Text

Transmittal of Technical Specifications Bases Revisions
	ML073100482
Person / Time
Site:	Robinson
Issue date:	10/30/2007
From:	Castell C; Progress Energy Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	RNP-RA/07-0108
	Download: ML073100482 (57)
	v • d • e

ýTS 5.5.14 Progress Energy Serial: RNP-RA/07-0108 OCT 3 0 2007 United States Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555 H. B. ROBINSON STEAM ELECTRIC PLANT, UNIT NO. 2 DOCKET NO. 50-261/LICENSE NO. DPR-23 TRANSMITTAL OF TECHNICAL SPECIFICATIONS BASES REVISIONS Ladies and Gentlemen:

In accordance with Technical Specifications 5.5.14.d, Carolina Power and Light Company, also known as Progress Energy Carolinas, Inc., is transmitting revisions to the H. B. Robinson Steam Electric Plant (HBRSEP), Unit No. 2, Technical Specifications Bases. The attachment to this letter provides Technical Specifications Bases pages for Revisions Number 30 through 35.

If you have any questions concerning this matter, please contact me at (843) 857-1626.

Sincerely, Curt Castell Supervisor - Licensing/Regulatory Programs (Interim)

CAC Attachment c: Dr. W. D. Travers, NRC, Region II NRC Resident Inspector, HBRSEP M. G. Vaaler, NRC, NRR Progress Energy Carolinas, Inc.

Robinson Nuclear Plant 3581 West Entrance Road Hartsville, SC 29550 4/o t

United States Nuclear Regulatory Commission Attachment to Serial: RNP-RA/07-0108 56 Pages (including cover page)

H. B. ROBINSON STEAM ELECTRIC PLANT, UNIT NO. 2 TECHNICAL SPECIFICATIONS BASES PAGES FOR REVISIONS NUMBER 30 THROUGH 35

RPS Instrumentation B 3.3.1 BASES APPLICABLE 3. Intermediate Range Neutron Flux SAFETY ANALYSES, LCO, and The Intermediate Range Neutron Flux trip Function APPLICABILITY provides backup protection against an (continued) uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup. This trip Function provides backup protection to the Power Range Neutron Flux-Low Setpoint trip Function. The NIS intermediate range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS intermediate range detectors do not provide any input to control systems. Note that this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.

The LCO requires two channels of Intermediate Range Neutron Flux to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function.

Because this trip Function is important only during startup, there is generally no need to disable channels for testing while the Function is required to be OPERABLE. Therefore, a third channel is unnecessary.

In MODE 1 below the P-10 setpoint, and in MODE 2, when there is a potential for an uncontrolled RCCA bank rod withdrawal accident during reactor startup, the Intermediate Range Neutron Flux trip must be OPERABLE.

Above the P-1O setpoint, the Power Range Neutron Flux-High Setpoint trip provides core protection for a rod withdrawal accident. In MODE 3, 4, or 5, the Intermediate Range Neutron Flux trip does not have to be OPERABLE because the control rods must be : 5 steps withdrawn and only the shutdown rods may be fully withdrawn. The reactor cannot be started up in this condition. The core also has the required SDM to mitigate the consequences of a positive reactivity addition accident. In MODE 6, all rods are fully inserted and the core has a required increased SDM.

Also, the NIS intermediate range detectors cannot detect neutron levels present in this MODE.

(continued)

HBRSEP Unit No. 2 B 3.3-11 Revision No. 30

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.14 (continued)

REQUIREMENTS The SR is modified by a Note that excludes verification of setpoints from the TADOT. The Functions affected have no setpoints associated with them.

SR 3.3.1.15 SR 3.3.1.15 is the performance of a TADOT of Turbine Trip Functions. This TADOT is as described in SR 3.3.1.4, except that this test is performed prior to reactor startup. A Note states that this Surveillance is not required if it has been performed within the previous 31 days. Verification of the Trip Setpoint does not have to be performed for this Surveillance. Performance of this test will ensure that the turbine trip Function is OPERABLE prior to taking the reactor critical. This test cannot be performed with the reactor at power and must therefore be performed prior to reactor startup.

REFERENCES 1. UFSAR, Chapter 7.

2. UFSAR, Chapter 6.

3. UFSAR, Chapter 15.

4. UFSAR, Section 3.1.

5. IEEE-279-1968.

6. 10 CFR 50.49.

7. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

8. EGR-NGGC-0153, "Engineering Instrument Setpoints."

HBRSEP Unit No. 2 B 3.3-54a Revision No. 30

AC Sources-Operating B-3.8.1 BASES SURVEILLANCE to change without the operator being aware of it and because REQUIREMENTS its status is displayed in the control room.

(continued)

SR 3.8.1.2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note (Note 2 for SR 3.8.1.2) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading.

For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the DGs are started from standby conditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.

In order to reduce stress and wear on diesel engines, the manufacturer recommends a modified start in which the starting speed of DGs is limited, warmup is limited to this lower speed, and the DGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 3, which is only applicable when such modified start procedures are recommended by the manufacturer.

SR 3.8.1.7 requires that, at a 184 day Frequency, the DG starts from standby conditions and achieves required voltage and frequency within 10 seconds. The minimum voltage and frequency stated in the SR are those necessary to ensure the DG can accept DBA loading while maintaining acceptable voltage and frequency levels. Stable operation at the nominal voltage and frequency values is also essential to establishing DG OPERABILITY, but a time constraint is not imposed. This is because a typical DG will experience a period of voltage and frequency oscillations prior to reaching steady state operation if these oscillations are not damped out by load application. This period may extend beyond the 10 second acceptance criteria and could be a cause for failing the SR. In lieu of a time constraint in the SR, HBRSEP Unit No. 2 will monitor and trend the actual (continued)

HBRSEP Unit No. 2 B 3.8-12 Revision No. 30

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by three Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. Note 3 to this SR permits removal of the bypass for protective trips after the DG has properly assumed its loads on the bus. This reduces exposure of the DG to undue risk of damage that might render it inoperable.

SR 3.8.1.11 This Surveillance demonstrates that DG noncritical protective functions (e.g., high coolant water temperature) are bypassed.

A keylocked manual switch is provided which bypasses the non-critical trips. The noncritical trips are normally bypassed during DBAs and provide an alarm on an abnormal engine condition.

This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG. This SR is satisfied by simulating a trip signal to each of the non-critical trip devices and observing the DG does not receive a trip signal.

The 24 month Frequency is based on engineering judgment and is intended to be consistent with the DG maintenance interval.

The equipment being tested is a manually-operated switch.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

(continued)

HBRSEP Unit No. 2 B 3.8-19 Revision No. 30

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 REQUIREMENTS (continued) This SR requires demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , > 1.75 hours8.680556e-4 days 0.0208 hours 1.240079e-4 weeks 2.85375e-5 months of which is at a load equivalent to 110% of the continuous duty rating and the remainder of the time at a load equivalent to the continuous duty rating of the DG. The DG start shall be a manually initiated start followed bymanual syncronization with other power sources.

Additionally, the DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelubricating and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, testing must be performed using a power factor of : 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG would experience. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. The 18 month Frequency takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This Surveillance is modified by three Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the power factor limit will not invalidate the test. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. Note 3 to this SR permits removal of the bypass for protective trips after the DG has properly assumed its loads on the bus.

(continued)

HBRSEP Unit No. 2 B 3.8-20 Revision No. 30

RCS Pressure SL

.B 2.1.2 B 2.0 SAFETY LIMITS (SLs)

B 2.1.2 Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND The SL on RCS pressure protects the integrity of the RCS against overpressurization. In the event of fuel cladding failure, fission products are released into the reactor coolant. The RCS then serves as the primary barrier in preventing the release of fission products into the atmosphere. By establishing an upper limit on RCS pressure, the continued integrity of the RCS is ensured. According to 10 CFR 50 Proposed Appendix A (Ref. 1), GDC 9 "Reactor Coolant System Pressure Boundary" and GDC 34 "Reactor Coolant Pressure Boundary (RCPB) Rapid Propagation Failure Prevention," the reactor coolant pressure boundary design conditions are not to be exceeded during normal operations and transients. Also, in accordance with proposed GDC 33, "Reactor Coolant Pressure Boundary Capability," reactivity accidents, including rod ejection and inadvertent and sudden releases of energy to the coolant, do not result in damage to the RCPB.

The design pressure of the RCS is 2485 psig. During normal operation and transients, RCS pressure is limited from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code (Ref. 2). To ensure system integrity, all RCS components were hydrostatically tested at 3110 psig, according to the ASME Code requirements prior to initial operation with no fuel in the core. Following inception of unit operation, RCS components shall be pressure tested, in accordance with the requirements of ASME Code,Section XI (Ref. 3).

Overpressurization of the RCS could result in a breach of the RCPB. If such a breach occurs in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere, raising concerns relative to dose limits specified in 10 CFR 50.67, "Accident Source Term."

(continued)

HBRSEP Unit No. 2 B 2.0-6 Revision No. 31

RCS Pressure SL B 2.1.2 BASES (continued)

SAFETY LIMITS The maximum transient pressure allowed in the RCS pressure vessel under the ASME Code,Section III, is 110% of design pressure. The maximum transient pressure allowed in the RCS piping, valves, and fittings under USAS, Section B31.1 (Ref. 5) is 120% of design pressure. The most limiting of these two allowances is the 110% of design pressure; therefore, the SL on maximum allowable RCS pressure is 2735 psig.

APPLICABILITY SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 because this SL could be approached or exceeded in these MODES due to overpressurization events. The SL is not applicable in MODE 6 because the reactor vessel head closure bolts are not fully tightened, making it unlikely that the RCS can be pressurized.

SAFETY LIMIT If the RCS pressure SL is violated when the reactor is in VIOLATIONS MODE 1 or 2, the requirement is to restore compliance and be in MODE 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Exceeding the RCS pressure SL may cause immediate RCS failure and create a potential for radioactive releases in excess of the dose limits of 10 CFR 50.67, "Accident Source Term."

The allowable Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of reducing power level to a MODE of operation where the potential for challenges to safety systems is minimized.

If the RCS pressure SL is exceeded in MODE 3, 4, or 5, RCS pressure must be restored to within the SL value within 5 minutes. Exceeding the RCS pressure SL in MODE 3,. 4, or 5 is more severe than exceeding this SL in MODE 1 or 2, since the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5 minutes. The action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress.

(continued)

HBRSEP Unit No. 2 B 2.0-8 Revision No. 31

RCS Pressure SL B 2.1.2 BASES (continued)

REFERENCES 1. 10 CFR 50, Proposed Appendix A, 32FR10213, July 11, 1967.

2. ASME, Boiler and Pressure Vessel Code,Section III, Article NB-7000.

3. ASME, Boiler and Pressure Vessel Code,Section XI, Article IWX-5000.

4. Deleted.

5. USAS B31.1, Standard Code for Pressure Piping, American Society of Mechanical Engineers, 1967.

HBRSEP Unit No. 2 B 2.0-9 Revision No. 31

SDM B 3.1.1 BASES APPLICABLE The ejection of a control rod rapidly adds reactivity to the SAFETY ANALYSES reactor core, causing both the core power level and heat (continued) flux to increase with corresponding increases in reactor coolant temperatures and pressure. The ejection of a rod also produces a time dependent redistribution of core power.

SDM satisfies Criterion 2 of the NRC Policy Statement. Even though it is not directly observed from the control room, SDM is considered an initial condition process variable because it is periodically monitored to ensure that the unit is operating within the bounds of accident analysis assumptions.

LCO SDM is a core design condition that can be ensured during operation through control rod positioning (control and shutdown banks) and through the soluble boron concentration.

The MSLB (Ref. 2) and the boron dilution (Ref. 3) accidents are the most limiting analyses that establish the SDM value of the LCO. For MSLB accidents, if the LCO is violated, there is a potential to exceed the DNBR limit and to exceed the dose limits of 10 CFR 50.67, "Accident Source Term."

For the boron dilution accident, if the LCO is violated, the minimum required time (Ref. 5) assumed for operator action to terminate dilution may no longer be applicable.

APPLICABILITY In MODE 2 with keff < 1.0 and in MODES 3 4, and 5, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses discussed above. In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, "Boron Concentration."

In MODES 1 and 2, SDM is ensured by complying with LCO 3.1.5, "Shutdown Bank Insertion Limits," and LCO 3.1.6.

ACTIONS A.1 If the SDM requirements are not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that (continued)

HBRSEP Unit No. 2 B 3.1-4 Revision No. 31

SDM B 3.1.1 BASES SURVEILLANCE SR 3.1.1.1 (continued)

REQUIREMENTS

c. RCS average temperature;

d. Fuel burnup based on previous critical boron concentration;

e. Xenon concentration;

f. Samarium concentration; and

g. Isothermal temperature coefficient (ITC).

Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperaturewill be changing at the same rate as the RCS.

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the generally slow change in required boron concentration and the low probability of an accident occurring without the required SDM. This allows time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the verification.

REFERENCES 1. UFSAR, Section 3.1.

2. UFSAR, Section 15.1.5.

3. UFSAR, Section 15.4.6.

4. Deleted.

5. UFSAR, Table 15.4.6-1.

6. UFSAR, Table 9.3.4-1.

HBRSEP Unit No. 2 B 3.1-6 Revision No. 31

RPS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protection System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a unit shutdown, based on the values of selected unit parameters, to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs) and to assist the Engineered Safety Features (ESF)

Systems in mitigating accidents.

The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as specifying LCOs on other reactor system parameters and equipment performance.

The LSSS, defined in this specification as the Allowable Values, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During AOOs, which are those events expected to occur one or more times during the unit life, the acceptable limits are:

1. The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling (DNB);

2. Fuel centerline melt shall not occur; and

3. The RCS pressure SL of 2735 psig shall not be exceeded.

Operation within the SLs of Specification 2.0, "Safety Limits (SLs)," also maintains the above values and assures that offsite dose will be within the 10 CFR 50.67 limits during AOOs.

Accidents are events that are analyzed even though they are not expected to occur during the unit life. The acceptable limit during accidents is that offsite dose shall be maintained within an acceptable fraction of 10 CFR 50.67 limits. Different accident categories are allowed a (continued)

JýBRSEP Unit No. 2 B 3.3-1 Revision No. 31

Containment Ventilation Isolation Instrumentation B 3.3.6 BASES APPLICABLE The containment ventilation isolation radiation monitors SAFETY ANALYSES ensure closing of the ventilation isolation valves. They are the primary means for automatically isolating containment in the event of a fuel handling accident during shutdown. Containment isolation in turn ensures meeting the containment leakage rate assumptions of the safety analyses, and ensures that the calculated accidental offsite radiological doses are below 10 CFR 50.67 limits. Due to radioactive decay, containment is only required to isolate during fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 56 hours6.481481e-4 days 0.0156 hours 9.259259e-5 weeks 2.1308e-5 months ).

The containment ventilation isolation instrumentation satisfies Criterion 3 of the NRC Policy Statement.

LCO The LCO requirements ensure that the instrumentation necessary to initiate Containment Ventilation Isolation, listed in Table 3.3.6-1, is OPERABLE.

1. Manual Initiation The LCO requires two channels OPERABLE. The operator can initiate containment ventilation isolation at any time by using either of two pushbuttons in the control room. Either pushbutton actuates both trains. This action will cause actuation of Phase A and Containment Ventilation Isolation automatic containment isolation valves. Containment Ventilation Isolation can also be initiated by the manual Containment Spray buttons.

The LCO for Manual Initiation ensures the proper amount of redundancy is maintained in the manual actuation circuitry to ensure the operator has manual initiation capability.

Each channel consists of one push button and the interconnecting wiring to the actuation logic cabinet.

2. Automatic Actuation Logic and Actuation Relays The LCO requires two trains of Automatic Actuation Logic and Actuation Relays to be OPERABLE. The (continued)

HBRSEP Unit No. 2 B 3.3-122 Revision No. 31

Containment Ventilation Isolation Instrumentation B 3.3.6 BASES (continued)

SURVEILLANCE SR 3.3.6.6 (continued)

REQUIREMENTS every 18 months. Each Manual Actuation Function is tested up to, and including, the master relay coils. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cycles, etc.).

The test also includes trip devices that provide actuation signals directly to the relay logic, bypassing the analog process control equipment. The SR is modified by a Note that excludes verification of setpoints during the TADOT.

The Functions tested have no setpoints associated with them.

The Frequency is based on the known reliability of the Function and the redundancy available, and has been shown to be acceptable through operating experience.

SR 3.3.6.7 A CHANNEL CALIBRATION is performed every 18 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor.

The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

The Frequency is based on operating experience and is consistent with the typical industry refueling cycle.

REFERENCES 1. Deleted.

2. NUREG-1366, "Improvements to Technical Specification Surveillance Requirements," December, 1992.

HBRSEP Unit No. 2 B 3.3-127 Revision No. 31

RCS Specific Activity B 3.4.16 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.16 RCS Specific Activity BASES BACKGROUND The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and gross specific activity in the reactor coolant. The allowable levels are intended to limit the offsite dose to less than the limits of 10 CFR 50.67 for analyzed accidents.

APPLICABLE The LCO limits on the specific activity of the reactor SAFETY ANALYSES coolant ensure that the resulting offsite doses will not exceed the 10 CFR 50.67 dose limits following an analyzed accident. The limiting accident analysis used in establishing the specified activity limits is the SGTR.

Other accidents, such as the Main Steam Line Break accident also use the limits from this LCO in the dose analysis. The SGTR dose analysis (Ref. 2) assumes the specific activity of the reactor coolant at the LCO limit and an existing reactor coolant steam generator (SG) tube leakage rate of 0.3 gpm.

The analysis assumes the specific activity of the secondary coolant at its limit of 0.1 ýtCi/gm DOSE EQUIVALENT 1-131 from LCO 3.7.15, "Secondary Specific Activity."

(continued)

HBRSEP Unit No. 2 B 3.4-98 Revision No. 31

RCS Specific Activity B 3.4.16 BASES SURVEILLANCE SR 3.4.16.3 (continued)

REQUIREMENTS 15 minutes, excluding iodines. The Frequency of 184 days recognizes P does not change rapidly.

This SR has been modified by a Note that indicates the P determination is required to be performed within 31 days after a minimum of 2 effective full power days and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for at least 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . This ensures that the radioactive materials are at equilibrium so the analysis for P is representative and not skewed by a crud burst or other similar abnormal event.

REFERENCES 1. Deleted.

2. UFSAR, Section 15.6.3.

HBRSEP Unit No. 2 B 3.4-103 Revision No. 31

IVSW System B 3.6.8 BASES BACKGROUND a period of time following the accident. Headers "B", "C",

(continued) and "D"are automatic headers that are pressurized through one or both of two redundant, fail open, air operated valves arranged in parallel. A loss of power will cause these valves to fail open. System operation is initiated by a Phase A containment isolation signal which accompanies any Safety Injection (SI) signal.

APPLICABLE The Design Basis Accident (DBA) that results in a release of SAFETY ANALYSES radioactive material within containment is a loss of coolant accident (LOCA). The analyses for the LOCA assumes the isolation of containment is completed and leakage from containment is at a rate equivalent to the design leakage rate. As part of the containment'boundary, containment isolation valves function to support the leak tightness of containment. By maintaining this barrier, offsite dose calculations will be less than the limits of 10 CFR 50.67 during a DBA (Ref. 2).

The IVSW System actuates on a containment isolation signal and functions to assure the actual leakage is no greater than the design value. IVSW assures the effectiveness of certain isolation valves to limit containment leakage by pressurizing the affected containment penetration flow paths at a pressure Ž 1.1 times Pa. IVSW is designed to maintain this seal for at least 30 days. A single failure analysis shows the failure of any active component will not prevent fulfilling the design function of the system. By meeting these requirements, IVSW is considered a qualified seal system in accordance with 10 CFR 50, Appendix J (Ref. 3).

The Isolation Valve Seal Water System satisfies Criterion 3 of the NRC Policy Statement.

LCO During the DBA, the IVSW System must function to seal the associated penetration flow paths. OPERABILITY of the IVSW System is based on the its ability to seal selected containment penetration flow paths, at elevated pressure for at least 30 days assuming a single active failure. This requires that the IVSW tank be maintained with an adequate volume of water at sufficient pressure to provide the motive (continued)

HBRSEP Unit No. 2 B 3.6-50 Revision No. 31

IVSW System B 3.6.8 BASES LCO force necessary to move this fluid to the applicable (continued) penetration. Piping as well as redundant active components (regulators and valves) necessary to provide a system capable of sustaining a single active failure are required to be OPERABLE. Automatic makeup from the dedicated nitrogen bottles and manual capability for makeup from both the Service Water System and the Primary Water System is required for the IVSW System to be OPERABLE.

APPLICABILITY In MODES 1, 2, 3 and 4, a DBA could cause a release of radioactive material to containment. Therefore, the IVSW System is required to be OPERABLE in MODES 1, 2, 3 and 4 to prevent leakage from containment. IVSW is not required to be OPERABLE in MODES 5 and 6, since the probability and consequences of these events are reduced due to the pressure and temperature limitations applicable to these MODES.

ACTIONS A.1 With the IVSW System inoperable, the system must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months completion time is reasonable considering the time necessary to repair most components and the low probability of an event which would require the IVSW System to function.

Without the benefit of the IVSW System the effectiveness of certain containment isolation valves to limit the containment leakage rate following a DBA is reduced. The containment is designed with an allowable leakage rate not to exceed 0.1%of the containment volume per day. The maximum allowable leakage rate is used to evaluate offsite doses resulting from a DBA. Confirmation that the leakage rate is within limit is demonstrated by the performance of a Type A leakage rate test in accordance with the Containment Leakage Rate Testing Program as required by LCO 3.6.1, "Containment." During the performance of the Type A test no credit is taken for the IVSW System in meeting the containment leakage rate criteria. As such, in the event of a DBA without an OPERABLE IVSW System, the doses would be within the limits specified in 10 CFR Part 50.67.

(continued)

HBRSEP Unit No. 2 B 3.6-51 Revision No. 31

MSIVs B 3.7.2 BASES APPLICABLE continuous uncontrolled steam release from more than SAFETY ANALYSES one steam generator.

(continued)

b. A break outside of containment and upstream from the MSIVs is not a containment pressurization concern.

The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition. Closure of the MSIVs isolates the break and limits the blowdown to a single steam generator.

c. A break.downstream of the MSIVs will be isolated by the closure of the MSIVs.

d. Following a steam generator tube rupture, closure of the MSIVs isolates the ruptured steam generator from the intact steam generators to minimize radiological releases.

e. The MSIVs are also utilized during other events such as a feedwater line break. This event is less limiting so far as MSIV OPERABILITY is concerned.

The MSIVs satisfy Criterion 3 of the NRC Policy Statement.

LCO This LCO requires that three MSIVs in the steam lines be OPERABLE. The MSIVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal.

This LCO provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite doses comparable to the limits of 10 CFR 50.67.

(continued)

HBRSEP Unit No. 2 B 3.7-10 Revision No. 31

MSIVs B 3.7.2 BASES SURVEILLANCE SR 3.7.2.1 (continued)

REQUIREMENTS containment analyses with the exception of closure of the MSIVs for a MSLB at 100% RTP, in which case MSIV closure in 2 seconds is assumed for MSIVs which close in the forward flow direction. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. The MSIVs should not be tested at power, since even a part stroke exercise increases the risk of a valve closure when the unit is generating power. As the MSIVs are not tested at power, they are exempt from the ASME Code,Section XI (Ref. 5), requirements during operation in MODE 1

.or 2.

The Frequency is in accordance with the Inservice Testing Program. The specified Frequency for valve closure time is based on the refueling cycle. Operating experience has shown that these components usually pass the Surveillance when performed at the specified Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

This test is conducted in MODE 3 with the unit at operating temperature and pressure, as discussed in Reference 5 exercising requirements. This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows a delay of testing until MODE 3, to establish conditions consistent with those under which the acceptance criterion was generated.

REFERENCES 1. UFSAR, Section 10.3.

2. UFSAR, Section 6.2.

3. UFSAR, Section 15.1.5.

4. Deleted.

5. ASME, Boiler and Pressure Vessel Code,Section XI.

HBRSEP Unit No. 2 B 3.7-13 Revision No. 31

Containment Penetrations B 3.9.3 B 3.9 REFUELING OPERATIONS B 3.9.3 Containment Penetrations BASES BACKGROUND During movement of recently irradiated fuel assemblies within containment, a release of fission product radioactivity within containment will be restricted from escaping to the environment when the LCO requirements are met. In MODES 1, 2, 3, and 4, this is accomplished by maintaining containment OPERABLE as described in LCO 3.6.1, "Containment." In MODE 6, the potential for containment pressurization as a result of an accident is not likely; therefore, requirements to isolate the containment from the outside atmosphere can be less stringent. The LCO requirements are referred to as "containment closure".rather than "containment OPERABILITY." Containment closure means that all potential escape paths are closed or capable of being closed. Since there is no potential for containment pressurization, the Appendix J leakage criteria and tests are not required.

The containment serves to contain fission product radioactivity that may be released from the reactor core following an accident, such that offsite radiation doses are maintained within the limits of 10 CFR 50.67. Additionally, the containment provides radiation shielding from the fission products that may be present in the containment atmosphere following accident conditions.

The containment equipment hatch, which is part of the containment pressure boundary, provides a means for moving large equipment and components into and out of containment.

During movement of recently irradiated fuel assemblies within containment, the equipment hatch must be held in place by at least four bolts. Good engineering practice dictates that the bolts required by this LCO be approximately equally spaced.

The containment air lock, which is also part of the containment pressure boundary, provides a means for personnel access during MODES 1, 2, 3, and 4 unit operation in accordance with LCO 3.6.2, "Containment Air Lock." The air lock has a door at both ends. The doors are normally interlocked to prevent simultaneous opening when containment OPERABILITY is required. During periods of unit shutdown (continued)

HBRSEP Unit No. 2 B 3.9-8 Revision No. 31

Containment Penetrations B 3.9.3 BASES (continued)

APPLICABLE During movement of irradiated fuel assemblies within SAFETY ANALYSES containment, the most severe radiological consequences result from a fuel handling accident involving handling recently irradiated fuel. The fuel handling accident is a postulated event that involves damage to irradiated fuel (Ref. 1). Fuel handling accidents analyzed include dropping a single irradiated fuel assembly and handling tool or a heavy object onto other irradiated fuel assemblies. The requirements of LCO 3.9.6, "Refueling Cavity Water Level,"

and irradiated fuel movement with containment closure capability or a minimum decay time of 56 hours6.481481e-4 days 0.0156 hours 9.259259e-5 weeks 2.1308e-5 months without containment closure capability ensure that the release of fission product radioactivity, subsequent to a fuel handling accident, results in doses that are well within (5 25%)the dose limits specified in 10 CFR 50.67.

Containment penetrations satisfy Criterion 3 of the NRC Policy Statement.

LCO This LCO limits the consequences of a fuel handling accident involving handling recently irradiated fuel in containment by limiting the potential escape paths for fission product radioactivity released within containment. The LCO requires any penetration providing direct access from the containment atmosphere to the outside atmosphere to be closed except for the OPERABLE containment ventilation penetrations. For the OPERABLE containment ventilation penetrations, this LCO ensures that these penetrations are isolable by the Containment Ventilation Isolation System. The OPERABILITY requirements for this LCO ensure that the automatic containment ventilation valve closure times specified in the UFSAR can be achieved and, therefore, meet the assumptions used in the safety analysis to ensure that releases through the valves are terminated, such that radiological doses are within the acceptance limit.

APPLICABILITY The containment penetration requirements are applicable during movement of recently irradiated fuel assemblies within containment because this is when there is a potential (continued)

HBRSEP Unit No. 2 B 3.9-10 Revision No. 31

TABLE OF CONTENTS B 3.4 REACTOR COOLANT SYSTEM (RCS) (continued)

B 3.4.7 RCS Loops-MODE 5, Loops Filled .............. .B 3.4-35 B 3.4.8 RCS Loops-MODE 5, Loops Not Filled .......... .B 3.4-40 B 3.4.9 Pressurizer ................................... .B 3.4-44 B 3.4.10 Pressurizer Safety Valves ..................... .B 3.4-49 B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs) ............................. .B 3.4-53 B 3.4.12 Low Temperature Overpressure Protection (LTOP)

System ... :..... ............................ B 3.4-61 B 3.4.13 RCS Operational LEAKAGE ....................... 3.4-75 RCS Pressure Isolation Valves (PIVs) ......... .........................

B B 3.4.14 3.4-82 RCS Leakage Detection Instrumentation ......... .........................

B B 3.4.15 3.4-91 RCS Specific Activity ......................... .........................

B B 3.4.16 3.4-98 Chemical and Volume Control System ............ .........................

B B 3.4.17 3.4-104 Steam Generator (SG) Tube Integrity .......... .........................

8 B 3.4.18 3.4-110 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) .......... ......... B 3.5-1 3.5.1 Accumulators ................................ ......... B 3.5-1 3.5.2 ECCS- Operating ........................... ......... B 3.5-10 3.5.3 ECCS- Shutdown ............................ ......... B 3.5-21 3.5.4 Refueling Water Storage Tank (RWST) ........ ......... B 3.5-25 3.6 CONTAINMENT SYSTEMS ............................ .......................... B 3.6-1 Containment ............................... .......................... B 3.6.1 3.6-1 Containment Air Lock ...................... ........................... B 3.6.2 3.6-6 Containment Isolation Valves .............. ........................... B 3.6.3 3.6-13 Containment Pressure ...................... .......................

,...B 3.6.4 3.6-26 Containment Air Temperature ............... .......................... B 3.6.5 3.6-29 Containment Spray and Cooling Systems ..... .......................... B 3.6.6 3.6-33 Spray Additive System ..................... .......................... B 3.6.7 3 .6-43 Isolation Valve Seal Water (IVSW) System ... B 3.6.8 3.6-49 PLANT SYSTEMS .................................. ..... B 3.7 3.7-1 Main Steam Safety Valves (MSSVs) ........... .......................... B 3.7.1 3.7-1 3.7.2 Main Steam Isolation Valves (MSIVs) ........ .......................... B 3.7-8 3.7.3 Main Feedwater Isolation Valves (MFIVs),

Main Feedwater Regulation Valves (MFRVs) and Bypass Valves ....................... ......................

,....B 3.7-14 3.7.4 Auxiliary Feedwater (AFW) System ........... .......................... B 3.7-21 Condensate Storage Tank (CST) .......... ............................B¸ 3.7.5 3.7-32 3.7.6 Component Cooling Water (CCW) System ....... ........................... B 3.7-36 Service Water System (SWS) ................. .......................... B 3.7.7 3.7-41 Ultimate Heat Sink (UHS) ................... .......................... B 3.7.8 3.7-48 3.7.9 Control Room Emergency Filtration System (CIREFS). .... B 3.7-52 3.7.10 Control Room Emergency Air Temperature ........................... B Control System (CREATC) ................. 3.7-59 3.7.11 Fuel Building Air Cleanup System (FBACS)... ........................... B 3.7-63 3.7.12 Fuel Storage Pool Water Level .............. ..... B 3.7-67 3.7.13 Fuel Storage Pool Boron Concentration ...... ........................... B 3.7-70 (continued)

HBRSEP Unit No. 2 iii Revision No. 32

PAM Instrumentation B 3.3.3 BASES LCO 15, 16, 17, 18. Core Exit Temperature (continued)

Core Exit Temperature is provided for verification and long term surveillance of core cooling.

Adequate core cooling is ensured with two valid Core Exit Temperature channels per quadrant with one core exit thermocouple per required channel (Ref. 4). Core Exit Temperature is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped. Core Exit Temperature is also used for unit stabilization and cooldown control.

Two OPERABLE channels of Core Exit Temperature are required in each quadrant to provide indication of radial distribution of the coolant temperature rise across representative regions of the core. Power distribution symmetry was considered in determining the specific number and locations provided for diagnosis of local core problems. Two channels of Core Exit Temperature per quadrant ensures that a single failure will not disable the ability to determine the core exit temperature in any quadrant. The two channels, each with a minimum of one Core Exit Thermocouple per quadrant, must be powered from separate trains to satisfy the single failure requirement.

19. Auxiliary Feedwater Flow AFW Flow is provided to monitor operation of decay heat removal via the SGs.

The three AFW discharge lines from the motor driven AFW pumps and the three AFW discharge lines from the steam driven AFW pump each contain one primary flow indicator. This provides two AFW flow paths per SG, for a total of six AFW lines and flow indicators.

Since the primary indication used by the operator during an accident is the control room indicator, the PAM specification deals specifically with this portion of the instrument channel.

AFW flow is used three ways:

to verify delivery of AFW flow to the SGs; to determine adequacy of the secondary heat sink; and (continued)

HBRSEP Unit No. 2 B 3.3-100 Revision No. 32

RCS Loops-MODES 1 and 2 B 3.4.4 BASES APPLICABLE Both transient and steady state analyses have been performed SAFETY ANALYSES to establish the effect of flow on the departure from (continued) nucleate boiling (DNB). The transient and accident analyses for the plant have been performed assuming three RCS loops are in operation. The majority of the plant safety analyses are based on initial conditions at high core power or zero power. The accident analyses that are most important to RCP operation are the three pump coastdown, single pump locked rotor, single pump (broken shaft or coastdown), and rod withdrawal events (Ref. 1).

Steady state DNB analysis has been performed for the three RCS loop operation. For three RCS loop operation, the steady state DNB analysis, which generates the pressure and temperature Safety Limit (SL) (i.e., the departure from nucleate boiling ratio (DNBR) limit) assumes a maximum power level of 109% RTP. This is the design overpower condition for three RCS loop operation. The value for the accident analysis setpoint of the nuclear overpower (high flux) trip is 118% and is based on an analysis assumption that bounds possible instrumentation errors. The DNBR limit defines a locus of pressure and temperature points that result in a minimum DNBR greater than or equal to the critical heat flux correlation limit.

The plant is designed to operate with all RCS loops in operation to maintain DNBR above the SL, during all normal operations and anticipated transients. By ensuring heat transfer in the nucleate boiling region, adequate heat transfer is provided between the fuel cladding and the reactor coolant.

RCS Loops-MODES 1 and 2 satisfy Criterion 2 of the NRC Policy Statement.

LCO The purpose of this LCO is to require an adequate forced flow rate for core heat removal. Flow is represented by the number of RCPs in operation for removal of heat by the SGs.

To meet safety analysis acceptance criteria for DNB, three pumps are required at rated power.

An OPERABLE RCS loop consists of an OPERABLE RCP in operation providing forced flow for heat transport and an OPERABLE SG.

(continued)

HBRSEP Unit No. 2 B 3.4-20 Revision No. 32

RCS Loops-MODES 1 and 2 B 3.4;4 BASES (continued)

APPLICABILITY In MODES 1 and 2, the reactor is critical and thus has the potential to produce maximum THERMAL POWER. Thus, to ensure that the assumptions of the accident analyses remain valid, all RCS loops are required to be OPERABLE and in operation in these MODES to prevent DNB and core damage.

The decay heat production rate is much lower than the full power heat rate. As such, the forced circulation flow and heat sink requirements are reduced for lower, noncritical MODES as indicated by the LCOs for MODES 3, 4, and 5.

Operation in other MODES is covered by:

LCO 3.4.5, "RCS Loops-MODE 3";

LCO 3.4.6, "RCS Loops-MODE 4";

LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";

LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).

ACTIONS A.1 If the requirements of the LCO are not met, the Required Action is to reduce power and bring the plant to MODE 3.

This lowers power level and thus reduces the core heat removal needs and minimizes the possibility of violating DNB limits.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging safety systems.

(continued)

HBRSEP Unit No. 2 B 3.4-21 Revision No. 32

RCS Loops-MODE 3 B 3.4.5 BASES (continued)

LCO will prevent the occurrence of an inadvertent control (continued) rod withdrawal transient. An alternate condition, described in item c.4 of the Note, is to maintain SDM within the MODE 3 limit for no RCS loops in operation as specified in the COLR. This SDM limit is sufficient to prevent a return to criticality in the event of simultaneous withdrawal of the two most reactive control rod banks as assumed in the inadvertent control rod transient analysis.

An OPERABLE RCS loop consists of one OPERABLE RCP and one OPERABLE SG, which has the minimum water level specified in SR 3.4.5.2. An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.

APPLICABILITY In MODE 3, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. The most stringent condition of the LCO, that is, two RCS loops OPERABLE and two RCS loops in operation, applies to MODE 3 with RTBs in the closed position. The least stringent condition, that is, two RCS loops OPERABLE and one RCS loop in operation, applies to MODE 3 with the RTBs open.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2";

LCO 3.4.6, "RCS Loops-MODE 4";

LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";

LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation--Low Water Level" (MODE 6).

(continued)

HBRSEP Unit No. 2 B 3.4-26 Revision No. 32

RCS Loops-MODE 4 B 3.4.6 BASES LCO Note 2 requires that there be a steam bubble in the (continued) pressurizer or the secondary side water temperature of each SG be < 50'F above each of the RCS cold leg temperatures before the start of an RCP. This restraint is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.

An OPERABLE RCS loop comprises an OPERABLE RCP and an OPERABLE SG, which has the minimum water level specified in SR 3.4.6.2.

Similarly for the RHR System, an OPERABLE RHR train comprises an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger. RCPs and RHR pumps are OPERABLE if they are capable of being powered and are able to provide forced flow if required.

APPLICABILITY In MODE 4, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. One loop or train of either RCS or RHR provides sufficient circulation for these purposes. However, two circuits consisting of any combination of RCS loops and RHR trains are required to be OPERABLE to meet single failure considerations.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2":

LCO 3.4.5, "RCS Loops-MODE 3";

LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";

LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).

ACTIONS A.1 If one required RCS loop or RHR train is inoperable and only one required RCS loop remains OPERABLE, the intended redundancy for heat removal is lost. Action must be initiated to restore a second RCS loop or RHR train to (continued)

HBRSEP Unit No. 2 B 3.4-32 Revision No. 32

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES LCO experience has shown that boron stratification is not likely (continued) during this short period with no forced flow.

Utilization of Note 1 is permitted provided the following conditions are met, along with any other conditions imposed by initial startup test procedures:

a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1, therefore maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure the SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and

b. Core outlet temperature is maintained at least 10OF below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

Note 2 allows one RHR train to be inoperable and de-energized for a period of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , provided that the other RHR train is OPERABLE. This permits periodic surveillance tests to be performed on the inoperable train during the only time when such testing is safe and possible.

Note 3 requires that there be a steam bubble in the pressurizer or the secondary side water temperature of each SG be

50°F above each of the RCS cold leg temperatures before the start of.a reactor coolant pump (RCP). This restriction is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.

Note 4 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting removal of RHR trains from operation when at least one RCS loop is in operation. This Note provides for the transition to MODE 4 where an RCS loop is permitted to be in operation and replaces the RCS circulation function provided by the RHR trains.

RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. An SG can perform as a heat sink when it has an adequate water level, the RCS is not vented, and is OPERABLE.

(continued)

HBRSEP Unit No. 2 B 3.4-37 Revision No. 32

RCS Operational LEAKAGE B 3.4.13 BASES (continued)

APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses SAFETY ANALYSES do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGE from all steam generators (SGs) is 0.3 gpm or increases to 0.3 gpm as a result of accident induced conditions. The LCO requirement to limit primary to secondary LEAKAGE through any one SG to less than or equal to 75 gallons per day is less than the conditions assumed in the safety analyses.

Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a steam line break (SLB) accident. To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR).

The leakage contaminates the secondary fluid.

For the SGTR, the activity released due to the 0.3 gpm primary to secondary LEAKAGE is relatively insignificant compared to the activity released via the ruptured tube.

The safety analysis for the SGTR accident assumes 0.3 gpm total primary to secondary LEAKAGE in all generators as an initial condition. After mixing in the secondary side, the activity is then released via the SG PORVs or safeties.

This release pathway continues until the SGs are isolated, which is relatively soon for the affected SG compared to the intact SGs. The dose consequences resulting from the SGTR accident are within the limits defined in 10 CFR 50.67.

The RCS operational LEAKAGE satisfies Criterion 2 of the NRC Policy Statement.

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE.

(continued)

HBRSEP Unit No. 2 B 3.4-77 Revision No. 32

RCS Operational LEAKAGE B 3.4.13 BASES LCO Violation of this LCO could result in continued (continued) degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

b. Unidentified LEAKAGE One gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment atmosphere radiation monitoring systems, condensate measuring system, dewpoint monitoring equipment, and containment sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.

c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of identified LEAKAGE and is well within the capability of the RCS Makeup System. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include pressure boundary LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (a normal function not considered LEAKAGE).

Violation of this LCO could result in continued degradation of a component or system.

d. Primary to Secondary LEAKAGE through Any One SG The limit of 75 gallons per day per SG is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines (Ref. 3). The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational LEAKAGE criterion of 75 gallons per day in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.

(continued)

HBRSEP Unit No. 2 B 3.4-78 Revision No. 32

RCS Operational LEAKAGE B 3.4-.13 BASES (continued)

APPLICABILITY In MODES 1,;2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.

In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.

LCO 3.4.14, "RCS Pressure Isolation Valves (PIVs)," measures leakage through each individual PIV and can impact this LCO.

Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.

ACTIONS A.1 Unidentified LEAKAGE or identified LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.

B.1 and B.2 If any pressure boundary LEAKAGE exists, primary to secondary LEAKAGE is not within limit, or Required Action A.1 is not met, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. The reactor must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.

The allowed Completion Times are reasonable,; based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the pressure stresses acting on the RCPB are much lower, and further deterioration is much less likely.

(continued)

HBRSEP Unit No. 2 B 3.4-79 Revision No. 32

RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE SR 3.4.13.1 REQUIREMENTS Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB is maintained. Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory balance.

The RCS water inventory balance must be met with the reactor at steady state operating conditions. The surveillance is modified by two notes. Note 1 states that this SR is required within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching continuous steady state operation.

Steady state operation is required to perform a proper inventory balance; calculations during maneuvering are not useful and a Note requires the Surveillance to be met when steady state is established. For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.

An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

These leakage detection systems are specified in LCO 3.4.15, "RCS Leakage Detection Instrumentation."

Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 75 gallons per day cannot be measured accurately by an RCS water inventory balance.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency during steady state operation is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents.

(continued)

HBRSEP Unit No. 2 B 3.4-80 Revision No. 32

RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE SR 3.4.13.2 REQUIREMENTS (continued)

This SR verifies that primary'to secondary LEAKAGE is less or equal to 75 gallons per day through any one SG.

Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCO 3.4.18, "Steam Generator Tube Integrity," should be evaluated. The 75 gallons per day limit is measured at room temperature as described in Reference 4. The operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, the entire primary to secondary LEAKAGE should be conservatively assumed to be from one SG.

The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after establishment of steady state operation. For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.

The Surveillance Frequency of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is a reasonable interval to trend primary to secondary LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Ref. 4).

REFERENCES 1. UFSAR, Section 3.1.

2. UFSAR, Chapter 15.

3. NEI 97-06, "Steam Generator Program Guidelines."

4. EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."

HBRSEP Unit No. 2 B 3.4-81 Revision No. 32

RCS Leakage Detection Instrumentation B 3.4.15 BASES APPLICABLE RCS leakage detection instrumentation satisfies Criterion 1 SAFETY ANALYSES of the NRC Policy Statement.

(continued)

LCO One method of protecting against large RCS leakage derives from the ability of instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.

The LCO is satisfied when monitors of diverse measurement means are available. Containment sump level is monitored by two channels which indicate on the post accident monitoring panel.

The R-11 and R-12 channels monitor containment particulate and gaseous activity, respectively, and the Condensate Measuring System consists of one condensate flow rate monitor channel on each of the four fan coolers. Thus, one containment sump monitor channel, in combination with either a gaseous or particulate radioactivity monitor and one containment fan cooler condensate flow rate monitor, provides an acceptable minimum. OPERABILITY of the condensate flow rate monitor includes the HVH condensate collection alarm function on the main control board in the control room.

APPLICABILITY Because of elevated RCS temperature and pressure in MODES 1, 2, 3, and 4, RCS leakage detection instrumentation is required to be OPERABLE.

In MODE 5 or 6, the temperature is to be : 200'F and pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation are much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.

(continued)

HBRSEP Unit No. 2 B 3.4-93 Revision No. 32

SG Tube Integrity B 3.4.18 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.18 Steam Generator (SG) Tube Integrity BASES BACKGROUND Steam generator (SG) tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers. The SG tubes have a number of important safety functions. Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary system's pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.4, "RCS Loops -

MODES 1 and 2," LCO 3.4.5, "RCS Loops - MODE 3," LCO 3.4.6, "RCS Loops - MODE 4," and LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled."

SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements.

Steam generator tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively.

The SG performance criteria are used to manage SG tube degradation.

Specification 5.5.9, "Steam Generator (SG) Program,"

requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 5.5.9, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 5.5.9. Meeting the SG performance criteria provides reasonable assurance of (continued)

HBRSEP Unit No. 2 B 3.4-110 Revision No. 32

SG Tube Integrity B 3.4.18 BASES (Continued)

BACKGROUND maintaining tube integrity at normal and accident (continued) conditions.

The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Ref. 1).

APPLICABLE The steam generator tube rupture (SGTR) accident is the SAFETY ANALYSES limiting design basis event for SG tubes and avoiding an SGTR is the basis for this Specification. The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate greater than the operational LEAKAGE rate limits in LCO 3.4.13, "RCS Operational LEAKAGE," plus the leakage rate associated with a double-ended rupture of a single tube.

The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture.) In these analyses, the steam discharge to the atmosphere is based on the total primary to secondary LEAKAGE from all SGs of 0.3 gallon per minute or is assumed to increase to 0.3 gallon per minute as a result of accident induced conditions. For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUIVALENT 1-131 is assumed to be equal to the LCO 3.4.16, "RCS Specific Activity,"

limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Ref. 2) and 10 CFR 50.67 (Ref. 3) or the NRC approved licensing basis (e.g., a small fraction of these limits).

Steam generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

(continued)

HBRSEP Unit No. 2 .B 3.4-111 Revision No. 32

SG Tube Integrity B 3.4.18 BASES (Continued)

LCO The LCO requires that SG tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the repair criteria be plugged in accordance with the Steam Generator Program.

During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is removed from service by plugging. If a tube was determined to satisfy the repair criteria but was not plugged, the tube may still have tube integrity.

In the context of this Specification, an SG tube is defined as the entire length of the tube, including the tube wall, between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.

A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 5.5.9, "Steam Generator Program,"

and describe acceptable SG tube performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria.

There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.

The, structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as, "The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance on assessing loads that have a (continued)

HBRSEP Unit No. 2 B 3.4-112 Revision No. 32

SG Tube Integrity B 3.4.18 BASES (Continued)

LCO significant effect on burst or collapse. In that context, (continued) the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis. The division between primary and secondary classifications will be based on detailed analysis and/or testing.

Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code,Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included in the design specification.

This includes safety factors and applicable design basis loads based on ASME Code,Section III, Subsection NB (Ref.

4) and Draft Regulatory Guide 1.121 (Ref. 5).

The accident induced leakage performance criterion ensures that the primary to secondary LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The accident analysis assumes that accident induced leakage does not exceed 150 gpd per SG.

The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.

The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in LCO 3.4.13, "RCS Operational LEAKAGE," and limits primary to secondary LEAKAGE through any one SG to 75 gallons per day.

This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative.

(continued)

HBRSEP Unit No. 2 B 3.4-113 Revision No. 32

SG Tube Integrity B 3.4.18 BASES (Continued)

APPLICABILITY Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced in MODE 1, 2, 3, or 4.

RCS conditions are far less challenging in MODES 5 and 6 than during MODES 1, 2, 3, and 4. In MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.

ACTIONS The ACTIONS are modified by a Note clarifying that the Conditions may be entered independently for each SG tube.

This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube.

Complying with the Required Actions may allow for continued operation, and subsequently affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.

A.1 and A.2 Condition A applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube repair criteria but were not plugged in accordance with the Steam Generator Program as required by SR 3.4.18.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Condition A does not apply to the occurrence of primary to secondary LEAKAGE, which is monitored and maintained in accordance with LCO 3.4.13. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG repair criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, Condition B applies.

(continued)

HBRSEP Unit No. 2 B 3.4-114 Revision No. 32

SG Tube Integrity B 3.4.18 BASES (Continued)

ACTIONS A.1 and A.2 (continued)

(continued)

A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with an SG tube that may not have tube integrity.

If the evaluation determines that the affected tube(s) have tube integrity, Required Action A.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tubes. However, the affected tube(s) must be plugged prior to entering MODE 4 following the next refueling outage or SG inspection. This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.

B.1 and B.2 If the Required Actions and associated Completion Times of Condition A are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.18.1 REQUIREMENTS During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices.

During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring (continued)

HBRSEP Unit No. 2 B 3.4-115 Revision No. 32

SG Tube Integrity B 3.4.18 BASES (Continued)

SURVEILLANCE SR 3.4.18.1 (continued)

REQUIREMENTS (continued) assessment determines the "as found" condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.

The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube repair criteria.

Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation. Inspection methods are a function of degradation morphology, nondestructive examination (NDE) technique capabilities, and inspection locations.

The Steam Generator Program defines the Frequency of SR 3.4.18.1. The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Ref. 6). The Steam Generator Program uses information on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 5.5.9 contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections.

SR 3.4.18.2 During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is removed from service by plugging. The tube repair criteria delineated in Specification 5.5.9 are intended to ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube repair criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.

(continued)

HBRSEP Unit No. 2 B 3.4-116 Revision No. 32

SG Tube Integrity B 3.4.18 BASES (Continued)

SURVEILLANCE SR 3.4.18.2 (continued)

REQUIREMENTS (continued) The Frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the repair criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential.

REFERENCES 1. NEI 97-06, "Steam Generator Program Guidelines."

2. 10 CFR 50 Appendix A, GDC 19.

3. 10 CFR 50.67.

4. ASME Boiler and Pressure Vessel Code,Section III, Subsection NB.

5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.

6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines."

HBRSEP Unit No. 2 B 3.4-117 Revision No. 32

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES BACKGROUND water level when the RCS is not vented 16% to provide an i

(continued) alternate method for decay heat removal when the RCS is not vented.

APPLICABLE In MODE 5, RCS circulation is considered in the SAFETY ANALYSES determination of the time available for mitigation of the accidental boron dilution event. The RHR trains provide this circulation.

RCS Loops-MODE.5 (Loops Filled) have been identified in the NRC Policy Statement as important contributors to risk reduction.

LCO The purpose of this LCO is to require that at least one of the RHR trains be OPERABLE and in operation with an additional RHR train OPERABLE or one SG with secondary side water level ; 16% and the RCS not vented. One RHR train provides sufficient forced circulation to perform the safety functions of the reactor coolant under these conditions. An additional RHR train is required to be OPERABLE to meet single failure considerations. However, if the standby RHR train is not OPERABLE, an acceptable alternate method is one SG with the secondary side water levels > 16%. Should the operating RHR train fail, the SG could be used to remove the decay heat through its sensible heat capacity, or, upon pressurization of the RCS, through latent heat removal and natural circulation flow.

Note 1 permits all RHR pumps to be de-energized

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months in any 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. The purpose of the Note is to permit tests designed to validate various accident analyses values.

One of the tests performed during the startup testing program is the validation of rod drop times during cold conditions, both with and without flow. The no flow test may be performed in MODE 3 or 5 and requires that the pumps be stopped for a short period of time. The Note permits de-energizing of the pumps in order to perform this test and validate the assumed analysis values. If changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values must be revalidated by conducting the test again. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months time period is adequate to perform the test, and operating (continued)

HBRSEP Unit No. 2 B 3.4-36 Revision No. 33

ECCS--Operating B 3.5.2 BASES ACTIONS B.1 and B.2 (continued) control power restored. Additionally, Required Action B.2 requires the control power to be removed to the valve within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . In this condition, the valves could be subject to a spurious single failure that could result in closure of the valve and isolation of an accumulator. During the interval in which control power is restored, the valve remains in its required position or if a valve is repositioned after the restoration of power, the applicable condition associated with the ECCS train or flow path must be entered. The flow path to FCV-605 may be isolated in lieu of FCV-605 being in the required position. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable considering a low probability of a spurious single failure coincident with a LOCA.

C.1 and C.2 If the inoperable trains cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained.

Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removal of control power or by key locking the control in the correct position ensures thatthey cannot change position as a result of an active failure or be inadvertently misaligned.

These valves are of the type, described in Reference 6, that can disable the function of both ECCS trains and invalidate the accident analyses. A 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered reasonable in view of other administrative controls that will ensure a mispositioned valve is unlikely.

(continued)

HBRSEP Unit No. 2 B 3.5-17 Revision No. 33

Containment Spray and Cooling Systems B 3.6.6 BASES ACTIONS A.1 (continued) removal capability afforded by the Containment Spray System and Containment Cooling System, reasonable time for repairs, and low probability of a DBA occurring during this period.

The 10 day portion of the Completion Time for Required Action A.1 is based upon engineering judgment. It takes into account the low probability of coincident entry into two Conditions in this Specification coupled with the-low probability of an accident occurring during this time.

Refer to Section 1.3, "Completion Times," for a more detailed discussion of the purpose of the "from discovery of failure to meet the LCO" portion of the Completion Time.

B.1 and B.2 If the inoperable containment spray train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 5 allows additional time for attempting restoration of the containment spray train and is reasonable when considering the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.

C.1 With one of the containment cooling trains inoperable, the inoperable containment cooling train must be restored to OPERABLE status within 7 days. In this degraded condition at least one train of containment spray and the remaining containment cooling train are capable of providing at least 100% of the heat removal needs. The 7 day Completion Time was developed taking into account the redundant heat removal capabilities afforded by combinations of the Containment Spray System and (continued)

HBRSEP Unit No. 2 B 3.6-38 Revision No. 33

Containment B 3.6.1 BASES BACKGROUND b. The air lock is OPERABLE, except as provided in (continued) LCO 3.6.2, "Containment Air Lock";

c. The equipment hatch is closed and sealed; and

d. The Isolation Valve Seal Water (IVSW) system is OPERABLE, except as provided in LCO 3.6.8.

APPLICABLE The safety design basis for the containment is that the SAFETY ANALYSES containment must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate.

The DBAs that result in a challenge to containment OPERABILITY from high pressures and temperatures are a loss of coolant accident (LOCA) and a steam line break (Ref. 2).

In addition, release of significant fission product radioactivity within containment can occur from a LOCA. In the LOCA analyses, it is assumed that the containment is OPERABLE such that, for the LOCA, the release to the environment is controlled by the rate of containment leakage. The containment has an allowable leakage rate of 0.1% of containment air weight per, day (Ref. 2). This leakage rate, used to evaluate offsite doses resulting from accidents, is defined in 10 CFR 50, Appendix J (Ref. 1), as La: the maximum allowable containment leakage rate at the calculated peak containment internal pressure (Pa) resulting from the LOCA. At HBRSEP, Unit No. 2, Pa is specified as the containment design pressure of 42 psig, which exceeds the calculated peak LOCA containment pressure. The allowable leakage rate represented by La forms the basis for the acceptance criteria imposed on all containment leakage rate testing. La is assumed to be 0.1% per day in the safety analysis at Pa = 42 psig (Ref. 2).

Satisfactory leakage rate test results are a requirement for the establishment of containment OPERABILITY.

The containment satisfies Criterion 3 of the NRC Policy Statement.

(continued)

HBRSEP Unit No. 2 B 3.6-2 Revision No. 34

Containment Air Lock B 3.6.2 BASES APPLICABLE leakage. The containment has an allowable leakage rate SAFETY ANALYSES of 0.1% of containment air weight per day at 42 psig (continued) (Ref. 2).

The containment air lock satisfies Criterion 3 of the NRC Policy Statement.

LCO The containment air lock form5 part of the containment pressure boundary. As part ol containment, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, the air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

The air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the'Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of containment does not exist when containment is required to be OPERABLE.

Closure of a single door in the air lock is sufficient to provide a leak tight barrier following postulated events.

Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into and exit from containment.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.

Therefore, the containment air locks are not required in MODE 5 to prevent leakage of radioactive material from containment. The requirements for the containment air locks during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."

(continued)

HBRSEP Unit No. 2 B 3.6-7 Revision No. 34

Containment Pressure B 3.6.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.4 Containment Pressure BASES BACKGROUND The containment pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) or steam line break (SLB). These limits also prevent the containment pressure from exceeding the containment design negative pressure differential with respect to the outside atmosphere in the event of inadvertent actuation of the Containment Spray System.

Containment pressure is a process variable that is monitored and controlled. The containment pressure limits are derived from the input conditions used in the containment functional analyses and the containment structure external pressure analysis. Should operation occur outside these limits coincident with a Design Basis Accident (DBA), post accident containment pressures could exceed calculated values.

APPLICABLE Containment internal pressure is an initial condition used SAFETY ANALYSES in the DBA analyses to establish the maximum peak containment internal pressure. The initial pressure condition used in the containment analysis was 15.7 psia (1.0 psig). The limiting DBAs considered, relative to containment pressure, are the LOCA and SLB, which are analyzed using computer codes designed to predict the resultant pressure and temperature transient. The containment pressure analysis indicates the containment peak pressure for the limiting SLB slightly exceeds the peak pressure for the limiting LOCA (Ref. 1) and does not exceed the containment design pressure of 42 psig.

The containment was also designed for an external pressure load equivalent to -3.0 psig. The inadvertent actuation of the Containment Spray System was analyzed to determine (continued)

HBRSEP Unit No. 2 B 3.6-26 Revision No. 34

Containment Air Temperature B 3.6.5 BASES APPLICABLE No two DBAs are assumed to occur simultaneously or SAFETY ANALYSES consecutively. The postulated DBAs are analyzed with regard (continued) to Engineered Safety Feature (ESF) systems, assuming the loss of one ESF bus, which is the worst case single active failure, resulting in one train each of the Containment Spray System, Residual Heat Removal System, and Containment Cooling System being rendered inoperable.

The limiting DBA for the maximum peak containment air temperature is an SLB. The initial containment average air temperature assumed in the design basis analyses (Ref. 1) is 130°F. This resulted in a maximum containment air temperature of approximately 274 0 F. The maximum containment air temperature from a LOCA is approximately 264 0 F. The environmental qualification temperature limit is 280 0 F. The containment structural design temperature is 263 0 F.

The temperature limit is used to establish the environmental qualification operating envelope for containment. The maximum peak containment air temperature was calculated to exceed the containment design temperature briefly during the transient. The basis of the containment design temperature, however, is to ensure the performance of safety related equipment inside containment (Ref. 2). Thermal analyses showed that the time interval during which the containment air temperature exceeded the containment design temperature was short enough that the equipment surface temperatures remained below the design temperature. Therefore, it is concluded that the calculated transient containment air temperature is acceptable for the DBA SLB and LOCA.

The temperature limit is also used in the depressurization analyses to ensure that the minimum pressure limit is maintained following an inadvertent actuation of the Containment Spray System (Ref. 1).

The containment pressure transient is sensitive to the initial air mass in containment and, therefore, to the initial containment air temperature. The temperature limit is used in this analysis to ensure that in the event of an accident the maximum containment internal pressure will not be exceeded.

(continued)

HBRSEP Unit No. 2 B 3.6-30 Revision No. 34

IVSW System B 3.6.8 B 3.6 CONTAINMENT SYSTEMS B 3.6.8 Isolation Valve Seal Water (IVSW) System BASES BACKGROUND The Isolation Valve Seal Water (IVSW) System assures the effectiveness of certain containment isolation valves during any condition which requires containment isolation, by providing a water seal at the valves. These valves are located in lines that are connected to the Reactor Coolant System (RCS), or that could be exposed to the containment atmosphere in the event of a loss of coolant accident (LOCA). The system provides a reliable means for injecting seal water between the seats and stem packing of the globe and double disc types of isolation valves, and into the piping between other closed isolation valves. The system provides assurance that, should an accident occur, the containment leak rate is no greater than that assumed in the accident analysis by providing seal water at a pressure

! 1.1 times Pa. The system is designed to maintain this seal for at least 30 days. The possibility of leakage from the containment or RCS past the first isolation point is thereby prevented by assuring that if leakage does exist, it will be from the IVSW System into containment.

The system includes one 175 gallon seal water tank capable of supplying the total requirements of the system. The IVSW tank's required volume is maintained and the tank is pressurized with nitrogen. The normal supply of makeup water to the IVSW tank is the Primary Water System. In the event Primary Water is not available, emergency makeup can be supplied from the Service Water System. The Plant Nitrogen System provides the normal supply of nitrogen to the IVSW tank. An automatic backup supply is provided from two dedicated high pressure nitrogen bottles (Ref. 1).

The system is normally in a static condition with the seal water injection tank filled and pressurized. Indication of IVSW tank level and pressure along with corresponding low level and low pressure alarms are provided in the Control Room. The tank supplies pressurized water to four distribution headers. Header "A" requires manual operation and serves lines that are normally filled with fluid following a LOCA, and lines that must remain in service for (continued)

HBRSEP Unit No. 2 B 3.6-49 Revision No. 34

2-a IVSW System B 3.6.8 BASES ACTIONS B.1 and B.2 (continued)

If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought, to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems SURVEILLANCE SR 3.6.8.1 REQUIREMENTS This SR verifies the IVSW tank has the necessary pressure to provide motive force to the seal water. A pressure Ž 46.2 psig ensures the containment penetration flowpaths that are sealed by the IVSW System are maintained at a pressure which is at least 1.1 times the calculated peak containment internal pressure (Pa) related to the design bases accident.

Verification of the IVSW tank pressure on a Frequency of once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is acceptable. This Frequency is sufficient to ensure availability of IVSW. Operating experience has shown this Frequency to be appropriate for early detection and correction of off normal trends.

SR 3.6.8.2 This SR verifies the IVSW tank has an initial volume of water necessary to provide seal water to the containment isolation valves served by the IVSW System. An initial volume

85 gallons ensures the IVSW System contains the proper inventory to maintain the required seal.

Verification of IVSW tank level on a Frequency of-once per 31 days is acceptable since tank level is continuously monitored by installed instrumentation and will alarm in the control room prior to level decreasing to 85 gallons.

SR 3.6.8.3 This SR verifies the stroke time of each automatic air operated header injection solenoid valve is within limits.

The frequency is specified by the Inservice Testing (continued)

HBRSEP Unit No. 2 B 3.6-52 Revision No. 34

PAM Instrumentation B 3.3.3 BASES LCO 9. Containment Isolation Valve Position (continued) active CIV, Note (b) requires a single channel of valve position indication to be OPERABLE.

This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve, as applicable, and prior knowledge of a passive valve, or via system boundary status. If a normally active CIV is known to be closed and deactivated, position indication is not needed-to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE. Note (a) to the Required Channels states that the Function is not required for isolation valves whose associated penetration is isolated by at least one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured.

10. Containment Area Radiation (High Range)

Containment Area Radiation is provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans.

Containment radiation level is used to determine the type of high energy line break (HELB) that has occurred inside containment.

11. Not Used

12. Pressurizer Level Pressurizer Level is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped. Knowledge of pressurizer (continued)

HBRSEP Unit No. 2 B 3.3-98 Revision No. 35

PAM Instrumentation B 3.3.3 BASES ACTIONS C.1 (continued)

Condition C applies when one or more Functions have two inoperable required channels (i.e., two channels inoperable in the same Function). Required Action C.1 requires restoring one channel in the Function(s) to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.

D.1 Condition D applies when one or more Functions, which have single, non-redundant position indication channels, have one required channel inoperable. Required Action D.1 requires that channel be restored to OPERABLE status within 7 days.

The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with the required position indication channel inoperable is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of the inoperable channel limits the risk that the PAM Function will be in a degraded condition should an accident occur. Condition D is modified by a Note that excludes PAM Functions that have two or more required channels.

Condition A provides appropriate Required Actions for PAM Functions that have two or more channels with one channel inoperable.

(continued)

HBRSEP Unit No. 2 B 3.3-104 Revision No. 35

PAM Instrumentation B 3.3.3 BASES ACTIONS E.1 (continued)

Condition E applies when the Required Action and associated Completion Time of Condition C or D are not met. Required Action E.1 requires entering the appropriate Condition referenced in Table 3.3.3-1 for the channel immediately.

The applicable Condition referenced in the Table is Function dependent. Each time an inoperable channel has not met any Required Action of Condition C or D, and the associated Completion Time has expired, Condition E is entered for that channel and provides for transfer to the appropriate subsequent Condition.

F.1 and F.2 If the Required Action and associated Completion Time of Conditions C or D are not met and Table 3.3.3-1 directs entry into Condition F, the unit must be brought to a MODE where the requirements of this LCO do not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

HBRSEP Unit No. 2 B 3.3-105 Revision No. 35

PAM Instrumentation B 3.3.3 BASES ACTIONS G.1 (continued)

Condition G applies to the Containment Sump Water Level, Containment Pressure, Containment Area Radiation, Auxiliary Feedwater Flow, PORV Position, PORV Block Valve Position, and Safety Valve Position Functions, which have alternate monitoring means available for use. These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. If these alternate means are used, the Required Action is not to shut down the unit but rather to follow the directions of Specification 5.6.6, in the Administrative Controls section of the TS. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.

SURVEILLANCE A Note has been added to the SR Table to clarify that REQUIREMENTS SR 3.3.3.1 and SR 3.3.3.2 apply to each PAM instrumentation Function in Table 3.3.3-1; except Function 9, Containment Isolation Valve Position; Function 22, PORV Position (Primary); Function 23, PORV Block Valve Position (Primary);

and Function 24, Safety Valve Position (Primary).

SR 3.3.3.3 applies only to Functions 9, 22, 23, and 24.

SR 3.3.3.1 Performance of the CHANNEL CHECK once every 31 days ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation (continued)

HBRSEP Unit No. 2 B 3.3-106 Revision No. 35

RNP-RA/07-0108, Transmittal of Technical Specifications Bases Revisions

Text

Navigation menu

RNP-RA/07-0108, Transmittal of Technical Specifications Bases Revisions

Text

Navigation menu

Search