies this Surveillance to indicate that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized.

Note 2 modifies this Surveillance by stating that momentary transients because of changing bus loads do not invalidate this test.

Note 3 indicates that this Surveillance shall be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.

SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the level at which fuel oil is automatically added. The level is expressed as an equivalent volume in gallons, and is selected to ensure adequate fuel oil for a minimum of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of DG operation at full load.

The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are provided and facility operators would be aware of any large uses of fuel oil during this period.

(continued)

RIVER BEND B 3.8-16 Revision No. 102 P

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.5 REQUIREMENTS Microbiological fouling is a major cause of fuel oil degradation.

There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil day tanks once every 31 days eliminates the necessary environment for bacterial survival. This is an effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system.

The Surveillance Frequency is established by Regulatory Guide 1.137 (Ref. 10). This SR is for preventive maintenance.

The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of this Surveillance.

This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. It is required to support the continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE. the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.

The design of the fuel transfer systems is such that pumps operate automatically in order to maintain an adequate volume of fuel oil in the day tanks during or following DG testing.

Therefore, a 31 day Frequency is specified to correspond to the maximum interval for DG testing.

(continued)

RIVER BEND B 3.8-17 Revision No. 102

AC Sources -Operating B 3.8.1 BASES I SURVEILLANCE SR 3.8.1.7 I REQUIREMENTS See SR 3.8.1.2 SR 3.8.1.8 Transfer of each 4.16 kV ESF bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit. The 18 month Frequency of the Surveillance is based on engineering judgment taking into consideration the plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed on the 18 month Frequency. Therefore. the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note. The reason for the Note is that.

during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and. as a result, plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance. for which adequate documentation of the required performance is available: and

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE. provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

(continued)

RIVER BEND B 3.8-18 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 REQUIREMENTS Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed. which.

if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load while maintaining a specified margin to the overspeed trip. The referenced load for DG 1A is the 917.5 kW low pressure core spray pump: for DG 1B. the 462.2 kW residual heat removal (RHR) pump:

and for DG IC the 1995 kW HPCS pump. The Standby Service Water (SSW) pump values are not used as the largest load since the SSW supplies cooling to the associated DG. If this load were to trip, it would result in the loss of the DG. As required by IEEE-308 (Ref. 13). the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous speed and the overspeed trip setpoint, or 15% above synchronous speed. whichever is lower. For the River Bend Station the lower value results from the first criteria.

The 18 month frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9).

This SR has been modified by two Notes. The reason for Note I is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. Credit may be taken for unplanned events that satisfy this.SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available: and

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE. provided the maintenance was required. or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, Note 2 requires that, if synchronized to offsite power, testing be performed using a power factor : 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG could experience.

(continued)

RIVER BEND B 3.8-19 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3,8.110 REQUIREMENTS This Surveillance demonstrates the DG capability to reject a full load, i.e.. maximum expected accident load, without overspeed tripping or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response undec the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the OG does not trip upon loss of the load. These acceptance criteria provide DG damage protection. While the DG is not expected to experience this transient during an event and continue to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible. testing must be performed using a power factor s 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DO would experience.

The 18 month Frequency is consistent with the recommendation of Regulatory Guide 1.108 (Ref. 9) and is intended to be consistent with expected fuel cycle lengths.

This SR has been modified by a Note. The reason for the Note is that during operation with the reactor critical, performance of this SR could cause perturbation to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available: and

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

(continued)

RIVER BEND B 3.8-20 Revision No. 102

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) As required by Regulatory Guide 1.108 (Ref. 9).

paragraph 2.a.(1). this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the Division I and II nonessential loads and energization of the emergency buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG auto-start time of 10 seconds for DG 1A and DG 1B and 13 seconds for DG IC is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.

The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance. ECCS injection valves are not desired to be stroked open, systems are not capable of being operated at full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of the connection and loading of these loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9). paragraph 2.a.(1). takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

(conti nued)

RIVER BEND 8 3.8-21 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is. with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations for DG 1A and DG 1B. For DG 1C. standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance. for which adequate documentation of the required performance is available: and

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8,1.12 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds for DG 1A and DG 1B and 13 seconds for DG 1C) from the design basis actuation signal (LOCA signal) and operates for a 5 minutes. The 5 minute period provides sufficient time to demonstrate stability.

(continued)

RIVER BEND 8 3.8-22 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 (continued)

REQUIREMENTS The Frequency of 18 months takes into consideration plant conditions required to perform the Surveillance and is intended to be consistent with the expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing. the DGs must be started from standby conditions, that is. with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations for DG 1A and DG 1B. For DG 1C. standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. The reason for Note 2 is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and. as a result, plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available: and

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE. provided the maintenance was required. or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.13 This Surveillance demonstrates that DG non-critical protective functions (e.g.. high jacket water temperature)

(continued)

RIVER BEND 8 3.8-23 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.13 (continued)

REQUIREMENTS are bypassed on an ECCS initiation test signal and critical protective functions trip the DG to avert substantial damage to the DG unit. The non-critical trips are bypassed during DBAs and provide alarms on abnormal engine conditions. These alarms provide the operator with necessary information to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.

The 18 month Frequency is based on engineering judgment. taking into consideration plant conditions required to perform the Surveillance. and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

The SR is modified by a Note. The reason for the Note is that performing the Surveillance removes a required DG from service.

Credit may be taken for unplanned events that satisfy this SR.

Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available: and

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

Regulatory Guide 1.108 (Ref. 9). paragraph 2.a.(3), requires demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months -22 hours of which is at a load (continued)

RIVER BEND B 3.8-24 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS equivalent to the continuous rating of the DG, and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at a load equivalent to 110% of the continuous duty rating of the DG. An exception to the loading requirements is made for DG 1A and DG lB. OG 1A and DG 1B are operated for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at a load greater than or equal to the maximum expected post accident load. Load carrying capability testing of the Transamerica Delaval Inc. (TDI) diesel generators (DG 1A and OG IB) has been limited to a load less than that which corresponds to 201 psig brake mean effective pressure (BMEP). Therefore.

full load testing is performed at a load Ž 3030 kW but < 3130 kW.

The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube and warmup. discussed in SR 3.8.1.2, and for gradual loading.

discussed in SR 3.8.1.3, are applicable to this SR.

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, testing must be performed using a power factor ! 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG could experience.

The 18 month Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9). paragraph 2.a.(3): takes into consideration plant conditions required to perform the Surveillance: and is intended to be consistent with expected fuel cycle lengths.

This Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. Similarly.

momentary power factor transients above the limit do not invalidate the test. The reason for Note 2 is that credit may be taken for unplanned events (continued)

RIVER BEND B 3.8-25 Revision No. 102

. J.

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance. for which adequate documentation of the required performance is available: and

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE. provided the maintenance was required. or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8-1.15 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances. and achieve the required voltage and frequency within 10 seconds for DG 1A and DG 1B and within 13 seconds for DG 1C. The time requirements are derived from the requirements of the accident analysis to respond to a design basis large break LOCA.

The 18 month Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9). paragraph 2.a.(5).

This SR has been modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The requirement that the diesel has operated for at least 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months at full load conditions prior to performance of this Surveillance and longer if necessary to stabilize the operating temperature.

is based on manufacturer recommendations for achieving hot conditions. The load band is provided to avoid routine overloading of the DG. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. Momentary transients due to changing bus loads do not invalidate this test.

Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.

(continued)

RIVER BEND B 3.8-26 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) As required by Regulatory Guide 1.108 (Ref. 9),

paragraph 2.a.(6). this Surveillance ensures that the manual synchronization and load transfer from the respective DG to each required offsite power source can be made and that the respective DG can be returned to ready-to-load status when offsite power is restored. It also ensures that the undervoltage logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready-to-load status when the DG is at rated speed and voltage, the output breaker is open and can receive an auto-close signal on bus undervoltage, and the load sequence timers are reset.

Portions of the synchronization circuit are associated with the DG and portions with the respective offsite circuit. If a failure in the synchronization requirement of the Surveillance occurs. depending on the specific affected portion of the synchronization circuit, either the DG or the associated offsite circuit is declare inoperable.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9). paragraph 2.a.(6). and takes into consideration plant conditions required to perform the Surveillance.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system.

and challenge safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE. provided the maintenance was required. or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

(continued)

RIVER BEND B 3.8-27 Revision No. 102

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) Demonstration of the test mode override ensures that the DG availability under accident conditions is not compromised as the result of testing. Interlocks to the LOCA sensing circuits cause the DG to automatically reset to ready-to-load operation if an ECCS initiation signal is received during operation in the test mode. Ready-to-load operation is defined as the DG running at rated speed and voltage with the DG output breaker open. These provisions for automatic switchover are required by IEEE-308 (Ref. 13). paragraph 6.2.6(2).

The requirement to automatically energize the emergency loads with offsite power is essentially identical to that of SR 3.8.1.13. The intent in the requirement associated with SR 3.8.1.18.b is to show that the emergency loading is not affected by the DG operation in test mode. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(8): takes into consideration plant conditions required to perform the Surveillance; and is intended to be consistent with expected fuel cycle lengths.

This SR has been modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available: and (continued)

RIVER BEND 8 3.8-28 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.17 (continued)

REQUIREMENTS

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE. provided the maintenance was required. or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.18 Under accident conditions, loads are sequentially connected to the bus by the load sequencing logic. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the bus power supply due to high motor starting currents. The 10% load sequence time tolerance ensures that sufficient time exists for the bus power supply to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. (Note that this surveillance requirement pertains only to the load sequence timer itself, and not to the interposing logic which comprises the remainder of the circuit.)

Reference 2 provides a summary of the automatic loading of ESF buses.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9)-. paragraph 2.a.(2); takes into consideration plant conditions required to perform the Surveillance: and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance during these MODES would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available: and (continued)

RIVER BEND B 3.8-29 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 (continued)

REQUIREMENTS

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel. RCS. and containment design limits are not exceeded.

This Surveillance demonstrates the OG operation, as discussed in the Bases for SR 3.8.1.12. during a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 18 months takes into consideration plant conditions required to perform the Surveillance and is intended to be consistent with an expected fuel cycle length of 18 months.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing. the DGs must be started from standby conditions, that is. with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations for OG 1A and DG 1B. For DG IC. standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from (continued)

RIVER BEND B 3.8-30 Revision No. 102

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.19 (continued)

REQUIREMENTS service, perturb the electrical distribution system, and challenge plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance. for which adequate documentation of the required performance is available: and

2) Post corrective maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.20 This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.

The 10 year Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9).

This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is. with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for DG 1A and DG lB. For DG IC. standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation.

(continued)

RIVER BEND B 3.8-31 Revision No. 102

AC Sources -Operating B 3.8.1 BASES REFERENCES 1. 10 CFR 50, Appendix A. GDC 17.

2. USAR, Chapter 8.

3. Regulatory Guide 1.9.

4. USAR, Chapter 6.

5. USAR, Chapter 15.

6. Regulatory Guide 1.93.

7. Generic Letter 84-15, July 2, 1984.

8. 10 CFR 50, Appendix A, GDC 18.

9. Regulatory Guide 1.108.

10. Regulatory Guide 1.137.

11. ANSI C84.1, 1982.

12. ASME, Boiler and Pressure Vessel Code,Section XI.

13. IEEE Standard 308.

14. 10 CFR 50.65.

15. Regulatory Guide 1.160.

(continued)

I RIVER SEND 8 3.8-32 Revision No. 3-1

AC Sources -Operating B 3.8.1 BASES PAGE INTENTIONALLY LEFT BLANK I RIVER BEND B 3.8-33 Revision No. 3-1

AC Sources-Shutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 AC Sources-Shutdown BASES BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC Sources-Operating."

APPLICABLE The OPERABILITY of the minimum AC sources during MODES 4 SAFETY ANALYSES and 5 and during movement of irradiated fuel assemblies in the primary containment or fuel building ensures that:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.

In general, when the unit is shut down the Technical Specifications (TS) requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or loss of all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no specific analyses in MODES 4 and 5. Worst case bounding events are deemed not credible in MODES 4 and S because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence significantly reduced or eliminated, and minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCOs for required systems.

During MODES 1, 2, and 3, various deviations from the analysis assumptions and design requirements are allowed within the ACTIONS. This allowance is in recognition that (continued)

RIVER BEND B 3.8-34 Revision No. 0

AC Sources-Shutdown B 3.8.2 BASES APPLICABLE certain testing and maintenance activities must be conducted SAFETY ANALYSES provided an acceptable level of risk is not exceeded.

(continued) During MODES 4 and 5, performance of a significant number of required testing and maintenance activities is also required. In MODES 4 and 5, the activities are generally planned and administratively controlled. Relaxations from typical MODE 1, 2, and 3 LCO requirements are acceptable during shutdown MODES based on:

a. The fact that time in an outage is limited. This is a risk prudent goal as well as utility economic consideration.

b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both.

c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.

d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, and 3 OPERABILITY requirements) with systems assumed to function during an event.

In the event of an accident during shutdown, this LCO ensures the capability of supporting systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite (diesel generator (DG)) power.

The AC sources satisfy Criterion 3 of the NRC Policy Statement.

LCO One offsite circuit supplying onsite Class 1E power distribution subsystem(s) of LCO 3.8.8, "Distribution Systems-Shutdown," ensures that all required loads are powered from offsite power. An OPERABLE DG, associated with a Division I or Division II Distribution System Engineered Safety Feature (ESF) bus required OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide (continued)

RIVER BEND B 3.8-35 Revision No. 0

AC Sources-Shutdown 8 3.8.2 BASES LCO electrical power support, assuming a loss of the offsite (continued) circuit. Similarly, when the high pressure core spray (HPCS) is required to be OPERABLE, a separate offsite circuit to the Division III Class 1E onsite electrical power distribution subsystem, or an OPERABLE Division III DG, ensure an additional source of power for the HPCS. This additional source for Division III is not necessarily required to be connected to be OPERABLE. Either the circuit required by LCO Item a, or a circuit required to meet LCO Item c may be connected, with the second source available for connection. Together, OPERABILITY of the required offsite circuit(s) and DG(s) ensure the availability of sufficient AC sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents, reactor vessel draindown).

The qualified offsite circuit(s) must be capable of maintaining rated frequency and voltage while connected to their respective ESF bus(es), and accepting required loads during an accident. Qualified offsite circuits are those that are described in the USAR and are part of the licensing basis for the plant. The offsite circuit consists of incoming breaker and disconnect to the respective preferred station service transformers IC and ID, the IC and iD preferred station service transformers, and the respective circuit path including feeder breakers to all 4.16 kV ESF buses required by LCO 3.8.10.

The required DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage, and accepting required loads. This sequence must be accomplished within 10 seconds for DG IA and DG 1B and 13 seconds for DG IC.

Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions such as: DG in standby with the engine hot and DG in standby with the engine at ambient conditions. Additional DG capabilities must be demonstrated to meet required Surveillance, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode.

Proper sequencing of loads, including tripping of (continued)

RIVER BEND 8 3.8-36 Revision No. 0

AC Sources-Shutdown B 3.8.2 BASES LCO nonessential loads, is a required function for DG (continued) OPERABILITY. In addition, proper load sequence operation is an integral part of offsite circuit and DG OPERABILITY since its inoperability impacts the ability to start and maintain energized any loads required OPERABLE by LCO 3.8.10.

It is acceptable for divisions to be cross tied during shutdown conditions, permitting a single offsite power circuit to supply all required AC electrical power distribution subsystems.

As described in Applicable Safety Analyses, in the event of an accident during shutdown, the TS are designed to maintain the plant in a condition such that, even with a single failure, the plant will not be in immediate difficulty.

APPLICABILITY The AC sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary containment or fuel building provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core in case of an inadvertent draindown of the reactor vessel;

b. Systems needed to mitigate a fuel handling accident are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The AC power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.1.

ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require reactor shutdown.

(continued)

RIVER BEND B 3.8-37 Revision No. 0

AC Sources-Shutdown B 3.8.2 BASES ACTIONS A.1 (continued)

An offsite circuit is considered inoperable if it is not available to one required ESF division. If two or more ESF 4.16 kV buses are required per LCO 3.8.10, division(s) with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, fuel movement, and operations with a potential for draining the reactor vessel. By the allowance of the option to declare required features inoperable which are not powered from offsite power, appropriate restrictions can be implemented in accordance with the required feature(s) LCOs' ACTIONS. Required features remaining powered from offsite power (even though that circuit may be inoperable due to failing to power other features) are not declared inoperable by this Required Action.

A.2.1, A.2.2. A.2.3, A.2.4, B.1, B.2, B.3. and B.4 With the offsite circuit not available to all required divisions, the option still exists to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With the required DG inoperable, the minimum required diversity of AC power sources is not available. It is, therefore, required to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies in the primary containment or fuel building, and activities that could potentially result in inadvertent draining of the reactor vessel.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.

These actions minimize probability of the occurrence of postulated events. It is further required to initiate action immediately to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the plant safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to (continued)

RIVER BEND B 3.8-38 Revision No. 0

AC Sources - Shutdown B 3.8.2 BASES ACTIONS A.2.1. A.2.2, A.2.3, A.2.4, B.1, B.2, B.3. and B.4 (continued) minimize the time during which the plant safety systems may be without sufficient power.

Pursuant to LCO 3.0.6. the Distribution System ACTIONS are not entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore. the Required Actions of Condition A have been modified by a Note to indicate that when Condition A is entered with no AC power to any required ESF bus. ACTIONS for LCO 3.8.10 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit whether or not a division is de-energized. LCO 3.8.10 provides the appropriate restrictions for the situation involving a de-energized division.

C.1 When the HPCS is required to be OPERABLE. and the additional required Division III AC source is inoperable, the required diversity of AC power sources to the HPCS is not available.

Since these sources only affect the HPCS, the HPCS is declared inoperable and the Required Actions of the affected Emergency Core Cooling Systems LCO entered.

In the event all sources of power to Division III are lost, Condition A will also be entered and direct that the ACTIONS of LCO 3.8.10 be taken. If only the Division III additional required AC source is inoperable, and power is still supplied to HPCS, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to restore the additional required AC source to OPERABLE. This is reasonable considering HPCS will still perform its function, absent an additional single failure.

SURVEILLANCE SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1. 2, and 3. SR 3.8.1.8 is not required to be met since only one offsite circuit is required to be OPERABLE.

SR 3.8.1.17 is not required to be met because the required OPERABLE DG(s) is not required to undergo periods (continued)

RIVER BEND B 3.8-39 Revision No. 102

AC Sources - Shutdown B 3.8.2 BASES SURVEILLANCE SR 3.8.2.1 (continued)

REQUIREMENTS of being synchronized to the offsite circuit. SR 3.8.1.20 is excepted because starting independence is not required with the DG(s) that is not required to be OPERABLE. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.

This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during the performance of SRs, and preclude de-energizing a required 4.16 KV ESF bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DG is required to be OPERABLE.

REFERENCES None.

RIVER BEND B 3.8-40 Revision No. 102 P

I

RBG-45935, Part B - Revisions 58 -76 to River Bend Station Technical Requirements Manual & Technical Specification Bases

Text

Navigation menu

RBG-45935, Part B - Revisions 58 -76 to River Bend Station Technical Requirements Manual & Technical Specification Bases

Text

Navigation menu

Search