Text

Union Electric Co. Technical Specification Bases Revision 5
	ML043580288
Person / Time
Site:	Callaway
Issue date:	12/10/2004
From:	Keith Young; AmerenUE
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	ULNRC-05101
	Download: ML043580288 (220)
	v • d • e

Union Electric One Ameren Plaza 1901 Chouteau Avenue PO Box 66149 St. Louis, AlO 63166-6149 314.621.322 December 10, 2004 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Stop PI-] 37 Washington, DC 20555-0001 Ladies and Gentlemen: ULNRC-05101 wAmeren UE DOCKET NUMBER 50-483 CALLAWAY PLANT UNIT 1 UNION ELECTRIC CO.

TECHNICAL SPECIFICATION BASES REVISION 5 Furnished herewith is the signed original and 10 copies of Revision 5 to the Callaway Plant Technical Specification Bases (TSB) in accordance with 10CFR50.4(b)(6).

Pursuant to IOCFR50.71(e), the TSB has been revised to include all the changes made to the plant since our revision 4 issued May 30, 2003.

If there are any questions, please contact us.

Very truly yours, ManageD . YoRy Manager - Regulatory Affairs BFH/jdg

Enclosure:

Directions for Replacement Pages Revision 4 to Callaway Plant TSB Of Aloi 01et

i. etle a subsidiary of Ameren Corporation

ULNRC-05101 December 10, 2004 Page 2 STATE OF MISSOURI

) SS CALLAWAY COUNTY Keith D. Young of lawful age, being first duly sworn upon oath says that he is Manager - Regulatory Affairs, for Union Electric Company; that he has read the foregoing document and knows the content thereof, that he has executed the same for and on behalf of said company with full power and authority to do so; and that the facts therein stated are true and correct to the best of his knowledge, information and belief.

By AL qCW

_, KeitU. Yodd Manager, Regulatory Affairs SUBSCRIBED and sworn to before me this l day of O8P~rbar 2004 ,

LORI L.TWIILLMAN Notary-Public - Notary Seal STATE OF MISSOURI Callaway County My Commission Expires: Aug. 3,2007 dtj~L JuJLLPThtM0fnj)

ULNRC-05101 December 10, 2004 Page 3 cc: U.S. Nuclear Regulatory Commission (Original and 10 copies)

Attn: Document Control Desk Mail Stop P1-137 Washington, DC 20555-0001 Mr. Bruce S. Mallett Regional Administrator U.S. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011-4005 Senior Resident Inspector Callaway Resident Office U.S. Nuclear Regulatory Commission 8201 NRC Road Steedman, MO 65077 Mr. Jack N. Donohew (2 copies)

Licensing Project Manager, Callaway Plant Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop 7E1 Washington, DC 20555-2738 Missouri Public Service Commission Governor Office Building 200 Madison Street PO Box 360 Jefferson City, MO 65102-0360

December 10, 2004 DIRECTIONS FOR INSERTING REVISION 5 TO TS BASES REMOVE INSERT Chapter 3.1 Bases (Continued)

B 3.1.8-6, Revision 4a B 3.1.8-6, Revision 5 B 3.1.8-7, Revision 4a B 3.1.8-7, Revision 5 B 3.1.8-8, Revision 4a B 3.1.8-8, Revision 5 Chanter 3.3 Bases B 3.3.1-3, Revision 0 B 3.3.1-3, Revision 0 B 3.3.1-4, Revision 4c B 3.3.1-4, Revision 5 B 3.3.1-5, Revision 4c B 3.3.1-5, Revision 5 B 3.3.1-6, Revision 4c B 3.3.1-6, Revision 5 B 3.3.1-7, Revision 4c B 3.3.1-7, Revision 5 B 3.3.1-8, Revision 4c B 3.3.1-8, Revision 5 B 3.3.1-9, Revision 4c B 3.3.1-9, Revision 5 B 3.3.1-10, Revision 4c B 3.3.1-1 0, Revision 5 B 3.3.1-11, Revision 4c B 3.3.1-11, Revision 5 B 3.3.1-12, Revision 4c B 3.3.1-12, Revision 5 B 3.3.1-13, Revision 4c B 3.3.1-13, Revision 5 B 3.3.1-14, Revision 4c B 3.3.1-14, Revision 5 B 3.3.1-15, Revision 4c B 3.3.1-15, Revision 5 B 3.3.1-16, Revision 4c B 3.3.1-16, Revision 5 B 3.3.1-17, Revision 4c B 3.3.1-17, Revision 5 B 3.3.1-1 8, Revision 4c B 3.3.1-1 8, Revision 5 B 3.3.1-19, Revision 4c B 3.3.1-19, Revision 5 B 3.3.1-20, Revision 4c B 3.3.1-20, Revision 5 B 3.3.1-21, Revision 4c B 3.3.1-21, Revision 5 B 3.3.1-22, Revision 4c B 3.3.1-22, Revision 5 B 3.3.1-23, Revision 4c B 3.3.1-23, Revision 5 B 3.3.1-24, Revision 4c B 3.3.1-24, Revision 5 B 3.3.1-25, Revision 4c B 3.3.1-25, Revision 5 B 3.3.1-26, Revision 4c B 3.3.1-26, Revision 5 B 3.3.1-27, Revision 4c B 3.3.1-27, Revision 5 B 3.3.1-28, Revision 4c B 3.3.1-28, Revision 5 B 3.3.1-29, Revision 4c B 3.3.1-29, Revision 5 Page 2 of 8

A December 10, 2004 DIRECTIONS FOR INSERTING REVISION 5 TO TS BASES REMOVE INSERT Chapter 3.3 Bases (Continued)

B 3.3.1-30, Revision 4c B 3.3.1-30, Revision 5 B 3.3.1-31, Revision 4c B 3.3.1-31, Revision 5 B 3.3.1 -32, Revision 4c B 3.3.1-32, Revision 5 B 3.3.1-33, Revision 4c B 3.3.1-33, Revision 5 B 3.3.1-34, Revision 4c B 3.3.1-34, Revision 5 B 3.3.1-35, Revision 4c B 3.3.1-35, Revision 5 B 3.3.1-36, Revision 4c B 3.3.1-36, Revision 5 B 3.3.1-37, Revision 4c B 3.3.1-37, Revision 5 B 3.3.1-38, Revision 4c B 3.3.1-38, Revision 5 B 3.3.1-39, Revision 4c B 3.3.1-39, Revision 5 B 3.3.1-40, Revision 4c B 3.3.1-40, Revision 5 B 3.3.1-41, Revision 4c B 3.3.1-41, Revision 5 B 3.3.1-42, Revision 4c B 3.3.1-42, Revision 5 B 3.3.1-43, Revision 4c B 3.3.1-43, Revision 5 B 3.3.1-44, Revision 4c B 3.3.1-44, Revision 5 B 3.3.1-45, Revision 4c B 3.3.1-45, Revision 5 B 3.3.1-46, Revision 4c B 3.3.1-46, Revision 5 B 3.3.1-47, Revision 4c B 3.3.1-47, Revision 5 B 3.3.1-48, Revision 4c B 3.3.1-48, Revision 5 B 3.3.1-49, Revision 4c B 3.3.1-49, Revision 5 B 3.3.1-50, Revision 4c B 3.3.1-50, Revision 5 B 3.3.1-51, Revision 4c B 3.3.1-51, Revision 5 B 3.3.1-52, Revision 4c B 3.3.1-52, Revision 5 B 3.3.1-53, Revision 4c B 3.3.1-53, Revision 5 B 3.3.1-54, Revision 4c B 3.3.1-54, Revision 5 B 3.3.1-55, Revision 4c B 3.3.1-55, Revision 5 B 3.3.1-56, Revision 4c B 3.3.1-56, Revision 5 B 3.3.1-57, Revision 4c B 3.3.1-57, Revision 5 B 3.3.1-58, Revision 4c B 3.3.1-58, Revision 5 B 3.3.1-59, Revision 4c B 3.3.1-59, Revision 5 B 3.3.1-60, Revision 4c B 3.3.1-60, Revision 5 Page 3 of 8

December 10, 2004 DIRECTIONS FOR INSERTING REVISION 5 TO TS BASES REMOVE INSERT Chapter 3.3 Bases (Continued)

B 3.3.2-2, Revision 0 B 3.3.2-2, Revision 0 B 3.3.2-3, Revision 4c B 3.3.2-3, Revision 5 B 3.3.2-4, Revision 4c B 3.3.2-4, Revision 5 B 3.3.2-5, Revision 4c B 3.3.2-5, Revision 5 B 3.3.2-6, Revision 4c B 3.3.2-6, Revision 5 B 3.3.2-7, Revision 4c B 3.3.2-7, Revision 5 B 3.3.2-8, Revision 4c B 3.3.2-8, Revision 5 B 3.3.2-9, Revision 4c B 3.3.2-9, Revision 5 B 3.3.2-10, Revision 4c B 3.3.2-10, Revision 5 B 3.3.2-11, Revision 4c B 3.3.2-11, Revision 5 B 3.3.2-12, Revision 4c B 3.3.2-12, Revision 5 B 3.3.2-13, Revision 4c B 3.3.2-13, Revision 5 B 3.3.2-14, Revision 4c B 3.3.2-14, Revision 5 B 3.3.2-15, Revision 4c B 3.3.2-15, Revision 5 B 3.3.2-16, Revision 4c B 3.3.2-16, Revision 5 B 3.3.2-17, Revision 4c B 3.3.2-17, Revision 5 B 3.3.2-18, Revision 4c B 3.3.2-18, Revision 5 B 3.3.2-19, Revision 4c B 3.3.2-19, Revision 5 B 3.3.2-20, Revision 4c B 3.3.2-20, Revision 5 B 3.3.2-21, Revision 4c B 3.3.2-21, Revision 5 B 3.3.2-22, Revision 4c B 3.3.2-22, Revision 5 B 3.3.2-23, Revision 4c B 3.3.2-23, Revision 5 B 3.3.2-24, Revision 4c B 3.3.2-24, Revision 5 B 3.3.2-25, Revision 4c B 3.3.2-25, Revision 5 B 3.3.2-26, Revision 4c B 3.3.2-26, Revision 5 B 3.3.2-27, Revision 4c B 3.3.2-27, Revision 5 B 3.3.2-28, Revision 4c B 3.3.2-28, Revision 5 B 3.3.2-29, Revision 4c B 3.3.2-29, Revision 5 B 3.3.2-30, Revision 4c B 3.3.2-30, Revision 5 B 3.3.2-31, Revision 4c B 3.3.2-31, Revision 5 B 3.3.2-32, Revision 4c B 3.3.2-32, Revision 5 B 3.3.2-33, Revision 4c B 3.3.2-33, Revision 5 B 3.3.2-34, Revision 4c B 3.3.2-34, Revision 5 Page 4 of 8

December 10, 2004 DIRECTIONS FOR INSERTING REVISION 5 TO TS BASES REMOVE INSERT Chapter 3.3 Bases (Continued)

B 3.3.2-35, Revision 4c B 3.3.2-35, Revision 5 B 3.3.2-36, Revision 4c B 3.3.2-36, Revision 5 B 3.3.2-37, Revision 4c B 3.3.2-37, Revision 5 B 3.3.2-38, Revision 4c B 3.3.2-38, Revision 5 B 3.3.2-39, Revision 4c B 3.3.2-39, Revision 5 B 3.3.2-40, Revision 4c B 3.3.2-40, Revision 5 B 3.3.2-41, Revision 4c B 3.3.2-41, Revision 5 B 3.3.2-42, Revision 4c B 3.3.2-42, Revision 5 B 3.3.2-43, Revision 4c B 3.3.2-43, Revision 5 B 3.3.2-44, Revision 4c B 3.3.2-44, Revision 5 B 3.3.2-45, Revision 4c B 3.3.2-45, Revision 5 B 3.3.2-46, Revision 4c B 3.3.2-46, Revision 5 B 3.3.2-47, Revision 4c B 3.3.2-47, Revision 5 B 3.3.2-48, Revision 4c B 3.3.2-48, Revision 5 B 3.3.2-49, Revision 4c B 3.3.2-49, Revision 5 B 3.3.2-50, Revision 4c B 3.3.2-50, Revision 5 B 3.3.2-51, Revision 4c B 3.3.2-51, Revision 5 B 3.3.2-52, Revision 4c B 3.3.2-52, Revision 5 B 3.3.2-53, Revision 4c B 3.3.2-53, Revision 5 B 3.3.2-54, Revision 4c B 3.3.2-54, Revision 5 B 3.3.2-55, Revision 4c B 3.3.2-55, Revision 5 B 3.3.2-56, Revision 4c B 3.3.2-56, Revision 5 B 3.3.2-57, Revision 4c B 3.3.2-57, Revision 5 B 3.3.9-3, Revision 4b B 3.3.9-3, Revision 5 B 3.3.9-4, Revision 4b B 3.3.9-4, Revision 5 B 3.3.9-5, Revision 4b B 3.3.9-5, Revision 5 B 3.3.9-6, Revision 4b B 3.3.9-6, Revision 5 B 3.3.9-7, Revision 4b B 3.3.9-7, Revision 5 B 3.3.9-8, Revision 4b B 3.3.9-8, Revision 5 Page S of 8

December 10, 2004 DIRECTIONS FOR INSERTING REVISION 5 TO TS BASES REMOVE INSERT Chapter 3.4 Bases B 3.4.13-3, Revision 0 B 3.4.13-3, Revision 5 B 3.4.13-4, Revision 0 B 3.4.13-4, Revision 0 Chapter 3.5 Bases B 3.5.2-9, Revision 0 B 3.5.2-9, Revision 0 B 3.5.2-10, Revision 4d B 3.5.2-10, Revision 5 B 3.5.2-11, Revision 4d B 3.5.2-11, Revision 5 B 3.5.2-12, Revision 4d B 3.5.2-12, Revision 5 Chanter 3.6 Bases B 3.6.1-3, Revision 0 B 3.6.1-3, Revision 0 B 3.6.1-4, Revision 4h B 3.6.1-4, Revision 5 Chapter 3.7 Bases B 3.7.2-6, Revision 0 B 3.7.2-6, Revision 0 B 3.7.3-1, Revision 4h B 3.7.3-1, Revision 5 B 3.7.3-2, Revision 4h B 3.7.3-2, Revision 5 B 3.7.3-3, Revision 4h B 3.7.3-3, Revision 5 B 3.7.3-4, Revision 4h B 3.7.3-4, Revision 5 B 3.7.3-5, Revision 4h B 3.7.3-5, Revision 5 B 3.7.5-6, Revision 4e B 3.7.5-6, Revision 5 B 3.7.5-7, Revision 4e B 3.7.5-7, Revision 5 B 3.7.5-8, Revision 4e B 3.7.5-8, Revision 5 B 3.7.5-9, Revision 4h B 3.7.5-9, Revision 5 B 3.7.5-10, Revision 4h B 3.7.5-10, Revision 5 B 3.7.5-11, Revision 4h B 3.7.5-11, Revision 5 B 3.7.7-1, Revision 0 B 3.7.7-1, Revision 0 B 3.7.7-2, Revision 4f B 3.7.7-2, Revision 5 Page 6 of 8

December 10, 2004 DIRECTIONS FOR INSERTING REVISION 5 TO TS BASES REMOVE INSERT Chapter 3.7 Bases (Continued)

B 3.7.7-3, Revision 4f B 3.7.7-3, Revision 5 B 3.7.7-4, Revision I B 3.7.7-4, Revision 1 B 3.7.8-2, Revision 4f B 3.7.8-2, Revision 5 B 3.7.8-3, Revision 0 B 3.7.8-3, Revision 0 B 3.7.9-1, Revision 4i B 3.7.9-1, Revision 5 B 3.7.9-2, Revision 4i B 3.7.9-2, Revision 5 B 3.7.10-1, Revision 4f B 3.7.10-1, Revision 5 B 3.7.10-2, Revision 4f B 3.7.10-2, Revision 5 B 3.7.10-3, Revision 4f B 3.7.10-3, Revision 5 B 3.7.10-4, Revision 4f B 3.7.104, Revision 5 B 3.7.10-5, Revision 4f B 3.7.10-5, Revision 5 B 3.7.10-6, Revision 4f B 3.7.10-6, Revision 5 B 3.7.10-7, Revision 4f B 3.7.10-7, Revision 5 B 3.7.10-8, Revision 4f B 3.7.10-8, Revision 5 B 3.7.13-1, Revision 4 B 3.7.13-1, Revision 4 B 3.7.13-2, Revision 4g B 3.7.13-2, Revision 5 B 3.7.13-3, Revision 4 B 3.7.13-3, Revision 4 B 3.7.13-4, Revision 4g B 3.7.13-4, Revision 5 B 3.7.13-5, Revision 4g B 3.7.13-5, Revision 5 B 3.7.13-6, Revision 4 B 3.7.13-6, Revision 4 Chapter 3.8 Bases B 3.8.1-17, Revision 4 B 3.8.1-17, Revision 4 B 3.8.1-18, Revision 4i B 3.8.1-18, Revision 5 B 3.8.1-19, Revision 0 B 3.8.1-19, Revision 0 B 3.8.1-20, Revision 4i B 3.8.1-20, Revision 5 B 3.8.1-21, Revision 4i B 3.8.1-21, Revision 5 B 3.8.1-22, Revision 4i B 3.8.1-22, Revision 5 Page 7 of 8

December 10, 2004 DIRECTIONS FOR INSERTING REVISION 5 TO TS BASES REMOVE INSERT Chapter 3.8 Bases (Continued)

B 3.8.1-23, Revision 4i B 3.8.1-23, Revision 5 B 3.8.1-24, Revision 4i B 3.8.1-24, Revision 5 B 3.8.1-25, Revision 4i B 3.8.1-25, Revision 5 B 3.8.1-26, Revision 4i B 3.8.1-26, Revision 5 B 3.8.1-27, Revision 4i B 3.8.1-27, Revision 5 B 3.8.1-28, Revision 4i B 3.8.1-28, Revision 5 B 3.8.1-29, Revision 4i B 3.8.1-29, Revision 5 B 3.8.2-1, Revision 0 B 3.8.2-1, Revision 0 Chapter 3.9 Bases B 3.9.4-3, Revision 4 B 3.9.4-3, Revision 4 B 3.9.4-4, Revision 4f B 3.9.4-4, Revision 5 B 3.9.4-5, Revision 4f B 3.9.4-5, Revision 5 B 3.9.4-6, Revision 4 B 3.9.4-6, Revision 4 B 3.9.5-2, Revision 4g B 3.9.5-2, Revision 5 B 3.9.5-3, Revision 4g B 3.9.5-3, Revision 5 B 3.9.5-4, Revision 4g B 3.9.5-4, Revision 5 B 3.9.6-1, Revision 0 B 3.9.6-1, Revision 0 B 3.9.6-2, Revision 4g B 3.9.6-2, Revision 5 B 3.9.6-3, Revision 4g B 3.9.6-3, Revision 5 B 3.9.6-4, Revision 4g B 3.9.6-4, Revision 5 B 3.9.7-1, Revision 0 B 3.9.7-1, Revision 0 Page 8 of 8

' %, .1.

I-,:7. , . - -

, .X 4.

BASES t DEC N04 I .I LIST OF EFFECTIVE PAGES I,

I: UP1111M ... I I

- ItLULIVLU I Page No. Revision I Page No. -Revision Table of Contents Chapter 3.1 Bases (continued) 1 0 B 3.1.1-2 2 0 B 3.1.1-3 3 0 B 3.1.1-4 4 0 B 3.1.1-5 B 3.1.1-6 B 3.1.2-1 Chapter 2.0 Bases B 3.1.2-2 B 3.1.2-3 B 2.1.1-1 2 B 3.1.2-4 B 2.1.1-2 0 B 3.1.2-5 B 2.1.1-3 0 B 3.1.3-1 B 2.1.1-4 0 B 3.1.3-2 B 2.1.2-1 0 B 3.1.3-3 B 2.1.2-2 0 B 3.1.3-4 B 2.1.2-3 0 B 3.1.3-5 B 3.1.3-6 B 3.1.3-7 Chapter 3.0 Bases B 3.1.4-1 B 3.1.4-2 B 3.0-1 0 B 3.1.4-3 B 3.0-2 0 B 3.1.4-4 B 3.0-3 0 B 3.1.4-5 B 3.0-4 0 B 3.1.4-6 B 3.0-5 0 B 3.1 .4-7 B 3.0-6 0 B 3.1.4-8 B 3.0-7

0 B 3.1.4-9 B 3.0-8 0 B 3.1.5-1 B 3.0-9

0 B 3.1.5-2 B 3.0-10 0 B 3.1.5-3 B 3.0-11

3 B3.1.564 B 3.0-12 3 B 3.1.6-1 B 3.0-13 3 B 3.1.6-2 B 3.0-14 3 B 3.1.6-3 B 3.1.6-4 B 3.1.6-5 Chapter 3.1 Bases B 3.1.7-1 B 3.1.1-1 0 B 3.1.7-2 1 Revision 5 12/10/04

BASES LIST OF EFFECTIVE PAGES K>

Page No. Revision Page No. Revision Chapter 3.1 Bases Chapter 3.2 Bases (continued) (continued)

B 3.1.7-3 0 B 3.2.4-1 0 B 3.1.7-4 I B 3.2.4-2 0 B 3.1.7-5 1 B 3.2.4-3 0 B 3.1.7-6 I B 3.2.4-4 0 B 3.1.7-7 I B 3.2.4-5 0 B 3.1.8-1 5 B 3.2.4-6 0 B 3.1.8-2 5 B 3.2.4-7 0 B 3.1.8-3 0 B 3.1.8-4 5 B 3.1.8-5 5 Chapter 3.3 Bases B 3.1.8-6 5 B 3.1.8-7 5 B 3.3.1-1 B 3.1.8-8 5 B 3.3.1-2 B 3.3.1-3 B 3.3.1-4 7I-Chapter 3.2 Bases B 3.3.1-5 B 3.3.1-6 B 3.2.1-1 B 3.3.1-7 B 3.2.1-2 B 3.3.1-8 B 3.2.1-3 B 3.3.1-9 B 3.2.1-4 B 3.3.1-10 B 3.2.1-5 B 3.3.1-11 B 3.2.1-6 B 3.3.1-12 B 3.2.1-7 B 3.3.1-13 B 3.2.1-8 B 3.3.1-14 B 3.2.1-9 B 3.3.1-15 B 3.2.1-10 B 3.3.1-16 B 3.2.1-11 B 3.3.1-17 B 3.2.2-1 B 3.3.1-18 B 3.2.2-2 B 3.3.1-19 B 3.2.2-3 B 3.3.1-20 B 3.2.2-4 B 3.3.1-21 B 3.2.2-5 B 3.3.1-22 B 3.2.2-6 B 3.3.1-23 B 3.2.2-7 B 3.3.1-24 B 3.2.3-1 B 3.3.1-25.

B 3.2.3-2 B 3.3.1-26 ,f B 3.2.3-3 B 3.3.1-27 K>y 2 Revision 5 12f10/04

- BASES SEP LIST OF EFFECTIVE PAGES ~

Page No. Revision IPage No. Revision Chapter 3.3 Bases Chapter 3.3 Bases (continued) (continued)

B 3.3.1-28 5 B 3.3.2-3 5 B 3.3.1-29 5 B 3.3.2-4 5 B 3.3.1-30 5 B 3.3.2-5 '.5 B 3.3.1-31 .. 5 B 3.3.2-6 5 B 3.3.1-32 5 B 3.3.2-7 5 B 3.3.1-33 5 B 3.3.2-8 B 3.3.1-34 5 B 3.3.2-9 5 B 3.3.1-35 5 B 3.3.2-10 5 B 3.3.1-36 5 B 3.3.2-11 5 B 3.3.1-37 5 B 3.3.2-12 -5 B 3.3.1-38 5 B 3.3.2-13 5 B 3.3.1-39 5 B 3.3.2-14 5 B 3.3.1-40 . 5 B 3.3.2-15 5 B 3.3.1-41 5 B 3.3.2-16 5 B 3.3.1-42 S B 3.3.2-17 5 B 3.3.1-43 . 5 B 3.3.2-18 5 B 3.3.1-44 5 B 3.3.2-19 5 B 3.3.1-45 B 3.3.2-20 5 5 5 B 3.3.1-46 B 3.3.2-21 5 5 B 3.3.1-47 B 3.3.2-22 B 3.3.1-48 5 B 3.3.2-23 5 B 3.3.1-49 5 B 3.3.2-24 .5 B 3.3.1-50 5 B 3.3.2-25 5 B 3.3.1-51 5 B 3.3.2-26 5 B 3.3.1-52 5 B 3.3.2-27 5 B 3.3.1-53 5 B 3.3.2-28 5 B 3.3.1-54 .5 B 3.3.2-29 5 B 3.3.1-55 .5 B 3.3.2-30 5

. 5 * .5 B 3.3.1-56 B 3.3.2-31 B 3.3.1-57 ". 5 B 3.3.2-32

5 B 3.3.1-58 5 B 3.3.2-33 5 B 3.3.1-59 4 B 3.3.2-34 5 B.3.3.1-60 B 3.3.2-35 5 4

B.3.3.1-61 B 3.3.2-36 4

B.3.3.1-62 B 3.3.2-37 5

.4 B.3.3.1-63 B 3.3.2-38 .5 0

B 3.3.2-1 0 B 3.3.2-39 .5 B 3.3.2-2 B 3.3.2-40 5 3 Revision 5 12/10/04

BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.3 Bases Chapter 3.3 Bases (continued) (continued)

B 3.3.2-41 B 3.3.3-17 B 3.3.2-42 B 3.3.4-1 B 3.3.2-43 B 3.3.4-2 B 3.3.2-44 B 3.3.4-3 B 3.3.2-45 B 3.3.4-4 B 3.3.2-46 B 3.3.4-5 B 3.3.2-47 B 3.3.4-6 B 3.3.2-48 B 3.3.5-1 B 3.3.2-49 B 3.3.5-2 B 3.3.2-50 B 3.3.5-3 B 3.3.2-51 B 3.3.5-4 B 3.3.2-52 B 3.3.5-5 B 3.3.2-53 B 3.3.5-6 B 3.3.2-54 B 3.3.5-7 B 3.3.2-55 B 3.3.5-8 B 3.3.2-56 B 3.3.6-1 B 3.3.2-57 B 3.3.6-2 B 3.3.2-58 B 3.3.6-3 B 3.3.2-59 B 3.3.6-4 B 3.3.2-60 B 3.3.6-5 B 3.3.2-61 B 3.3.6-6 B 3.3.2-62 B 3.3.6-7 B 3.3.3-1 B 3.3.6-8 B 3.3.3-2 B 3.3.7-1 B 3.3.3-3 B 3.3.7-2 B 3.3.3-4 B 3.3.7-3 B 3.3.3-5 B 3.3.7-4 B 3.3.3-6 B 3.3.7-5 B 3.3.3-7 B 3.3.7-6 B 3.3.3-8 B 3.3.7-7 B 3.3.3-9 B 3.3.7-8 B 3.3.3-10 B 3.3.7-9 B 3.3.3-1 1 B 3.3.7-10 B 3.3.3-12 B 3.3.8-1 B 3.3.3-13 B 3.3.8-2 B 3.3.3-14 B 3.3.8-3 B 3.3.3-15 B 3.3.8-4 B 3.3.3-16 B 3.3.8-5 4 Revision 5 12/10104

I BASES t, s LIST OF EFFECTIVE PAGES Page No. I Revision - Page No. - Revision Chapter 3.3 Bases Chapter 3.4 Bases (continued) (continued)

B 3.3.8-6 4 B 3.4.6-1 0 B 3.3.8-7 0 B 3.4.6-2 3 B 3.3.9-1 3 B 3.4.6-3 3 B 3.3.9-2 3 B 3.4.6-4 3 B 3.3.9-3 5 B 3.4.6-5 3 B 3.3.9-4 5 B 3.4.7-1 0 B 3.3.9-5 5 B 3.4.7-2 0 B 3.3.9-6 5 B 3.4.7-3 3 B 3.3.9-7 5 B 3.4.7-4 3 B 3.3.9-8 5 B 3.4.7-5 3 B 3.4.8-1 0 B 3.4.8-2 3 Chapter 3.4 Bases B 3.4.8-3 3 B 3.4.8-4 3 B 3.4.1-1 0 B 3.4.9-1 0 B 3.4.1-2 0 B 3.4.9-2 3 B 3.4.1-3 0 B 3.4.9-3 *0 B 3.4.1-4 3 B 3.4.9-4 0 2.

B 3.4.1-5 0 B 3.4.10-1 B 3.4.2-1 B 3.4.10-2 2 B 3.4.2-2 2 B 3.4.10-3 I 0 B 3.4.2-3 .0 B 3.4.10-4 2 B 3.4.3-1 0 B 3.4.1 1-1 2 B 3.4.3-2 0 B 3.4.11-2 2 B 3.4.3-3 0 B 3.4.11-3 2 B 3.4.3-4 0 B 3.4.11-4 2 B 3.4.3-5 0 B 3.4.11-5 2 B 3.4.3-6 .0 B 3.4.11-6 2 B 3.4.3-7 0 B 3.4.11-7 2 B 3.4.4-1 0 B 3.4.11-8 2 B 3.4.4-2 0. B 3.4.12-1 0 B 3.4.4-3 0 B 3.4.12-2 0 B 3.4.5-1 0 B 3.4.12-3 0 B 3.4.5-2 0 B 3.4.12-4 0 B 3.4.5-3 j3 B 3.4.12-5 0 B 3.4.5-4 B 3.4.12-6 0 B 3.4.5-5 3 B 3.4.12-7 0 B 3.4.5-6 3 - B 3.4.12-8 2-0 5 Revision 5 12/10/04

I..

BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.4 Bases Chapter 3.5 Bases (continued) (continued)

B 3.4.12-9 B 3.5.1-5 B 3.4.12-10 B 3.5.1-6 B 3.4.12-11 B 3.5.1-7 B 3.4.12-12 B 3.5.1-8 B 3.4.12-13 B 3.5.2-1 B 3.4.13-1 B 3.5.2-2 B 3.4.13-2 B 3.5.2-3 B 3.4.13-3 B 3.5.2-4 B 3.4.13-4 B 3.5.2-5 B 3.4.13-5 B 3.5.2-6 B 3.4.13-6 B 3.5.2-7 B 3.4.14-1 B 3.5.2-8 B 3.4.14-2 B 3.5.2-9 B 3.4.14-3 B 3.5.2-10 B 3.4.14-4 B 3.5.2-11 B 3.4.14-5 B 3.5.2-12 K)

B 3.4.14-6 B 3.5.3-1 B 3.4.14-7 B 3.5.3-2 B 3.4.15-1 B 3.5.4-4 B 3.4.15-2 B 3.5.4-5 B 3.4.15-3 B 3.5.4-6 B 3.4.15-4 B 3.5.5-1 B 3.4.15-5 B 3.5.5-2 B 3.4.15-6 B 3.5.5-3 B 3.4.15-7 B 3.5.5-4 B 3.4.16-1 B 3.4.16-2 B 3.4.16-3 Chapter 3.6 Bases B 3.4.16-4 B 3.4.16-5 B 3.6.1-1 0 B 3.6.1-2 0 B 3.6.1-3 0 Chapter 3.5 Bases B 3.6.1-4 5 B 3.6.2-1 1 B 3.5.1-1 0 B 3.6.2-2 0 B 3.5.1-2 I 0 B 3.6.2-3 0 B 3.5.1-3 0 B 3.6.2-4 1 B 3.5.1-4 0 B 3.6.2-5 0 K) 6 Revision 5 12/10/04

- - BASES LIST OF EFFECTIVE PAGES Page No. -- Revision Page No. Revision Chapter 3.6 Bases Chapter 3.6 Bases (continued) (continued)

B 3.6.2-6 0 B 3.6.8-2 0 B 3.6.2-7 0 B 3.6.8-3 0 B 3.6.3-1 0 B 3.6.84 0 B 3.6.3-2 0 B 3.6.8-5 0 B 3.6.3-3 2 B 3.6.3-4 4 B 3.6.3-5 4 Chapter 3.7 Bases B 3.6.3-6 4 B 3.6.3-7 4 B 3.7.1-1 0 B 3.6.3-8 4 B 3.7.1-2 I B 3.6.3-9 0 B 3.7.1-3 B 3.6.3-10 B 3.7.1-4 0

B 3.6.3-1 1 B 3.7.1-5 I 0

B 3.6.3-12 B 3.7.2-1 0 0

B 3.6.3-13 B 3.7.2-2 0 0

B 3.6.3-14 B 3.7.2-3 0 0

B 3.6.4-1 B 3.7.2-4 0 0

B 3.6.4-2 B 3.7.2-5 0 0

B 3.6.4-3 B 3.7.2-6 0 0

B 3.6.5-1 B 3.7.3-1 0

B 3.6.5-2 B 3.7.3-2 5 0

B 3.6.5-3 B 3.7.3-3

5 0

B 3.6.5-4 B 3.7.3-4

5 0

B 3.6.6-1 B 3.7.3-5 5 B 3.6.6-2 0 B 3.7.4-1

I B 3.6.6-3 B 3.7.4-2 I 0

B 3.6.6-4 .. B 3.7.4-3 0 0

B 3.6.6-5 B 3.7.4-4 I B 3.6.6-6 0 B 3.7.4-5 B 3.6.6-7 0 : B 3.7.5-1 I B 3.6.6-8 B 3.7.5-2 0 B 3.6.6-9 1 B 3.7.5-3 Jo B 3.6.6-10 B 3.7.5-4 1 B 3.6.6-1 1 1 ! B 3.7.5-5 I B 3.6.7-1 I B 3.7.5-6 5 B 3.6.7-2 0 B 3.7.5-7 5 e.,

B 3.6.7-3 0 B 3.7.5-8 B 3.6.8-1 0 B 3.7.5-9 5 7 Revision 5 12/10/04

In BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.7 Bases Chapter 3.7 Bases (continued) (continued)

B 3.7.5-10 B 3.7.13-8 4 B 3.7.5-11 B 3.7.14-1 0 B 3.7.6-1 B 3.7.15-1 1 B 3.7.6-2 B 3.7.15-2 1 B 3.7.6-3 B 3.7.15-3 1 B 3.7.7-1 B 3.7.16-1 1 B 3.7.7-2 B 3.7.16-2 1 B 3.7.7-3 B 3.7.16-3 0 B 3.7.7-4 B 3.7.17-1 2 B 3.7.7-5 B 3.7.17-2 0 B 3.7.8-1 B 3.7.17-3 0 B 3.7.8-2 B 3.7.18-1 1 B 3.7.8-3 B 3.7.18-2 0 B 3.7.8-4 B 3.7.18-3 0 B 3.7.8-5 B 3.7.9-1 B 3.7.9-2 Chapter 3.8 Bases B 3.7.9-3 B 3.7.9-4 0 B3.8.1-1 B 3.7.10-1 5 B 3.8.1-2 B 3.7.10-2 5 B 3.8.1-3 B 3.7.10-3 5 B 3.8.1-4 B 3.7.10-4 5 B 3.8.1-5 B 3.7.10-5 5 B 3.8.1-6 B 3.7.10-6 5 B 3.8.1-7 B 3.7.10-7 5 B 3.8.1-8 B 3.7.10-8 5 B 3.8.1-9 B 3.7.11-1 1 B 3.8.1-10 B 3.7.11-2 0 B 3.8.1-11 B 3.7.11-3 1 B 3.8.1-12 B 3.7.12-1 0 B 3.8.1-13 B 3.7.13-1 4 B 3.8.1-14 B 3.7.13-2 5 B 3.8.1-15 B 3.7.13-3 4 B 3.8.1-16 B 3.7.13-4 5 B 3.8.1-17 B 3.7.13-5 5 B 3.8.1-18 B 3.7.13-6 4 B 3.8.1-19 B 3.7.13-7 4 B 3.8.1-20 8 Revision 5 12/10/04

BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.8 Bases Chapter 3.8 Bases (continued) (continued)

B 3.8.1-21 B 3.8.6-2 0 B 3.8.1-22 B 3.8.6-3 0 B 3.8.1-23 B 3.8.6-4 0 B 3.8.1-24 B 3.8.6-5 0 B 3.8.1-25 B 3.8.6-6 0 B 3.8.1-26 B 3.8.7-1 0 B 3.8.1-27 B 3.8.7-2 0 B 3.8.1-28 B 3.8.7-3 : 0 B 3.8.1-29 B 3.8.7-4 0 B 3.8.2-1 B 3.8.8-1 0 B 3.8.2-2 B 3.8.8-2 0 B 3.8.2-3 B 3.8.8-3 1 B 3.8.2-4 B 3.8.8-4 3 B 3.8.2-5 B 3.8.8-5 3 B 3.8.2-6 B 3.8.9-1 - 0 B 3.8.3-1 B 3.8.9-2 0 B 3.8.3-2 B 3.8.9-3 0 B 3.8.3-3 B 3.8.9-4 0 B 3.8.3-4 B 3.8.9-5 0 B 3.8.3-5 B 3.8.9-6 0 B 3.8.3-6 B 3.8.9-7 0 B 3.8.3-7 B 3.8.9-8 0 B 3.8.3-8 B 3.8.9-9 0 B 3.8.3-9 B 3.8.10-1 0 B 3.8.4-1 B 3.8.10-2 0 B 3.8.4-2 B 3.8.10-3 0 B 3.8.4-3 B 3.8.10-4 0 B 3.8.4-4 B 3.8.10-5 3 B 3.8.4-5 B 3.8.10-6 3 B 3.8.4-6 B 3.8.4-7 B 3.8.4-8 Chapter 3.9 Bases B 3.8.5-1 B 3.8.5-2 B 3.9.1-1 0 B 3.8.5-3 B 3.9.1-2 I B 3.8.5-4 B 3.9.1-3 3 B 3.8.5-5 B 3.9.1-4 3 B 3.8.6-1 B 3.9.2-3 0 9 Revision 5 12/10/04

In BASES LIST OF EFFECTIVE PAGES Page No. Revision Page No. Revision Chapter 3.9 Bases (continued)

B 3.9.3-1 1 B 3.9.3-2 3 B 3.9.3-3 3 B 3.9.3-4 3 B 3.9.4-1 4 B 3.9.4-2 4 B 3.9.4-3 4 B 3.9.4-4 5 B 3.9.4-5 5 B 3.9.4-6 4 B 3.9.4-7 4 B 3.9.4-8 4 B 3.9.5-1 0 B 3.9.5-2 5 B 3.9.5-3 5 B 3.9.5-4 5 B 3.9.6-1 0 B 3.9.6-2 5 B 3.9.6-3 5 B 3.9.6-4 5 B 3.9.7-1 0 B 3.9.7-2 0 B 3.9.7-3 0 10 Revision 5 12/10/04

SDM B 3.1.1 BASES

- APPLICABLE reactivity. As RCS temperature decreases, the severity of an' MSLB SAFETY decreases until the MODE 5 value is reached. The mostlirniting MSLB, ANALYSES with respect to potential fuel damage before a reactor trip occurs, is a (continued) guillotine break of a main steam line inside containment initiated at the end of core life with RCS Tavg equal to 5571F. The positive reactivity addition from the moderator temperature decrease will terminate when the affected SG boils dry, thus terminating RCS heat removal and cooldown. Following the MSLB, a post trip return to power may occur, however, no fuel damage occurs as a result of the post trip return to power, and THERMAL POWER does not violate the Safety Limit (SL) requirement of SL 2.1.1. Although the severity of an MSLB is reduced at lower RCS temperatures, e.g., in MODES 3 and 4, SDM requirements still apply to ensure that the limiting MSLB analyzed at the end of core life with RCS Tayg equal to 5570F remains bounding. In MODES 3 and 4 the required SDM with automatic safety injection (SI) capability blocked below P-11 is greater than the SDM required below P-11 with Si capability unblocked, to'ensure that an MSLB occurring at the analyzed conditions remains bounding, as described in Westinghouse NSAL-02-14 (Ref. 5).

In the boron dilution analysis, the required SDM defines the reactivity difference between an initial subcritical boron concentration and the corresponding critical boron concentration. These values, in conjunction with the configuration of the RCS and the assumed dilution flow rate, directly affect the results of the analysis. This event is most limiting at the beginning of core life, when critical boron concentrations are highest. The SDM must be adequate to allow sufficient time for the BDMS'to detect a flux multiplication greater than its setpoint and initiate valve swapover to prevent inadvertent criticality.

Depending on the system initial conditions and reactivity insertion rate, the uncontrolled rod withdrawal transient is terminated by either a high power level trip or a high pressurizer pressure trip. In all cases, power level, RCS pressure, linear heat rate, and the DNBR do not exceed allowable limits.

The startup of an inactive RCP is'administratively precluded in MODES 1 and 2. In MODE 3, the startup bf an inactive RCP can not result in a "cold water" criticality, even if the maximum difference in temperature exists between the SG and the core.. The maximum positive reactivity addition that can occur due to an inadvertent RCP start is less than half the minimum required SDM. Startup of an idle RCP cannot, therefore, produce a return to power from the hot standby condition.

The ejection of a control rod rapidly adds reactivity to the reactor core, causing both the core power level and heat flux to increase with

.* . corresponding increases in reactor coolant temperatures and pressure.

(continued)

CALLAWAY PLANT ;: B 3.1.1-3 Revision 5

in-SDM B 3.1.1

/7-BASES APPLICABLE The ejection of a rod also produces a time dependent redistribution of SAFETY core power. Depending on initial power level, this accident is terminated ANALYSES by the power range neutron flux - high or low reactor trip setpoint in the (continued) FSAR analyses.

SDM satisfies Criterion 2 of 10CFR50.36(c)(2)(ii). Even though it is not directly observed from the control room, SDM is considered an initial condition process variable because it is periodically monitored to ensure that the unit is operating within the bounds of accident analysis assumptions.

LCO SDM is a core design condition that can be ensured during operation through control rod positioning (control and shutdown banks) and through the soluble boron concentration.

The MSLB (Ref. 2) and the boron dilution (Ref. 3) accidents are the most limiting analyses that establish the SDM value of the LCO. For MSLB accidents, if the LCO is violated, there is a potential to exceed the DNBR limit and to exceed 10 CFR 100, "Reactor Site Criteria," limits (Ref. 4).

For the boron dilution accident, if the LCO is violated, the minimum required time assumed for operator action to terminate dilution may no longer be sufficient. The required SDM limits are specified in the COLR.

APPLICABILITY In MODE 2 with keff < 1.0 and in MODES 3, 4, and 5 the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses discussed above. In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, "Boron Concentration." In MODES 1 and 2, SDM is ensured by complying with LCO 3.1.5, "Shutdown Bank Insertion Limits," and LCO 3.1.6, "Control Bank Insertion Limits.'

The Applicability is modified by a Note stating that the transition from MODE 6 to MODE 5 is not permitted while LCO 3.1.1 is not met. This Note specifies an exception to LCO 3.0.4 and prohibits the transition when SDM limits are not met. This Note assures that the initial assumptions of a postulated boron dilution event in MODE 5 are met.

ACTIONS A.1 If the SDM requirements are not met, boration must be initiated promptly.

A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that boration will be continued until the SDM requirements are met.

(continued)

CALLAWAY PLANT B 3.1.1-4 Revision 5

SDM B 3.1.1 BASES ACTIONS _. (continued)

In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Since it is imperative to raise the boron concentration of the RCS as soon as possible, the borated water source should be a highly concentrated solution, such as that normally found in the boric acid storage tanks, or the refueling water storage tank. The operator should borate with the best source available for the plant conditions.

SURVEILLANCE SR 3.1.1.1 REQUIREMENTS In MODES I and 2, SDM is verified by observing that the requirements of LCO 3.1.5 and LCO 3.1.6 are met. In the event that a rod is known to be untrippable, however,'SDM verification must account for the worth of the untrippable rod as well as another rod of maximum worth.

In MODES 2 (with kHrr < 1.0), 3, 4, and 5, the SDM is verified by performing a reactivity balance calculation, considering the listed reactivity effects:

a. RCS boron concentration (may include allowances for boron-10 depletion);

b. Control and shutdown rod position;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;

e. Xenon concentration;

f. Samarium concentration; and

9. Isothermal temperature coefficient (ITC).

Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS.

(continued)

CALLAWAY PLANT B 3.1.1-5 Revision 0

in SDM B 3.1.1 BASES SURVEILLANCE SR 3.1.1.1 (continued)

REQUIREMENTS In the event that a rod is known to be untrippable and not fully inserted, SDM verification must account for the worth of the untrippable rod as well as another rod of maximum worth.

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the generally slow change in required boron concentration and the low probability of an accident occurring without the required SDM. This allows time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the calculation.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. FSAR, Chapter 15, Section 15.1.5.

3. FSAR, Chapter 15, Section 15.4.6.

4. 10 CFR 100.

5. Westinghouse NSAL-02-14.

CALLAWAY PLANT B 3.1.1-6 Revision 5

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.8 PHYSICS TESTS Exceptions MODE 2 BASES BACKGROUND The primary purpose of the MODE 2 PHYSICS TESTS exceptions is to permit relaxations of existing LCOs to allow certain PHYSICS TESTS to be performed.

Section Xl of 10 CFR 50, Appendix B (Ref. 1), requires that a test program be established to ensure that structures, systems, and components will perform satisfactorily in service. All functions necessary to ensure that the specified design conditions are not exceeded during normal operation and anticipated operational occurrences must be tested.

This testing is an integral part of the design, construction, and operation of the plant. Requirements for notification of the NRC, for the purpose of conducting tests and experiments, are specified in 10 CFR 50.59 (Ref. 2).

The key objectives of a test program are to (Ref. 3):

a. Ensure that the facility has been adequately designed;

b. Validate the analytical models used in the design and analysis;

c. Verify the assumptions used to predict unit response;

d. Ensure that installation of equipment in the facility has been accomplished in accordance with the design; and

e. Verify that the operating and emergency procedures are adequate. . -

To accomplish these objectives, testing is performed prior to initial criticality, during startup, during low power operations, during power ascension, at high power, and after each refueling. The PHYSICS TESTS requirements for reload fuel cycles ensure that the operating characteristics of the core are consistent with the design predictions and that the core can be operated as designed. l PHYSICS TESTS procedures are written and approved in accordance

-.with established formats. The procedures include all information necessary to permit a detailed execution of the testing required to ensure that the design intent is met. PHYSICS TESTS are performed in accordance with these procedures and test results are approved prior to continued power escalation and long term power operation.

(continued)

CALLAWAY PLANT I.- B 3.1.8-1 Revision 5

i in PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES K BACKGROUND The PHYSICS TESTS typically required for reload fuel cycles in (continued) MODE 2 include:

a. Critical Boron Concentration - Control Rods Withdrawn;

b. Critical Boron Concentration - Control Rods Inserted;

c. Control Rod Worth; and

d. Isothermal Temperature Coefficient (ITC).

These and other supplementary tests may be required to calibrate the nuclear instrumentation or to diagnose operational problems. These tests may cause the operating controls and process variables to deviate from their LCO requirements during their performance.

a. The Critical Boron Concentration - Control Rods Withdrawn Test measures the critical boron concentration at hot zero power (HZP). With all rods out, the lead control bank is at or near its fully withdrawn position. HZP is where the core is critical (ken = 1.0),

and the Reactor Coolant System (RCS) is at design temperature and pressure for zero power. Performance of this test should not violate any of the referenced LCOs. K

b. The Critical Boron Concentration - Control Rods Inserted Test measures the critical boron concentration at HZP, with a bank having a worth of at least 1% Ak/k at or near its fully inserted position in the core. With the core at HZP and all banks fully withdrawn, the boron concentration of the reactor coolant is gradually lowered in a continuous manner. The selected bank is then inserted to make up for the decreasing boron concentration.

The boron concentration is then measured with the selected bank at or near its fully inserted position. This test may be performed concurrently with the Control Rod Worth Test described below.

Performance of this test could violate LCO 3.1.4, "Rod Group Alignment Limits"; LCO 3.1.5, "Shutdown Bank Insertion Limits";

or LCO 3.1.6, "Control Bank Insertion Limits."

c. The Control Rod Worth Test is used to measure the reactivity worth of selected banks. This test is performed at HZP and has four alternative methods of performance. The first method, the Boron Exchange Method, varies the reactor coolant boron concentration and moves the selected bank in response to the changing boron concentration. The reactivity changes are measured with a reactivity computer. This sequence is continued (continued)

CALLAWAY PLANT B 3.1 .8-2 'Revision 5

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES BACKGROUND for the remaining selected banks. The second method, the Rod (continued)* Swap Method,- measures the worth of a predetermined reference

bank using the Boron Exchange Method above. The reference bank is then nearly fully inserted into the core. The selected bank is then inserted into the core as the reference bank is withdrawn.

The HZP critical conditions are then determined with the selected bank fully inserted into the core. -The worth of the selected bank is inferred, based on the position of the reference bank with respect to the selected bank. This sequence is repeated as necessary for

-the remaining selected banks. The third method, the Boron Endpoint Method, moves the selected bank over its entire length of travel and then varies the reactor coolant boron concentration to achieve HZP criticality again. The difference in boron concentration is the worth of the selected bank. This sequence is repeated for the remaining selected banks. The fourth method, the Dynamic Rod Worth Measurement Method, fully inserts and withdraws the selected bank into the core while measuring reactivity changes with a reactivity computer. Since the reactor is not maintained critical while the selected bank is inserted, the measured reactivity is corrected based on design predictions to obtain the actual measured bank worth. The insertion and withdrawal sequence is repeated for each selected bank to obtain their worths. Performance of this test by any of the four methods could violate LCO 3.1.4, LCO 3.1.5, or LCO 3.1.6.

d. The ITC Test measures the ITC of the reactor. This test is performed at HZP and has two methods of performance. The first method, the Slope Method, varies RCS temperature in a slow and continuous manner. The reactivity change is measured with a reactivity computer as a function of the temperature change. The ITC is the slope of the reactivity versus the temperature plot. The test is repeated by reversing the direction of the temperature change, and the final ITC is the average of the two calculated ITCs. The second method, the Endpoint Method, changes the RCS temperature and measures the reactivity at the beginning and end of the temperature change. The ITC is the total reactivity change divided by the total temperature change. The test is repeated by reversing the direction of the temperature change, and the final ITC is the average of the two calculated ITCs.

Performance of this test could violate LCO 3.4.2, "RCS Minimum Temperature for Criticality."

APPLiCABLE The fuel is protected by LCOs that preserve the initial conditions of the SAFETY- core assumed during the safety analyses. The methods for development ANALYSES of the LCOs that are excepted by this LCO are described in the (continued)

CALLAWAY PLANT B 3.1.8-3 Revision 0

in PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES APPLICABLE Westinghouse Reload Safety Evaluation Methodology Report (Ref. 5).

SAFETY The above mentioned PHYSICS TESTS, and other tests that may be ANALYSES required to calibrate nuclear instrumentation or to diagnose operational (continued) problems, may require the operating control or process variables to deviate from their LCO limitations.

The FSAR defines requirements for initial testing of the facility, including PHYSICS TESTS. Section 14.2 summarizes the zero, low power, and power tests. Reload fuel cycle PHYSICS TESTS are performed in accordance with Technical Specification requirements, fuel vendor guidelines, and established industry practices. Although these PHYSICS TESTS are generally accomplished within the limits for all LCOs, conditions may occur when one or more LCOs must be suspended to make completion of PHYSICS TESTS possible or practical. This is acceptable as long as the fuel design criteria are not violated. When one or more of the requirements specified in LCO 3.1.3, "Moderator Temperature Coefficient (MTC)," LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and LCO 3.4.2 are suspended for PHYSICS TESTS, the fuel design criteria are preserved as long as the power level is limited to

5% RTP, the reactor coolant lowest operating loop temperature is kept > 541OF, and SDM is within the limits specified in the COLR.

The PHYSICS TESTS include measurement of core nuclear parameters K or the exercise of control components that affect process variables.

Among the process variables involved are MTC and RCS Average Temperature, which represent initial conditions of the unit safety analyses.

Also involved are the movable control components (control and shutdown rods), which are required to shut down the reactor. The limits for these variables are specified for each fuel cycle in the COLR. PHYSICS TESTS meet the criteria for inclusion in the Technical Specifications, since the components and process Variable LCOs suspended during PHYSICS TESTS meet Criteria 1, 2, and 3 of 10CFR50.36(c)(2)(ii).

Reference 6 allows special test exceptions (STEs) to be included as part of the LCO that they affect. It was decided, however, to retain this STE as a separate LCO because it was less cumbersome and provided additional clarity.

LCO This LCO allows the reactor parameters of MTC and minimum temperature for criticality to be outside their specified limits. In addition, it allows selected control and shutdown rods to be positioned outside of their specified alignment and insertion limits. One Power Range Neutron Flux channel may be bypassed, reducing the number of required channels from 4 to 3. Operation beyond specified limits is permitted for (continued)

CALLAWAY PLANT B 3.1 .8-4 Revision 5

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES LCO the purpose of performing PHYSICS TESTS and poses no threat to fuel (continued) integrity, provided the SRs are met.

The requirements of LCO 3.1.3, LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and LCO 3.4.2 may be suspended and the number of required channels for LCO 3.3.1, "RTS Instrumentation," Functions 2, 3, 6, and 18.e, may be reduced to 3 required channels during the performance of PHYSICS TESTS provided:

a. RCS lowest operating loop average temperature is 2 541OF;

b. SDM is within the limits specified in the COLR; and

c. THERMAL POWER is < 5% RTP.

APPLICABILITY This LCO is applicable in MODE 2 when performing low power PHYSICS TESTS. The applicable PHYSICS TESTS are performed in MODE 2 at HZP.

ACTIONS A.1 and A.2 If the SDM requirement is not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. The operator should begin boration with the best source available for the plant conditions. Boration will be continued until SDM is within limit.

Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification.

B.1 When THERMAL POWER is > 5% RTP, the only acceptable action is to open the reactor trip breakers (RTBs) to prevent operation of the reactor beyond its design limits. Immediately opening the RTBs will shut down the reactor and prevent operation of the reactor outside of its design limits.

C.1 When the RCS lowest operating loop Tame is < 5410F, the appropriate

- action is to restore To,, to within its specified limit. The allowed (continued)

CALLAWAY PLANT B 3.1.8-5 ARevision 5

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES Q ACTIONS CA (continued)

Completion Time of 15 minutes provides time for restoring Tasg to within limits without allowing the plant to remain in an unacceptable condition for an extended period of time. Operation with the reactor critical and with an operating loop's temperature below 541'F could violate the assumptions for accidents analyzed in the safety analyses.

D.I If the Required Actions cannot be completed within the associated Completion Time, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within an additional 15 minutes. The Completion Time of 15 additional minutes is reasonable, based on operating experience, for reaching MODE 3 in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.8.1 REQUIREMENTS The required power range and intermediate range channels must be OPERABLE in MODE 2 by LCO 3.3.1, "Reactor Trip System (RTS)

Instrumentation." A CHANNEL OPERATIONAL TEST is performed on each OPERABLE power range and intermediate range channel prior to initiation of the PHYSICS TESTS. This will ensure that the RTS is properly aligned to provide the required degree of core protection during the performance of the PHYSICS TESTS.

SR 3.1.8.2 Verification that the RCS lowest operating loop Tayg is 2 541°F will ensure that the unit is not operating in a condition that could invalidate the safety analyses. Verification of the RCS temperature at a Frequency of 30 minutes during the performance of the PHYSICS TESTS will ensure that the initial conditions of the safety analyses are not violated.

SR 3.1.8.3 Verification that the THERMAL POWER is

5% RTP will ensure that the plant is not operating in a condition that could invalidate the safety analyses. Verification of the THERMAL POWER at a Frequency of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months during the performance of the PHYSICS TESTS will ensure that the initial conditions of the safety analyses are not violated.

(continued)

CALLAWAY PLANT B 3.1.8-6 Revision 5

PHYSICS TESTS Exceptions - MODE 2 B3.1.8 BASES SURVEILLAN CE SR 3.1.8.4 .- -

REQUIREMEI FIT<:

,5 I, J . , -I - . .1 . .

(continued) Verification that the SDM is within limits specified in the COLR ensures that, for the specific RCCA and RCS temperature manipulations performed during PHYSICS TESTS, the plant is not operating in a manner that could invalidate the safety analysis assumptions During PHYSICS TESTS in which the requirements of LCOs 3.1.4, 3.1.5, and 3.1.6 are satisfied, the SDM surveillance consists of a verification that the rod insertion limits of LCOs 3.1.5 and 3.1.6 are met.

During PHYSICS TESTS in which the requirements of LCO 3.1.4, LCO 3.1.5, or LCO 3.1.6 are not met, the SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects:

a. RCS boron concentration (may include allowances for boron-10 depletion);

b. Control and shutdown rod position;

c. RCS average temperature;

d. Fuel bumup based on gross thermal energy generation;

e. Xenon concentration;

f. Samarium concentration; and

g. Isothermal temperature coefficient (ITC).

Using the ITC accounts for Doppler reactivity in this calculation when the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS.

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the generally slow change in required boron concentration and on the low probability of an accident occurring without the required SDM.

REFERENCES 1. 10 CFR 50, Appendix B, Section Xl.

2. 10 CFR 50.59.

3. Regulatory Guide 1.68, Revision 2,August, 1978.

4. Not Used.

(continued)

CALLAWAY PLANT :-B 3.1.8-7 Revision 5

in PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES REFERENCES 5. WCAP-9272-P-A, 'Westinghouse Reload Safety Evaluation (continued) Methodology Report," July 1985.

6. WCAP-11618, including Addendum 1,April 1989.

CALLAWAY PLANT B 3.1 .8-8 Revision 5

RTS Instrumentation B 3.3.1 BASES BACKGROUND Signal Process Control and Protection System (continued)

Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments. The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision evaluation. Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.

Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails, such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.

Generally, if a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy. The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Again, a single failure will neither cause nor prevent the protection function actuation.

These requirements are described in IEEE-279-1971 (Ref. 3). The actual number of channels required for each unit parameter is specified in Reference 1.

Two logic channels are required to ensure no single random failure of a logic channel will disable the RTS. The logic channels are designed such that testing required while the reactor is at power may be accomplished without causing trip.

(continued)

CALLAWAY PLANT .1 3.3.1-3 Revision 0

In RTS Instrumentation B 3.3.1 BASES BACKGROUND Trip Setpoints and Allowable Values (continued)

The Trip Setpoints are the nominal values at which the bistables are set.

Any bistable is considered to be properly adjusted when the "as left" value is within the two-sided tolerance band for calibration accuracy (typically 15 mV).

The Trip Setpoints listed in Table B 3.3.1-1 and used in the bistables are based on the analytical limits stated in Reference 2. The selection of these Trip Setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those RTS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 4), the Allowable Values specified in Table 3.3.1-1 in the accompanying LCO are conservatively adjusted with respect to the analytical limits. A detailed description of the methodology used to calculate the Trip Setpoints, including their explicit uncertainties, is provided in Reference 6. The actual nominal Trip Setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a COT. One example of such a change in measurement error is drift during the surveillance interval. If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERABLE.

Setpoints in accordance with the Allowable Value ensure that design limits are not violated during ACOs (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed).

Note that in the accompanying LCO 3.3.1, the Allowable Values of Table 3.3.1-1 are the LSSS.

Each channel of the process control equipment can be tested on line to verify that the signal or setpoint accuracy is within the specified allowance requirements. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SRs section.

The Allowable Values listed in Table 3.3.1-1 are based on the methodology described in Reference 6, and reviewed in support of Amendments 15, 43, 57, 84, 102, and 125, which incorporates all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each Trip Setpoint. All field sensors and signal processing equipment for these (continued)

CALLAWAY PLANT B 3.3.1-4 Revision 5

RTS Instrumentation B 3.3.1 BASES BACKGROUND Trip Setpoints and Allowable Values (continued) channels are assumed to operate within the allowances of these uncertainty magnitudes.

Solid State Protection System The SSPS equipment is used for the decision logic processing of outputs from the signal processing equipment bistables. To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide reactor trip and/or ESF actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result. Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements. The system has been designed to trip in the event of a loss of power, directing the unit to a safe shutdown condition.

The SSPS performs the decision logic for actuating a reactor trip or ESF actuation, generates the electrical output signal that will initiate the required trip or actuation, and provides the status, permissive, and annunciator output signals to the main control room of the unit.

The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various unit upset and accident transients. If a required logic matrix combination is completed, the system Will initiate a reactor trip or send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition. Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.

Reactor Trip Switchaear The RTBs are in the electrical power supply line from the control rod drive motor generator set power supply to the CRDMs. Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods and control rods to fall into the core by gravity. Each RTB is equipped with a bypass breaker-to allow testing of the RTB while the unit is at power.

During normal operation the output from the SSPS is a voltage signal that energizes the undervoltage coils in the RTBs and bypass breakers, if in use. When the required logic matrix combination is completed, the SSPS (continued)

CALLAWAY PLANT . i -- , B 3.3.1-5 -Revision 5

RTS Instrumentation B 3.3.1 BASES (continued)

BACKGROUND Reactor Trip Switchaear (continued) output voltage signal is removed, the undervoltage coils are de-energized, the breaker trip lever is actuated by the de-energized undervoltage coil, and the RTBs and bypass breakers are tripped open. This allows the shutdown rods and control rods to fall into the core. In addition to the de-energization of the undervoltage coils, each reactor trip breaker is also equipped with an automatic shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip signal from the SSPS. Either the undervoltage coil or the shunt trip mechanism is sufficient by itself, thus providing a diverse trip mechanism.

The decision logic matrix Functions are described in the functional diagrams included in Reference 1. In addition to the reactor trip or ESF, these diagrams also describe the various "permissive interlocks" that are associated with unit conditions.

Each train has a built in testing device that can test the decision logic matrix Functions and the actuation devices while the unit is at power.

When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed. The testing device is semiautomatic to minimize testing time.

APPLICABLE The RTS functions to maintain the applicable Safety Limits during all SAFETY ACOs and mitigates the consequences of DBAs in all MODES in which ANALYSES, the Rod Control System is capable of rod withdrawal or one or more rods LCO, AND are not fully inserted.

APPLICABILITY Each of the analyzed accidents and transients can be detected by one or more RTS Functions. The accident analysis described in Reference 2 takes credit for most RTS trip Functions. RTS trip Functions not specifically credited in the accident analysis are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These RTS trip Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. They may also serve as backups to RTS trip Functions that were credited in the accident analysis.

The LCO requires all instrumentation performing an RTS Function, listed in Table 3.3.1-1 in the accompanying LCO, to be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

(continued)

CALLAWAY PLANT B 3.3.1-6 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE The LCO generally requires OPERABILITY of three-or four channels in SAFETY each instrumentation Function, two channels of Manual Reactor Trip in ANALYSES, each logic Function, and two trains in each Automatic Trip Logic Function.

LCO, AND Four OPERABLE instrumentation channels in a two-out-of-four APPLICABITLITY configuration are required when one RTS channel is also used as a (continued) control system input. This configuration accounts for the possibility of the shared channel failing in such a manner that it creates a transient that requires RTS action. In this case, the RTS will still provide protection, even with a random failure of one of the other three protection channels.

Three operable instrumentation channels in a two-out-of-three configuration are generally required when there is no potential for control system and protection system interaction that could simultaneously create a need for RTS trip and disable one RTS channel. The two-out-of-three

' and two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing a reactor trip. In cases where an

'inoperable channel is placed in the tripped condition indefinitely to satisfy the Required Action of an LCO, the logic configurations are reduced to one-out-of-two and one-out-of-three where tripping of an additional channel, for any reason, would result in a reactor trip. To allow for surveillance testing or setpoint adjustment of other channels while in this condition, several Required Actions allow the inoperable channel to be bypassed. Bypassing the inoperable channel creates a two-out-of-two or two-out-of-three logic configuration allowing a channel to be tripped for testing without causing a reactor trip. Specific exceptions to the above general philosophy exist and are discussed below.

Reactor Trip Svstem Functions The safety analyses and OPERABILITY requirements applicable to each RTS Function are discussed below:

-1. Manual Reactor Trip The Manual Reactor Trip ensures that the control room operator can initiate a'reactor trip at any time by using either of two reactor trip switches in the control room. A Manual Reactor Trip accomplishes the same results as any one of the automatic trip Functions. It is used by the reactor operator to shut down the reactor whenever any parameter is rapidly trending toward its Trip Setpoint.

The LCO requires two Manual Reactor Trip channels to be OPERABLE. Each channel is controlled by a manual reactor trip switch. Each channel activates the reactor trip breaker in both trains. Two independent channels are required to be OPERABLE (continued)

CALLAWAY PLANT B 3.3.1-7 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE Manual Reactor Trip (continued)

SAFETY ANALYSES, so that no single random failure will disable the Manual Reactor LCO, AND Trip Function.

APPLICABILITY In MODE 1 or 2, manual initiation of a reactor trip must be OPERABLE. These are the MODES in which the shutdown rods and/or control rods are partially or fully withdrawn from the core.

In MODE 3, 4, or 5, the manual initiation Function must also be OPERABLE if one or more shutdown rods or control rods are withdrawn or the Rod Control System is capable of withdrawing the shutdown rods or the control rods. In this condition, inadvertent control rod withdrawal (automatic rod withdrawal is no longer available) is possible. In MODE 3, 4, or 5, manual initiation of a reactor trip does not have to be OPERABLE if the Rod Control System is not capable of withdrawing the shutdown rods or control rods and if all rods are fully inserted. If the rods cannot be withdrawn from the core and all of the rods are fully inserted, there is no need to be able to trip the reactor. In MODE 6, neither the shutdown rods nor the control rods are permitted to be withdrawn and the CRDMs are disconnected from the control rods and shutdown rods. Therefore, the manual initiation Function is not required.

2. Power Range Neutron Flux The NIS power range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS power range detectors provide input to the Rod Control System and the Steam Generator (SG) Water Level Control System.

Therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Note that this Function also provides a signal to prevent rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.

a. Power Range Neutron Flux - High The Power Range Neutron Flux - High trip Function ensures that protection is provided, from all power levels, against a positive reactivity excursion leading to DNB during power operations and will prevent fuel melting, providing protection for the safety limit on linear heat rate.

(continued)K'j CALLAWAY PLANT B 3.3.1-8 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE . a. Power Range Neutron Flux - High (continued)

SAFETY ANALYSES,- These excursions can be caused by rod withdrawal or LCO, AND reductions in RCS temperature.

APPLICABILITY The LCO requires all four of the Power Range Neutron Flux - High channels to be OPERABLE (two-out-of-four trip logic). The Trip Setpoint is*< 109% RTP.

In MODE I or 2, when a positive reactivity excursion could occur; the Power Range Neutron Flux - High trip must be OPERABLE. This Function will terminate the reactivity excursion and shut down the reactor prior to reaching a power level that could damage the fuel. In MODE 3, 4, 5, or 6, the NIS power range detectors cannot detect neutron

.,levels. In these MODES, the Power Range Neutron Flux -

High does not have to be OPERABLE because the reactor is shut down and reactivity excursions into the power range are extremely unlikely. Other RTS Functions and

-administrative controls provide protection against reactivity additions when in MODE 3, 4, 5, or 6.

b. Power Range Neutron Flux - Low The LCO requirement for the Power Range Neutron Flux -

Low trip Function ensures that protection is provided against a positive reactivity excursion from low power or subcritical conditions.

The LCO requires all four of the Power Range Neutron Flux - Low channels to be OPERABLE (two-out-of-four trip

-logic). The Trip Setpoint is

25% RTP.

-In MODE 1,-below the Power Range Neutron Flux (P-10 setpoint), and in MODE 2, the Power Range Neutron Flux -

Low trip must be OPERABLE. This Function may be

-- pmanually blocked by the operator when two out of four power range channels are greater than 1t0% RTP (P-1 0 setpoint). This Function is automatically unblocked when

-,three out of four power range channels are below the P-1 0

-setpoint. Above the P-10 setpoint, positive reactivity additions are mitigated by the Power Range Neutron Flux-High trip Function.

In MODE 3, 4, 5, or 6, the Power Range Neutron Flux -

Low trip Function does not have to be OPERABLE because the reactor is shut down and the NIS power range

- ~- - (continued)

CALLAWAY PLANT CALWYLN B 3.3.1-9 Revision 5

II RTS Instrumentation B 3.3.1 BASES APPLICABLE b. Power Range Neutron Flux - Low (continued)

SAFETY ANALYSES, detectors cannot detect neutron levels in this range. Other LCO, AND RTS trip Functions and administrative controls provide APPLICABILITY protection against positive reactivity additions or power excursions in MODE 3, 4, 5, or 6.

3. Power Range Neutron Flux Rate The Power Range Neutron Flux Rate trip uses the same channels as discussed for Function 2 above.

Power Range Neutron Flux - High Positive Rate The Power Range Neutron Flux - High Positive Rate trip Function ensures that protection is provided against rapid increases in neutron flux that are characteristic of an RCCA drive rod housing rupture and the accompanying ejection of the RCCA. This Function compliments the Power Range Neutron Flux - High and Low Setpoint trip Functions to ensure that the criteria are met for a rod ejection from the power range. This Function also provides protection for the rod withdrawal at power event.

The LCO requires all four of the Power Range Neutron Flux - High Positive Rate channels to be OPERABLE (two-out-of-four trip logic). The Trip Setpoint is

4.25% RTP with a time constant 2 2 seconds.

In MODE 1 or 2, when there is a potential to add a large amount of positive reactivity from a rod ejection accident (REA), the Power Range Neutron Flux- High Positive Rate trip must be OPERABLE.

In MODE 3, 4, 5, or 6, the Power Range Neutron Flux - High Positive Rate trip Function does not have to be OPERABLE because other RTS trip Functions and administrative controls will provide protection against positive reactivity additions. Also, since only the shutdown banks may be withdrawn in MODE'3, 4, or 5, the remaining complement of control bank worth ensures a sufficient degree of SDM in the event of an REA. In MODE 6, no rods are withdrawn and the SDM is increased during refueling operations. The reactor vessel head is also removed or the closure bolts are detensioned preventing any pressure buildup. In addition, the NIS power range detectors cannot detect neutron levels present in this mode.

(continued)

CALLAWAY PLANT B 3.3.1-10 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE 4. Intermediate Rance Neutron Flux SAFETY ANALYSES, The Intermediate Range Neutron Flux trip Function ensures that LCO, AND protection is provided against an uncontrolled RCCA bank rod APPLICABILITY withdrawal accident from a subcritical condition during'startup (continued) (automatic rod withdrawal is no longer available). This trip Function provides redundant protection to the Power Range Neutron Flux - Low Setpoint trip Function. The NIS intermediate range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS intermediate range detectors do not provide any input to control systems. Note that this Function also provides a signal to prevent rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.

The LCO requires two channels of Intermediate Range Neutron Flux to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function (one-out-of-two trip logic). The Trip Setpoint is

25% RTP.

Because this trip'Function is important only during startup, there is generally no need to disable channels for testing while the Function is required to be OPERABLE. Therefore, a third channel is unnecessary.

In MODE '1 below the P-10 setpoint, and in MODE 2 above the P-6 setpoint, when there is a potential for an uncontrolled RCCA bank rod withdrawal accident during reactor startup, the Intermediate Range Neutron Flux trip must be OPERABLE.

Above the P-10 setpoint, the Power Range Neutron Flux - High Setpoint trip and the Power Range Neutron Flux - High Positive Rate trip provide core protection for a rod withdrawal accident. In MODE 2 below the P-6 setpoint, the Source Range Neutron Flux trip Function provides core protection for reactivity accidents. In MODE 3, 4, or 5, the Intermediate Range Neutron Flux trip does not have to be OPERABLE because the control rods must be fully inserted and only the shutdown rods may be withdrawn. The reactor cannot be started up in this condition. The core also has the required SDM to mitigate the consequences of a positive reactivity addition accident. In MODE 6, all rods are fully inserted and the core has a required increased SDM. Also, the NIS intermediate range detectors cannot detect neutron levels present

-in this MODE.-;

CALLAWAY PLANT '. B 3.3.1 -1 I Revision 5

~in RTS Instrumentation B 3.3.1 BASES APPLICABLE 5. Source Ranae Neutron Flux SAFETY ANALYSES, The LCO requirement for the Source Range Neutron Flux trip LCO, AND Function ensures that protection is provided against an APPLICABILITY uncontrolled RCCA bank rod withdrawal accident from a (continued) subcritical condition during startup (automatic rod withdrawal is no longer available). This trip Function provides redundant protection to the Power Range Neutron Flux- Low and Intermediate Range Neutron Flux trip Functions. In MODES 3, 4, and 5, administrative controls also prevent the uncontrolled manual withdrawal of rods.

The NIS source range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS source range detectors do not provide any inputs to control systems. The source range trip is the only RTS automatic protection function required in MODES 3, 4, and 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. Therefore, the functional capability at the Trip Setpoint is assumed to be available.

The LCO requires two channels of Source Range Neutron Flux to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function. This Function uses one-out-of-two trip logic. The Trip Setpoint is S 1.0 E5 cps. The outputs of the Function to RTS logic are not required OPERABLE in MODE 6 or when all rods are fully inserted and the Rod Control System is incapable of rod withdrawal.

The Source Range Neutron Flux trip Function provides protection for control rod withdrawal from subcritical, boron dilution, and control rod ejection events.

In MODE 2 when below the P-6 setpoint, the Source Range Neutron Flux trip must be OPERABLE. Above the P-6 setpoint, the Intermediate Range Neutron Flux trip and the Power Range Neutron Flux- Low trip will provide core protection for reactivity accidents. Above the P-6 setpoint, the NIS source range neutron flux reactor trip may be manually blocked. When the source range trip is blocked, the high voltage to the detectors is also removed.

In MODES 3, 4, and 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted, the Source Range Neutron Flux trip Function must also be OPERABLE. If the Rod Control System is capable of rod withdrawal, the Source Range Neutron Flux trip must be OPERABLE to provide core protection against a rod withdrawal accident. If the Rod Control (continued)

CALLAWAY PLANT B 3.3.1-12 Revision 5

RTS Instrumentation B 3.3.1 BASE BASES APPLICABLE 5. Source Range Neutron Flux (continued)

SAFETY ANALYSES, System is not capable of rod withdrawal, the source range LCO, AND detectors are not required to trip the reactor. However, their APPLICABILITY monitoring Function must be OPERABLE to monitor core neutron levels and provide inputs to the BDMS as addressed in LCO 3.3.9,

,Boron Dilution Mitigation System (BDMS)," to protect against inadvertent reactivity changes that may occur as a result of events like an uncontrolled boron dilution. The requirements for the NIS source range detectors in MODE 6 are addressed in LCO 3.9.3, "Nuclear Instrumentation."

6. Overtemperature AT The Overtemperature AT trip Function is provided to ensure that the design limit DNBR is met. This trip Function also limits the range over which the Overpower AT trip Function must provide protection. The inputs to the Overtemperature AT trip include pressure, coolant temperature, axial power distribution, and reactor power as indicated by loop AT assuming full reactor coolant flow. Protection from violating the DNBR limit is assured for those transients that are slow with respect to delays from the core to the measurement system. The Overtemperature AT trip Function uses each loop's AT as a measure of reactor power and is compared with a setpoint that is automatically varied with the following parameters:

reactor coolant average temperature - the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature;

', , pressurizer pressure - the Trip Setpoint is varied to correct for changes in system pressure; and

.. axial power distribution f(AI) - the Trip Setpoint is varied to

- account for imbalances in the axial power distribution as

.'detected by the NIS upper and lower power range

-- detectors. If axial peaks are greater than the design limits, as indicated by the difference between the upper and lower

- NIS power range detectors, the Trip Setpoint is reduced.

Dynamic compensation is included for system piping delays from the core to the temperature measurement system.

ATO and T', as used in the Overtemperature AT trip, represent the 100% RTP values as measured by the plant for each loop. For (continued)

CALLAWAY PLANT . . . B 3.3.1-13 Revision 5

!U RTS Instrumentation B 3.3.1 BASES APPLICABLE 6. Overtemperature AT (continued)

SAFETY ANALYSES, the startup of a refueled core until reset to actual measured values LCO, AND (at 90-100% RTP), AT, is initially set at a value which is APPLICABILITY conservatively lower than the last measured 100% RTP ATO for.

each loop. Setting ATO and T' to the measured value of AT, and T' normalizes each loop's Overtemperature AT trip to the RCS loop conditions existing at the time of measurement, thus the trip reflects the equivalent full power conditions assumed for the OTAT trip in the accident analyses. These differences in vessel AT and Tavg can result from several factors, two of them being measured RCS loop flows greater than Minimum Measured Flow and asymmetric power distributions between quadrants. While RCS loop flows are not expected to change, radial power redistribution between quadrants may occur resulting in small changes in loop-specific vessel AT and Tavg values. Accurate determination of the loop-specific vessel AT and Ta.g values are made when performing the Incore/Excore quarterly recalibration under steady state conditions (i.e., power distributions not affected by xenon or other transient conditions).

The time constants used in the lag compensation of measured AT

('13 ) and measured Tavg (TO) are set at 0 seconds. This setting corresponds to the 7300 NLL card values used for lag compensation of these signals. Safety analyses that credit Overtemperature AT for protection must account for these field adjustable lag cards as well as all other first order lag contributions (i.e., the combined RTD/thermowell response time and the scoop transport delay and thermal lag). The safety analyses use a total first order lag of less than or equal to 6 seconds.

The Overtemperature AT trip Function is calculated for each loop as described in Note 1 of Table 3.3.1-1. Trip occurs if Overtemperature AT is indicated in two loops. The pressure and temperature signals are used for other control functions; thus, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Note that this Function also provides a signal to generate a turbine runback prior to reaching the Trip Setpoint. A turbine runback will reduce turbine power and reactor power, either through automatic rod insertion or through operator action. A reduction in power will normally alleviate the Overtemperature AT condition and may prevent a reactor trip.

(continued)

CALLAWAY PLANT B 3.3.1-14 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE 6. Overtemperature AT (continued)

SAFETY '

ANALYSES, The LCO requires all four channels of the Overtem perature AT trip LCO, AND Function to be OPERABLE (two-out-of-four trip logic). Note that APPLICABILITY the Overtemperature AT Function receives input from channels shared with other RTS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.

In MODE 1 or 2, the Overtemperature AT trip must be OPERABLE to prevent DNB. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about DNB.

7. OverpowerAT:.

The OverpowerAT trip Function ensures that protection is provided to ensure the integrity of the fuel (i.e., no fuel pellet melting and less than 1% cladding strain) under all possible overpower-conditions. This trip Function also limits the required range of the Overtemperature AT trip Function and provides a backup to the Power Range Neutron Flux - High Setpoint trip. The OverpowerAT trip Function ensures that the allowable heat generation rate (kWlft) of the fuel is not exceeded. The Overpower AT trip also provides protection to mitigate the consequences of small steamline breaks, as reported in Reference 11, and the decrease in feedwater temperature event (Ref. 13). It uses the AT of each loop as a measure of reactor power with a setpoint that is automatically varied with the following parameters:

-. reactor coolant average temperature - the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature; and -

- xrate of change of reactor coolant average temperature -

including dynamic compensation for the delays between the core and the temperature measurement system.

ATo and T',' as used in the Overpower AT trip, represent the 100%

RTP values as measured by the plant for each loop. For the

'startup of a-refueled core until reset to actual measured values (at

90-100% RTP)AT0 is initially set at a value which is conservatively lower than the last measured 100% RTP AT, for each loop. Setting AT, and T to the measured value of AT, and (continued)

CALLAWAY PLANT , - B 3.3.1-15 Revision 5

AL RTS Instrumentation B 3.3.1 BASES APPLICABLE 7. Overpower AT (continued)

SAFETY ANALYSES, T" normalizes each loop's OverpowerAT trip to the RCS loop LCO, AND conditions existing at the time of measurement, thus the trip APPLICABILITY reflects the equivalent full power conditions assumed for the OPAT trip in the accident analyses. These differences in vessel AT and Tavg can result from several factors, two of them being measured RCS loop flows greater than Minimum Measured Flow and asymmetric power distributions between quadrants. While RCS loop flows are not expected to change, radial power redistribution between quadrants may occur resulting in small changes in loop-specific vessel AT and Tavg values. Accurate determination of the loop-specific vessel AT and Tavg values are made when performing the Incore/Excore quarterly recalibration under steady state conditions (i.e., power distributions not affected by xenon or other transient conditions).

The time constants used in the lag compensation of measured AT (T3 ) and measured Tarvg (Te) are set at 0 seconds. This setting corresponds to the 7300 NLL card values used for lag compensation of these signals. Safety analyses that credit Overpower AT for protection must account for these field adjustable lag cards as well as all other first order lag contributions (i.e., the combined RTD/ thermowell response time and the scoop transport delay and thermal lag). The safety analyses use a total first order lag of less than or equal to 6 seconds.

The OverpowerAT trip Function is calculated for each loop as per Note 2 of Table 3.3.1-1. Trip occurs if Overpower AT is indicated in two loops. The actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the remaining channels providing the protection function actuation. Note that this Function also provides a signal to generate a turbine runback prior to reaching the Trip Setpoint. A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the OverpowerAT condition and may prevent a reactor trip.

The LCO requires four channels of the OverpowerAT trip Function to be OPERABLE (two-out-of-four trip logic). Note that the OverpowerAT trip Function receives input from channels shared with other RTS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions.

(continued)

CALLAWAY PLANT B 3.3.1-16 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE 7. -Oyerpower AT (continued)

SAFETY ANALYSES, In MODE 1or 2, the OverpowerAT trip Function must be LCO, AND OPERABLE.- These are the only times that enough heat is APPLICABILITY generated in the fuel to be concerned about the heat generation rates and overheating of the fuel. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about fuel overheating and fuel damage.

8. Pressurizer Pressure The same sensors provide input to the Pressurizer Pressure -

High and -'Low trips and the Overtemperature AT trip. The Pressurizer Pressure channels are also used to provide input to the Pressurizer.Pressure Control System; thus, the actuation logic must be able to withstand an input failure to the control system, which mayrthen require the protection function actuation, and a single failure in the other channels providing the protection function actuation.

- - a. Pressurizer Pressure - Low The Pressurizer Pressure - Low trip Function ensures that protection is provided against violating the DNBR limit due to low pressure.

The LCO requires four channels of Pressurizer Pressure -

Low to be OPERABLE (two-out-of-four trip logic). The Trip Setpoint is Ž 1885 psig.

In MODE 1, when DNB is a major concern, the Pressurizer

-Pressure -.Low trip must be OPERABLE. This trip Function is'automatically enabled on increasing power by

-the P-7 interlock (NIS power range P-1 0 or turbine impulse pressure greater than 10% of full power equivalent (P-13)).

-- - - ,-;On decreasing power, this trip Function is automatically blocked below.P-7. Below the P-7 setpoint, there is

- . insufficient heat production to generate DNB conditions.

.b. - Pressurizer Pressure - High The Pressurizer Pressure - High trip Function ensures that protection is provided against overpressurizing the RCS.

This trip Function operates in conjunction with the (continued)

CALLAWAY PLANT 1.B 3.3.1-17 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE b. Pressurizer Pressure - High (continued)

SAFETY ANALYSES, pressurizer PORVs and safety valves to prevent RCS LCO, AND overpressure conditions.

APPLICABILITY The LCO requires four channels of Pressurizer Pressure -

High to be OPERABLE (two-out-of-four trip logic). The Trip Setpoint is

2385 psig.

The Pressurizer Pressure - High Allowable Value is selected to be below the pressurizer safety valve actuation pressure and above the power operated relief valve (PORV) setting. This setting minimizes challenges to safety valves while avoiding unnecessary reactor trip for those pressure increases that can be controlled by the PORVs.

In MODE 1 or 2, the Pressurizer Pressure - High trip must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the PORVs and safety valves.

In MODE 3, 4, 5, or 6, the Pressurizer Pressure - High trip Function does not have to be OPERABLE because transients that could cause an overpressure condition will <9 be slow to occur. Therefore, the operator will have sufficient time to evaluate unit conditions and take corrective actions. Additionally, low temperature overpressure protection systems provide overpressure protection when the temperature of one or more RCS loops is below 2750F.

9. Pressurizer Water Level - High The Pressurizer Water Level - High trip Function provides a backup signal for the Pressurizer Pressure - High trip and also provides protection against water relief through the pressurizer safety valves. These valves are designed to pass steam in order to achieve their design energy removal rate. A reactor trip is actuated prior to the pressurizer becoming water solid. The LCO requires three channels of Pressurizer Water Level - High to be OPERABLE (two-out-of-three trip logic). The Trip Setpoint is

92% of instrument span. The pressurizer level channels are used as input to the Pressurizer Level Control System. A fourth channel is not required to address control/protection interaction concerns. The level channels do not actuate the safety valves, and the high pressure reactor trip is set below the safety valve setting. Therefore, with the slow rate of charging available, (continued)

CALLAWAY PLANT B 3.3.1-18 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE 9. PressurizerWater Level - High (continued)

SAFETY ANALYSES, -pressure overshoot due to level channel failure cannot cause the LCO, AND -safety valve to lift before reactor high pressure trip.

APPLICABILITY In MODE 1, when there is a potential for overfilling the pressurizer, the Pressurizer Water Level - High trip must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-7 interlock. On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, transients that could raise the pressurizer water level will be slow and the operator will have sufficient time to evaluate unit conditions and take corrective actions.

10. Reactor Coolant Flow - Low The Reactor Coolant Flow - Low trip Function ensures that protection is provided against violating the DNBR limit due to low flow in one or more RCS loops, while avoiding reactor trips due to normal variations in loop flow. Above the P-7 setpoint, the reactor trip on low flow in two or more RCS loops is automatically enabled. Above the P-8 setpoint, a loss of flow in any RCS loop will actuate a reactor trip. Each RCS loop has three flow detectors to monitor flow. The flow signals are not used for any control system input. -

The LCO requires three Reactor Coolant Flow - Low channels per loop to be OPERABLE in MODE 1 above P-7 (two-out-of-three trip logic). The Trip Setpoint is 2 90% of loop Minimum Measured Flow (MMF - 95,660 gpm).

In MODE 1 above the P-8 setpoint, a loss of flow in one RCS loop could result in DNB conditions in the core because of the higher power level. In MODE 1 below the P-8 setpoint and above the P-7 setpoint, a loss of flow in two or more loops is required to actuate

-a reactor trip because of the lower power level and the greater margin to the design limit DNBR. Below the P-7 setpoint, all reactor trips on low flow are automatically blocked since there is

- insufficient heat production to generate DNB conditions.

11. Not used. :

12. Undervoltape Reactor Coolant Pumps The Undervoltage RCP reactor trip Function ensures that protection is provided against violating the DNBR limit due to a (continued)

CALLAWAY PLANT . I 1 _'B 3.3.1-19 Revision 5

ll RTS Instrumentation B 3.3.1 BASES APPLICABLE 12. Undervoltape Reactor Coolant Pumps (continued)

SAFETY ANALYSES, loss of flow in two or more RCS loops. There is one potential LCO, AND transformer (PT), with a primary to secondary ratio of 14400:120, APPLICABILITY connected in parallel with the 13.8 kV power supply (PA system) to each RCP motor at the motor side of the supply breaker. Each PT secondary side is connected to an undervoltage relay and time delay relay, as well as a separate underfrequency relay. The undervoltage relays provide output signals to the SSPS which trips the reactor, if permissive P-7 issatisfied (i.e., greater than 10% of rated thermal power), when the voltage at one out of two RCP motors on both PA system buses drops below 10584 Vac (corresponding to 88.2 Vac at the undervoltage relay). The time delay relay prevents spurious trips caused by transient voltage perturbations. This trip Function will generate a reactor trip before the Reactor Coolant Flow - Low Trip Setpoint is reached.

The LCO requires two Undervoltage RCP channels per bus to be OPERABLE, a total of four channels. The Trip Setpoint is

Ž 10,584 Vac.

In MODE I above the P-7 setpoint, the Undervoltage RCP trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since the core is not producing sufficient power to generate DNB conditions. Above the P-7 setpoint, the reactor trip on Undervoltage-RCPs is automatically enabled.

13. Underfreauencv Reactor Coolant Pumps The Underfrequency RCP reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops from a major network frequency disturbance. An underfrequency condition will slow down the pumps, thereby reducing their coastdown time following a pump trip. An adequate coastdown time is required so that reactor heat can be removed immediately after reactor trip. There is one potential transformer (PT), with a primary to secondary ratio of 14400:120, connected in parallel with the 13.8 kV power supply (PA system) to each RCP motor at the motor side of the supply breaker. Each PT secondary side is connected to an undervoltage relay and time delay relay, as well as a separate underfrequency relay. The underfrequency relays provide output signals to the SSPS which trips the reactor, if permissive P-7 issatisfied (i.e.,

greater than 10% of rated thermal power), when the frequency at one out of two RCP motors on both PA system buses drops below (continued)

CALLAWAY PLANT B,3.3.1-20 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE 13.; Underfrequency Reactor Coolant Pumps (continued)

SAFETY ANALYSES, 57.2 Hz. The time delay set on the underfrequency relay prevents LCO, AND spurious trips caused by transient frequency perturbations. This APPLICABILITY trip Function will generate a reactor trip before the Reactor Coolant Flow - Low Trip Setpoint is reached.

The LCO requires two Underfrequency RCP channels per bus to be OPERABLE, a total of four channels. The Trip Setpoint is

-2 57.2 Hz.

In MODE 1 above the-P-7 setpoint, the Underfrequency RCP trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since the core is not producing sufficient power-to generate DNB conditions. Above the P-7 setpoint, the reactor trip on Underfrequency-RCPs is automatically enabled.

14. Steam Generator Water Level - Low Low The SG Water Level - Low Low trip Function ensures that protection is provided against a loss of heat sink and actuates the AFW System prior to uncovering the SG tubes. The SGs are the heat sink'for the reactor. In order to act as a heat sink, the SGs must contain a minimum amount of water. A narrow range low low level in any SG is indicative of a loss of heat sink for the reactor.

The level transmitters also provide input to the SG Level Control System. Therefore', the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other

- .channels providing the protection function actuation. This Function also performs the ESFAS function of starting the AFW

' pumps on low low SG level. As discussed in Reference 7, the SG Water.Level - Low Low trip function has been modified to allow a lower Trip Setpoint under normal containment environmental

-l conditions and a delayed trip when THERMAL POWER is less

- -than or equal to 22.41% RTP. The EAM/TTD circuitry reduces the potential for inadvertent trips via the Environmental Allowance Modifier, (EAM), enabled on containment pressure exceeding its setpoint, and the Trip Time Delay (TTD), enabling time delays dependent on vessel AT as listed in Table B 3.3.1-1. Because the SG Water Level transmitters (d/p cells) are located inside containment, they may experience adverse environmental conditions due to a feedline break. The EAM function is used to

-monitor-the presence of adverse containment conditions (elevated (continued)

CALLAWAY PLANT ;- B 3.3.1-21 .. ' Revision 5

.JM RTS Instrumentation B 3.3.1 BASES APPLICABLE 14. Steam Generator Water Level - Low Low (continued)

SAFETY ANALYSES, pressure) and enables the Steam Generator Water Level LCO, AND Low-Low (Adverse) trip setpoint to reflect the increased APPLICABILITY transmitter uncertainties due to this harsh environment. The EAM enables a lower Steam Generator Water Level - Low-Low (Normal) trip setpoint when these conditions are not present, thus allowing more margin to trip for normal operating conditions. The TTD delays reactor trip on SG Water Level Low-Low, thereby providing additional operational margin during early power ascension by allowing the operator time to recover level when the primary side load is sufficiently small to not require an earlier trip.

The TTD continuously monitors primary side power using Vessel AT. Scaling of the Vessel AT channels is dependent on the loop-specific values for AT., discussed under the OTAT and OPAT trips. Two time delays are provided, based on the primary side power level; the magnitude of the trip delay decreases with increasing power. If the EAM or TTD trip functions have inoperable required channels, it is acceptable to place the inoperable channels in the tripped condition and continue operation. Placing the inoperable channels in the trip mode enables the Steam Generator Water Level - Low-Low (Adverse) function, for the EAM, or removes the trip delay for the TTD. If the <)

Steam Generator Water Level - Low-Low (Normal) trip function has an inoperable required channel, the inoperable channel must be tripped, subject to the LCO Applicability footnote.

The LCO requires four channels of SG Water Level - Low Low per SG to be OPERABLE because these channels are shared between protection and control. All SG Water Level-Low Low reactor trip Functions use two-out-of-four logic. As with other protection functions, the single failure criterion applies. The Trip Setpoints for the SG Water Level Low-Low (Adverse Containment Environment) and (Normal Containment Environment) bistables are 2 27.0% and 2 21.6% of narrow range span, respectively. The Trip Setpoints for the Vessel AT (Power-1) and (Power-2) bistables are < Vessel AT Equivalent to 12.41% RTP and

Vessel AT Equivalent to 22.41% RTP, respectively, with corresponding trip time delays of

232 seconds and

122 seconds. The Trip Setpoint for the Containment Pressure - Environmental Allowance Modifier bistables is

1.5 psig.

In MODE 1 or 2, when the reactor requires a heat sink, the SG Water Level - Low Low trip must be OPERABLE. The SG Water Level Low-Low (Normal Containment Environment) channels do not provide protection when the Containment Pressure -

(continued)

CALLAWAY PLANT B 3.3.1-22 Revision 5

RTS Instrumentation B 3.3;1 BASES APPLICABLE 14. Steam Generator Water Level- Low Low (continued)

SAFETY ANALYSES, Environmental Allowance Modifier (EAM) channels in the same LCO, AND protection sets are tripped since that enables the SG Water Level APPLICABILITY Low-Low (Adverse Containment Environment) channels with a higher water level trip setpoint. As such, the SG Water Level Low-Low (Normal Containment Environment) channels need not be OPERABLE when the Containment Pressure - EAM channels in the same protection sets are tripped, as discussed in a footnote to Table 3.3.1-1. The normal source of water for the SGs is provided by the Main Feedwater (MFW) Pumps (not safety related). The MFW Pumps are only in operation in MODE I or2. TheAFW System is the safety-related source of water to ensure that the SGs remain the heat sink for the reactor. During normal startups and shutdowns the MFWV System orAFW System provides feedwater to maintain SG level. In MODE 3, 4, 5, or 6, the SG Water Level - Low Low Reactor Trip Function does not have to be OPERABLE because the reactor is not operating or even critical (see LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," for Applicability of SG Water Level -

Low Low ESFAS Functions).

15. Not used.

16; Turbine Trip I a. -Turbine Trip - Low Fluid Oil Pressure The Turbine Trip - Low Fluid Oil Pressure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip. This trip Function acts to minimize the pressure/temperature transient on the reactor. Any turbine trip from a power level below the P-9 setpoint, 50% power, will not actuate a reactor trip. Three pressure switches monitor the control oil pressure in the Turbine Electrohydraulic Control System. A low pressure condition sensed by two-out-of-three pressure switches will actuate a reactor trip. These pressure switches do not provide any input to

.the control .system. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure - High trip Function and RCS integrity is ensured by the pressurizer safety

-.valves... -

(continued)

.. CALLAWAY PLANT - , B 3.3.1-23 CL AP T332-:Revision 5

-iIn RTS Instrumentation B 3.3.1 BASES APPLICABLE a. Turbine Trip - Low Fluid Oil Pressure (continued)

SAFETY ANALYSES, The LCO requires three channels of Turbine Trip - Low LCO, AND Fluid Oil Pressure to be OPERABLE in MODE 1 above APPLICABILITY P-9. The Trip Setpoint is 2 598.94 psig.

Below the P-9 setpoint, a turbine trip does not actuate a reactor trip. In MODE 2, 3, 4, 5, or 6, there is no potential for a turbine trip, and the Turbine Trip - Low Fluid Oil Pressure trip Function does not need to be OPERABLE.

b. Turbine Trip - Turbine Stop Valve Closure The Turbine Trip - Turbine Stop Valve Closure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip. The trip Function anticipates the loss of secondary heat removal capability that occurs when the stop valves close. Tripping the reactor in anticipation of loss of secondary heat removal acts to minimize the pressure and temperature transient on the reactor. Any turbine trip from a power level below the P-9 setpoint, 50% power, will not actuate a reactor trip. This trip Function will not and is not required )

to operate in the presence of a single channel failure. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure - High trip Function, and RCS integrity is ensured by the pressurizer safety valves. This trip Function is diverse to the Turbine Trip - Low Fluid Oil Pressure trip Function. Each turbine stop valve is equipped with one limit switch that inputs to the RTS. If all four limit switches indicate that the stop valves are all closed, a reactor trip is initiated.

The Allowable Value for this Function is set to assure channel trip occurs when the associated stop valve is completely closed.

The LCO requires four Turbine Trip - Turbine Stop Valve Closure channels, one per valve, to be OPERABLE in MODE 1 above P-9. All four channels must trip to cause reactor trip. The Trip Setpoint is 2 1% open.

Below the P-9 setpoint, a load rejection can be accommodated by the Steam Dump and Reactor Control (continued)

CALLAWAY PLANT B 3.3.1-24 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE b. -Turbine Trip - Turbine Stop Valve Closure (continued)

SAFETY ANALYSES, Systems. In MODE 2, 3, 4, 5, or 6, there-is no potential for LCO, AND a load rejection, and the Turbine Trip - Turbine Stop Valve APPLICABILITY Closure trip Function does not need to be OPERABLE.

17. Safety Iniection Input from Engineered SafetV Feature Actuation Systemr The Si Input from ESFAS ensures that if a reactor trip has not already been generated by the RTS, the ESFAS automatic actuation logic will initiate a reactor trip upon any automatic signal

-that initiates SI. This is a condition of acceptability for the LOCA.

However, other transients and accidents take credit for varying levels of ESF performance and rely upon rod insertion, except for the most reactive rod that is assumed to be fully withdrawn, to ensure reactor shutdown. Therefore, a reactor trip is initiated every time an Si signal is present.

Trip Setpoint and Allowable Values are not applicable to this Function. The Si Input is provided by logic in the SSPS circuitry of ESFAS. Therefore, there is no measurement signal with which to associate an LSSS.

The LCO requires two trains of SI Input from ESFAS to be

- OPERABLE in MODE 1 or 2.

A reactor trip is initiated every time an Si signal is present.

Therefore,this trip Function must be OPERABLE in MODE 1 or 2, when the reactor is critical. In MODE 3, 4, 5, or 6, the reactor is not critical, and this trip Function does not need to be OPERABLE.

18. ReactorTrinp System Interlocks

.Reactor protection interlocks are provided to ensure reactor trips are in the correct configuration for the current unit status. They back up operator actions to ensure protection system Functions are not bypassed during unit conditions under which the safety analysis assumes the Functions are not bypassed. Therefore, the interlock Functions do not need to be OPERABLE when the associated reactor trip functions are outside the applicable (continued)

-CALLAWAY PLANT B 3.3.1-25 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE 18. Reactor Trip System Interlocks (continued)

SAFETY ANALYSES, MODES. These are:

LCO, AND APPLICABILITY a. Intermediate Range Neutron Flux, P-6 The Intermediate Range Neutron Flux, P-6 interlock is actuated when any NIS intermediate range channel goes approximately one decade above the minimum channel reading. If both channels drop below the setpoint, the permissive will automatically be defeated. The LCO requirement for the P-6 interlock ensures that the following Functions are performed:

on increasing power, the P-6 interlock allows the manual block of the NIS Source Range, Neutron Flux reactor trip. This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPERABLE prior to leaving the source range. When the source range trip is blocked, the high voltage to the detectors is also removed;

on decreasing power, the P-6 interlock automatically energizes the NIS source range detectors and enables the NIS Source Range Neutron Flux reactor trip; and

on increasing power, the P-6 interlock provides a backup block signal to the source range flux multiplication circuit. Normally, this Function is manually blocked by the control room operator during the reactor startup.

The LCO requires two channels of Intermediate Range Neutron Flux, P-6 interlock to be OPERABLE in MODE 2 when below the P-6 interlock setpoint (one-out-of-two trip logic). The Trip Setpoint is 2 1.0 E-10 amps.

Above the P-6 interlock setpoint, the NIS Source Range Neutron Flux reactor trip will be blocked, and this Function will no longer be necessary. In MODE 3, 4, 5, or 6, the P-6 interlock does not have to be OPERABLE because the NIS Source Range is providing core protection.

(continued)

CALLAWAY PLANT B 3.3.1-26 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE 18. Reactor Trip System Interlocks (continued).

SAFETY ANALYSES, b. Low Power Reactor Trips Block, P-7 LCO, AND APPLICABILITY The Low Power Reactor Trips Block, P-7 interlock is actuated by input from either the Power Range Neutron Flux, P-10, or the Turbine Impulse Chamber Pressure, P-1 3 interlock. The LCO requirement for the P-7 interlock ensures that the following Functions are performed:

1, .

(1) on increasing power, the P-7 interlock automatically enables reactor trips on the following Functions:

Pressurizer Pressure - Low;

Pressurizer Water Level - High;

- Reactor Coolant Flow - Low (low flow in two or more RCS loops);

Undervoltage RCPs; and

Underfrequency RCPs.

These reactor trips are only required when operating above the P-7 setpoint (10% power).

The reactor trips provide protection against violating the DNBR limit. Below the P-7 setpoint, the RCS is capable of providing sufficient natural circulation without any RCP running.

(2) on decreasing power, the P-7 interlock automatically blocks reactor trips on the following Functions:

Pressurizer Pressure - Low; Pressurizer Water Level - High;

Reactor Coolant Flow - Low (low flow in two I :. or more RCS loops);

Undervoltage RCPs; and

Underfrequency RCPs.

(continued)

CALLAWAY PLANT I B 3.3.1-27 IRevision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE b. Low Power Reactor Trips Block. P-7 (continued)

SAFETY ANALYSES, Allowable Values are not applicable to the P-7 interlock LCO, AND because it is a logic Function and thus has no parameter APPLICABILITY with which to associate an LSSS.

The P-7 interlock is a logic Function with train and not channel identity. Therefore, the LCO requires one channel per train of Low Power Reactor Trips Block, P-7 interlock to be OPERABLE in MODE 1.

The low power trips are blocked below the P-7 setpoint and unblocked above the P-7 setpoint. In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the interlock performs its Function when power level drops below 10% power, which is in MODE 1.

c. Power Range Neutron Flux. P-8 The Power Range Neutron Flux, P-8 interlock is actuated at 48% power as determined by two-out-of-four NIS power range detectors. The P-8 interlock automatically enables the Reactor Coolant Flow - Low reactor trip on low flow in one or more RCS loops on increasing power. The LCO requirement for this trip Function ensures that protection is provided against a loss of flow in any RCS loop that could result in DNB conditions in the core when greater than 48% power. On decreasing power, the reactor trip on low flow in any loop is automatically blocked (low flow in two or more loops will initiate a reactor trip above the P-7 interlock).

The LCO requires four channels of Power Range Neutron Flux, P-8 interlock to be OPERABLE in MODE 1 (two-out-of-four trip logic). The Trip Setpoint is

48% RTP.

In MODE 1, a loss of flow in one RCS loop could result in DNB conditions, so the Power Range Neutron Flux, P-8 interlock must be OPERABLE. In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the core is not producing sufficient power to be concerned about DNB conditions.

\ .(

(continued) -2 CALLAWAY PLANT B 3.3.1-28 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE 18. - Reactor Trip System Interlocks (continued) i SAFETY

-ANALYSES, d. - Power Range Neutron Flux, P-9 LCO, AND APPLICABILITY The Power Range Neutron Flux, P-9 interlock is actuated at 50% power as determined by two-out-of-four NIS power range detectors. The LCO requirement for this Function ensures that the Turbine Trip - Low Fluid Oil Pressure and

Turbine Trip - Turbine Stop Valve Closure reactor trips are

- enabled above the P-9 setpoint. Above the P-9 setpoint, a turbine trip will cause a load rejection beyond the

- capacities of the Steam Dump and Reactor Control Systems. A reactor trip is automatically initiated on a turbine trip when it is above the P-9 setpoint, to minimize

- the transient on the reactor.

The LCO requires four channels of Power Range Neutron

- Flux, P-9 interlock to be OPERABLE in MODE 1 (two-out-of-four trip logic). The Trip Setpoint is

50% RTP.

In MODE 1, a turbine trip could cause a load rejection

,,-beyond the capacities of the Steam Dump and Reactor Control Systems, so the Power Range Neutron Flux interlock must be OPERABLE. In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the reactor is not at a power level sufficient to have a load rejection beyond the capacities of the Steam Dump and Reactor Control Systems.

e. Power Range Neutron Flux, P-10

- The Power. Range Neutron Flux, P-10 interlock is actuated at 10% power, as determined by two-out-of-four NIS power range detectors. If power level falls below 10% RTP on 3 of 4 channels, the nuclear instrument trips will be automatically unblocked. The LCO requirement for the

P-10 interlock ensures that the following Functions are

-performed:

on increasing power, the P-10 interlock allows the

- :* operator to manually block the Intermediate Range

-Neutron Flux reactor trip. Note that blocking the reactor trip also blocks the signal to prevent rod withdrawal; (continued)

CALLAWAY PLANT -- - - B 3.3.1-29 ;Revision 5

_ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ u RTS Instrumentation B 3.3.1 BASES APPLICABLE e. Power Range Neutron Flux. P-10 (continued)

SAFETY ANALYSES,

on increasing power, the P-10 interlock allows the LCO, AND operator to manually block the Power Range APPLICABILITY Neutron Flux - Low reactor trip;

on increasing power, the P-10 interlock automatically provides a backup signal to block the Source Range Neutron Flux reactor trip, and also to de-energize the NIS source range detectors;

the P-10 interlock provides one of the two inputs to the P-7 interlock; and

on decreasing power, the P-10 interlock automatically enables the Power Range Neutron Flux - Low reactor trip and the Intermediate Range Neutron Flux reactor trip (and rod stop).

The LCO requires four channels of Power Range Neutron Flux, P-10 interlock to be OPERABLE in MODE 1 or 2 (two-out-of-four trip logic). The Trip Setpoint is 10% RTR OPERABILITY in MODE 1 ensures the Function is available to perform its decreasing power Functions in the event of a reactor shutdown. This Function must be OPERABLE in MODE 2 to ensure that core protection is provided during a startup or shutdown by the Power Range Neutron Flux - Low and Intermediate Range Neutron Flux reactor trips. In MODE 3, 4, 5, or 6, this Function does not have to be OPERABLE because the reactor is not at power and the Source Range Neutron Flux reactor trip provides core protection.

f. Turbine Impulse Pressure. P-13 The Turbine Impulse Pressure, P-13 interlock is actuated when the pressure in the first stage of the high pressure turbine is greater than 10% of the full power pressure. The full power pressure corresponds to the first stage pressure at 100% RTP. The interlock is determined by one-out-of-two pressure detectors. The LCO requirement for this Function ensures that one of the inputs to the P-7 interlock is available.

(continued)

CALLAWAY PLANT B 3.3.1-30 Revision 5

RTS Instrumentation B 3.3.1 BASES APPLICABLE f. Turbine Impulse Pressure. P-13 (continued)

SAFETY

,ANALYSES, The LCO requires two channels of Turbine Impulse LCO, AND - Pressure, P-13 interlock to be OPERABLE in MODE 1 APPLICABILITY (one-out-of-two trip logic). The Trip Setpoint is s 10% of Turbine Power.

The Turbine Impulse Pressure, P-13 interlock must be OPERABLE when the turbine generator is operating. The interlock Function is not required OPERABLE in MODE 2,

3,: -4, 5, or 6 because the turbine generator is not operating.

19. Reactor Trip Breakers This trip Function applies to the RTBs exclusive of individual trip mechanisms. The LCO requires two OPERABLE trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single RTS logic train that are racked in, closed, and capable of supplying power to the Rod Control System. Thus, the train may consist of the main breaker or main breaker and opposite train bypass breaker, depending upon the system configuration. Two OPERABLE trains ensure no single random failure can disable the RTS trip capability.

These trip Furictions must be OPERABLE in MODE I or 2 when the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.

20. Reactor Trip Breaker Undervoltape and Shunt Trip Mechanisms The LCO requires both the Undervoltage and Shunt Trip Mechanisms to be OPERABLE for each RTB that is in service.

The trip mechanisms are not 'required to be OPERABLE for trip breakers that are open,'racked out, incapable of supplying power to the Rod Control System, or'declared inoperable under Function 19 above. OPERABILITY of both trip mechanisms on

each breaker ensures that no single trip mechanism failure will prevent opening any breaker on a valid signal.

'

These trip Functions must be'OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.

(continued)

CALLAWAY PLANT '-~B 3.3.1-31 Revision 5

RTS Instrumentation B 3.3.1 BASES J APPLICABLE 21. Automatic Trip Loqgic SAFETY ANALYSIS, The LCO requirement for the RTBs (Functions .19 and 20) and LCO, AND Automatic Trip Logic (Function 21) ensures that means are APPLICABILITY provided to interrupt the power to allow the rods to fall into the (continued) reactor core. Each RTB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. Each RTB is equipped with a bypass breaker to allow testing of the trip breaker while the unit is at power. The reactor trip signals generated by the RTS Automatic Trip Logic cause the RTBs and associated bypass breakers to open and shut down the reactor.

The LCO requires two trains of RTS Automatic Trip Logic to be OPERABLE. Having two OPERABLE channels ensures that random failure of a single logic channel will not prevent reactor trip.

These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.

The RTS instrumentation satisfies Criterion 3 of I OCFR50.36(c)(2)(ii).

ACTIONS A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.1-1.

In the event a channel's Trip Setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected. When the Required Channels in Table 3.3.1-1 are specified on a per loop, per SG, per bus, or per train basis, then the Condition may be entered separately for each loop, SQ bus, or train.

When the number of inoperable channels in a trip Function exceed those specified in one or other related Conditions associated with a trip Function, then the unit is outside the safety analysis. Therefore, LCO 3.0.3 must be immediately entered if applicable in the current MODE of operation.

(continued)

CALLAWAY PLANT B 3.3.1-32 Revision 5

RTS Instrumentation B 3.3.1 BASES ACTIONS A.1 (continued)

Condition A applies to all RTS protection Functions. Condition A addresses the situation where one or more required channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.1-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.

B.1 and B.2 Condition B applies to the Manual Reactor Trip in MODE 1 or 2. This action addresses the train orientation of the RTS for this Function. With one channel inoperable, the inoperable channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . In this Condition, the remaining OPERABLE channel is adequate to perform the safety function.

The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE, and the low probability of an event occurring during this interval.

If the Manual Reactor Trip Function cannot be restored to OPERABLE status within the allowed 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time, the unit must be brought to a MODEmin which .the requirement does not apply. To achieve this status,- the unit must be brought to at least MODE 3 within

-6 additional hours (54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months total time). -The 6 additional hours to reach MODE 3 is reasonable, based on operating experience, to exit the Applicability from full power operation in an orderly manner and without challenging unit systems. With the unit in MODE 3, Condition C is entered if the Manual Reactor Trip Function has not been restored and the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.

C.1, C.2.1, and C.2.2 Condition C applies to the following reactor trip Functions in MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted:

Manual Reactor Trip; RTBs;-

. -RTB Undervoltage and Shunt Trip Mechanisms; and (continued)

CALLAWAY PLANT .- B 3.3.1-33 I i CPT3- Revision 5

RTS Instrumentation B 3.3.1 BASES ACTIONS C.1,C.2.1.AND C.2.2 (continued)

Automatic Trip Logic.

This action addresses the train orientation of the RTS for these Functions.

With one channel or train inoperable, the inoperable channel or train must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . If the affected Function(s) cannot be restored to OPERABLE status within the allowed 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time, the unit must be placed in a MODE in which the requirement does not apply. To achieve this status, action must be initiated within the same 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to fully insert all rods and the Rod Control System must be rendered incapable of rod withdrawal within the next hour (e.g., by de-energizing all CRDMs, by opening the RTBs, or de-energizing the motor generator (MG) sets). The additional hour for the latter provides sufficient time to accomplish the action in an orderly manner. With the rods fully inserted and the Rod Control System incapable of rod withdrawal, these Functions are no longer required.

The Completion Time is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function, and given the low probability of an event occurring during this interval.

Condition C is modified by a Note stating that while this LCO is not met for Function 19, 20, or 21 in MODE 5, making the Rod Control System capable of rod withdrawal is not permitted. This Note specifies an exception to LCO 3.0.4 for this MODE 5 transition and avoids placing the plant in a condition where control rods can be withdrawn or not fully inserted while the reactor trip system is degraded.

D.1.1, D.1.2, D.2.1, D.2.2. and D.3 Condition D applies to the Power Range Neutron Flux - High trip Function.

The NIS power range detectors provide input to the Rod Control System and the SG Water Level Control System and, therefore, have a two-out-of-four trip logic. A known inoperable channel must be placed in the tripped condition. This results in a partial trip condition requiring only one-out-of-three logic for actuation. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition is justified in Reference 5.

In addition to placing the inoperable channel in the tripped condition, THERMAL POWER must be reduced to

75% RTP within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Reducing the power level prevents operation of the core with radial power distributions beyond the design limits at a power level where DNB (continued)

CALLAWAY PLANT B 3.3.1-34 Revision 5

- ,~ t; I, :,

RTS Instrumentation B 3.3.1 BASES ACTIONS D.1.1, D.1.2. D.2.1. D.2.2, and D.3 (continued) conditions may exist. With one of the NIS power range detectors inoperable, 1/4 of the radial power distribution monitoring capability is lost.

As an alternative to the above actions, the inoperable channel can be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and the QPTR monitored once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months as per SR 3.2.4.2 (including the SR 3.2.4.2 Note),

QPTR verification. Calculating QPTR every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months compensates for the lost mo'nitoring capability due to the inoperable NIS power range channel and allows continued unit operation at power levels > 75% RTR The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time and the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency are consistent with LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."

As an alternative to the above Actions, the plant must be placed in a MODE where this Function is no longer'required OPERABLE. Twelve hours are allowed to'place the plant in MODE 3. This is a reasonable time, based on operating experience, to reach MODE 3 from full power in an orderly'manner and without challenging plant systems. If Required Actions cannot be completed within their allowed Completion Times, LCO 3.0.3 must be entered.

'The Required Actions have been modified by a Note that allows placing the inoperable channel in the'bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routinre surveillance testing of other channels. The Note also allows placing the inoperable channel in the bypassed condition to allow setpoint adjustments of other channels when required to reduce the setpoint in accordance with other Technical Specifications. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 5.'

Required Action D.2.2 has been modified by a Note which only requires SR 3.2.4.2 to be performed if the Power Range Neutron Flux input to QPTR becomes inoperable. Failure of a component in the Power Range Neutron Flux Channel which renders the High Flux Trip Function inoperable may not affect the capability to monitor QPTR. As such, determining QPTR using the movable incore detectors once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months may not be necessary.

E.1 and E.2' Condition E'applies to the following reactor trip Functions:

Power Range Neutron Flux - Low;

Overtemperature AT; (continued)

CALLAWAY PLANT '.I B 3.3.1-35 Revision 5

M RTS Instrumentation B 3.3.1 BASES ACTIONS E.1 and E.2 (continued)

Overpower AT;

Power Range Neutron Flux - High Positive Rate;

Pressurizer Pressure - High;

SG Water Level - Low Low (Adverse Containment Environment);

and

SG Water Level - Low Low (Normal Containment Environment).

A known inoperable channel must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Placing the channel in the tripped condition results in a partial trip condition requiring only one-out-of-two logic for actuation of the two-out-of-three trips and one-out-of-three logic for actuation of the two-out-of-four trips. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition is justified in Reference 5.

If the inoperable channel cannot be placed in the tripped condition within the specified Completion Time, the unit must be placed in a MODE where.

these Functions are not required OPERABLE. An additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is \J allowed to place the unit in MODE 3. Six hours is a reasonable time, based on operating experience, to place the unit in MODE 3 from full power in an orderly manner and without challenging unit systems.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of the other channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 5.

F.1 and F.2 Condition F applies to the Intermediate Range Neutron Flux trip when THERMAL POWER is above the P-6 setpoint and below the P-10 setpoint and one channel is inoperable. Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range detectors perform the monitoring and protection functions. If THERMAL POWER is greater than the P-6 setpoint but less than the P-10 setpoint, 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed to reduce THERMAL POWER below the P-6 setpoint or increase THERMAL POWER above the P-10 setpoint. The NIS Intermediate Range Neutron Flux channels must be OPERABLE when the power level is above the capability of the source range, P-6, and below the capability of the power range, P-10. If THERMAL POWER is greater than the P-10 setpoint, the NIS power range detectors perform the monitoring and (continued),-,

CALLAWAY PLANT B 3.3.1-36 Revision 5

RTS Instrumentation B 3.3.1 BASES ACTIONS F.1 and F.2 (continued) protection functions and the intermediate range is not required. The Completion Times allow for a slow and controlled power adjustment above P-10 or below P-6 and take into account the redundant capability afforded by the redundant OPERABLE channel, the overlap of the Power Range detectors, and the low probability of another intermediate range channel failure during this period. This action does not require the inoperable.channel to be tripped because the Function uses one-out-of-two logic. Tripping one channel would trip the reactor. Thus, the Required Actions specified in this Condition are only applicable when channel failure does not result in reactor trip.

G.1 and G2 Condition G applies to two inoperable Intermediate Range Neutron Flux trip channels in MODE 2 when THERMAL POWER is above the P-6 setpoint and below the P-10 setpoint. Required Actions specified in this Condition are only applicable when channel failures do not result in reactor trip., Above the P-6 setpoint and below the P-1 0 setpoint, the NIS intermediate range detectors perform the monitoring and protection functions. With no intermediate range channels OPERABLE, the Required Actions are to suspend operations involving positive reactivity additions immediately. This will preclude any power level increase since there are no.OPERABLE Intermediate Range Neutron Flux channels.

The operator must also reduce THERMAL POWER below the P-6 setpoint within two hours. This may require the use of the NIS source range channels or the neutron flux channels discussed in LCO 3.3.3, "Post Accident Monitoring (PAM) Instrumentation," with action to reduce power below the count rate equivalent to the P-6 setpoint.

Below P-B, the Source Range Neutron Flux channels will be able to monitorthe core power level. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months will allow a slow and controlled power reduction to less than the P-6 setpoint and takes into account the low probability of occurrence of an event during this period that may require the protection afforded by the NIS Intermediate Range Neutron Flux trip.

Required Action G1 is modified by a Note to indicate that normal plant control operations that individually add limited positive reactivity (i.e.,

temperature or boron concentration fluctuations associated with RCS inventory management or temnperature control) are not precluded by this Action, provided the SDM limits specified in the COLR are met and the requirements of LCOs 3.1.5, 3.1.6, and 3.4.2 are met.

(continued)

CALLAWAY PLANT B 3.3.1-37 Revision 5

RTS Instrumentation B 3.3.1 BASES ACTIONS H.1 (continued)

Not used.

Condition I applies to one inoperable Source Range Neutron Flux trip channel when in MODE 2 below the P-6 setpoint. With the unit in this Condition, below P-6, the NIS source range performs the monitoring and protection functions. With one of the two channels inoperable, operations involving positive reactivity additions shall be suspended immediately.

This will preclude any power escalation. With only one source range channel OPERABLE, core protection is severely reduced and any actions that add positive reactivity to the core must be suspended immediately.

Required Action 1.1 is modified by a Note to indicate that normal plant control operations that individually add limited positive reactivity (i.e.,

temperature or boron concentration fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action, provided the SDM limits specified in the COLR are met, the requirements of LCOs 3.1.5, 3.1.6, and 3.4.2 are met, and the initial and '

critical boron concentration assumptions in FSAR Section 15.4.6 (Ref. 16) are satisfied. Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permitted when one source range neutron flux channel is inoperable.

J.1 Condition J applies to two inoperable Source Range Neutron Flux trip channels when in MODE 2 below the P-6 setpoint or in MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. With the unit in this Condition, below P-6, the NIS source range performs the monitoring and protection functions. With both source range channels inoperable, the Reactor Trip Breakers (RTBs) must be opened immediately. With the RTBs open, the core is in a more stable condition.

K.1, K.2.1. and K.2.2 Condition K applies to one inoperable source range channel in MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. With the unit in this Condition, below P-6, (continued) J CALLAWAY PLANT B 3.3.1-38 Revision 5

RTS Instrumentation B 3.3.1 BASES ACTIONS K.1, K.2.1. and K.2.2. (continued) the NIS source range performs the monitoring and protection functions.

With one of the source range channels inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to restore it to an OPERABLE status. If the channel cannot be returned to an OPERABLE status,,action must be initiated within the same 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to fully insert all rods. One additional hour is allowed to place the Rod Control System in a condition incapable of rod withdrawal (e.g., by de-energizing all CRDMs, by opening the RTBs, or de-energizing the motor generator (MG) sets). Once these ACTIONS are completed, the core is in a more stable condition. The allowance of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to restore the channel to OPERABLE status, and the additional hour to place the Rod Control System in a condition incapable of rod withdrawal, are justified in Reference 5. Normal plant control operations that individually add limited positive reactivity (i.e., temperature or boron concentration fluctuations associated with RCS inventory management or temperature

'control) are permitted provided the SDM limits specified in the COLR are met and the initial and critical boron concentration assumptions in FSAR Section 15.4.6 (Ref. 16) are satisfied. Introduction of reactor makeup water into the RCS.from the Chemical and Volume Control System mixing tee is not permitted when one source range neutron flux channel is inoperable.

L.1, L.2. and L.3 Not used.

M.1 and M.2 Condition M applies to the following reactor trip Functions:

Pressurizer Pressure - Low; Pressurizer Water Level - High;

. Reactor Coolant Flow Low;

-. 'Undervoltage RCPs; and

'. UnderfrequencyRCPs.

With one channel inoperable, the inoperable channel must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . For the Pressurizer Pressure - Low, Pressurizer Water Level - High,'Undervoltage RCPs, and Underfrequency (continued)

CALLAWAY PLANT B 3.3.1-39 Revision 5

'U RTS Instrumentation B 3.3.1 BASES ACTIONS M.1 and M.2 (continued)

RCPs trip Functions, placing the channel in the tripped condition when above the P-7 setpoint results in a partial trip condition requiring only one additional channel to initiate a reactor trip. For the Reactor Coolant Flow

- Low trip Function, placing the channel in the tripped condition when above the P-8 setpoint results in a partial trip condition requiring only one additional channel in the same loop to initiate a reactor trip. For the Reactor Coolant Flow - Low trip Function, two tripped channels in two RCS loops are required to initiate a reactor trip when below the P-8 setpoint and above the P-7 setpoint. These Functions do not have to be OPERABLE below the P-7 setpoint because there are no loss of flow trips below the P-7 setpoint. There is insufficient heat production to generate DNB conditions below the P-7 setpoint. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the channel in the tripped condition is justified in Reference 5. An additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to reduce THERMAL POWER to below P-7 if the inoperable channel cannot be restored to OPERABLE status or placed in trip within the specified Completion Time.

Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channels, and the low probability of occurrence of an event during this period that may require the protection afforded by the Functions associated with Condition M.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of the other channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 5.

N.1 and N.2 Not used.

0.1 and 0.2 Condition 0 applies to the Turbine Trip - Low Fluid Oil Pressure trip Function. With one channel inoperable, the inoperable channel must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . If placed in the tripped condition, this results in a partial trip condition requiring only one additional channel to initiate a reactor trip. If the channel cannot be restored to OPERABLE status or placed in the tripped condition, then power must be reduced below the P-9 setpoint within the next 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped (continued)K V' CALLAWAY PLANT B 3.3.1-40 Revision 5

RTS Instrumentation B 3.3.1 BASES ACTIONS 0.1 and 0.2 (continued) condition and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for reducing power are justified in The Reference 5..

Required Actions have been modified by a Note that allows placing an inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of the other channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 5.

P.1 and P.2 Condition P applies to the Turbine Trip - Turbine Stop Valve Closure trip Function. With one or more channel(s) inoperable, the inoperable channel(s) must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . For the Turbine Trip - Turbine Stop Valve Closure trip Function, four of four channels are required to initiate a reactor trip; hence, more than one channel may be placed in trip., If the channels cannot be restored to OPERABLE status or placed in the tripped condition, then power must be reduced below the P-9setpoint Within the next 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channels in the tripped condition and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for reducing power are justified in Reference 5.

Q.1 and Q.2 Condition Q applies to the SI Input from ESFAS reactor trip and the RTS Automatic Trip Logic in MODES I and 2. These actions address the train orientation of the RTS for these Functions. With one train inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train'to OPERABLE status (Required Action Q.1) or the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (Required Action Q.1) is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function and given the low probability of an event during this'interval. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (Required Action Q.2) is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems.

The Required Actions have been modified by a Note that allows bypassing one train up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing, provided the other train is OPERABLE. - :

(continued)

CALLAWAY PLANT a B 3.3.1-41 - - Revision 5

Ii RTS Instrumentation B 3.3.1 BASES ACTIONS R.l and R.2 (continued)

Condition R applies to the RTBs in MODES 1 and 2. These actions address the train orientation of the RTS for the RTBs. With one train inoperable, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Times are equal to the time allowed by LCO 3.0.3 for shutdown actions in the event of a complete loss of RTS Function. Placing the unit in MODE 3 results in Condition C entry if one RTB train is inoperable and the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.

The Required Actions have been modified by three Notes. Note 1 allows one train to be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for RTB surveillance testing, provided the other train is OPERABLE. Note 2 allows one RTB to be bypassed only for the time required for performing maintenance on undervoltage or shunt trip mechanisms per Condition U if the other RTB train is OPERABLE. Note 3 allows one RTB to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for logic surveillance testing per Condition Q provided the other train is OPERABLE. The time limits are justified in References 5 and 12. .,

S.1 and S.2 Condition S applies to the P-6 and P-10 interlocks. With one or more required channel(s) inoperable, the associated interlock must be verified to be in its required state for the existing unit condition within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Verifying the interlock status manually, e.g., by observation of the associated permissive annunciator window, accomplishes the interlock's Function.

The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on operating experience and the minimum amount of time allowed for manual operator actions. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Times are equal to the time allowed by LCO 3.0.3 for shutdown actions in the event of a complete loss of RTS Function.

T.1 and T.2 Condition T applies to the P-7, P-8, P-9, and P-13 interlocks. With one or more required channel(s) inoperable, the associated interlock must be (continued)

CALLAWAY PLANT B 3.3.1-42 Revision 5

RTS Instrumentation B 3.3.1 BASES ACTIONS T.l and T.2 (continued) verified to be in its required state for the existing unit condition within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or the unit must be placed in MODE 2 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

These actions are conservative for the case where power level is being

raised. Verifying the interlock status manually, e.g., by observation of the associated permissive annunciator window, accomplishes the interlock's Function. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on operating experience and the minimum amount of time allowed for manual operator actions. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating 'experience, to reach MODE 2 from full power in an orderly manner and without challenging unit systems.

U.1 and U.2 Condition U applies to the RTB Undervoltage and Shunt Trip Mechanisms, or diverse trip features, in MODES 1 and 2. With one of the diverse trip features inoperable, it must be restored to an OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or the unit must be placed in a MODE where the requirement does not apply. This is accomplished by placing the unit in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months total time). The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is a reasonable time, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems.

With the unit in MODE 3, Condition C is entered if the inoperable trip mechanism has not been restored and the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted. The affected RTB shall not be bypassed while one of the diverse features is inoperable except for-the time required to perform maintenance to restore the inoperable trip mechanism to OPERABLE status, consistent with Reference 12.

The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months for Required Action U.1 is reasonable considering that in this Condition there is one remaining diverse trip feature for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval.

V.1 Not used.

(continued)

CALLAWAY PLANT B 3.3.1-43 Revision 5

RTS Instrumentation B 3.3.1 BASES ACTIONS W. 1 and W.2 (continued)

Condition W applies to the Trip Time Delay (TTD) circuitry enabled for the SG Water Level - Low Low trip Function when THERMAL POWER is less than or equal to 22.41% RTP in MODES 1 and 2. With one or more Vessel AT Equivalent (Power-1, Power-2) channel(s) inoperable, the associated Vessel AT channel(s) must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . If the inoperability impacts the Power-1 and Power-2 portions of the TTD circuitry (e.g., Vessel AT RTD failure), both the Power-1 and Power-2 bistables in the affected protection set(s) are placed in the tripped condition. However, if the inoperability is limited to either the Power-1 or Power-2 portion of the TTD circuitry, only the corresponding Power-1 or Power-2 bistable in the affected protection set(s) is placed in the tripped condition. With one or more TTD circuitry delay timer(s) inoperable, both the Vessel AT (Power-1) and Vessel AT (Power-2) channels are tripped. This automatically enables a zero time delay for that protection channel with either the normal or adverse containment environment level bistable enabled. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is based on Reference 7. If the inoperable channel cannot be placed in the tripped condition within the specified Completion Time, the unit must be placed in a MODE where this Function is not required to be OPERABLE. An additional six hours is allowed to place the unit in MODE 3.

X. 1 and X.2 Condition X applies to the Environmental Allowance Modifier (EAM) circuitry for the SG Water Level - Low Low trip Function in MODES 1 and 2. With one or more EAM channel(s) inoperable, they must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Placing an EAM channel in trip automatically enables the SG Water Level - Low Low (Adverse Containment Environment) bistable for that protection channel, with its higher SG level Trip Setpoint (a higher trip setpoint means a reactor trip would occur sooner). The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is based on Reference 7. If the inoperable channel cannot be placed in the tripped condition within the specified Completion Time, the unit must be placed in a MODE where this Function is not required to be OPERABLE. An additional six hours is allowed to place the unit in MODE 3.

SURVEILLANCE The SRs for each RTS Function are identified by the SRs column of REQUIREMENTS Table 3.3.1-1 for that Function.

A Note has been added stating that Table 3.3.1-1 determines which SRs apply to which RTS Functions.

(continued)"'-

CALLAWAY PLANT B 3.3.1-44 Revision 5

1U 'I"!T RTS Instrumentation B 3.3.1 BASES

. ;r '.; I, SURVEILLANCE Note that each channel of process protection supplies both trains of the REQUIREMENTS RTS. When testing Channel I, Train A and Train B must be examined.

(continued)

Similarly, Train A and Train B must be examined when testing Channel II, Channel l1l, and Channel IV. The CHANNEL CALIBRATIONs and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.

SR 3.3.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK-will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability. Ifa channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its

-* limit.

The Frequency is based on operating experience that demonstrates channel failure is rare.; The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.1.2 -'

SR 3.3.1.2 compares the calorimetric heat balance calculation to the powerjange'channel outputfevery 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If the calorimetric heat balance'calculati6n results exceed the power range channel output by more'than +2% RTP, the power range channel is not declared inoperable, but 'must be adjusted. The power range' channel output shall be adjusted consistent with the calorimetric heat balance calculation results ifthe (continued)

CALLAWAY PLANT B 3.3.1-45 '%t . Revision 5

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.2 (continued)

REQUIREMENTS calorimetric calculation exceeds the power range channel output by more than +2% RTR If the power range channel output cannot be properly adjusted, the channel is declared inoperable.

If the calorimetic is performed at part-power (<40% RTP), adjusting the power range channel indication in the increasing power direction will assure a reactor trip below the power range high safety analysis limit (SAL) of s 118% RTP in FSAR Table 15.0-4 (Reference 10). Making no adjust to the power range channel in the decreasing power direction due to a part-power calorimetric assures a reactor trip consistent with the safety analyses.

This allowance does not preclude making indicated power adjustments, if desired, when the calorimetric heat balance calculation power is less than the power range channel output. To provide close agreement between indicated power and to preserve operating margin, the power range channels are normally adjusted when operating at or near full power during steady-state conditions. However, discretion must be exercised if the power range channel output is adjusted in the decreasing power direction due to a part-power calorimetric (<40% RTP). This action could introduce a non-conservative bias at higher power levels which could delay an NIS reactor trip until power is above the power range high SAL.

The cause of the non-conservative bias is the decreased accuracy of the calorimetric at reduced power conditions. The primary error contributor to the instrument uncertainty for a secondary side power calorimetric measurement is the feedwater flow measurement, which is determined by a AP measurement across a feedwater venturi. While the measurement uncertainty remains constant in AP span as power decreases, when translated into flow the uncertainty increases as a square term. Thus, a 1% flow error at 100% power can approach a 10% flow error at 30% RTP even though the AP error has not changed. To assure a reactor trip below the power range high SAL, the power range neutron flux - high trip setpoint is first set at

85% RTP prior to adjusting the power range channel output in the decreasing power direction whenever the calorimetric power is 2 20% RTP and <40% RTP. To assure a reactor trip below the power range high SAL, the power range neutron flux - high trip setpoint is first set a

70% RTP prior to adjusting the power range channel output in the decreasing power direction whenever the calorimetric power is 2 15% RTP and <20% RTR Adjustments in the increasing power direction do not require a prior decrease in the trip setpoint. Following a plant shutdown, it is permissible to reduce the (continued)P-CALLAWAY PLANT B 3.3.1-46 Revision 5

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.2 (continued)

REQUIREMENTS power range neutron flux - high trip setpoint prior to startup. This would anticipate the potential need for a decreasing power direction adjustment, thereby obviating the need to suspend power escalation for the purpose of first reducing the trip setpoint. Before the power range neutron flux -

high trip setpoint is re-set to its nominal full power value (* 109% RTP),

the power range'channel calibration must be confirmed based on a calorimetric performed at Ž 40% RTP.

The Note to SR 3.3.1.2 clarifies that this Surveillance is required only if the reactor power is 215% RTP and that 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months are allowed for performing the first Surveillance after reaching 15% RTP. A power level of 15% RTP is chosen based on plant stability, i.e., automatic rod control capability (manual rod control is normally used at Callaway) and the turbine generator synchronized to the grid. The 24-hour allowance after increasing THERMAL POWER above 15% RTP provides a reasonable time toattain a scheduled power plateau, establish the requisite conditions, perform the required calorimetric measurement, and make any required adjustments in a controlled, orderly manner and without

- -introducing the potential for extended operation at high power levels with instrumentation that has not been verified to be OPERABLE for subsequent use.,

The Frequency of every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is adequate. It is based on unit operating experience, considering instrument reliability and operating history data for instrument drift. Together these factors demonstrate that a difference between the calorimetric heat balance calculation and the power range channel output of more than +2% RTP is not expected in

- any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period.

In addition, control room operators periodically monitor redundant indications and alarms to detect deviations in channel outputs.

SR 3.3.1.3 .

SR 3.3.1.3 compares the incore system to the NIS channel output every 31 EFPD. If the absolute difference is 2 2%, the NIS channel is still OPERABLE, but must be readjusted. The excore NIS channel shall be adjusted if the absolute difference between the incore and excore AFD is

Ž 2%. The purpose of the comparison is to check for differences that result from core power distribution changes that may have occurred since the last required adjustment or incore-excore calibration (SR 3.3.1.6).

(continued)

CALLAWAY PLANT B 3.3.1-47 . Revision 5

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.3 (continued)

REQUIREMENTS If the NIS channel cannot be properly readjusted, the channel is declared inoperable. This Surveillance is performed to verify the f(AI) input to the Overtemperature AT Function.

The Note to SR 3.3.1.3 clarifies that the Surveillance is required only if reactor power is 2 50% RTP and that 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed for performing the first Surveillance after reaching 50% RTR This Note allows power ascensions and associated testing to be conducted in a controlled and orderly manner, at conditions that provide acceptable results and without introducing the potential for extended operation at high power levels with instrumentation that has not been verified to be OPERABLE for subsequent use. Due to such effects as shadowing from the relatively deep control rod insertion and, to a lesser extent, the axially-dependent radial leakage which varies with power level, the relationship between the incore and excore indications of axial flux difference (AFD) at lower power levels is variable. Thus, it is acceptable to defer the calibration of the excore AFD against the incore AFD until more stable conditions are attained (i.e., withdrawn control rods and a higher power level). The AFD is used as an input to the Overtemperature AT reactor trip function and for assessing compliance with LCO 3.2.3, "AXIAL FLUX DIFFERENCE."

Due to the DNB benefits gained by administratively restricting the power J level to 50% RTP, no limits on AFD are imposed below 50% RTP by LCO 3.2.3; thus, the proposed change is consistent with the LCO 3.2.3 requirements below 50% RTP. Similarly, sufficient DNB margins are realized through operation below 50% RTP that the intended function of the Overtemperature AT reactor trip function is maintained, even though the excore AFD indication may not exactly match the incore AFD indication. Based on plant operating experience, 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable time frame to limit operation above 50% RTP while completing the procedural steps associated with the surveillance in an orderly manner.

The Frequency of every 31 EFPD is adequate. It is based on unit operating experience, considering instrument reliability and operating history data for instrument drift. Also, the slow changes in neutron flux during the fuel cycle can be detected during this interval.

SR 3.3.1.4 SR 3.3.1.4 is the performance of a TADOT every 31 days on a STAGGERED TEST BASIS. This test shall verify OPERABILITY by actuation of the end devices. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of (continued) K CALLAWAY PLANT B 3.3.1-48 Revision 5

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.4 (continued)

REQUIREMENTS -

state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The RTB test shall include separate verification of the undervoltage and shunt trip mechanisms. Independent verification of RTB undervoltage and shunt trip Function is not required for the bypass breakers. No capability is provided for performing such a test at power. The independent test for bypass breakers is included in SR 3.3.1.14. The

-bypass breaker test shall include a local manual shunt trip only. A Note has been added to indicate that this test must be performed on the bypass breaker prior to placing it in service.

The Frequency of every 31 days on a STAGGERED TEST BASIS is

.adequate. It is based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.1.5 SR 3.3.1.5 is the performance of an ACTUATION LOGIC TEST. The

-SSPS is tested every 31 days on a STAGGERED TEST BASIS, using the semiautomatic tester. The train being tested is placed in the bypassed condition; thus preventing inadvertent actuation. Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function, including operation of the P-7 permissive which is a logic function only. The Frequency of every,31 days on a STAGGERED TEST BASIS is adequate. It is based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.1.6 SR 3.3.1.6 is a calibration of the excore channels to the incore channels.

If the measurements do not agree, the excore channels are not declared inoperable but must be calibrated to agree with the incore detector measurements.- If the excore channels cannot be adjusted, the channels are declared inoperable. This Surveillance is performed to verify the f(Al) input to the Overtemperature AT Function. Determination of the loop-specific vessel AT and Tag values should be made when performing this (continued)

CALLAWAY PLANT I B 3.3.1-49 Revision 5

In RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.6 (continued)

REQUIREMENTS calibration, under steady state conditions (ATo and 1 [T for Overpower AT] when at 100% RTP).

A Note modifies SR 3.3.1.6. The Note states that this Surveillance is required only if reactor power is 2 75% RTP and that 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after achieving equilibrium conditions with THERMAL POWER 2 75% RTP is allowed for performing the first surveillance. Equilibrium conditions are achieved when the core is sufficiently stable at intended operating conditions to perform flux mapping.

The SR is deferred until a scheduled testing plateau above 75% RTP is attained during a power ascension. During a typical power ascension, it is usually necessary to control the axial flux difference at lower power levels through control rod insertion. After equilibrium conditions are achieved at the specified power plateau, a flux map must be taken and the required data collected. The data is typically analyzed and the appropriate excore calibrations completed within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months after achieving equilibrium conditions. An additional time allowance of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is provided during which the effects of equipment failures may be remedied and any required re-testing may be performed.

The allowance of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after equilibrium conditions are attained at the testing plateau provides sufficient time to allow power ascensions and associated testing to be conducted in a controlled and orderly manner at conditions that provide acceptable results and without introducing the potential for extended operation at high power levels with instrumentation that has not been verified to be OPERABLE for subsequent use.

The Frequency of 92 EFPD is adequate. It is based on industry operating experience, considering instrument reliability and operating history data for instrument drift.

SR 3.3.1.7 SR 3.3.1.7 is the performance of a COT every 92 days.

A COT is performed on each required channel to ensure the channel will perform the intended Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical (continued) -- '

CALLAWAY PLANT B 3.3.1-50 Revision 5

RTS Instrumentation B 3.3.1

' i:'

L..t -1

BASES SURVEII LLANCE SR 3.3.1.7 (continued) .,I REQUIR EMENTS

- Specifications tests at least once per refueling interval with applicable

-extensions. . --

Setpoints must be within the Allowable Values specified in Table 3.3.1-1.

-SR 3.3.1.7 is modified by two Notes. Note 1 provides a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months delay in

the requirement to perform this Surveillance for source range instrumentation when entering MODE 3 from MODE 2. This Note allows a normal shutdown to proceed without a delay for testing in MODE 2 and

-. - for a short time in MODE 3 until the Applicability is exited and SR 3.3.1.7 is no longer required to be performed. -If the unit is to be in MODE 3 with the Rod Control System capable of rod withdrawal of one or more rods not fully inserted for > 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , this Surveillance must be performed prior to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after entry into MODE 3. Note 2 requires that the quarterly COT for the source range instrumentation shall include verification by v observation of the associated permissive annunciator window that the P-6 i-and P-1 0 interlocks are in their required state for the existing unit conditions.

The Frequency of 92 days is justified in Reference 5.

SR 3.3.1.8 SR 3.3.1.8 is the performance of a COT as described in SR 3.3.1.7 and it is modified by the same Note that this test shall include verification that the P-6 and P-10 interlocks are in their required state for the existing unit conditions by-observation of the associated permissive annunciator window. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay.- This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Frequency is modified by a Note that allows this surveillance to be satisfied if it has been performed within 92 days of the Frequencies prior to reactor startup, 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reducing power below P-10, and four hours after reducing power below P-6, as discussed below. The Frequency of "prior to reactor startup" ensures this surveillance is performed prior to critical operations and applies to the source, intermediate and power range low instrument channels. The Frequency of "12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reducing power below P-10" (applicable to intermediate and power range low channels) and "4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reducing power below P-6" (applicable to source range channels)

(continued)

CALLAWAY PLANT I- B 3.3.1-51 Revision 5

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.8 (continued)

REQUIREMENTS allows a normal shutdown to be completed and the unit removed from the MODE of Applicability for this surveillance without a delay to perform the testing required by this surveillance. The Frequency of every 92 days thereafter applies if the plant remains in the MODE of Applicability after the initial performances of prior to reactor startup, 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reducing power below P-10, and four hours after reducing power below P-6. The MODE of Applicability for this surveillance is < P-10 for the power range low and intermediate range channels and < P-6 for the source range channels. Once the unit is in MODE 3, this surveillance is no longer required. If power is to be maintained < P-10 for more than 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or

< P-6 for more than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , then the testing required by this surveillance must be performed prior to the expiration of the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months limit, as applicable. These time limits are reasonable, based on operating experience, to complete the required testing or place the unit in a MODE where this surveillance is no longer required. This test ensures that the NIS source, intermediate, and power range low channels are OPERABLE prior to taking the reactor critical and after reducing power into the applicable MODE (< P-1 0 or < P-6) for the periods discussed above.

SR 3.3.1.9 SR 3.3.1.9 is the performance of a TADOT and is performed every 92 days, as justified in Reference 5. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

This SR is modified by a Note that excludes verification of setpoints from the TADOT. Setpoint verification is accomplished during the CHANNEL CALIBRATION.

SR 3.3.1.10 ACHANNEL CALIBRATION is performed every 18 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

(continued)

CALLAWAY PLANT B 3.3.1-52 Revision 5

RTS Instrumentation B 3.3.1

.~ .

BASES SURVEILLANCE SR 3.3.1.10 (continued)

REQUIREMENTS CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the setpoint methodology.

The Frequency of 18 months is based on the assumed calibration interval in the determination of the magnitude of equipment drift in the setpoint methodology. -.

SR 3.3.1.10 is modified by a Note stating that this test shall include verification that the time constants are'adjusted to the prescribed values

- where applicable. This does not include verification of time delay relays.

These are verified via response time testing per SR 3.3.1.16. See the

- discussion of AT0 in the Applicable Safety Analyses for the Overtemperature AT and OverpowerAT trip functions. Whenever an RTD is replaced in Function 6,1-7, or 14.c, the next required CHANNEL

- ; CALIBRATION of the RTDs is accomplished by an inplace cross calibration that compares the other sensing elements with the recently

. - installed sensing element. -

The CHANNEL CALIBRATION of Function 6, Overtemperature AT, includes the axial flux difference penalty circuitry in the 7300 Process Protection System cabinets, but does not include the power range

-neutron detectors. SR 3.3.1.11 and its Notes 1 and 3 govern the performance and timing of the power range neutron detector plateau voltage verification.

Although not required for any safety function, the CHANNEL CALIBRATION of Function 10, Reactor Coolant Flow-Low, will ensure proper performance and normalization of the RCS flow indicators.

SR 3.3.1.11 SR 3.3.1.11 is the performance of a CHANNEL CALIBRATION, as

---described

- in SR 3.3.1.10, every 18 months. This SR is modified by three Notes. ,Note istates that neutron detectors are excluded from the CHANNEL CALIBRATION. -Neutron detectors are excluded from the CHANNEL CALIBRATION because it is impractical to set up a test that demonstrates and adjusts neutron detector response to known values of the parameter (neutron flux) that the channel monitors. Note 1 applies to the source range proportional counters, intermediate range ion chambers, and power range ion chambers in the Nuclear Instrumentation System (NIS). Note 2 states that this test shall include verification that the time constants are adjusted to the prescribed values where applicable.

Detector,plateau curves are obtained, evaluated, and compared to manufacturer's data for the intermediate and power range neutron (continued)

CALLAWAY PLANT -;I ' B 3.3.1-53 -Revision 5

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.11 (continued)

REQUIREMNTS detectors. The testing of the source range neutron detectors consists of obtaining integral bias curves, evaluating those curves, and comparing the curves to previous data. Note 3 states that the power and intermediate range detector plateau voltage verification is not required to be current until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after achieving equilibrium conditions with THERMAL POWER 2 95% RTP. Equilibrium conditions are achieved when the core is sufficiently stable at intended operating conditions to perform a meaningful detector plateau voltage verification. The allowance of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after equilibrium conditions are attained at the testing plateau provides sufficient time to allow power ascension testing to be conducted in a controlled and orderly manner at conditions that provide acceptable results and without introducing the potential for extended operation at high power levels with instrumentation that has not been verified to be OPERABLE for subsequent use. The source range integral bias curves are obtained under the conditions that apply during a plant outage.

The 18 month Frequency is based on past operating experience, which has shown these components usually pass the Surveillance when performed on the 18 month Frequency. The conditions for obtaining the source range integral bias curves and the power and intermediate range detector plateau voltages are described above. The other remaining portions of the CHANNEL CALIBRATIONS may be performed either during a plant outage or during plant operation.

SR 3.3.1.12 Not used.

SR 3.3.1.13 SR 3.3.1.13 is the performance of a COT of RTS interlocks every 18 months. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The Frequency is based on the known reliability of the interlocks and the multichannel redundancy available, and has been shown to be acceptable through operating experience.

(continued) v-CALLAWAY PLANT B 3.3.1-54 Revision 5

l* RTS Instrumentation B 3.3.1

-. . : . 17 SURVEILLAINICE SR 3.3.1.14 REQUIREME AITA (continued) SR'3.3.1.14 is the performance of a TADOT of the Manual Reactor Trip, the Si Input from ESFAS, and the Reactor Trip Bypass Breaker undervoltage trip hieclianisms. A successful test of the required contact(s) of a-chann'el relay may be performed by the verification of the change' of state of a single'contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is'acceptable because all of the other required 'contacts-of the' relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This TADOT is performed every 18 months.i' The Manual Reactor Trip TADOT shall independently verify the OPERABILITY of the undervoltage and shunt trip handswitch contacts for both the Reactor Trip Breakers and Reactor Trip Bypass Breakers. The Reactor Trip Bypass Breaker test shall include testing of the automatic undervoltage trip mechanism.

The Frequency is based on the known reliability of the Functions and the multichannel redundancy available, and has been shown to be acceptable through operating experience.

The SR is modified by a Note that excludes verification of setpoints from the TADOT. The Functions affected have no setpoints associated with them.'

SR 3.3.1.15 SR 3.3.1.15 is the performance of a TADOT of Turbine Trip Functions. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an'acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions, .This TADOT is performied prior to exceeding the P-9 interlock whenever the unit has been in MODE 3. This Surveillance is not required if it has been performed within the previous 31 days. Verification of the Trip Setpoint does not have to be performed for this Surveillance.

Performance of this test will ensure that the turbine trip Function is OPERABLE prior to exceeding the P-9 interlock.

(continued)

CALLAWAY PLANT I .". 8 3.3.1-55 Revision 5

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.16 REQUIREMENTS (continued) SR 3.3.1.16 verifies that the individual channel actuation response times are less than or equal to the maximum values assumed in the accident analysis. Response time verification acceptance criteria are included in Reference 8. No credit was taken in the safety analyses for those channels with response times listed as N.A. No response time testing requirements apply where N.A. is listed in Reference 8. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor until loss of stationary gripper coil voltage (at which point the rods are free to fall).

The safety analyses include the sum of the following response time components:

(a) Process delay times (e.g., scoop transport delay and thermal lag associated with the narrow range RCS RTDs used in the OTAT, OPAT, and SG low-low Vessel AT (Power-1, Power-2) functions) which are not testable; (b) Sensing circuitry delay time from the time the trip setpoint is reached at the sensor until a reactor trip is generated by the SSPS; (c) Any intentional time delay set into the trip circuitry (e.g.,

undervoltage relay time delay, NLL cards (lag, lead/lag, rate/lag) and NPL cards (PROM logic cards for trip time delay) associated with the OTAT, OPAT, and SG low-low level Vessel AT (Power-1, Power-2) trip functions, and NLL cards (lead/lag) associated with the low pressurizer pressure reactor trip function) to add margin or prevent spurious trip signals; (d) For the undervoltage RCP trip function, back EMF delay from the time of the loss of the bus voltage until the back EMF voltage generated by the bus loads has decayed; (e) The time delay for the reactor trip breakers to open; and (f) The time delay for the control rod drive stationary gripper coil voltage to decay and the RCCA grippers to mechanically release making the rods free to fall (i.e., gripper release time measured during the performance of SR 3.1.4.3).

(continued)

CALLAWAY PLANT B,3.3.1-56 Revision 5

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.16 (continued)'

REQUIREMENTS For channels that include'dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.),' the response time verification is performed with the time constants set at their'nominal values.' Time constants are verified during the performance of SR 3.3.1.10 and SR 3.3.1.11. The response time may be verified by a series of overlapping tests, or other verification (e.g.,

- Ref. 9 and Ref. 15),' such that the entire response time is verified.

Response time' may be verified by actual response time tests in any series of sequential, overlapping, or total channel measurements, or by the summation of allocated sensor, signal processing, and actuation logic response times With actual response time tests on the remainder of the

-channel. Allo6ations for sensor response times may be obtained from:

1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests); (2) inplace, onsite, or offsite (e.g. vendor) test measurements; or (3) utilizing vendor engineering specifications.

-WCAP-13632-P-A' Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test.

WCAP-1 4036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.

The allocatiosri for'sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in

-operational service'and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value.' Specific components identified in References 9 and 15 may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.

As appropriate, each channel's response'time must be verified every 18 months on a STAGGERED TEST BASIS. Each verification shall include at least one'train such that both trains are verified at least once per 36 months. Testing of the final actuation devices (i.e., reactor trip breakers) is included in the verification. Testing of the final actuation devices measures the time delay for the reactor trip breakers to open.

The time delay for the control rod drive stationary gripper coil voltage to (continued)

CALLAWAY PLANT B 3.3.1-57 Revision 5

IAL RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.16 (continued)

REQUIREMENTS decay and the RCCA grippers to mechanically release making the rods free to fall (i.e., gripper release time) is measured during the performance of SR 3.1.4.3 which verifies rod drop time from the beginning of decay of stationary gripper coil voltage. For surveillance testing performance, gripper release time is not included in the reactor trip system instrumentation response time testing due to the difficulty in determining the precise point at which the rods are free to fall. SR 3.1.4.3 specifies a readily quantifiable time to use as a separation point for field measurements, i.e., "from the beginning of decay of stationary gripper coil voltage." The rod drop time measurement in SR 3.1.4.3 begins at the time the rod control power cabinet regulator board circuit for a specific rod group is grounded, causing the board to reduce the stationary gripper coil current to zero releasing the rod group. This is essentially the same time at which the reactor trip breaker's opening would interrupt current to the stationary gripper coil. The response time definition, "until loss of stationary gripper coil voltage, " is less quantifiable. However, the definition's provision for overlapping testing allows this testing approach since the total response time is determined. The safety analyses are satisfied as long as both surveillances, response time and rod drop time, are met. Some portions of the response time testing cannot be performed during unit operation because equipment operation is required eJ to measure response times. Experience has shown that these components usually pass this Surveillance when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.3.1.16 is modified by a Note stating that neutron detectors are excluded from RTS RESPONSE TIME testing. This Note is necessary because of the difficulty in generating an appropriate detector input signal.

Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response. Response time of the neutron flux signal portion of the channel shall be verified from detector output or input to the first electronic component in the channel.

REFERENCES 1. FSAR, Chapter 7.

2. FSAR, Chapter 15.

3. IEEE-279-1 971.

4. 10 CFR 50.49.

5. Callaway OLAmendment No. 17 dated September 8, 1986.

(continued)

CALLAWAY PLANT B 3.3.1-58 Revision 5

RTS Instrumentation B 3.3.1 BASES REFERENCES 6. Callaway Setpoint Methodology Report, SNP (UE)-565 dated (continued) May 1, 1984.

7. Callaway OLAmendment No.43 dated April 14, 1989.

8. FSAR Section 16.3, Table 16.3-1.

9. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," January 1996.

10. FSAR Table 15.04.

11. WCAP-9226, "Reactor Core Response to Excessive Secondary Steam Releases," Revision 1, January 1978.

12. NRC Generic Letter 85-09 dated May 23, 1985.

13. FSAR Section 15.1.1.

14. RFR- 18637A.

15. WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," October 1998.

16. FSAR Section 15.4.6.

CALLAWAY PLANT - B 3.3.1-59 Revision 5

AL RTS Instrumentation B 3.3.1 BASES PAGE INTENTIONALLY BLANK

' I CALLAWAY PLANT B 3.3.1-60 Revision 5

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND Signal Processinq E6'uipment -

(continued)

Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments. The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. If the measured value of a unit parameter

-exceeds the predetermined setpoin't, an output from a bistable is forwarded to the SSPS for decision evaluation. Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit I

computer, and one or more control systems.

Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If onre channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two'logic. 'If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function is still

OPERABLE with a one-out-of-two logic.

Generally, if a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy. The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Again, a single

- failure will neither cause nor prevent the protection function actuation.

These requirements are described in IEEE-279-1971 (Ref. 4). The actual number of channels required for each unit parameter is specified in Reference 2.

TriD SetDoints and Allowable Values

-The Trip Setpoints are the nominal values at which the bistables are set.

Any bistable is considered to be properly'adjusted when the "as left" value is within the two-sided tolerance band for calibration accuracy (typically

+/- 15 mV).

(continued)

CALLAWAY PLANT ' " _B 3.3.2-2 CAY P- T - Revision 0

U In ESFAS Instrumentation B 3.3.2 BASES BACKGROUND Trip Setpoints and Allowable Values (continued)

The Trip Setpoints listed in Table B 3.3.2-1 and used in the bistables are based on the analytical limits stated in Reference 3. The selection of these Trip Setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 5), the Allowable Values specified in Table 3.3.2-1 in the accompanying LCO are conservatively adjusted with respect to the analytical limits. A detailed description of the methodologies used to calculate the Trip Setpoints, including their explicit uncertainties, is provided in Reference 6. The BOP methodology used for Function 6.h is a similar square-root-sum-of-squares (SRSS) methodology as used for the RTS setpoints. The actual nominal Trip Setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a COT. One example of such a change in measurement error is drift during the surveillance interval. If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERABLE.

Setpoints in accordance with the Allowable Value ensure that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.

Each channel can be tested on line to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SR section.

The Allowable Values listed in Table 3.3.2-1 are based on the methodologies described in Reference 6, which incorporate all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each Trip Setpoint. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes.

(continued)

CALLAWAY PLANT B 3.3.2-3 Revision 5

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND Solid State Protection Svstem . -"

(continued)l (continued) - The SSPS equipment is used for the decision logic processing of outputs from the signal processing equipment bistables. To meet the redundancy requirements,'two trains of SSPS, each performing the same functions, are provided. Ifone train is taken out of service for maintenance or test purposes, the'sec6nd train will provide ESF actuation for the unit. Ifboth trains are taken out of service or placed in test, a reactor trip will result.

Each train is'packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements.

-- The SSPS performs the decision logic for most ESF equipment actuation; generates the electrical 'output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.,

The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations' indicative of various transients. Ifa required logic matrix combination is completed, the system will send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition. Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases..

Each SSPS train has 'abuilt in testing device that can automatically test the decision logic matrix functions and the actuation devices while the unit is at power. Whe'n any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed. The testing device is semiautomatic to

-minimize testing time.

The actuation of ESF components is accomplished through master and

-slave relays. The SSPS energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices. The master and slave relays are routinely tested to ensure operation. The test of the

master relays energizes the relay, which then operates the contacts and applies a low voltage to the associated slave relays. The low voltage is not sufficient to actuate the slave relays but only demonstrates signal path

- 'continuity.-

. The SLAVE RELAY TEST actuates the devices if their operation will not interfere with'continu'ed unit operation. For the latter case, actual component operation is prevented by the SLAVE RELAY TEST circuit,' and slave relay contact operation is verified by a continuity

'-. check of the circuit containing the slave relay.

(continued)

CALLAWAY PLANT "I1_7 ;'.B 3.3.2-4 'C'L P A' 3Revision 5

ESFAS Instrumentation B 3.3.2 BASES I BACKGROUND Balance of Plant (BOP) ESFAS (continued)

The BOP ESFAS processes signals from SSPS, signal processing equipment (e.g., LSELS), and plant radiation monitors to actuate certain ESF equipment. There are two redundant trains of BOP ESFAS (separation groups 1 and 4), and a third separation group (separation group 2) to actuate the Turbine Driven Auxiliary Feedwater pump and reposition automatic valves (turbine steam supply valves, turbine trip and throttle valve) as required. The separation group 2 BOP-ESFAS cabinet is considered to be part of the end device (the Turbine Driven Auxiliary Feedwater pump) and its OPERABILITY is addressed under LCO 3.7.5, "Auxiliary Feedwater (AFW) System." The redundant trains provide actuation for the Motor Driven Auxiliary Feedwater pumps (and reposition automatic valves as required, i.e., steam generator blowdown and sample line isolation valves, ESW supply valves, CST supply valves),

Containment Purge Isolation, Control Room Emergency Ventilation, and Emergency Exhaust Actuation functions.

The BOP ESFAS has a built-in automatic test insertion (ATI) feature which continuously tests the system logic. Any fault detected during the testing causes an alarm on the main control room overhead annunciator system to alert operators to the problem. Local indication shows the test step where the fault was detected.

APPLICABLE Each of the analyzed accidents can be detected by one or more ESFAS SAFETY Functions. One of the ESFAS Functions is the primary actuation signal ANALYSES, for that accident. An ESFAS Function may be the primary actuation LCO, AND signal for more than one type of accident. An ESFAS Function may also APPLICABILITY be a secondary, or backup, actuation signal for one or more other accidents. For example, Pressurizer Pressure - Low is a primary actuation signal for small loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) outside containment.

Functions such as manual initiation, not specifically credited in the accident safety analysis, are qualitatively credited. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).

The LCO requires all instrumentation performing an ESFAS Function to be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

The LCO generally requires OPERABILITY of three or four channels in each instrumentation function and two channels in each logic and manual initiation function. The two-out-of-three and the two-out-of-four (continued)

CALLAWAY PLANT B 3.3.2-5 Revision 5

ESFAS Instrumentation B 3.3.2 t .

I. I '

1' ,

41 BASES APPLICABLE configurations allow one channel to be tripped during maintenance or SAFETY testing without causing an ESFAS initiation. In cases wh&e an

ANALYSES, inoperable channel is placed in the tripped condition indefinitely to satisfy

- *LCO, AND the Required Action of an LCO, the logic configurations'are reduced to APPLICABILITY.-! one-out-of-two and one-out-of-three where tripping of an additional (continued) channel, for any reason, would result in an ESFAS initiation. To allow for surveillance testing or setpoint adjustment of other channels while in this condition, several Required Actions allow the inoperable channel to be bypassed. Bypassing the inoperable channel creates a two-out-of-two or two-out-of-three logic configuration allowing a channel to be tripped for testing without causing an ESFAS initiation. Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.

The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents. ESFAS protection functions are as follows:

1. Safety Iniection Safety Injection (SI) provides two primary functions:

1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 22000F); and

2. Borationr to ensure recovery and maintenance of SDM (kNff < 1.O).

These functions are necessary to mitigate the effects of high energy lin'e breaks'(HELBs) both inside and outside of containment. The SI signal is also used to initiate other Functions such as:

" .- Phase A Isolation; React6or Trip;

-TurbinrTrip e

Feedwater Isolation;

Start of motor driven auxiliary feedwater (AFW) pumps;

Isolation of SG blowdown and sample lines; (continued)

CALLAWAY PLANT 1. " .,,.

' __..,B 3.3.2-6 : .' 1,I.., .I ' ! - - Revision 5

AU ESFAS Instrumentation B 3.3.2 BASES APPLICABLE Safety Iniection (continued)

SAFETY ANALYSES,

Enabling automatic switchover of Emergency Core Cooling LCO, AND Systems (ECCS) suction to containment recirculation APPLICABILITY sumps, coincident with RWST low-low I level;

Emergency DG start;

Initiation of LSELS LOCA sequencer,

Containment Cooling;

Emergency Exhaust System in the LOCA (SIS) mode;

Start of ESW and CCW pumps; and

Hydrogen mixing fans start in slow speed.

These other functions ensure:

Isolation of nonessential systems through containment penetrations;

Trip of the turbine and reactor to limit power generation;

Isolation of main feedwater (MFW) to limit secondary side mass losses;

Start of AFW to ensure secondary side cooling capability;

Isolation of SG blowdown and sample lines to limit uncontrolled SG blowdown;

Enabling ECCS suction from the refueling water storage tank (RWST) switchover on low-low I RWST level to ensure continued cooling via use of the containment recirculation sumps;

Emergency loads for LOCA are properly sequenced and powered;

Containment cooling to preserve containment integrity; (continued) V CALLAWAY PLANT B 3.3.2-7 Revision 5

ESFAS Instrumentation i ' ). Hr B 3.3.2 BASES

APPLICABLE; Safety Iniection '(c6ntinued)

SAFETY ANALYSES, Emergency Exhaust System operation in the LOCA (SIS)

LCO, AND - mode to maintain the auxiliary building at a negative

APPLICABILITY pressure and filter its exhaust;

-I, . ! : I,

-. Start of ESW and CCW to service safety-related systems; and -

. Hydrogen mixing fans start in slow speed to protect the mixing fan motors.

a.; Safety Iniection - Manual Initiation The LCO requires one channel per train to be OPERABLE.

The'operator can initiate SI at any time by using either of

-two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.

The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has

'manual ESFAS initiation capability.

'Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinet. Each switch actuates both trains. This configuration does not allow testing at power.

1 ., I- 11. .- .b SafetV Iniection - Automatic Actuation Logic and Actuation Relays (SSPS)

,i - ' , -

This LCO requires two trains to be OPERABLE. Actuation

-logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.

,Manual and automatic initiation of SI must be OPERABLE

' -in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. Manual Initiation is

. also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available

- 'to manually actuate required components in the event of a (continued)

CALLAWAY PLANT , _:-- '.I1.-. .. B 3.3.2 -8 -i i Revision 5

I ESFAS Instrumentation B 3.3.2 BASES APPLICABLE b. Safety Iniection - Automatic Actuation Logic and Actuation SAFETY Relays (SSPS) (continued)

ANALYSES, LCO, AND DBA, but because of the large number of components APPLICABILITY actuated on a Si, actuation is simplified by the use of the manual actuation switches. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.

These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.

c. Safety Iniection - Containment Pressure - High 1 This signal provides protection against the following accidents:

SLB inside containment;

LOCA; and

Feed line break inside containment.

Containment Pressure - High 1 provides no input to any control functions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic. The transmitters (d/p cells) and electronics are located outside of containment with the sensing line (high pressure side of the transmitter) located inside containment.

Thus, the high pressure Function will not experience any adverse environmental conditions and the Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is *3.5 psig.

Containment Pressure - High 1 must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary systems to pressurize the (continued)

CALLAWAY PLANT B 3.3.2-9 Revision 5

ESFAS Instrumentation B 3.3.2 4:.

.BASES APPLICABLE: c. Safety Iniection - Containment Pressure - Hiph'l SAFEETY (continued)

ANALYSES,

- LCO, AND containment following a pipe break. In MODES 4, 5, APPLICABILITY and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment.

d. Safety Iniection - Pressurizer Pressure - Low This signal'provides protection against the following accidents:

'* Inadvertent opening of a steam generator (SG) atmospheric steam dump valve or safety valve;

. SLB;

-A spectrum'of rod cluster control assembly ejection accidents (rod ejection);

*Inadvertent opening of a pressurizer PORV or safety valve;

LOCAs; and

SG Tube Rupture.

The pressurizer pressure channels provide both control and protection functions: input to the Pressurizer Pressure Control System, reactor trip, Si, and automatic PORV actuation. Therefore, the actuation logic must be able to withstand both an input failure to control system, which X may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Thus, four OPERABLE channels are recjuired to satisfy the requirements with a two-out-of-four logic.

The transmitters are located inside containment, with the

taps in the vapor space region of the pressurizer, and thus possibly experiencing adverse environmental conditions

' '(LOCA, SLB inside containment, rod ejection). Therefore,

' the Trip Setpoint reflects the inclusion of both steady state and adverse environment instrument uncertainties. The Trip Setpoint is Ž 1849 psig.

(continued)

CALLAWAY PLANT ' - B 3.3.2-1 0 AP .'- Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE d. Safety Iniection - Pressurizer Pressure - Low (continued)

SAFETY ANALYSES, This Function must be OPERABLE in MODES 1, 2, and 3 LCO, AND (above P-1I and below P-11 unless the Safety Injection -

APPLICABILITY Pressurizer Pressure - Low Function is blocked) to mitigate the consequences of an HELB inside containment. This signal may be manually blocked by the operator below the P-11 setpoint. Automatic Si actuation below this pressure setpoint is then performed by the Containment Pressure -

High 1 signal.

This Function is not required to be OPERABLE in MODE 3 below the P-11 setpoint. Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.

e. Safety Iniection - Steam Line Pressure Steam Line Pressure - Low Steam Line Pressure - Low provides protection against the following accidents:

SLB;

Feed line break; and

Inadvertent opening of an SG atmospheric steam dump valve or an SG safety valve.

Steam Line Pressure - Low provides no input to any control functions. Thus, three OPERABLE channels on each steam line are sufficient to satisfy the protective requirements with a two-out-of-three logic on each steam line.

With the transmitters located inside Area 5 (the steam tunnel), it is possible for them to experience adverse environmental conditions during a secondary side break. Therefore, the Trip Setpoint reflects both steady state and adverse environment instrument uncertainties. The Trip Setpoint is 2 615 psig.

(continued)

CALLAWAY PLANT B 3.3.2-11 Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE -'Steam Line Pressure - Low (continued)"

SAFETY

-"ANALYSES, This Function is anticipatory

.- in nature and has a LCO, AND :,.,lead/lag ratio of 50/5.

\PPLICABILITY ii.

Steam Line Pressure - Low must be OPERABLE in MODES .1,2, and 3 (above P-11 and below P-11

-. , - -- unless the Safety Injection - Steam Line Pressure -

- - .Low Function is blocked) when a secondary side

... break or stuck open valve could result in the rapid

-depressurization of the steam lines. This signal may be manually blocked by the operator below the P-.11 setpoint. Below P-11, feed line break is not a concern. Inside containment SLB will be terminated by automatic Si actuation via Containment Pressure - High 1, and outside containment SLB will be terminated by the Steam

-. -Line Pressure - Negative Rate - High signal for

. steam line isolation. This Function is not required

m. -;to be OPERABLE in MODE 4, 5, or 6 because

- -. there is insufficient energy in the secondary side of the unit to have a significant effect on required plant

. .equipment.

2. Containment Spray.

- Containment Spray provides three primary functions:

J., Lowers containment pressure and temperature after an

-HELB in containment;

2. Reduces the amount of radioactive iodine in the containment atmosphere; and

.3. Adjusts the pH of the water in the containment recirculation sumps after a large break LOCA, in conjunction with the

-Recirculation Fluid pH Control (RFPC) system.

-These functions are necessary to:

,Ensure the pressure boundary integrity of the containment structure; .

a-l.imit the release of radioactive iodine to the environment in

-".;the event of a failure of the containment structure; and (continued)

CALLAWAY PLANT .- '- B 3.3.2-12 ":, . : -'.Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 2. Containment Spray (continued)

SAFETY ANALYSES,

Minimize corrosion of the components and systems inside LCO, AND containment following a LOCA.

APPLICABILITY The containment spray actuation signal starts the containment spray pumps and aligns the discharge of the pumps to the containment spray nozzle headers in the upper levels of containment. Water is initially drawn from the RWST by the containment spray pumps. When the RWST reaches the low-low 2 level setpoint, the spray pump suctions are manually realigned to the containment recirculation sumps if continued containment spray is required. Containment spray is actuated by Containment Pressure-High 3.

a. Containment Spray - Manual Initiation The operator can initiate containment spray at any time from the control room by simultaneously turning two containment spray actuation switches in the same train.

Because an inadvertent actuation of containment spray could have such serious consequences, two switches must be turned simultaneously to initiate containment spray.

There are two sets of two switches each in the control room. Simultaneously turning the two switches in either set will actuate containment spray in both trains in the same manner as the automatic actuation signal. Two Manual Initiation switches in each train are required to be OPERABLE to ensure no single failure disables the Manual Initiation Function. Note that Manual Initiation of containment spray also actuates Phase B containment isolation.

b. Containment Spray -Automatic Actuation Logic and Actuation Relays (SSPS)

Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

Manual and automatic initiation of containment spray must be OPERABLE in MODES 1, 2, and 3 when there is a potential for an accident to occur, and sufficient energy in the primary or secondary systems to pose a threat to containment integrity due to overpressure conditions.

Manual initiation is also required in MODE 4, even though (continued) "

CALLAWAY PLANT B 3.3.2-13 Revision 5

ESFAS Instrumentation B 3.3.2 BASES

- APPLICABLE b. Containment Spray -Automatic Actuation Lo-gic and SAFETY Actuation Relays (SSPS) (continued)

ANALYSES, LCO,-AND automatic actuation is not required. In this MODE, APPLICABILITY -adequate time is available to manually actluate required components in the event of a DBA. However, because of the large number of components actuated on a containment spray, actuation is simplified by the use of the manual actuation switches. Automatic actuation logic and

-- actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary and secondary systems to result in containment overpressure. In MODES 5 and 6, there is also adequate time for the operators to evaluate unit conditions and respond, to mitigate the consequences of abnormal conditions by manually starting individual components.

c. Containment Spray - Containment Pressure

--This signal provides protection against a LOCA or an SLB inside containment. The transmitters (d/p cells) are l6cated outside of containment with the sensing line (high

-pressure side of the transmitter) located inside containment. The transmitters and electronics are located outside of containment. Thus, they will not experience any adverse environmental conditions and the Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is

27.0 psig.

This is'one of the only Functions that requires the bistable output to energize to perform its required action (see also

-ESFAS Function 7.b). It is not desirable to have a loss of power actuate'containment spray, since the consequences of ah inadvertent actuation of containment spray could be serious. 'Note that this Function also has the inoperable channel placed in' bypass rather than trip to decrease the probability of an inadvertent actuation.

-I* ':Four channels are used in a two-out-of-four logic configuration. This configuration is called the Containment

-'Pressure-High 3 Setpoint. Additional redundancy is

- warranted because this Function is energize to trip.

Containment Pressure-High 3 must be OPERABLE in

-- MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment (continued)

CALLAWAY PLANT I.. . ., B 3.3.2-14 Revision 5

I.

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE C. Containment Spray - Containment Pressure (continued)

SAFETY ANALYSES, following a pipe break. In MODES 4, 5, and 6, there is LCO, AND insufficient energy in the primary and secondary sides to APPLICABILITY pressurize the containment and reach the Containment Pressure-High 3 setpoint.

3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment. This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.

There are two separate Containment Isolation signals, Phase A and Phase B. Phase A isolation isolates all automatically isolable process lines, except component cooling water (CCW), at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required) method of decay heat removal. Since CCW is required to support RCP operation, not isolating CCW on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS circulation to cool the unit. Isolating CCW on the low pressure signal may force the use of feed and bleed cooling, which could prove more difficult to control.

Phase A containment isolation is actuated automatically by SI, or manually via the automatic actuation logic. All process lines penetrating containment, with the exception of CCW, are isolated.

CCW is not isolated at this time to permit continued operation of the RCPs with cooling water flow to the thermal barrier heat exchangers, motor air coolers, and upper and lower bearing coolers. All process lines not equipped with remote operated isolation valves are manually closed, or otherwise isolated, prior to reaching MODE 4.

Manual Phase A Containment Isolation is accomplished by either of two switches in the control room. Either switch actuates both trains. Manual or automatic actuation of Phase A Containment Isolation also actuates Containment Purge Isolation.

The Phase B signal isolates CCW. This occurs at a relatively high containment pressure that is indicative of a large break LOCA or (continued)K' CALLAWAY PLANT B 3.3.2-15 Revision 5

ESFAS Instrumentation B 3.3.2

.'t, .'

v."'t, ,, ,. ...

BASES APPLICABLE .,I

3. - -Containment Isolation (continued)

SAFETY ANALYSES, an SLB. -For these events, forced circulation using the RCPs is no LCO, AND longer desirable. Isolating the CCW at the higher pressure does APPLICABIL .ITY not pose a challenge to the containment boundary because the CCW System is a closed loop inside containment. Although some

-;system components do not meet all of the ASME Code

-requirements applied to the containment itself, the system is continuously pressurized to a pressure greater than the Phase B setpoint. Thus, routine operation demonstrates the integrity of the

-system pressure boundary for pressures exceeding the Phase B setpoint.. Furthermore, because system pressure exceeds the

-- Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment. Therefore, the combination of CCW System design and Phase B isolation ensures the CCW System is not a potential path for radioactive release from containment.

Phase B containment isolation is actuated by Containment

. .-.I i Pressure - High 3, or manually, via the automatic actuation logic, as previously discussed. For containment pressure to reach a

- value high enough to actuate Containment Pressure - High 3, a large break LOCA or SLB must have occurred and containment

- - .. spray must have been actuated. RCP operation will no longer be

- required .and CCW to the RCPs is, therefore, no longer necessary.

The RCPs can be operated with seal injection flow alone and without CCW flow to the thermal barrier heat exchanger.

Manual Phase B Containment Isolation is accomplished by the same switches that actuate Containment Spray. When the two switches in either set are turned simultaneously, Phase B Containment Isolation and Containment Spray will be actuated in

both trains.'

. a.:

a Containment Isolation - Phase A Isolation

- . (1) Phase A Isolation - Manual Initiation

, -Manual Phase A Containment Isolation is actuated

-by either of two switches in the control room. Either switch actuates both trains.

-. j.

1, . .: . " .1 (continued)

CALLAWAY PLANT i- I .- 13 3.3.2-16 Ai . Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE a. Containment Isolation - Phase A Isolation (continued)

SAFETY ANALYSES, (2) Phase A Isolation -Automatic Actuation Logic and LCO, AND Actuation Relays (SSPS)

APPLICABILITY Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

Manual and automatic initiation of Phase A Containment Isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a Phase A Containment Isolation, actuation is simplified by the use of the manual actuation switches. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary or secondary \J systems to pressurize the containment to require Phase A Containment Isolation. There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.

(3) Phase A Isolation - Safety Iniection Phase A Containment Isolation is also initiated by all Functions that initiate Si.

The Phase A Containment Isolation requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1.

Instead, Function 1, Si, is referenced for all initiating Functions and requirements.

b. Containment Isolation - Phase B Isolation Phase B Containment Isolation is accomplished by Manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure channels (the same (continued)

CALLAWAY PLANT B 3.3.2-17 Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE -b.- Containment Isolation - Phase B Isolation' (continued)

SAFETY ANALYSIS; -channels that actuate Containment Spray, Function 2).

LCO, AND-. The Containment Pressure trip of Phase B Containment APPLICABILITY Isolation' is Energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.

(1) Phase B Isolation -Manual Initiation (2) r Phase B Isolation -Automatic Actuation Logic and Actuation Relays (SSPS)

Manual and automatic initiation of Phase B containment isolation must be OPERABLE in

-. 'MODES 1, 2, and 3, when there is a potential for an

- - - 'accident to occur. Manual initiation is also required

- in MODE 4 even though automatic actuation is not

- required. In this MODE, adequate time is available to manually actuate required components in the

- - - -:- event of a DBA. However, because of the large number of components actuated on a Phase B containment isolation, actuation is simplified by the

- ',;use of the manual actuation switches. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is

* - ': .... e ':insufficient energy in the primary or secondary

' ' systems to pressurize the containment to require Phase B containment isolation. There also is adequate time for the operator to evaluate unit

-conditions

' and manually actuate individual isolation valves in response to abnormal or accident conditions.

(3) .Phase B Isolation - Containment Pressure v ' ' The basis for containment pressure MODE

- ;applicability and the Trip Setpoint are as discussed for ESFAS Function 2.c above.

4. Steam Line Isolation Isolation of the main steam lines provides protection in the event

- of an SLB inside oreoutside'containment. Rapid isolation of the

- . .-

steam lines will limnit the steam break accident to the blowdown (continued)

.CALLAWAY PLANT 1: --' -13 3.3.2-18 . . Revision 5

1.

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 4. Steam Line Isolation (continued)

SAFETY ANALYSES, from one SG, at most. For an SLB upstream of the main steam LCO, AND isolation valves (MSIVs), inside or outside of containment, closure APPLICABILITY of the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident as soon as the steam lines depressurize. Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.

a. Steam Line Isolation - Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two pushbuttons in the control room and either pushbutton can initiate action to immediately close all MSIVs. The LCO requires two channels to be OPERABLE.

b. Steam Line Isolation -Automatic Actuation Logic and Actuation Relays (SSPS)

Automatic actuation logic and actuation relays in the SSPS'K, consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

c. Steam Line Isolation -Automatic Actuation Logic and Actuation Relays (MSFIS)

As discussed in Reference 13, the Main Steam and Feedwater Isolation System (MSFIS) includes three redundant programmable logic controllers (PLCs) per logic train, arranged in a two-out-of-three voting configuration for each train. The three PLCs in each train operate in parallel, each receiving all of the input signals. Each of the outputs from each PLC drives a relay. The relay contacts are arranged in a two-out-of-three voting scheme, requiring that at least two PLCs agree upon the output before that train can initiate an isolation function. Each train requires a minimum of two PLCs to be OPERABLE.

Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident. This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation (continued)

CALLAWAY PLANT B 3.3.2-19 Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 4. - Steam Line Isolation (continued) :

SAFETY ANALYSES, Function is required in MODES 2 and 3 unless all MSIVs are LCO, AND closed. In MODES 4, 5, and 6, there is insufficient energy in the APPLICABILITY RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.

- d. Steam Line Isolation - Containment Pressure - HiQh 2

' -This Function actuates closure of the MSIVs in the event of a' LOCA or an SLB inside containment to maintain at least i- one unfaulted SG as a heat sink for the reactor, and to limit

'the mass and energy release to containment. The transmitters (d/p cells) are located outside containment with the sensing line (high pressure side of the transmitter) located inside containment. Containment Pressure -

High 2 provides no input to any control functions. Thus,

- :.- three OPERABLE channels are sufficient to satisfy

.' ' ' - ';- protective requirements with two-out-of-three logic. The transmitters and electronics are located outside of

- containment. Thus, they will not experience any adverse

- - -environmental conditions, and the Trip Setpoint reflects v -only steady state instrument uncertainties. The Trip

Setpoint is* 17.0 psig.

Containment Pressure - High 2 must be OPERABLE in

'MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant

- increase in the containment pressure, thus allowing

'detection and closure of the MSIVs. The Steam Line

-' 'Isolation Function is required to be OPERABLE in

'MODES 2 and 3 unless all MSIVs are closed. In MODE 4,

- -the increase in containment pressure following a pipe

-'break would occur over a relatively long time period such

-that' manual action could reasonably be expected to

- provide protection and ESFAS Function 4.d need not be

- OPERABLE In MODES 5 and 6, there is not enough

- energy in the primary and secondary sides to pressurize

- the containment to the Containment Pressure - High 2 setpoint.

.n... . .o

- (continued)

CALLAWAY PLANT . -B 3.3.2-20 Revision 5

- IN ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 4. Steam Line Isolation (continued)

SAFETY ANALYSES, e. Steam Line Isolation - Steam Line Pressure LCO, AND APPLICABILITY (1) Steam Line Pressure - Low (continued)

Steam Line Pressure - Low provides closure of the MSIVs in the event of an SLB to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment. This Function provides closure of the MSIVs in the event of a feed line break to ensure a supply of steam for the turbine driven AFW pump.

Steam Line Pressure - Low was discussed previously under SI Function 1.e and the Trip Setpoint is the same.

Steam Line Pressure - Low Function must be OPERABLE in MODES 1, 2, and 3 (above P-11 and below P-11 unless safety injection on low steam line pressure is blocked), with any main steam isolation valve open, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the P-11 setpoint. If not blocked below P-11, the function must be OPERABLE. When blocked, an inside containment SLB will be terminated by automatic actuation via Containment Pressure -

High 2. Stuck valve transients and outside containment SLBs will be terminated by the Steam Line Pressure - Negative Rate - High signal for Steam Line Isolation below P-11 when SI has been manually blocked. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed. This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have a significant effect on required plant equipment.

(2) Steam Line Pressure - Negative Rate - High Steam Line Pressure - Negative Rate - High provides closure of the MSIVs for an SLB when (continued)

CALLAWAY PLANT B 3.3.2-21 Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE (2) :-Steam Line Pressure - Negative Rate - High SAFETY (continued)

~IANALYSES, LCO, AND less than the P-11 setpoint, to maintain at least one APPLICABILITY unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.

When the operator manually blocks the Steam Line Pressure - Low main steam isolation signal when less than the P-11 setpoint, the Steam Line Pressure - Negative Rate - High signal is automatically enabled. Steam Line Pressure -

Negative Rate - High provides no input to any control functions. Thus, three OPERABLE channels on each steam line are sufficient to satisfy requirements with a two-out-of-three logic.

Steam Line Pressure - Negative Rate - High must be OPERABLE in MODE 3 when less than the P-11

setpoint (may be blocked below P-11 when safety injection on low steam line pressure is not blocked),

-when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). In MODES 1 and 2, and in MODE 3, when above the P-11 setpoint, this signal is automatically disabled and the Steam Line Pressure - Low signal is automatically enabled.

The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MSIVs are closed. In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to have an SLB or other accident that would result in a release of significant enough quantities of energy to cause a cooldown of the RCS.

-- While the transmitters may experience elevated i-ambient temperatures due to an SLB, the trip function is based on rate of change, not the absolute accuracy of the indicated steam pressure.

Therefore, the Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is

- .100 psi with a rate/lag controller time constant 2 50 seconds.

(continued)

CALLAWAY PLANT ` - B 3.3.2-22 . Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 5. Turbine Trip and Feedwater Isolation SAFETY ANALYSES, The primary functions of the Turbine Trip and Feedwater Isolation LCO, AND signals are to prevent damage to the turbine due to water in the APPLICABILITY steam lines and to stop the excessive flow of feedwater into the (continued) SGs. These Functions are necessary to mitigate the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows.

The Function is actuated when the level in any SG exceeds the high high setpoint and performs the following functions:

- . Trips the main turbine;

Trips the MFW pumps, closing the pump discharge valves; and

. Initiates feedwater isolation.

This Function is actuated by SG Water Level - High High, or by an SI signal. The RTS also initiates a turbine trip signal whenever a K.

reactor trip (P4) is generated. In the event of SI, the unit is taken off line and the turbine generator must be tripped. The MFW System is also taken out of operation and the AFW System is automatically started. The SI signal was previously discussed.

While the above discussion applies to both turbine trip and feedwater isolation in response to excessive feedwater in MODES 1 and 2, feedwater isolation on SG low-low level is required for events in MODES 1, 2, and 3 where the assurance of AFW delivery to the intact steam generators is paramount in the accident analysis. The analyses for the Loss of Non-Emergency AC Power, Loss of Normal Feedwater, and Feedwater System Pipe Break events credit feedwater isolation on SG low-low level.

Given the location of the feedwater check valves inside containment downstream of the point where AFW connects to the main feedwater piping, closure of the main feedwater isolation valves (MFIVs) is required to assure AFW flow is not diverted.

The Applicable MODES for the feedwater isolation function on SG low-low level are consistent with those for the MFIVs (LCO 3.7.3) and AFW System (LCO 3.7.5).

(continued)\K>

CALLAWAY PLANT B 3.3.2-23 Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE - .5. Turbine Tric, and Feedwater Isolation' (continued).

SAFETY ANALYSES, a. Turbine Trip and Feedwater Isolation - Automatic Actuation LCO, AND Logic and Actuation Relays (SSPS) '

APPLICABILITY Automatic Actuation Logic and Actuation Relays in the SSPS consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

b.' Feedwater Isolation -Automatic Actuation Logic and Actuation Relays (MSFIS)

Automatic Actuation Logic and Actuation Relays in the MSFIS consist of the same features and operate in the same manner as described for ESFAS Function 4.c.

- c: Turbine Trip and Feedwater Isolation - Steam Generator

I ' Water Level - High High (P-14) i is . -.

-This signal provides protection against excessive feedwater'flow. The ESFAS SG water level instruments provide input to the SG Water Level Control System.

- ,. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single

- failure in the other channels providing the protection function actuation. Thus, four OPERABLE channels per

.. I SG are required to satisfy the requirements with a two-out-of-four logic in any SG resulting in actuation signal

- generation.

.The transmitters (d/p cells) are located inside containment.

-However, the events that this Function protects against cannot cause a severe environment in containment.

-'The'ref6ie, the Trip Setpoint reflects only steady state

' ^ 'instrument uncertainties. The Trip Setpoint is

78% of

- 1' narrow range span.

d. Turbine Trio and Feedwater Isolation - Safety Iniection Turbine Trip and Feedwater Isolation are also initiated by

allFunitions that initiate Si. The Feedwater Isolation

-Function requirements for these Functions are the same as the requirements for their Si function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead (continued)

CALLAWAY PLANT f-,. - _-, . B 3.3.2-724 CA P N ' 3' Revision 5

I .

ESFAS Instrumentation B 3.3.2 BASES V APPLICABLE d. Turbine Trip and Feedwater Isolation - Safety Iniection SAFETY (continued)

ANALYSES, -

LCO, AND Function 1, Si, is referenced for all initiating functions and APPLICABILITY requirements.

e. Feedwater Isolation - Steam Generator Water Level - Low Low SG Water Level - Low Low provides protection against a loss of heat sink by ensuring the isolation of normal feedwater and AFW delivery to the steam generators.

Given the location of the feedwater line check valves inside containment downstream of the point where AFW connects to the main feedwater piping, closure of the MFIVs is required to assure AFW flow is not diverted. A feedwater line break or a loss of MFW would result in a loss of SG water level. SG Water Level - Low Low provides input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system, which may then require a protection function actuation, and a single failure in the other channels providing the protection function actuation.

Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic (the Environmental Allowance Modifier (EAM) and Trip Time Delay (TTD) functions also use a two-out-of-four logic). Two-out-of-four low level signals in any SG initiates feedwater isolation. As discussed in Reference 11, the SG Water Level - Low Low trip Function has been modified to allow a lower Trip Setpoint under normal containment environmental conditions and a delayed trip when THERMAL POWER is less than or equal to 22.41% RTR The EAMITTD circuitry reduces the potential for inadvertent trips via the EAM, enabled on containment pressure exceeding its setpoint, and the TTD, enabling time delays dependent on vessel AT as listed in Table B 3.3.2-1. Because the SG Water Level transmitters (d/p cells) are located inside containment, they may experience adverse environmental conditions due to a feedline break.

The EAM function is used to monitor the presence of adverse containment conditions (elevated pressure) and enables the Steam Generator Water Level - Low Low (Adverse) trip setpoint to reflect the increased transmitter uncertainties due to this harsh environment. The EAM (continued)

CALLAWAY PLANT B 3.3.2-25 Revision 5

ESFAS Instrumentation B 3.3.2 I.

B,.,ASES. . a.I BASES APPLICABLE e. Feedwater Isolation'- Steam GeneratorWater Level - Low SAFETY Low (continued) ', '

ANALYSES, LCO, AND enables a lower Steam Generator Water Level - Low Low APPLICABILITY (Normal) trip setpoint when these conditions are not present,'thus allowing more margin to trip for normal operating conditions. The TTD delays feedwater isolation on SG Water Level.- Low Low, thereby providing additional operating margin during early power ascension by allowing the operator time to recover level when the primary side load is sufficiently small to not require an earlier isolation.

The TTD continuously monitors primary side power using Vessel AT. Scaling of the Vessel AT channels is dependent on the loop-specific values for AT,, discussed under the OTAT and OPAT trips. Two time delays are provided,- based on the primary side power levels; the magnitude of the trip delay decreases with increasing power. If the EAM or TTD trip functions have inoperable required channels, it is acceptable to place the inoperable channels in the tripped condition and continue operation.

Placing the inoperable channels in the trip mode enables the Steam Generator Water Level - Low Low (Adverse)

Function, for the EAM, or removes the trip delay for the TTD. If the Steam Generator Water Level - Low Low (Normal) trip Function has an inoperable required channel, the inoperable channel must be tripped, subject to the LCO Applicability footnote. I The SG Water Level - Low Low Trip Setpoints are chosen to reflect both steady state and adverse environment instrument behavior. The Trip Setpoints for the Steam Generator Water Level - Low Low (Adverse Containment Environment) and (Normal Containment Environment) bistables are Ž 27.0% and Ž 21.6% of narrow range span, I

- respectively The Trip Setpoints for the Vessel AT (Power-1) and (Power-2) bistables are < Vessel AT Equivalentfto 12.41% RTP and < Vessel AT Equivalent to i22.41% 'RTP, respectively, with corresponding trip time delays of

232 seconds and

122 seconds. The Trip Setp'6int for the Containment Pressure - Environmental Allowance Modifier bistables is < 1.5 psig.

Turbine Trip 6nd Feedwater Isolation Function 5.c, SG Water LeveHih High; and Feedwater Isolation Function 5.e.(3), SG Water Level Low-Low Vessel AT Equivalent, must be OPERABLE in MODES 1 and 2 except when all MFIVs are closed. In (continued)

CALLAWAY PLANT .- '. B 3.3.2-26 CLAAPL TB3326Revision 5

ESFAS Instrumentation B 3.3.2 BASES ki APPLICABLE 5. Turbine Trip and Feedwater Isolation (continued)

SAFETY ANALYSES, MODES 3, 4, 5, and 6, Functions 5.c and 5.e.(3) are not required LCO, AND to be OPERABLE. All other Turbine Trip and Feedwater Isolation APPLICABIILITY Functions must be OPERABLE in MODE 1, MODE 2 (except when all MFIVs are closed), and MODE 3 (except when all MFIVs are closed). The SG Water Level Low-Low (Normal Containment Environment) channels do not provide protection when the Containment Pressure - Environmental Allowance Modifier (EAM) channels in the same protection sets are tripped since that enables the SG Water Level Low-Low (Adverse Containment Environment) channels with a higher water level trip setpoint. As such, the SG Water Level Low-Low (Normal Containment Environment) channels need not be OPERABLE when the Containment Pressure - EAM channels in the same protection sets are tripped, as discussed in a footnote to Table 3.3.2-1.

6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available. The system has two motor driven pumps and a turbine driven pump, making it available during normal unit operation, v during a loss of AC power, a loss of MFW, and during a Feedwater System pipe break. The normal source of water for the AFW System is the condensate storage tank (CST). A loss of suction pressure, coincident with an auxiliary feedwater actuation signal (AFAS), will automatically realign the pump suctions to the safety related Essential Service Water (ESW) System. The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately.

- a. Auxiliary Feedwater - Manual Initiation Manual initiation of Auxiliary Feedwater can be accomplished from the control room. Each of the three AFW pumps has a pushbutton for manual AFAS initiation.

The LCO requires three channels to be OPERABLE.

b. AuxiliarV Feedwater - Automatic Actuation Loqic and Actuation Relays (SSPS)

Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

(continued) -

CALLAWAY PLANT B 3.3.2-27 Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE- -- 6. Auxiliary Feedwater (continued) - 'I SAFETY ANALYSES, c. Auxiliary Feedwater -Automatic Actuation Logic and LCO, AND. Actuation Relays (BOP ESFAS)

APPLICABILITY ;

Automatic actuation logic and actuation relays consist of similar features and operate in a similar manner as

,described for SSPS in ESFAS Function 1.b.

d. Auxiliary Feedwater - Steam Generator Water Level -

Low Low SG Water Level - Low Low provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level - Low Low provides input to

.the SG Water Level Control System. Therefore, the

- - actuation logic must be able to withstand both an input

-: failure to the control system, which may then require a

- - protection function actuation, and a single failure in the other channels providing the protection function actuation.

Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic (the Environmental Allowance Modifier (EAM) and Trip Time Delay (TTD) functions also use a two-out-of-four logic). Two-out-of-four

- low level signals in any SG starts the motor-driven AFW pumps; in two SGs starts the turbine-driven AFW pump.

- ._As discussed in Reference 11, the SG Water Level -

Low Low trip Function has been modified to allow a lower

'Trip Setpoint under normal containment environmental

-. conditions and a delayed trip when THERMAL POWER is

-less than or equal to 22.41% RTP.

r ~ . ' , *1 The EAM/TTD circuitry reduces the potential for

- -inadvertent trips via the EAM, enabled on containment pressure exceeding its setpoint, and the TTD, enabling time delays dependent on vessel AT as listed in Table

. 'B 3.3.2-1. Because the SG Water Level transmitters (d/p

-cells)'are located inside containment, they may experience adverse environmental conditions due to a feedline break.

The EAM function is used to monitor the presence of advers'e containment conditions (elevated pressure) and

.enables the Steam Generator Water Level - Low Low (Adverse) trip setpoint to reflect the increased transmitter

Uncertainties due to this harsh environment. The EAM enables a lower Steam Generator Water Level - Low Low (continued)

. CALLAWAY PLANT . ., ; B 3.3.2-28 , -Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE d. Auxiliary Feedwater - Steam Generator Water Level -

SAFETY Low Low (continued)

ANALYSES, LCO, AND (Normal) trip setpoint when these conditions are not APPLICABILITY present, thus allowing more margin to trip for normal operating conditions. The TTD delays AFW actuation on SG Water Level - Low Low, thereby providing additional operational margin during early power ascension by allowing the operator time to recover level when the primary side load is sufficiently small to not require an earlier actuation. The TTD continuously monitors primary side power using Vessel AT. Scaling of the Vessel AT channels is dependent on the loop-specific values for AT,,

discussed under the OTAT and OPAT trips. Two time delays are provided, based on the primary side power level; the magnitude of the trip delay decreases with increasing power. If the EAM or TTD trip functions have inoperable required channels, it is acceptable to place the inoperable channels in the tripped condition and continue operation. Placing the inoperable channels in the trip mode enables the Steam Generator Water Level -

Low Low (Adverse) Function, for the EAM, or removes the trip delay for the TTD. If the Steam Generator Water Level K.j

- Low Low (Normal) trip Function has an inoperable required channel, the inoperable channel must be tripped, subject to the LCO Applicability footnote.

The Trip Setpoint reflects the inclusion of both steady state and adverse' environment instrument uncertainties. The Trip Setpoints for the SG Water Level - Low Low (Adverse Containment Environment) and (Normal Containment Environment) bistables are Ž 27.0% and Ž 21.6% of narrow I range span, respectively. The Trip Setpoints for the Vessel AT (Power-1) and (Power-2) bistables are

Vessel AT Equivalent to 12.41% RTP and

Vessel AT Equivalent to 22.41% RTP, respectively, with corresponding trip time delays of

232 seconds and

122 seconds. The Trip Setpoint for the Containment Pressure - Environmental Allowance Modifier bistables is

1.5 psig.

e. Auxiliarv Feedwater - Safety Iniection An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function. Therefore, the requirements are not (continued&

CALLAWAY PLANT B 3.3.2-29 .Revision 5-

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE e. Auxiliary Feedwater- Safety Iniection (continued)

SAFETY

- ANALYSES, 'repeated in Table 3.3.2-1. Instead, Function 1,Si, is

-LCO, AND .:referenced for all initiating functions and requirements.

APPLICABILITY'-:

AT -. f. Auxiliary Feedwater - Loss of Offsite Power The loss of offsite power (LOP) is detected by a voltage drop on each ESF bus. The LOP is sensed and processed by the circuitry for LOP DG Start (Load Shedder and Emergency Load Sequencer) and fed to BOP ESFAS by relay actuation. Loss of power to either ESF bus will start the turbine driven AFW pump, to ensure that at least one SG contains enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip, and automatically isolate the SG blowdown and sample lines. In addition, once the diesel generators are started and up to speed, the motor driven AFW pumps will be sequentially loaded onto the diesel generator

'buses.

, -Functions 6.a through 6.f must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor, except Function 6.d.(3) which must be OPERABLE in only MODES 1 and 2. Vessel AT is used to

-limit the 'allowed trip time delay only when greater than 12.41% RTR Below 12.41% RTP the maximum time delay is 'permitted; therefore, . no OPERABILITY requirements should be imposed on the Vessel AT channels in MODE 3.

SG Water Level - Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is

- - aligned, so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level -

-Low Low in' any two operating SGs will cause the turbine driven pump to . start. The SG Water Level Low-Low (Normal Containment Environment) channels do not

- provide' protection. when the Containment Pressure -

-Environmental Allowance Modifier (EAM) channels in the

.-. same protection sets are tripped since that enables the SG Water Level Low-Low (Adverse Containment Environment)

-channels with a higher water level trip setpoint. As such,

',the SG Water Level Low-Low (Normal Containment Environment) channels need not be OPERABLE when the Containment Pressure - EAM channels in the same

^ - .~ 'protection sets are tripped, as discussed in a footnote to

- Table 3.3.2-1. These Functions do not have to be (continued)

CALLAWAY PLANT .. . " B 3.3.2-30 Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 6. Auxiliary Feedwater (continued)

SAFETY ANALYSES, OPERABLE in MODES 5 and 6 because there is not enough heat LCO, AND being generated in the reactor to require the SGs as a heat sink.

APPLICABILITY In MODE 4, AFW actuation does not need to be OPERABLE because eitherAFW or residual heat removal (RHR) will be available to remove decay heat or sufficient time is available to manually place either system in operation.

g. Auxiliary Feedwater - Trip of All Main Feedwater Pumps A Trip of all MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure. Each turbine driven MFW pump is equipped with two pressure switches (one in separation group 1 and one in separation group 4) on the oil line for the speed control system. A low pressure signal from either of these pressure switches indicates a trip of that pump. Two OPERABLE channels per pump satisfy redundancy requirements with one-out-of-two logic on both.

pumps required for signal actuation. A trip of all MFW 'I pumps starts the motor driven AFW pumps to ensure that at least one SG is available with water to act as the heat sink for the reactor.

- Function 6.g must be OPERABLE in MODES 1 and 2. This ensures that at least one SG is provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. In MODES 3, 4, and 5, the MFW pumps may be normally shut down, and thus pump trip is not indicative of a condition requiring automatic AFW initiation. Note (n) of Table 3.3.2-1 allows the blocking of this trip function just before shutdown of the last operating main feedwater pump and the restoration of this trip function just after the first main feedwater pump is put into service following its startup trip test. This limits the potential for inadvertent AFW actuations during normal startups and shutdowns.

h. Auxiliary Feedwater - Pump Suction Transfer on Suction Pressure - Low A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal supply of water for the pumps, the CST. Three pressure (continued)\'J CALLAWAY PLANT B 3.3.2-31 Revision 5

ESFAS Instrumentation B 3.3.2

,,, a-BASES APPLICABLE ' ': h.> Auxiliarv Feedwater - Pump Suction Transfer on Suction SAFETY Pressure - Low (continued)

ANALYSES, LCO,-AND -switches are located on the AFW pump suction line from APPLICABILITY the CST. A low pressure signal sensed by any two of the three switches coincident with an auxiliary feedwater actuation signal will cause the emergency supply of water for the pumps to be aligned. ESW (safety grade) is automatically lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW System to maintain at least one of the SGs as the heat sink for reactor decay heat and sensible heat removal.

-. Since the detectors are located in an area not affected by HELBs or high radiation, they will not experience any adverse environmental conditions and the Trip Setpoint

- reflects only steady state instrument uncertainties. The Trip Setpoint is 2 21.71 psia.

This Function must be OPERABLE in MODES 1,2, and 3 to ensure a safety grade supply of water for the AFW System to maintain the SGs as the heat sink for the reactor. This Function does not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.

In MODE 4, AFW automatic suction transfer does not need to be OPERABLE because RHR will already be in operation,'or sufficient time is available to place RHR in operation, to remove decay heat.

7. -Automatic -Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECCS to remove decay heat. The source of water for the RHR pumps is automatically switched to the containment recirculation sumps.

The low head residual heat removal (RHR) pumps and containment spray pumps draw the water from the containment

-recirculation sumps, the RHR pumps pump the water through the

- 'supRHR heat exchanger, inject the water back into the RCS, and

supply the cooled water to the other ECCS pumps. Switchover from the RWST to the containment sumps must occur before the RWST empties to prevent damage to the RHR pumps and a loss

-. -of core cooling capability. For similar reasons, switchover must not occur before there is sufficient water in the containment sumps to support ESF pump suction.

(continued)

CALLAWAY PLANT r. :_B 3.3.2-32 Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 7. Automatic Switchover to Containment Sump (continued)

SAFETY ANALYSES, a. Automatic Switchover to Containment Sump - Automatic LCO, AND Actuation Logic and Actuation Relays (SSPS)

APPLICABILITY Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

b. Automatic Switchover to Containment Sump - Refueling Water Storage Tank (RWST) Level - Low Low Coincident With Safety Iniection During the injection phase of a LOCA, the RWST is the source of water for all ECCS pumps. A low low level in the RWST coincident with an SI signal provides protection against a loss of water for the ECCS pumps and indicates the end of the injection phase of the LOCA. The RWST is equipped with four level transmitters. These transmitters provide no control functions. Therefore, a two-out-of-four logic is adequate to initiate the protection function actuation. Although only three channels would be sufficient, a fourth channel has been added for increased K<,

reliability.

The RWST - Low Low Trip Setpoint is selected to ensure switchover occurs before the RWST empties, to prevent ECCS pump damage.

The transmitters are located in an area not affected by HELBs or post accident high radiation. Thus, they will not experience any adverse environmental conditions and the Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is 2 36% of span.

Automatic switchover occurs only if the RWST low low level signal is coincident with SI. This prevents accidental switchover during normal operation. Accidental switchover could damage ECCS pumps if they are attempting to take suction from an empty sump. The automatic switchover Function requirements for the SI Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.

(continued)~'~

CALLAWAY PLANT B 3.3.2-33 Revision 5

ESFAS Instrumentation B 3.3.2 I- r '. ,

.4.-. y -_ "

BASES APPLICABLE : b. 'Automatic Switchover to Containment Suinrp- Refueling SAFETY Water Storage Tank (RWST) Level - Low Low Coincident ANALYSES, With Safety Iniection (continued)

LCO, AND APPLICABILITY This Function must be OPERABLE in MODES 1, 2, 3, and 4 when there is a potential for a LOCA to occur, to ensure a continued supply of water for the ECCS pumps.

'This Function is not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by

.manually starting systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. System pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.

8. Engineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses.

a. -Engineered Safety Feature Actuation System Interlocks -

Reactor Trip, P-4 The P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker are open.

-;Manual reset of SI following a 60 second time delay, in conjunction with P4, generates an automatic SI block.

This Function allows operators to take manual control of SI

systems afterthe initial phase of injection is complete.

.*Once SI is blocked, automatic actuation of SI cannot occur until the RTBs have been manually closed.

The functions of the P4 interlock are:

- f Triips the main turbine;

Isolates MFW with coincident low Tang; (continued)

CALLAWAY PLANT -'-'-- B 3.3.2-34 'Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE a. Engineered Safety Feature Actuation System Interlocks -

SAFETY Reactor Trio. P-4 (continued)

ANALYSES, LCO, AND

Prevents automatic reactuation of SI after a manual APPLICABILITY reset of SI;

Allows arming of the steam dump valves and transfers the steam dump from the load rejection Tars controller to the plant trip controller; and

Prevents opening of the MFW isolation valves if they were closed on SI or SG Water Level - High High.

Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip. An excessive cooldown of the RCS following a reactor trip could cause an insertion of positive reactivity with a subsequent increase in core power. To avoid such a situation, the noted Functions have been interlocked with PA as part of the design of the unit control and protection system. The feedwater isolation function on-P4 with coincident low Tavg may be blocked using a bypass switch to prevent undue cycling of the FWIVs and AFW pumps.

None of the noted Functions serves a mitigation function in the unit licensing basis safety analyses. Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function. Neither turbine trip, nor any of the other four Functions associated with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are met.

The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. Therefore, this Function has no adjustable trip setpoint with which to associate a Trip Setpoint and Allowable Value.

This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality.

(continued)\>J CALLAWAY PLANT B 3.3.2-35 Revision 5

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 8. ' Engineered Safety Feature Actuation System Interlocks SAFETY (continued)

-ANALYSES, -'

'LCO, AND '-; -- b. Engin6ered Safety Feature Actuation System Interlocks -

APPLICABILITY -' Pressurizer Pressure, P-1I The P-11 interlock permits a normal unit cooldown and

-depressurization without actuation of Si or main steam line isolation. With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-11 setjoint, the operator can manually block the Pressurizer

. 'Pressure - Low and Steam Line Pressure - Low Si signals

-'-nd the Steam Line Pressure - Low steam line isolation

' sighal (previously discussed). When the Steam Line Pres'sure -'Low steam line isolation signal is manually blocked, a main steam isolation signal on Steam Line Pressure - Negative Rate - High is automatically enabled.

"-This'provides

' protection for an SLB by closure of the

'-- - 'MSIVs' With two-out-of-three pressurizer pressure channels above the P-11 setpoint, the Pressurizer Pressure - Low and Steam Line Pressure - Low SI signals

'. ' the:Steam

.and Line Pressure - Low steam line isolation sidnal;are automatically enabled. The operator can also enable these trips by use of the respective manual unblock

'(reset) buttons. When the Steam Line Pressure - Low isolation on Steam Line Pressure - Negative Rate - High is disabled: The Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is

1970 psig.

-~ -.

This Function must be OPERABLE in MODES 1,2, and 3 to'allow an orderly cooldown and depressurization of the unit without the actuation of SI or main steam isolation.

This Function does not have to be OPERABLE in MODE 4,

'5,-or 6 because system pressure must already be below the P-11 setpoint for the requirements of the heatup and

- cooldown curves to be met.

9 r Automatic Pressurizer PORV Actuation For the inadvertent ECCS actuation at power event (a Condition II event); the safety analysis (Ref. 15) credits operator actions from

-the main6 control room to terminate flow from the normal charging puiip'(NCP) and to'open at least one PORV block valve (assumed to initially be closed) and assure the availability of the PORV for automatic pressure relief. Analysis results indicate that (continued)

CALLAWAY PLANT ' B 3.3.2-36 Revision 5

ESFAS Instrumentation B 3.3.2 BASES ^

APPLICABLE 9. Automatic Pressurizer PORV Actuation (continued)

SAFETY ANALYSES, water relief through the pressurizer safety valves, which could APPLICABILITY result in the Condition II event degrading into a Condition III event if the safety valves did not reseat, is precluded if operator actions are taken within the times assumed in the Reference 15 analysis to terminate NCP flow and to assure at least one PORV is available for automatic pressure relief. The assumed operator action times conservatively bound the times measured during simulator exercises. Therefore, automatic PORV operation is an assumed safety function in MODES 1, 2, and 3. The PORVs are equipped with automatic actuation circuitry and manual control capability. The PORVs are considered OPERABLE in either the automatic or manual mode, as long as the automatic actuation circuitry is OPERABLE and the PORVs can be made available for automatic pressure relief by timely operator actions (Ref. 15) to open the associated block valves (if closed) and to assure the PORV handswitches are in the automatic operation position. The automatic mode is the preferred configuration, as this provides the required pressure relieving capability without reliance on operator actions.

a. Automatic Pressurizer PORV Actuation -Automatic Actuation Logic and Actuation Relays (SSPS)

Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for Function 1.b, except that the LCO is not applicable in MODE 4 as discussed below for Function 9.b.

b. Automatic Pressurizer PORVActuation - Pressurizer Pressure - High This signal provides protection against an inadvertent ECCS actuation at power event. Pressurizer pressure provides both control and protection functions: input to the Pressurizer Pressure Control System, reactor trip, SI, and automatic PORV actuation. Therefore, the actuation logic must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four opening logic. The Trip Setpoint is *2335 psig.

4 11-(continued)

CALLAWAY PLANT B 3.3.2-37 Revision 5

ESFAS Instrumentation B 3.3.2

BASE;S-, I.

BASES

'APPLICABLE b. -Automatic Pressurizer PORVActuation - Pressurizer SAFETY Pressure - High (continued)

ANALYSES,

' LCO, AND The'automatic'PORV opening logic is satisfied when two-

'APPLICABILITY out-of-four (2/4) pressurizer pressure channels exceed their setpoint. Continued operation is allowed with one

-cin6perable channel in the tripped condition. In this case, the automatic opening logic would revert to one-out-of-three (1/3). A single failure (e.g., failed bistable card) in one of the remaining three channels could result in both PORVs opening and remaining open since the automatic

' closure logic requires three-out-of-four (3/4) channels to reset, which could not be satisfied with two inoperable channels: However, this event can be terminated by PORV block valve'closure and the consequences of this

'event are bounded by the analysis of a stuck open pressurizer safety valve in Reference 16. Therefore, automatic PORV closure is not a required safety function and the OPERABILITY requirements are satisfied by four OPERABLE pressurizer pressure channels.

Consistent with the Applicability of LCO 3.4.11,

~Pressurizer PORVs," the LCO for Function 9 is not applicable in MODE 4 when both pressure and core energy are decreased and transients that could cause an overpressure condition will be slow to occur. This is also consistent with the Applicability of Functions 1.c, 1.d, and 1.e. LCO 3.4.12 addresses automatic PORV actuation instrumentation requirements in MODES 4 (with any RCS cold leg temperature <2750F), 5, and 6 with the reactor vessel head in place.

The ESFAS instrumentation satisfies Criterion 3 of 10CFR50.36(c)(2)(ii).

ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1.

-In the event a channel's Trip Setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the

. LCO Condition(s) entered for the protection Function(s) affected. When the Required Channels in Table 3.3.2-1 are specified on a per steam line,

-(continued)

CALLAWAY PLANT *I; B 3.3.2-38 Revision 5

ESFAS Instrumentation B 3.3.2 BASES ACTIONS per SG, per pump, etc., basis, then the Condition may be entered (continued) separately for each steam line, SGQ pump, etc., as appropriate.

When the number of inoperable channels in a trip function exceed those specified in one or other related Conditions associated with a trip function, then the unit is outside the safety analysis. Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.

A.1 Condition A applies to all ESFAS protection functions.

Condition A addresses the situation where one or more channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.

B.1. B.2.1. and B.2.2 Condition B applies to manual initiation of:

SI; Containment Spray; Phase A Isolation; and

. Phase B Isolation.

This action addresses the train orientation of the SSPS for the functions listed above. If a channel or train is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months are allowed to return it to an OPERABLE status. Note that for containment spray and Phase B isolation, failure of one or both channels in one train renders the train inoperable. Condition B, therefore, encompasses both situations.

The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval. If the channel or train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months total time) and in MODE 5 within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months (84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months total time). The allowed Completion Times are reasonable, based on operating experience, to reach the required unit (continued)

CALLAWAY PLANT B 3.3.2-39 Revision 5

ESFAS Instrumentation B 3.3.2 BASES ACTIONS B.1, B.2.1. and B.2.2 (continued) conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1, C.2, C.3.1, and C.3.2 Condition C applies to the automatic actuation logic and actuation relays for the following functions:

SI;

Containment Spray;

.Phase A Isolation;

Phase B Isolation; and

Automatic Switchover to Containment Sump.

This action addresses the train orientation of the SSPS and the master and slave relays. -Containment Isolation Phase A is the primary signal to ensure closing of the containment purge supply and exhaust valves. If one Phase A train is inoperable, operation may continue as long as the Required Action to place and maintain containment purge supply and exhaust valves in their closed position is met. Required Action C.1 is modified by a Note that this Action is only required if Containment Phase A Isolation (Function 3.a.(2)) is inoperable. If one train is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train to OPERABLE status.

The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply.

This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months total time) and in MODE 5 within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months (42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months total time). The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing, provided the other train is OPERABLE. This allowance is based on the reliability analysis assumption of Reference 8 that 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is the average time required to

- * - perform channel surveillance. . -

(continued)

CALLAWAY PLANT B 3.3.2-40 ALLAWAY PLANTB33240Revision 5

ESFAS Instrumentation B 3.3.2 BASES ACTIONS D.1, D.2.1. and D.2.2 (continued)

Condition D applies to:

Containment Pressure - High 1;

Pressurizer Pressure - Low;

~Steam Line Pressure - Low;

Containment Pressure - High 2;

Steam Line Pressure - Negative Rate - High;

SG Water Level - Low Low (Adverse Containment Environment);

SG Water Level - Low Low (Normal Containment Environment);

and

Pressurizer Pressure - High.

If one channel is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 'are allowed to restore the channel to OPERABLE status or to place it in the tripped condition. Generally this Condition applies to functions that'operate on two-out-of-three logic (excluding Pressurizer Pressure - Low, Pressurizer Pressure - High, and

'SG Water Level - Low Low (Adverse and Normal Containment Environment)). Therefore, failure of one'channel (i.e., with the bistable not tripped) places the Function in a two-out-of-two configuration. The inoperable channel must be tripped to place the Function in a orie-out-of-two configuration that satisfies redundancy requirements.

Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status or to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for testing, are justified in Reference 8.

(contLinu~ed)}

CALLAWAY PLANT B 3.3.2-41 Revision 5

ESFAS Instrumentation B 3.3.2 BASES ACTIONS E.1, E.2.1, and E.2.2 (continued) '

Condition E applies to:

Containment Spray Containment Pressure - High 3; and

Containment Phase B'Isolation Containment Pressure - High 3.

None'of these signals has input to a control function. Thus,

two-out-of-three logic is necessary to meet acceptable protective requirements. 'However, a'two-out-of-three design would require tripping a failed channel. This is undesirable because a single failure would then cause spurious containment spray initiation. Spurious spray actuation is undesirable because of the cleanup problems presented. Therefore, these channels are designed with two-out-of-four logic so that a failed channel may be bypassed rather than tripped. Note that one channel may be bypassed and still satisfy the single failure criterion. Furthermore, with one channel bypassed, a single instrumentation channel failure will not spuriously initiate containment spray.

To avoid the inadvertent actuation of containment spray and Phase B containment isolation, the inoperable channel should not be placed in the tripped condition. Instead it is bypassed. Restoring the channel to OPERABLE status, or placing the inoperable channel in the bypassed condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , is sufficient to assure that the Function remains OPERABLE and minimizes the'time' that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The Completion Time is further justified based on the low probability of an event occurring during this interval. 'Failure to restore the inoperable channel to OPERABLE status, or place it in the bypassed condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODEA4 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging 'unit systems. in MODE 4, these Functions are no longer required OPERABLE. -

The Required Actions are modified by'a Note that allows one additional channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing. Placing

- -a second channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for testing purposes is acceptable'based on the results of Reference 8.

,o . . -n - , d (continued)

CALLAWAY PLANT IB 3.3.2-42 A PN BRevision 5

ESFAS Instrumentation B 3.3.2 BASES ACTIONS F.1. F.2.1, and F.2.2 (continued)

Condition F applies to:

Manual Initiation of Steam Line Isolation; and

P-4 Interlock.

For the Manual Initiation and the P-4 Interlock Functions, this action addresses the train orientation of the SSPS. If a channel or train is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months are allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of these Functions, the available redundancy, and the low probability of an event occurring during this interval. If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.

G.1 G2.1. and G2.2 Condition G applies to the automatic actuation logic and actuation relays (SSPS) for the Steam Line Isolation, Turbine Trip and Feedwater Isolation, and AFW actuation Functions. Condition G also applies to the MSFIS automatic actuation logic.

The action addresses the train orientation of the actuation logic for these functions. If one train is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train to OPERABLE status. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of the protection channels and actuation functions. In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.

(continued)

CALLAWAY PLANT B 3.3.2-43 Revision 5

ESFAS Instrumentation B 3.3.2 BASES ACTIONS G.1, G2.1. and G.2.2 -(continued)

The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing provided the other train

-is OPERABLE. This allowance is based on the reliability analysis (Refs. 8 and 13) assumption that 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is the average time required to perform channel surveillance.

H.1 Condition H applies to the automatic logic and actuation relays (SSPS) for the Automatic Pressurizer PORV Actuation Function.

The Required Actio'n addresses the impact on the ability to mitigate an inadvertent ECCS actuation at p6wer event that requires the availability of at least one pressurizer PORV for automatic pressure relief. With one or more automatic actuation logic'trains inoperable, the associated pressurizer PORV(s) must be declared inoperable immediately. This

- requires that Condition B or E of LCO 3.4.11, "Pressurizer PORVs," be entered immediately depending on the number of PORVs inoperable.

The Required Action is modified by a Note that allows one train to be bypassed for up to-4 hours for surveillance testing provided the other train is OPERABLE. This allowance is based on the reliability analysis (Refs. 8

- and 13) assumption that 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is the average time required to perform channel surveillance.

1.1 and 1.2 Condition I applies to:

SG Water Level - High High (P-14).

Ifone channel is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the channel to OPERABLE status or to place it in the tripped condition. If placed in the tripped condition; the'Function is then in' a partial trip condition where one-out-of-three logic will result in actuation. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is justified in Reference 8... Failure to restore the inoperable channel to OPERABLE status or'place it in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed Completion Time'of 6 hoU'rs is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an

-,orderly manner and without challenging unit systems. In MODE 3, this Function is no longer required OPERABLE.

(continued)

,; CALLAWAY PLANT B 3.3.2-44 Revision 5

ESFAS Instrumentation B 3.3.2 BASES ACTIONS 1.1 and 1.2 (continued)

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for an inoperable channel to be in the bypassed condition for testing, are justified in Reference 8.

J.1 and J.2 Condition J applies to the AFW pump start on trip of all MFW pumps.

This action addresses the train orientation of the BOP ESFAS for the auto start function of the AFW System on loss of all MFW pumps. The OPERABILITY of the AFW System must be assured by providing automatic start of the AFW System pumps. If a channel is inoperable, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to place it in the tripped condition. If the channel cannot be tripped in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , 6 additional hours are allowed to place the unit in MODE 3. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, the unit does not have any analyzed transients or conditions that require the \..

explicit use of the protection function noted above. The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing of other channels.

K.1, K.2, K.3.1, and K.3.2 Condition K applies to:

RWST Level - Low Low Coincident with Safety Injection.

RWST Level - Low Low Coincident With SI provides actuation of switchover to the containment recirculation sumps. Note that this Function requires the bistables to energize to perform their required action. The failure of up to two channels will not prevent the operation of this Function. This Action Statement limits the duration that an RWST level channel could be tripped, due to its being inoperable or for testing, in order to limit the probability for automatic switchover to an empty containment sump upon receipt of an inadvertent safety injection signal (SIS), coincident with a single failure of another RWST level channel, or for premature switchover to the sump after a valid SIS. This sequence of events would start the RHR pumps, open the containment sump RHR (continued)~

CALLAWAY PLANT B 3.3.2-45 Revision 5

ESFAS Instrumentation B 3.3.2 BASES ACTIONS K.1, K.2, K.3.1, and K:3.2 (continued)- - '

suction valves and, after meeting the sump suction valve open position interlock, the RWST RHR suction valves would close. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months restoration time for an inoperable channel is consistent with that given in other Technical Specifications 'affecting RHR operability, e.g., for one ECCS train inoperable and for one diesel generator inoperable.

The Completion Times are justified in Reference 8. If the channel cannot be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ; the unit must be brought to MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within the next 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, the unit does not have any analyzed transients or conditions that require the'explicit use of the protection function noted above. The Required Actions are modified by a Note that allows placing an inoperable

-channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. This bypass allowance is justified in Reference 8.--'

L.1, L.2.1. and L.2.2 Condition L applies to the P-11 interlock.

With one or more required channel(s) inoperable, the operator must verify that the interlock is in the required state for the existing unit condition by observation of the associated permissive annunciator window. This action manually accomplishes the function of the interlock. Determination must be made within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete loss of ESFAS'function. If the interlock is not in the required state (or placed in the required state) for the existing unit condition, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of this interlock.

M.1 and M.2 Condition M applies to the Trip Time Delay (TTD) circuitry enabled for the (continued)

CALLAWAY PLANT - B 3.3.2-46 Revision 5

ESFAS Instrumentation B 3.3.2 BASES ACTIONS M.1 and M.2 (continued)

SG Water Level-Low Low trip Functions when THERMAL POWER is less than or equal to 22.41% RTP in MODES 1 and 2. With one or more Vessel AT Equivalent (Power-1, Power-2) channel(s) inoperable, the associated Vessel AT channel(s) must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . If the inoperability impacts the Power-1 and Power-2 portions of the TTD circuitry (e.g., Vessel AT RTD failure), both the Power-1 and Power-2 bistables in the affected protection set(s) are placed in the tripped condition. However, if the inoperability is limited to either the Power-1 or Power-2 portion of the TTD circuitry, only the corresponding Power-1 or Power-2 bistable in the affected protection set(s) is placed in the tripped condition. With one or more TTD circuity delay timer(s) inoperable, both the Vessel AT (Power-1) and Vessel AT (Power-2) channels are tripped. This automatically enables a zero time delay for that protection channel with either the normal or adverse containment environment level bistable enabled. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is based on Reference 11. If the inoperable channel cannot be placed in the tripped condition within the specified Completion Time, the unit must be placed in a MODE where this Function is not required to be OPERABLE. The unit must be placed in MODE 3 within an additional six hours.

N.1. N.2.1, and N.2.2 Condition N applies to the Environmental Allowance Modifier (EAM) circuitry for the SG Water Level-Low Low trip Functions in MODES 1, 2, and 3: With one or more EAM channel(s) inoperable, they must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Placing an EAM channel in trip automatically enables the SG Water Level-Low Low (Adverse Containment Environment) bistable for that protection channel, with its higher SG level Trip Setpoint (a higher trip setpoint means a feedwater isolation or an AFW actuation would occur sooner). The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is based on Reference 11. If the inoperable channel cannot be placed in the tripped condition within the specified Completion Time, the unit must be placed in a MODE where this Function is not required to be OPERABLE. The unit must be placed in MODE 3 within an additional six hours and in MODE 4 within the following six hours.

0.1 and 0.2 Condition 0 applies to the Auxiliary Feedwater Pump Suction Transfer on Suction Pressure - Low trip Function. The Condensate Storage Tank is the highly reliable and preferred suction source for the AFW pumps. This (continued)

CALLAWAY PLANT B 3.3.2-47 Revision 5

ESFAS Instrumentation B 3.3.2 I.,-

BASES

, ACTIONS' 0.1 and 0.2 (continued) function has a two-out-of-three trip logic. Therefore, continued operation

- is allowed with one inoperable channel until the performance of the next

' monthly COT on one of the other channels, as long as the inoperable channel is placed in trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Condition 0 is modified by a Note stating that LCO 3:0.4 is not applicable. MODE changes are permitted with an inoperable channel.

P. 1 Condition P applies to the Auxiliary Feedwater Manual Initiation trip Function. The associated auxiliary feedwater pump(s) must be declared inoperable immediately when one or more channel(s) is inoperable.

Refer to LCO 3.7.5, "Auxiliary Feedwater (AFW) System."

Q.1 and Q.2';v Condition Q applies to the Auxiliary Feedwater Balance of Plant ESFAS automatic actuation logic and actuation relays. With one train inoperable, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . -The Required Actions'are modified by a Note that allows one train to be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing provided the other train is OPERABLE. '

R.1. R.2.1. and R.2.2, Condition R applies to the Auxiliary Feedwater Loss of Offsite Power trip Function. With the inoperability of one or both train(s), 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months are allowed to return the train(s) to OPERABLE status. The specified Completion Time is reasonable considering this Function is only associated with the turbine driven auxiliary feedwater pump (TDAFP), the available redundancy provided by the motor driven auxiliary feedwater pumps, and the low probability of an event occurring during this interval.

If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the'required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the TDAFP for mitigation..,

- . , * ., * . 2.,

(continued)

CALLAWAY PLANT - i I 13 3.3.2-48 -Revision 5

ESFAS Instrumentation B 3.3.2 BASES (continued)

SURVEILLANCE The SRs for each ESFAS Function are identified by the SRs column of REQUIREMENTS Table 3.3.2-1.

A Note has been added to clarify that Table 3.3.2-1 determines which SRs REQUIREMENTS apply to which ESFAS Functions.

Note that each channel of process protection supplies both trains of the ESFAS. When testing channel 1,train A and train B must be examined.

Similarly, train A and train B must be examined when testing channel 11, channel Ill, and channel IV. The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.

SR 3.3.2.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift im one of the-channels or of something even more serious. A CHANNEL \ :

CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and reliability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.2.2 SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST. The SSPS is tested every 31 days on a STAGGERED TEST BASIS, using the semiautomatic tester. The train being tested is placed in the bypassed condition, thus preventing inadvertent actuation. Through the semiautomatic tester, all possible logic combinations, with and without (continued)

CALLAWAY PLANT B 3.3.2-49 .Revision 5

ESFAS Instrumentation B 3.3.2

. I.

BASES to SURVEILLANC ITE SR 3.3.2.2 (continued)

REQUIREMEN applicable permissives,-are tested for each protection function. In addition, the master relay coil is pulse tested for continuity. This verifies that the logic modules are OPERABLE and that there is an intact voltage signal path to the master relay coils. In addition, SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST of the MSFIS PLC "actuation logic, initiated from the SSPS slave relays. The Frequency of every 31 days on a STAGGERED TEST BASIS is adequate. It is based on industry operating experience, considering instrument reliability and operating history data.'- -

SR 3.3.2.3 SR 3.3.2.3 is the performance of an ACTUATION LOGIC TEST using the BOP ESFAS automatic tester. The continuity check does not have to be performed, as explained in the Note. This SR is applied to the balance of plant actuation logic and relays that do not have circuits installed to perform the continuity check. This test is required every 31 days on a

'STAGGERED TEST BASIS. The Frequency is adequate based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.2.4 SR 3.3.2.4 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil. Upon master relay contact operation, a low voltage is injected to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity. This test is performed every 31 days on a STAGGERED TEST BASIS. The time allowed for the testing (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ) and the surveillance interval are justified in Reference 8.

SR 3.3.2.5

'SR 3.3.2.5 is the performance of a COT.

A COT is performed on each required channel to ensure the channel will perform the intended Function., Setpoints must be found within the

-Allowable Values specified in 'Table 3.3.2-1. A successful test of the

'required contact(s) of a channel relay rmay be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL-OPERATIONAL TEST of a (continued)

CALLAWAY PLANT ' " B 3.3.2-50 , _; Revision 5

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.5 (continued)

REQUIREMENTS relay., This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The setpoint shall be left set consistent with the assumptions of the current unit specific setpoint methodology.

The Frequency of 92 days is justified in Reference 8.

SR 3.3.2.6 SR 3.3.2.6 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation mode is either allowed to function, or is placed in a condition where the relay contact operation can be verified without operation of the equipment. Actuation equipment that may not be operated in the design mitigation mode is prevented from operation by the SLAVE RELAY TEST circuit. For this latter case, contact operation is verified by a continuity check of the circuit containing the slave relay. This test is performed every 92 days. The SR is modified by a Note that excludes slave relays K602, K620, K622, K624, K630, K740, and K741 which are included in testing required by SR 3.3.2.13 and SR 3.3.2.14.

The Frequency is adequate, based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.2.7 SR 3.3.2.7 is the performance of a TADOT every 18 months. This test is a check of the AFW pump start on Loss of Offsite Power trip Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The trip actuating devices tested within the scope of SR 3.3.2.7 are the LSELS output relays and BOP ESFAS separation groups I and 4 logic associated with the automatic start of the turbine driven auxiliary feedwater pump on an ESF bus undervoltage condition.

(continued)<>

CALLAWAY PLANT B 3.3.2-51 Revision 5

ESFAS Instrumentation B 3.3.2 BASE -S i BASES SURVEILLANCE SR 3.3.2.7 (continued)

REQUIREMENTS The Frequency is adequate. It is based on industry operating experience and is consistent with the typical refueling cycle. The SR is modified by a Note that'excludes verification of setpoints for relays. The trip actuating devices tested have no associated setpoint.

S R 3.3.2.8 -

SR 3.3.2.8 is the performance of a TADOT. This test is a check of the Manual Actuation Functions and AFW pump start on trip of all MFW pumps. 'The Manual Safety Injection TADOT shall independently verify OPERABILITY of the undervoltage and shunt trip handswitch contacts for both the Reactor Trip Breakers and Reactor Trip Bypass Breakers as well as the contacts for safety injection actuation. It is performed every 18 months. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a, single contact of the relay.'>This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical 1, .

Specifications tests at least once per refueling interval with applicable extensions. The Frequency is adequate, based on industry operating experience and is consistent with the typical refueling cycle. The SR is I I I

I . .

modified by a-Note that excludes verification of setpoints during the I . Ii TADOT for manual initiation Functions. The manual initiation Functions

. I - II I have no associated setpoints. - -

- -SR 3.3.2.9 SR 3.3.2.9 is the performance of a CHANNEL CALIBRATION.

i .: ;

A,. I '-'A CHANNEL CALIBRATION is performed every 18 months, or approximately at every refueling.. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range'and accuracy. -

CHANNEL CALIBRATIONS must be performed consistent-with the assumptions of Reference 6.

The Frequency of 18 months is based on the assumed calibration interval in the determination of the magnitude of equipment drift in the setpoint methodology.

(continued)

CALLAWAY PLANT ,1.-, - I-B 3.3.2-52 ' Revision 5

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.9 (continued)

REQUIREMENTS This SR is modified by a Note stating that this test should include verification that the time constants are adjusted to the prescribed values where applicable. This does not include verification of time delay relays.

These are verified via response time testing per SR 3.3.2.10.

Whenever an RTD is replaced in Function 5.e.(3) or 6.d.(3), the next required CHANNEL CALIBRATION of the RTDs is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element..

The portion of the automatic PORV actuation circuitry required for COMS is calibrated in accordance with SR 3.4.12.9.

SR 3.3.2.10 This SR verifies the individual channel ESF RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis.

Response time verification acceptance criteria are included in Reference 9. No credit was taken in the safety analyses for those channels with response times listed as N.A. No response time testing requirements apply where N.A. is listed in Reference 9. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position). The safety analyses include the sum of the following response time components:

a. Process delay times (e.g., scoop transport delay and thermal lag associated with the narrow range RCS RTDs used in the SG low-low level Vessel AT (Power-1, Power-2) functions) which are not testable;

b. Sensing circuitry delay time from the time the trip setpoint is reached at the sensor until an ESFAS actuation signal is generated by the SSPS (response time testing associated with LSELS and BOP-ESFAS is discussed under SR 3.3.5.4 and SR 3.3.6.6);

(continued)

CALLAWAY PLANT B 3.3.2-53 Revision 5

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.10 (continued) f.s . .,: _ , I.;-

REQUIREMENT

c. Any intentional time delay set into the trip circuitry (e.g., NLL cards (lag) and NPL cards (PROM logic cards for trip time delay) associated with the SG low-low level Vessel AT (Power-1, Power-2) trip functions, NLL cards (lead/lag) associated with the steam line pressure high negative rate trip function) to add margin

- or prevent spurious trip signals; and

d. The time for the final actuation devices to reach the required functional state (e.g., valve stroke time, pump or fan spin-up time).

For channels that include-dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), -the'response time verification is performed with the time constants set at their nominal values. Time constants are verified during the performance of SR 3.3.2.9. The response time may be verified by a series of overlapping tests, or other verification (e.g., Ref. 10 and Ref. 14), such that the entire response time is verified.

Response time may be verified by actual response time tests in any series of sequential, overlapping, or total channel measurements, or by the summation of allocated sensor,-signal processing, and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from:

(1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests); (2) inplace, onsite, or offsite (e.g. vendor) test measurements; or (3) utilizing vendor engineering specifications.

WCAP-13632-P-A Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," provides the basis and methodology for using allocated sensorlresponse times-in the overall verification of the channel response time for specific sensors identified in the WCAP.

Response time verification for other sensor types must be demonstrated by test.

WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," psrbvides the basis and methodology for using allocated signal processing and actuation logic response time in the overall verification of the protection system channel response time.

The allocations for sens6i, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service arid re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. -Specific components identified in References 10 and 14 may be replaced without verification testing. One example where (continued)

CALLAWAY PLANT ..B 3.3.2-54 CA-AA P -Revision 5

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.10 (continued)

REQUIREMENTS response time could be affected is replacing the sensing assembly of a transmitter.

ESF RESPONSE TIME verification is performed on an 18 month STAGGERED TEST BASIS. Each verification shall include at least one train such that both trains are verified at least once per 36 months.

Testing of the final actuation devices, which make up the bulk of the response time, is included in the'verification of each channel. The final actuation device in one train is tested with each channel. Therefore, staggered testing results in response time verification of these devices every 18 months. The 18 month Frequency is consistent with the typical refueling cycle and is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

This SR is modified by a Note that clarifies that the turbine driven AFW pump is tested within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after reaching 900 psig in the SGs.

SR 3.3.2.11 SR 3.3.2.11 is the performance of a TADOT for the P4 Reactor Trip Interlock. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The 18 month Frequency is based on operating experience.

The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Function tested has no associated setpoint. This TADOT does not include the circuitry associated with steam dump operation since it is control grade circuitry.

SR 3.3.2.12 SR 3.3.2.12 is the performance of a monthly COT on ESFAS Function 6.h, "AFW Pump Suction Transfer on Suction Pressure - Low."

A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with (continued)

CALLAWAY PLANT B 3.3.2-55 Revision 5

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.12 (continued):"

REQUIREMENTS applicable extensions.

A COT is performed to ensure the channel will perform the intended Function. Setpoints must be found within the Allowable Values specified in Table 3.3.2-1.

The setpoint shall be left set consistent with the assumptions of the current unit specific setpoint methodology.

SR 3.3.2.13 SR 3.3.2.13 is the performance of a SLAVE RELAY TEST as described in SR 3.3.2.6, except that SR 3.3.2.13 has-a Note specifying that it applies only to slave relays K602, K622, K624, K630, K740, and K741. These

-slave relays are tested with a Frequency of 18 months and prior to entering MODE'4 for Functions 1.b, 3.a.(2), and 7.a whenever the unit has been'in MODE 5 or 6 for > 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , if not performed within the previous 92 days (Reference 12). The 18 month Frequency for these slave relays is based on the need to perform this Surveillance under the conditions that apply during a unit outage to avoid the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

SR 3.3.2.14 SR 3.3.2.14 is the performance of a SLAVE RELAY TEST as described in SR 3.3.2.6, except that SR 3.3.2.14 has a Note specifying that it applies only to slave relays K620 and K750. These slave relays are tested with a Frequency of 18 months and prior to entering MODE 3 for Functions 5.a and 9.a whenever the unit has been in MODE 5 or 6 for > 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , if not performed within the previous 92 days. The 18 month Frequency for these slave relays is based on the need to perform this Surveillance under the conditions that apply during a unit outage to avoid the potential for an unplanned transient if the' Surveillance were performed with the reactor at power. The SLAVE RELAY TEST of relay K620 does not include the circuitry associated with the main feedwater pump trip solenoids since that circuitry serves no required safety function. The 18 month Frequency for slave relay K620 was accepted by NRC at initial plant licensing based on Reference 12. The 18 month Frequency for slave relay K750 is consistent with that of SR 3.4.11.2 in LCO 3.4.11, Pressurizer PORVs,' which in turn is based on the NRC-approved Inservice Test.(IST) program relief'request BB-10 on the pressurizer PORVs (Ref. .17). Testing slave relay K750 at power would result in (continued)

CALLAWAY PLANT . B 3.3.2-56 -Revision 5

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.12 (continued)

REQUIREMENTS opening the PORVs and depressurizing the RCS. If the PORV block valves are closed, there is not enough pressure to open the PORVs.

REFERENCES 1. FSAR, Chapter 6.

2. FSAR, Chapter 7.

3. FSAR, Chapter 15.

4. IEEE-279-1971.

5. 10 CFR 50.49.

6. Callaway Setpoint Methodology Report (NSSS), SNP (UE)-565 dated May 1,1984, and Callaway Instrument Loop Uncertainty Estimates (BOP), J-U-GEN.

7. Not used.

8. Callaway OLAmendment No. 64 dated October 9,1991.

9. FSAR Section 16.3, Table 16.3-2.

10. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," January 1996.

11. Callaway OL Amendment No. 43 dated April 14,1989.

12. SLNRC 84-0038 dated February 27, 1984.

13. Callaway OLAmendment No. 117 dated October 1,1996.

14. WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," October 1998.

15. FSAR, Section 15.5.1.

16. FSAR, Section 15.6.1.

17. Letter from Mel Gray (NRC) to Garry L. Randolph (UE), 'Revision 20 of the Inservice Testing Program for Callaway Plant, Unit 1 (TAC No. MA4469)," dated March 19,1999.

K-,

CALLAWAY PLANT B 3.3.2-57 Revision 5

BDMS B 3.3.9 BASES APPLICABILITY In MODE 6, a dilution event-is precluded by locked valves'(BGV0178 and (continued) BGV0601) that isolate the RCS from the potential source of unborated water (according to LCO 3.9.2, "Unborated Water Source Isolation Valves"). , s ' ':;

TheApplicability is modified by' a Note that allows the boron dilution flux multiplication signal to be blocked during reactor startup in MODE 2 (below P-6 setpoint) and MODE 3. Blocking the flux multiplication signal is acceptable during startup provided the reactor trip breakers are closed with the intent to'commence the withdrawal of control banks for startup.

This Applicability Note can not be used to block BDMS prior to or during shutdown bank withdrawal. The P-6 interlock provides a backup block signal to the source range flux multiplication circuit.

ACTIONS The most common cause of channel inoperability is outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by the unit specific calibration procedure. Typically, the drift is found to be small and results in a'delay of actuation rather than a total loss of function. 'This determination of setpoint drift is generally made during the performance of a COT when the process instrumentation is set up for adjustment to bring it to within specification. If the Trip Setpoint is less conservative than the tolerance specified by the calibration procedure, the channel must be declared inoperable immediately and the appropriate Condition entered.

A.1 With one train of the BDMS inoperable, Required Action A.1 requires that the inoperable train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining BDMS train is adequate to

provide protection. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the BDMS

' Function and is consistent with Engineered Safety Feature Actuation System Completion Times for loss of one redundant train. Also, the remaining OPERABLE train'provides continuous indication of core power status to the operator, has an alarm function, and sends a signal to both trains of the BDMS to'assure system actuation.

'Administrative ontrols require operator awareness during all reactivity manipulations.' These administrative controls include:

- Reactivity' management briefs of the Control Room Operations Staff (typically conducted at the beginning of each shift);

(continued)

' CALLAWAY PLANT ;, . . B 3.3.9-3 Revision 5

LML-BDMS B 3.3.9 BASES >

ACTIONS M (continued)

- Use of self-verification techniques by all licensed operators performing core reactivity manipulations;

- Peer checks for all reactivity manipulations during routine operations and for all positive reactivity additions during transient or off-normal operations;

- Off-normal procedures are available that address reactor makeup control system (RMCS) malfunctions and potential loss of shutdown margin (SDM).

During any and all rod motion, operators monitor all available indications of nuclear power. During RCS boron concentration change evolutions, operators observe the various indications and alarms provided in the RMCS design for monitoring proper system operation as discussed in FSAR Section 15.4.6 (Reference 1). Introduction of reactor makeup water into the RCS from the Chemical and Volume Control System mixing tee is not permitted when one BDMS train is inoperable.

B.1, B.2, B.3.1, and B.3.2 With two trains inoperable, or the Required Action and associated Completion Time of Condition A not met, the initial action (Required Action B.1) is to suspend all operations involving positive reactivity additions immediately. This includes withdrawal of control or shutdown rods and intentional boron dilution.

Required Action B.2 verifies the SDM according to SR 3.1.1.1 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This action is intended to confirm that no unintended boron dilution has occurred while the BDMS was inoperable, and that the required SDM has been maintained. The specified Completion Time takes into consideration sufficient time for the initial determination of SDM and other information available in the control room related to SDM.

Required Action B.3.1 requires valves listed in LCO 3.9.2 (Required Action A.2), BGV0178 and BGV0601, to be secured to prevent the flow of unborated water into the RCS. Once it is recognized that two trains of the BDMS are inoperable, the operators will be aware of the possibility of a boron dilution, and the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is adequate to complete the requirements of LCO 3.9.2. The recurring 31 day verification of Required Action B.3.2 ensures these valves remain closed for an extended Condition B entry.

(continued)~

CALLAWAY PLANT B 3.3.9-4 Revision 5

BDMS B 3.3.9 t .I BASES ACTIONS B.1. B.2. B.3.1. and B.3.2 (continued) : -

Required Action B.1 is-modified by a'Note which permits plant temperature'charnges provided the'temperature change is accounted for in the calculated SDM. Introduction of temperature changes, including temperature increases when a positive MTC exists, must be evaluated to

- ensure they do'not result in a loss of required SDM.

I C.1 and C.2 Condition C is entered with no RCS loop in operation. The operation of one RCS loop provides'adequate flow to ensure mixing, prevent stratification, and produce gradual reactivity changes during RCS boron concentration reductions. The reactivity change rate associated with boron reduction will, therefore, be within the transient mitigation capability of the Boron Dilution Mitigation System (BDMS). With no reactor coolant loop in operation, dilution sources must be isolated. The boron dilution analysis takes credit for the mixing volume associated with having at least one reactor coolant loop in operation.

Required Action C.1'requires that valves BGV0178 and BGV0601 be closed'and secured to prevent the flow of unborated water into the RCS.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is adequate to perform these local valve manipulations. The recurring 31 day verification of Required Action C.2 ensures these valves remain closed and secured for an extended Condition C entry.

.. . I* :. ~

. . I II. ;

'SURVEILLANCE: The BDMS trains are subject to a CHANNEL CHECK, valve closure in

' REQUIREMENTS MODE 5, COT, CHANNEL CALIBRATION, and Response Time Testing.

In addition, the requirement to verify one RCS loop in operation is subject to periodic surveillance.

SR 3.3.9.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that

' gross failure' of source range instrumentation has not occurred.

A CHANNEL-CHECK is normally a comparison of the parameter indicated on one channel to azsimilar parametet on'other channels. It is based on

'the assumption that instrument'channels monitoring the same parameter

-should read approximately the same value. Significant deviations

-between the two instrument -channels could be an indication of excessive instrum'ent drift in one'of the channels'or of something even more serious.

-ACHANNEL CHECK will detect gross channel failure; thus, it is key to (continued)

CALLAWAY PLANT - 'i B 3.3.9-5 Revision 5

BDMS B 3.3.9 BASES SURVEILLANCE SR 3.3.9.1 (continued)

REQUIREMENTS verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.9.2 SR 3.3.9.2 requires that valve BGV0178 be secured and closed prior to entry into MODE 5. Specification 3.9.2 requires that this valve also be secured and closed in MODE 6. Closing BGV0178 satisfies the boron dilution accident analysis assumption that flow orifice BGFOO010 limits \.>

the dilution flow rate to no more than 150 gpm in MODE 5. This Surveillance demonstrates that the valve is closed through a system walkdown. SR 3.3.9.2 is modified by a Note stating that it is only required to be performed in MODE 5. This Note requires that the surveillance be performed prior to entry into MODE 5 and every 31 days while in MODE 5. The 31 day frequency is based on engineering judgment and is considered reasonable in view of other administrative controls that will ensure that the valve opening is an unlikely possibility.

SR 3.3.9.3 SR 3.3.9.3 requires the performance of a COT every 92 days, to ensure that each train of the BDMS and associated trip setpoints are fully operational. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This test shall include verification that the boron dilution flux multiplication setpoint is equal to or less than an increase of 1.7 times the count rate within a 10 minute (continued)\-

- CALLAWAY PLANT B 3.3.9-6 Revision 5

BDMS B 3.3.9 B ,:,-j,,,,

S;,ES BASES I..

SURVEILLA NCE SR 3.3.9.3 (continued)

REQUIREMI ENTS - , -

period. The 1.7 flux multiplication setpoint is a nominal value. SR 3.3.9.3 is met if the measured setpoint is within a two-sided calibration tolerance band on either side of the nominal va[6e:. SR 3.3.9.3 is modified by a Note that provides a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months delay in the requirement to perform this Surveillance after reducing power beloW the P-6 interlock. This Note allows a delay in the performance of the COT to reflect the delay allowed for the source range channels. If the plant is to remain below the P-6 setpoint for more than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , this Surveillance must be performed prior to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after,reducing power below the P-6 setpoint. The Frequency of 92 days is'consistent with the requirements for source range channels in Reference 2.'

SR 3.3.9.4 SR 3.3.9.4 is the performance of a CHANNEL CALIBRATION every 18 months.. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. The SR is modified by a Note that neutron detectors are excluded from the CHANNEL CALIBRATION. Neutron detectors are excluded from the CHANNEL CALIBRATION because it is impractical to set up a test that demonstrates and adjusts neutron detector response to known values of the parameter (neutron flux) that the channel monitors.

The Note applies to the source range proportional counters in the Nuclear Instrumentation System (NIS).

The testing of the source range neutron detectors consists of obtaining integral bias curves, evaluating those curves, and comparing the curves previous data. The 18 month Frequency is based on operating experience and on the need to obtain integral bias curves under the conditions that apply during a plant outage. The other remaining portions of the CHANNEL CALIBRATION may be performed either during a plant outage or during plant operation.

SR 3.3.9.5 SR 3.3.9.5 is the performance of a response time test every 18 months to verify that, on a simulated or actual boron dilution flux multiplication signal, the centrifugal charging pump suction valves from the RWST open and the CVCS volume control tank discharge valves close in the required time of

30 seconds to reflect the analysis requirements of Reference 1.

(continued) f . .

CALLAWAY PLANT -B 3.3.9-7 - Revision 5

BDMS BDMS B 3.3.9 BASES SURVEILLANCE SR 3.3.9.5 (continued)

REQUIREMENTS The Frequency is based on operating experience and consistency with the typical industry refueling cycle.

SR 3.3.9.6 SR 3.3.9.6 requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that one RCS loop is in operation. Verification may include flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing adequate mixing. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS loop performance.

REFERENCES 1. FSAR, Section 15.4.6.

2. Callaway OLAmendment No. 17 dated September 8, 1986.

CALLAWAY PLANT B 3.3.9-8 Revision 5

RCS Operational LEAKAGE B 3.4.13 BASES LCO ; aa.a. - Pressure Boundary LEAKAGE (continued)

Normal charging can accommodate a 3/8 inch break and maintain normal pressurizer level such that the ECCS is not actuated.

b. Unidentified LEAKAGE One galloh per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable'minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect'within a reasonable time period. Violation of this LCO

could result incontinued degradation of the RCPB, if the LEAKAGE is from th'e pressure boundary.

c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE is considered allowable t . I. . ,

because LEAKAGE is from known sources that do not interfere I . ! . I -:1 ;

.with detection of unidentified LEAKAGE and is well within the capability of the RCS Makeup System. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include pressure boundary LEAKAGE or controlled reactor coolant pump (RCP)'seal leakoff (a normal function not considered LEAKAGE). RCP number 2 seal leak off is included in the measured identified LEAKAGE since it is directed to the RCDT along with other identified leakage sources; :Violation of this LCO could result in continued degradation of a component or system.

d. - Primary to Secondary LEAKAGE through All Steam Generators (SGs)

Total primary to secondary LEAKAGE amounting to 1 gpm through all SGs produces acceptable offsite doses in the accident analyses involving secondary steam discharge to the atmosphere.

Violation of this leakige-rate could exceed the offsite dose limits for these accidents.- Per Reference 6 and SG tube integrity considerations, the LCO is set lower at 600 gallons per day through all SGs: Primary to secondary LEAKAGE must be

-- included in' the total allowable limit for identified LEAKAGE.

e. Primary to Secondary LEAKAGE through Any One SG The 150 gallons per day limit on one SG is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a (continued)

-CALLAWAY PLANT . 1 ! .:,. ;'. B 3.4.13-3 Y PT 'B Revision 5

RCS Operational LEAKAGE B 3.4.13 BASES LCO e. Primary to Secondary LEAKAGE through Any One SG (continued) main steam line rupture. If leaked through many cracks, the cracks are very small, and the above assumption is conservative.

APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.

In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.

LCO 3.4.14, "RCS Pressure Isolation Valve (PIV) Leakage," measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.

ACTIONS A.1 Unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.

B.1 and B.2 If any pressure boundary LEAKAGE exists, or if unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE cannot be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It snould be noted that LEAKAGE past seals, gaskets, and instrumentation lines is not pressure boundary LEAKAGE.

The reactor must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.

(continued>-

- CALLAWAY PLANT B 3.4.13-4 Revision 0

ECCS - Operating B 3.5.2 BS ,E .S BASES SURVEILLANCE SR 3.5.2.1 (continued) - -

REQUIREMENTS

. . . bV Th6 hand 6ontrol s'witch for S! pump A (or SI pump B) is placed in pull to'lock.

Closure of EMHV882IA or EMHV8821 B isolates the associated SI pump from its cold leg injection path rendering that train inoperable; however, the opposite train is 'prevented from'exceeding runout flow conditions which would occur if the opposite pump were connected to both cold leg and hot leg injection paths' The inoperable train's pump is then placed in pull to lock to prevent urianalyzed hot leg'injection via its associated 8802 valve. Although'one SI train would be rendered inoperable, more than 100% of the ECCS flow equivalent to a single OPERABLE ECCS train would be available, and the plant would be in CONDITION A.1 with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months restoration time rather than entering LCO 3.0.3.

SR 3.5.2.2 -

Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified tobe in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a non-accident position provided the valve will automatically reposition within the proper stroke time. 'This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown (which may include the use of local or remote indicators), that those valves capable of being mispositionred are in the correct position.

The 31 day Frequency is appropriate because the valves are operated under administrative control. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves and relief valves. Additionally, vent and drain valves are not within the scope of this SR.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operations, and ensures correct valve positions.

SR 3.5.2.3 The ECCS pumps are normally in a standby, non-operating mode. As

- such, flow path piping has the potential to develop voids and pockets of (continued)

CALLAWAY PLANT :'" -B 3.5.2-9 A P' T Revision 0

ECCS - Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.3 (continued)

REQUIREMENTS entrained gases. Maintaining the piping from the ECCS pumps to the RCS full of water by venting RHR and Si pump casings and accessible ECCS discharge piping high point vents ensures that the system will perform properly, injecting its full capacity into the RCS upon demand. In conjunction with or in lieu of venting, Ultrasonic Testing (UT) may be performed to verify ECCS pumps and associated piping are full of water.

The design of the centrifugal charging pump is such that significant noncondensible gases do not collect in the pump. Therefore, it is unnecessary. to require periodic pump casing venting to ensure the centrifugal charging pumps will remain OPERABLE. Accessible high point vents are those that can be reached without hazard or high radiation dose to personnel. This will also prevent water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an Si signal or during shutdown cooling. The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the ECCS piping and the procedural controls governing system operation.

SR 3.5.2.4 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by Section Xl of the ASME Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. The ECCS pumps are required to develop the following differential pressures on recirculation flow: 1) centrifugal charging pumps 2 2400 psid; 2) safety injection pumps 2 1445 psid; and 3) RHR pumps 2 165 psid. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the plant safety analysis. SRs are specified in the applicable portions of the Inservice Testing Program, which encompasses Section Xl of the ASME Code. Section Xl of the ASME Code provides the activities and Frequencies necessary to satisfy the requirements.

SR 3.5.2.5 and SR 3.5.2.6 These Surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal or on an actual or simulated RWST Level Low-Low 1Automatic Transfer signal coincident with an SI signal and that each ECCS pump starts on receipt (continued)

CALLAWAY PLANT B 3.5.2-1 0 Revision 5

ECCS - Operating B 3.5.2 v .,, r.

¢ Tut.','

BASES SURVEILLA NCE SR 3.5.2.5 and SR 3.5.2.6 (continued)

I-REQUIREM ENTS of an actual or'simulated Si signal. *The containment recirculation sump

--to RHR pumnp isolation valves (EJHV881 1AIB) automatically open upon receipt of an actual or simulated RWST Level Low-Low-1 Automatic Transfer sigial coincident with an SI 'signal. In addition to testing that automatic function,:SR'3.5.2.5 demonstrates that the RWSTto RHR pump suction isolation valves (BNHV8812A/B) are capable of automatic closure after the EJHV88I1A/B valves are fully open. The valve, interlock functions are depicted in Reference 10. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for unplanned plant transients if the Surveillances were performed with the reactor at power.

The 18 month FreqiqUe'ncy is also acceptable based on consideration-of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of ESF Actuation System

'testing, andequipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.2.7 The correct position of throttle valves in the flow path is necessary for proper ECCS performance. These valves have mechanical stops to allow proper positioning for restricted flow to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. The 18 month Frequency is based on the same reasons as those stated in SR 3.5.2.5 and SR 3.5.2.6.- The ECCS throttle valves are set to ensure proper flow resistance and pressure drop in the piping to each injection point in the event of a LOCAL Once set, these throttle valves are secured with locking devices and mechanical position stops. These devices help to ensure that the following safety analyses assumptions remain valid:

(1) both the maximum and minimum total system resistance; (2) both the maximum and minimum branch injection line resistance; and (3) the maximum and minimum ranges of potential pump performance. These resistances and pump performance ranges are used to calculate the maximum and minimum ECCS flows assumed in the LOCA analyses of Reference 3.

SR 3.5.2.8 Periodic inspections of the containment sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the (continued)

B. 3.. 21. . Is v inI CALLAWAY PLANT ' 13 3.5.2-11 .. , Revision 5

ECCS - Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.8 (continued)

REQUIREMENTS conditions that apply during a plant outage, on the need to have access to the location, and because of the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation and is confirmed by operating experience.

REFERENCES 1. 10 CFR 50, AppendixA, GDC 35.

2. 10 CFR 50.46.

3. FSAR, Sections 6.3 and 15.6.

4. FSAR, Chapter 15, "AccidentAnalysis."

5. NRC Memorandum to V. Stello, Jr., from R. L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

6. IE Information Notice No. 87-01.

7. RFR-14801A.

8. ULNRC-2535 dated 12-18-91 (for SI and RHR pumps) and ULNRC-04583 dated 12-13-01 (for CCPs).

9. OLAmendment No. 68 dated 3-24-92 (for SI and RHR pumps and OLAmendment No. 150 dated 5-2-02 (for CCPs).

10. FSAR Figure 7.6-3.

CALLAWAY PLANT B 3.5.2-12 Revision 5

Containment B 3.6.1 BASES LCO Compliance with this LCO will ensure a containment configuration, (continued) including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.

Individual leakageirates specified for the containment air lock (LCO 3.6.2) and containment shutdown and mini-purge valves with resilient seals (LCO 3.6.3) are not specifically part of the acceptance criteria of 10 CFR 50, Appendix J, Option B. 'These leakage rates are specified in the Containment Leakage Rate Testing Program. Therefore, leakage rates exceeding these individual limits only result in the containment

- being inoperable when the leakage results in exceeding the overall acceptance criteria of 1.0 La.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. In MODES 5 and 6, the probability and

- consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, containment is not required to be OPERABLE in MODE 5 to prevent leakage of radioactive material from containment. The requirements for containment during MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations."

ACTIONS-.. A.1 In the event containment is inoperable, containment must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining containment during MODES 1, 2, 3, and 4. This time

-period also ensures that the probability of an accident (requiring containment OPERABILITY) occurring during periods when containment is inoperable is minimal. - -

B.1 and B.2 If containment cannot be restored to OPERABLE status'within'the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply.: To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are' reasonable', based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

CALLAWAY PLANT '-B 3.6.1-3 II . . 'Revision 0

Containment B 3.6.1 BASES (continued)

SURVEILLANCE SR 3.6.1.1 REQUIREMENTS Maintaining the containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Containment Leakage Rate Testing Program. The containment concrete visual examinations may be performed during either power operations, or during a maintenance/refueling outage. The visual examinations of the steel liner plate inside containment are performed during maintenance or refueling outages as this is the only time the liner plate is fully accessible.

Failure to meet air lock and purge valve with resilient seal leakage limits specified in LCO 3.6.2 and LCO 3.6.3 does not invalidate the acceptability of these overall leakage determinations unless their contribution to overall Type A, B, and C leakage causes that to exceed limits. As left leakage prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test is required to be < 0.6 La for combined Type B and C leakage and < 0.75 La for overall Type A leakage. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of

1.0 La. At 5 1.0 La the offsite dose consequences are bounded by the assumptions of the safety analysis.

SR Frequencies are as required by the Containment Leakage Rate Testing Program. These periodic testing requirements verify that the \

containment leakage rate does not exceed the leakage rate assumed in the safety analysis.

SR 3.6.1.2 This SR ensures that the structural integrity of the containment will be maintained in accordance with the provisions of the Containment Tendon Surveillance Program. Testing and Frequency are in accordance with ASME Code Section Xl, subsection IWL (Ref. 4), and applicable addenda as required by 10 CFR 50.55a..

REFERENCES 1. 10 CFR 50, Appendix J, Option B.

2. FSAR, Chapter 15.

3. FSAR, Section 6.2.

4. ASME Code Section Xl, subsection IWL. I

__ )

CALLAWAY PLANT B 3.6.1-4 Revision 5

MSIVs B 3.7.2

.- ' . .;! I, . ,;..

BASES REFERENCES 3. FSAR, Section 15.1.5,,Steam System Piping Failure.

(continued)

4. 10 CFR 100.11.

5. ASME, Boiler and Pressure Vessel Code, Section Xl.

6. FSAR 6.2.1.4.3.3, Containment Pressure - Temperature Results.

- , I

. I -, i' I 1. . . .

- . i . 1

. I - I

.I - - I

. . I 1

'j CALLAWAY PLANT IB 3.7.2-6 Revision 0

MFIVs B 3.7.3 B 3.7 PLANT SYSTEMS K>

B 3.7.3 Main Feedwater Isolation Valves (MFIVs)

BASES BACKGROUND The MFIVs isolate main feedwater (MFW) flow to the secondary side of the steam generators following a high energy line break (HELB). The MFRVs function to control feedwater flow to the SGs.

The MFIV is a 14-inch gate valve with a system-medium actuator. The assumed single active failure of one of the redundant MFIV actuation trains will not prevent the MFIV from closing.

Closure of the MFIVs terminates flow to the steam generators, terminating the event for feedwater line breaks (FWLBs) occurring upstream of the MFIVs. The consequences of events occurring in the main steam lines or in the MFW lines downstream from the MFIVs will be mitigated by their closure. Closure of the MFIVs effectively terminates the addition of feedwater to an affected steam generator, limiting the mass and energy release for steam line breaks (SLBs) or FWLBs inside containment, and reducing the cooldown effects for SLBs.

The MFIVs isolate the nonsafety related portions from the safety related K portions of the system. In the event of a secondary side pipe rupture inside containment, the valves limit the quantity of high energy fluid that enters containment through the break, and provide a pressure boundary for the controlled addition of auxiliary feedwater (AFW) to the intact loops.

One MFIV is located on each MFW line, outside but close to containment.

The MFIVs are located upstream of the AFW injection point so that AFW may be supplied to the steam generators following MFIV closure. The piping volume from these valves to the steam generators is accounted for in calculating mass and energy releases, and refilled prior to AFW reaching the steam generator following either an SLB or FWLB.

The MFIVs close on receipt of any safety injection signal, a Tavg - Low coincident with reactor trip (P-4), a low-low steam generator level, or steam generator water level - high high signal. They may also be actuated manually. In addition to the MFIVs a check valve inside containment is available. The check valve isolates the feedwater line, penetrating containment, and ensures the pressure boundary of any intact loop not receiving auxiliary feedwater.

The MFIV actuators consist of two separate system-medium actuation trains each receiving an actuation signal from one of the redundant (continued)

CALLAWAY PLANT B 3.7.3-1 Revision 5

MFIVs I B 3.7.3 BASES - -

- a1 e *t ,il

- BACKGROUND ESFAS channels.' -Asingle active failure in one power train would not

- (continued'd- "'prevent the'other p6wer train'fromr functioning. The MFIVs provide the primary'success path for events requiring feedwater isolation and isolation of non-safety-related portions from the safety-related portion of the system, such as, for auxiliary feedwater addition.

I . .. . .. .

'A description of the MFIVi and MFRVs is found in the FSAR,

-'Section 10.4.7 (Ref. 1). -

. . .: . . I

. . . I I I. . . .

- APPL ICABLE Credit is taken in accident analysis for the MFIVs to close on demand.

' SAFE TY 'The function of the MFRVs and associated bypass valves as discussed in

' ANAL YSES ' the' accident analysis is to provide a'diverse backup function to the MFIVs for the potential failure of an MFIV to close even though the MFRVs are located in the non-safety-related portion of the feedwater system. Further

' assurance of feedwater flow termination is provided by the SGFP trip function; however, this is'not credited in accident analysis. The accident analysis credits the main feedwater check valves as backup to the MFIVs to prevent SG blowdown for pipe ruptures in the non-seismic Category I portions of the feedwater system outside containment.

Criterion 3 of 10 CFR '50.36(c)(2)(iiH)indicates that components that are part of the primary success path and that actuate to mitigate an event that presents a challenge to a fission product barrier should be in Technical Specifications. The primary success path of a safety sequence analysis consists of the combination and sequences of equipment needed to operate (including consideration of the single failure criteria) so that the plant response' to the 'event remains within appropriate acceptance criteria. The' primary success path does not include backup and diverse equipment. The MFIVs, with their dual-redundant actuation trains, are the primary success path for feedwater isolation; the MFRVs, bypass valves, and the SGFP trip function aie backup and diverse equipment.

Therefore,'only the'MFIVs are incorporated into Technical Specifications.

The MFIVs satisfy'Criterion 3 of 10 CFR'50.36(c)(2)(ii).

LCO This LCO ensures that the MFIVs will isolate MFW flow to the steam

-. generators, following'an FWLB or main'steam line break. These valves will also isolate the-noniafety related portions from the safety related

-'portions of the system.' -- ; -

-¢- :~~~ - .:

j' 'w-,, -', ,2.

:'This LCO requires that four MFIVs be'OPERABLE. The MFIVs are considered OPERABLE when isolation times are within limits when given a fast close signal and they are capable of closing on an isolation actuation signal.'

- (continued)

'CALLAWAY PLANT , B 3.7.3-2 Revision 5

MFIVs I B 3.7.3 BASES LCO Failure to meet the LCO requirements can result in additional mass and (continued) energy being released to containment following an SLB or FWLB inside containment. Afeedwater isolation signal on high steam generator level is relied on to terminate an excess feedwater flow event. I APPLICABILITY The MFIVs must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and steam generators. This ensures that, in the event of an HELB, a single failure cannot result in the blowdown of more than one steam generator. In MODES 1, 2, and 3, the MFIVs are required to be OPERABLE to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment. When the MFIVs are closed they are performing their safety function.

In MODES 4, 5, and 6, steam generator energy is low. Therefore, the MFIVs are not required to mitigate the effects of a feedwater or steamline I break in these MODES.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each valve.

K1-I.

A.1 andA.2 With one MFIV in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . When these valves are closed, they are performing their required safety function.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the redundancy afforded by the dual-redundant actuation trains on the MFIVs and the low I probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, based on operating experience.

Inoperable MFIVs that are closed must be verified on a periodic basis that they are closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed.

(continued) '

CALLAWAY PLANT B 3.7.3-3 Revision 5 '

MFIVs I B 3.7.3 BASES ACTIONS B.1 and B.2 (continued) -

If the MFIV(s) cannot be restored to'OPERABLE status, or closed, within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach'the required unit coniditions fro'm full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR' '3.7.3.1 '

REQUIREMENTS This SR verifies that the closure time of each MFIV is < 15 seconds from each actuation train when tested pursuant to the Inservice Testing Program. The MFIV closure time is assumed in the accident and containment analyses. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. These valves should not be tested at power since even a part stroke exercise increases the risk of a valve closure with the unit generating power.

The Frequency for this SR is in accordance with the Inservice Testing Program.

This test is conducted in MODE 3 with the unit at nominal operating temperature and pressure, as discussed in Reference 2. This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows a delay of testing until MODE 3, to establish conditions consistent with those under which the acceptance criterion was generated.

SR 3.7.3.2 This SR verifies that each MFIV is capable of closure on an actual or simulated actuation signal. The manual fast close handswitch in the Control Room provides an acceptable actuation signal. Each actuation train must be tested separately. This Surveillance is normally performed upon returning the unit to operation following a refueling outage in conjunction with SR 3.7.3.1. However, it is acceptable to perform this surveillance individually.

The frequency of MFIV testing is every 18 months. The 18 month Frequency for testing is based on the refueling cycle. This Frequency is acceptable from a reliability standpoint. This SR is modified by a NOTE that allows entry into and operation in MODE 3 prior to performing the SR.

(continued)

CALLAWAY PLANT I' - - B 3.7.3-4 1~- Revision 5

MFIVs I B 3.7.3 BASES SURVEILLANCE SR 3.7.3.2 (continued)

REQUIREMENTS This allows a delay of testing until MODE 3, to establish conditions consistent with those necessary to perform SR 3.7.3.1 and SR 3.7.3.2 concurrently.

REFERENCES 1. FSAR, Section 10.4.7, Condensate and Feedwater System.

2. ASME, Boiler and Pressure Vessel Code, Section Xl.

3. FSAR, Table 7.3-14, NSSS Instrument Operating Conditions for Isolation Functions.

'J CALLAWAY PLANT B 3.7.3-5 Revision 5

AFW System B 3.7.5 BASES ACTIONS B.1 (continued) I -

c. -The availability of at least one OPERABLE motor driven AFW pump.- When an ESW train inoperability renders a TDAFP supply line inoperable and a motor driven AFW pump supply line inoperable, then one motor driven AFW pump is OPERABLE and

. 'the second motor.driven AFW pump is available with water

- - supplied from the nonsafety grade Condensate Storage Tank;

- d. The'low probability of an event occurring that will require the inoperable' Essential Service Water supply line to the turbine driven AFW pump; and

e. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is c6nsistent with the allowed Completion Time for one train of ESW inoperable.

The second Completion Time for Required Action B.1 establishes a limit on the 'maximum time' allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which multiple Conditions are entered concurrently. The AND connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

C.1 With one of the required AFW train's (pump or flow path) inoperable for reasons other than Condition A or Condition B, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condition includes the loss of two steam supply lines or two ESW supply lines to the turbine driven'AFW pump. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.

License Amendment 158 approved a one-time only Completion Time extension to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months for the Condition C entry on 2/3/04 for the turbine driven auxiliary feedwater pump: Condition C was entered at 0756 hours0.00875 days 0.21 hours 0.00125 weeks 2.87658e-4 months Central Standard Time on 2/3/04 when the turbine driven auxiliary feedwater pump was declared inoperable. This one-time Completion Time extension for Required Action C.1 'expires at'0756 hours0.00875 days 0.21 hours 0.00125 weeks 2.87658e-4 months Central Standard Time on 219/04, after which Condition' D must be entered. At the time'a formal cause of the inoperability is determined, Condition D will be entered imniediat6ly..!

(continued)

- CALLAWAY PLANT '.I-.'B 3.7.5-6 I- Revision 5

AFW System B 3.7.5 BASES ACTIONS C.A (continued)

The second Completion Time for Required Action C.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which multiple Conditions are entered concurrently. The AND connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

D.1 and D.2 When Required Action A.1 or B.1 or C.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

E.1 If all three AFW trains are inoperable, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status.

Required Action E.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe condition.

SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW System water and steam supply flow paths provides assurance that the proper flow paths will exist for AFW (continued)

CALLAWAY PLANT B 3.7.5-7 Revision 5

AFW System B 3.7.5 BASES SURVEILLAN( C#E SR 3.7.5.1 (continued) l I REQUIREMEI ITS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown (which may include the use of

-localor remote -indicators), that those valves capable of being' mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control.

This SR does not apply to' valves that cannot be inadvertently misaligned, such as check valves and relief valves. Additionally, vent and drain valves are not within the scope of this SR.

ThisZSR is modified by a Note indicating that the SR is not required to be performed for the AFW flow control valves until the AFW system is placed in automatic control or when Thermal Power is above 10% RTR In order for the TDAFP and MDAFPs to be OPERABLE while the AFW system is in automatic control 'or above 10% RTP, the discharge flow control valves (ALHV0005, 6, 7, 8, 9, 10, 11, and 12) shall be in the full open position. The TDAFP and MDAFPs remain OPERABLE with the discharge flow control valves throttled to maintain steam generator levels during plant heatup, cooldown, or if started due to an Auxiliary Feedwater Actuation Signal (AFAS) or manually started in anticipation of an AFAS.

, - I' . ,

The 31 day Frequency, based on engineering judgment, is consistent with procedural controls governing valve operation, and ensures correct valve positions.

SR, 7.5.2 1 5R; 37.75.2 ;

Verifying'that ie'ach'AFW punp's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has 'not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required bySection Xl of the ASME Code (Ref. 2). Because it is undesirable to introduce 'cold AFW into the steam generators while they are operating, this testing is'performed on recirculation flow. Such inservice'tests co'nfirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.

Performance of inservice testing discussed in the ASME Code, Section Xi (Ref. 2) (only required at 3 month intervals) satisfies this requirement.

The test Frequency in accordance with the Inservice Testing Program (continued)

CALLAWAY PLANT I .- ' :' '--B 3.7.5-8 CAAPL N' ' ' ' ' Revision 5

AFW System B 3.7.5 BASES '>

SURVEILLANCE SR 3.7.5.2 (continued)

REQUIREMENT results in testing each pump once every 3 months, as required by Reference 2.

The required differential pressure for the AFW pumps when tested in accordance with the Inservice Testing Program is:

a. The acceptance criteria for the MDAFPs have been calculated using a limiting performance curve. The acceptance criteria, given as a table below, have been determined based on the Loss of Normal Feedwater (LONF) or Loss of Non-emergency AC Power (LOAC) events.

MOTOR DRIVEN PUMPS ACCEPTANCE CRITERIA (using performance curve)

Recirc. Flow (gpm) Diff. Pressure (psid) 2130 21543 2150 21542 2160 21539 2170 21537

b. The acceptance criteria for the TDAFP has been calculated using a limiting performance curve. The acceptance criteria given as a table below, have been determined based on the Small Break Loss of Coolant Accident (SBLOCA) event.

TURBINE DRIVEN PUMP ACCEPTANCE CRITERIA (using performance curve)

Recirc. Flow (gpm) Diff. Pressure (psid) 2120 21628 2140 21626 This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test.

(continued)

CALLAWAY PLANT B 3.7.5-9 Revision 5

AFW System B 3.7.5 BA SE. S.

BASES SURVEILLANCE SR 3.7.5.3 REQUIREMENTS (continued) This SR verifies'that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct position on an'actual or simulated actuation signal.

This Surveillance'is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for ar'nunplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is acceptable based on operating experience and the design reliability of the equipment.

This SR includes the requirement to verify that each AFW motor-operated discharge valve, ALHV0005, 7, 9 and 11, limits the flow from the notor-driven'pump to each steam generator to < 300 gpm (Reference 6) and that valves ALHV0030, 31, 32, 33, 34, 35 and 36 actuate to the required position upon receipt of an Auxiliary Feedwater Pump suction Pressure-Low signal. -

' SR' 3.7.5.4 - '

This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an AFAS by demonstrating that each AFW pump starts automatically on an actual or simulated auxiliary feedwater actuation signal. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

This SR is modified by a Note. The Note indicates that the SR be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test.

SR 3.7.5.5 This SR verifies that the AFW is properly aligned by verifying the flow paths from the CST to each steam generator prior to entering MODE 2 after more than 30 days in MODE 5 or 6.

OPERABILITY of AFW flow paths must be verified before sufficient core heat is generated that would require the operation of the AFW System during a subsequent shutdown. The Frequency is reasonable, based on (continued)

CALLAWAY PLANT B 3.7.5-1 0 -Revision 5

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.5 (continued)

REQUIREMENTS engineering judgement and other administrative controls that ensure that flow paths remain OPERABLE. To further ensure AFW System alignment, flow path OPERABILITY is verified following extended outages to determine no misalignment of valves has occurred. This SR ensures that the flow path from the CST to the steam generators is properly aligned.

REFERENCES 1. FSAR, Section 10.4.9, Auxiliary Feedwater System.

2. ASME, Boiler and Pressure Vessel Code, Section Xl.

3. FSAR, Section 9.3.1, Compressed Air System.

4. Amendment No. 55 to facility Operating License No. NPF-30, dated 7/27/90.

5. FSAR 15.2.8, Feedwater System Pipe Break.

6. Request for Resolution (RFR) 21816A.

J CALLAWAY PLANT B 3.7.5-1 1 Revision 5

CCW System B 3.7.7 B 3.7 PLANT SYSTEMS _

B 3.7.7 Component Cooling Water (CCW) System -'-

BASES BACKGROUND The CCW System provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, the CCW System also provides this function for various nonessential components, as well as the spent fuel storage pool. The CCWSystem serves as a barrier to the release of radioactive byproducts'between potentially radioactive systems and the Essential Service Water System, and thus to the environment.

The CCW System is arranged as two independent, full capacity cooling loops, and has isolatable nonsafety related components. Each safety related train includes two full capacity pumps, surge tank, heat exchanger, piping, valves, and instrumentation. Each safety related train is powered from a separate bus.-A vented surge tank in each loop functions to ensure that sufficient net positive suction head is available and to accommodate volumetric changes due to thermal transients or leakage.

One pump in each train is automatically started on receipt of a safety injection signal, and all nonessential components are isolated.

-Additional information on the design and operation of the system, along with a list of the components served,- is presented in the FSAR,

-Section 9.2.2 (Ref. 1). The principal safety related function of the CCW System is the removal of decay heat from the reactor via the Residual Heat Removal (RHR) System. This may be during a normal or post accident cooldown and shutdown.

APPLICABLE .The design basis of the CCW System is for one CCW train to remove the

- SAFETY heat from components important to mitigating the consequences of a loss ANALYSES of coolant accident (LOCA) or a main steam line break (MSLB). The maximum CCW temperature post LOCAis 131OF'(Ref. 2)..

The CCW System'is-designed to perform its function with a single failure of any active component, assuming a loss of offsite power.

-- The COW Systeni also functions to 'cool the unit from RHR entry conditions (Taj9 <3500F), to MODE 5 (Tavg. < 2000 F), during normal and post accident operations. The time' required to cool from 3500 F to 200OF is a function of the number of CCW and RHR trains operating. One CCW train is sufficient to remove decay heat during subsequent operations with (continued)

I CALLAWAY PLANT B 3.7.7-1 Revision 0

1.

CCW System B 3.7.7 BASES APPLICABLE Tavg. 2001F. This assumes a maximum service water temperature of SAFETY 950 F occurring simultaneously with the maximum heat loads on the ANALYSES system.

(continued)

The CCW System satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO The CCW trains are independent of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a DBA, one CCW train is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two trains of CCW must be OPERABLE.

At least one CCW train will operate assuming the worst case single active failure occurs coincident with a loss of offsite power.

A CCW train is considered OPERABLE when:

a. One pump and associated surge tank are OPERABLE; and

b. The associated piping, valves, heat exchanger, and instrumentation and controls required to perform the safety related.

function are OPERABLE.

A CCW train is rendered inoperable when one or more associated ESW emergency makeup valves are closed, inoperable and not capable of being remotely opened from the Control Room. CCW Train 'A' emergency makeup valves include EGHV0011 and EGHV0013. CCW Train 'B' emergency makeup valves include EGHV0012 and EGHV0014.

The isolation of CCW from other components or systems not required for safety may render those components or systems inoperable but does not affect the OPERABILITY of the CCW System.

APPLICABILITY In MODES 1, 2, 3, and 4, the CCW System is a normally operating system, which must be prepared to perform its post accident safety functions, primarily RCS heat removal, which is achieved by cooling the RHR heat exchanger.

In MODES 5 and 6, the CCW system is capable of performing its specified safety function when required for Operability of the system it

- .supports.

(continued)

CALLAWAY PLANT B 3.7.7-2 .Revision 5

CCW System B 3.7.7 BASES (continued)

ACTIONS A.1. ,

Required ActionA1 is modified by a Note indicating that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4,"

be entered if an inoperable CCW train results in an inoperable RHR loop.

This is an 'exception to LCO 3.0.6 and 'ensures the proper actions are taken for these components. -

If one CCW train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE CCW train is adequate to perform the heat removal function.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this period.

B.1 and B.2 If the CCW train cannot be restored to OPERABLE status within the

- ' associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The

'allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the CCW flow to individual components may render those components inoperable but does not affect the OPERABILITY of the CCW System.

Verifying the'correct alignment for manual, power operated, and automatic valves in the' CCW flow path servicing safety related equipment provides assurance that the proper flow paths exist for CCW operation.

This SR does not apply to valves that are'locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, 'or securing. A valve that receives an actuation signal is allowed to be in' a nonaccident position provided the valve will automatically reposition'within the proper stroke time. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown (which may include the use of local or remote indicators), that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control.

This SR does not apply to valves that cannot be inadvertently misaligned, (continued)

CALLAWAY PLANT ~-.B 3.7.7-3 .Revision 5

CCW System B 3.7.7 BASES SURVEILLANCE SR 3.7.7.1 (continued)

REQUIREMENTS such as check valves and relief valves. Additionally, vent and drain valves are not within the scope of this SR.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.7.2 This. SR verifies proper automatic operation of the CCW valves, servicing safety related components or isolating nonsafety related components, on an actual or simulated actuation signal. This SR applies to the CCW valves that receive a Safety Injection signal and the RCP thermal barrier valves that receive a high CCW flow signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

SR 3.7.7.3 This SR verifies proper automatic operation of the CCW pumps on an actual or simulated actuation signal. These actuation signals include Safety Injection and Loss of Power. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

(continued)

CALLAWAY PLANT B 3.7.7-4 Revision 1

ESW B 3.7.8 BASES

., ~...,- ~.

APPLICABLE The ESW system, in conjunction with the CCW System, also cools the SAFETY unit from residual heat removal (RHR), as discussed in the FSAR, ANALYSES Section 5.4.7; (Ref. 3) entry conditions to MODE 5 during post accident (continued) operations or'during a cooldown' usin'g only safety grade equipment. The time required for this evolution is a function of the number of ESW pumps, CCW heat exchangers, and RHR System trains that are operating. One ESW system train is sufficient to remove'decay heat during subsequent operations in MODES 5 and 6. -This assumes a maximum ESW

- ;temperature of 950 F occurring simultaneously with maximum heat loads I: - on the system;. - -

- ' - . 'The ESW system satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO, Two ESW system trains are required to be OPERABLE to provide the required redundancy to'ensure that the system functions to remove post accident heat loads,'assuming'that the worst case single active failure occurs coincident with the loss of offsite power.

An ESW system train is considered OPERABLE during MODES 1, 2, 3, and 4 when:

a. The pump is OPERABLE;

b. The associated pipin , valves, and instrumentation and controls required to perform the'safety related function are OPERABLE; and

c. The pump room supply fan is OPERABLE.

The prelube storage tanks, TEF01A and TEF01 B, are not required for OPERABILITY of the ESW pumps. The ESW pumps will start and run satisfactorily with dry bearings in an emergency should prelube water supply from the prelube storage tank not be present. Once the pump starts, lube water will be supplied byjthe' pump.

APPLICABILITY In MODES 1, 2, 3, and 4, the ESW system is a standby system that is required to support the OPERABILITY of the equipment serviced by the

-ESW system arid required to be OPERABLE in these MODES.

In MODES 5 and 6, the ESW system is capable of performing its specified safety function when required for Operability of the system it supports. ' ' * ' ;;

KJ

.. .. .(continued)

CALLAWAY PLANT A I ' B8' Revision 5

J EL.

ESW B 3.7.8 BASES (continued)

ACTIONS A.1 If one ESW train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE ESW system train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE ESW system train could result in loss of ESW function. Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources - Operating," should be entered if an inoperable ESW train results in an inoperable emergency diesel generator. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," should be entered if an inoperable ESW system train results in an inoperable residual heat removal train. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period.

B.1 and B.2 If the ESW System train cannot be restored to OPERABLE status within at the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.8.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the ESW components or systems may render those components inoperable, but d6os not affect the OPERABILITY of the ESW system.

Verifying the correct alignment for manual, power operated, and automatic valves in the ESW system flow path servicing safety related components provides assurance that the proper flow paths exist for ESW system operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation (continued)

CALLAWAY PLANT B 3.7.8-3 Revision 0

UHS B 3.7.9 B 3.7 PLANT SYSTEMS B 3.7.9 Ultimate Heat Sink (UHS) - ;

I.

BASES - -' '

BACKGROUND The UHS provides a heat sink for processing and operating heat from safety related components during a transient or accident, as well as during normal operation.' This is done by utilizing the Essential Service Water System (ESW). - I The two principal functions of the UHS are the dissipation of residual heat after reactor shutdown, and dissipation of residual heat after an accident.

The UHS consists of a 4-cell seismic Category I mechanical draft cooling tower and a seismic Category I source of makeup water (retention pond) for the tower. Heat from the ESW system as discussed in FSAR Section 9.2.5, is rejected to the UHS to permit a safe shutdown of the plant following an accident. The UHS furnishes approximately 15,000 gpm of cooling water at a maximum temperature of 950 F to remove the heat loads of the components listed in the Standard Plant FSAR Section 9.2.5.

- The mechanical draft cooling tower is a safety related, seismic Category I structure sized with 100 percent redundancy to provide heat dissipation for safe shutdown following an accident. 'The cooling tower is protected from horizontal and vertical tornado missiles. The supply headers and spray pipes for each train of the ESW System from the Power Block are separated by interior walls. A passive failure of the spray pipe for one train will not affect the opposite train.

- -The approximate dimensions'of the UHS retention pond are 330 by 680

- feet and the sides slopes are 3 horizontal to 1 vertical. The side slopes are protected by riprap from the surrounding grade elevation. Two submerged, reinforced concrete discharge structures discharge water into the pond from the mechanical draft cooling tower. A reinforced concrete outlet structure is provided for outflow from the pond.

Additional information on the design and operation of the system, along with a list of components served, can be found in Reference 1.

APPLICABLE The UHS is sized to dissipate the maximum heat loads listed in Standard SAFETY ' ' Plant FSAR Section 9.2.5 while providing a cold water temperature less ANALYSES than or equal to 950F. It is assumed that the design basis accident occurs

-at the time that the most adverse meteorological conditions for tower (continued)

CALLAWAY PLANT ' I' ' ..B13.7.9-1 CALLAWAY .PLN-B7Revision 5

UHS UHS B 3.7.9 BASES _'I APPLICABLE performance prevail. The UHS pond temperature reached under these SAFETY conditions is 92.3 0F.

ANALYSES (continued) The minimum required level is 13.25 feet from the bottom of the UHS (38 acre-feet). Less than 24 acre-feet is needed to provide a 30 day supply of cooling and makeup water post LOCA under maximum evaporation condition for this period. The total pond water volume remaining after 30 days is 14.7 acre-feet. The useable portion of this volume is 12.4 acre-feet, which is the volume of water above the minimum level needed to maintain the NPSH for the ESW pumps. The remaining volume provides a margin that is greater than 50% of the total water volume requirement. The UHS was analyzed for the design basis LOCA in accordance with NRC Regulatory Guide 1.27 (Ref. 2).

I The UHS satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO The UHS is required to be OPERABLE and is considered OPERABLE if it contains a sufficient volume of water at or below the maximum temperature that would allow the ESW system to operate for at least 30 days following the design basis LOCA without the loss of net positive suction head (NPSH), and without exceeding the maximum design temperature of the equipment served by the ESW system. To meet this condition, the UHS temperature should not exceed 900 F and the level should not fall below 13.25 feet from the bottom of the UHS (831.25 ft mean sea level) during normal unit operation.

In addition, two UHS cooling tower trains (2 cells per train) are required to dissipate the heat contained in the ESW system. An inoperable UHS cooling tower electrical room supply fan renders its UHS cooling tower train inoperable. The UHS is not inoperable if a UHS sump heater is inoperable unless ice formation blocks the return line to the UHS pond.

APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of the ESW system and required to be OPERABLE in these MODES.

ACTIONS A.1 If one cooling tower train is inoperable, action must be taken to restore the inoperable cooling tower train to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable based on the low probability of an accident occurring during the 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months that one cooling tower train (continued)

CALLAWAY PLANT B 3.7.9-2 Revision 5

CREVS B 3.7.10 B 3.7 PLANT SYSTEMS B 3.7.10 Control Room Emergency Ventilation System (CREVS)

.. .:. ~ ~~~~ ~~~~~ . ..- . , . . . , -/,,.; .'-. . .

BASES - - ,. v': > ' -i*

--BACKGROUI ND The CREVS provides a protected environment from which operators can

.. . . control the unit following'an uncontrolled release of radioactivity. The CREVS consists of two independent,'redundant trains that pressurize, recirculate, and filter the control room air.- Each CREVS train consists of a filtration system train and a pressurization. system train. Each filtration system train consists of a fan, a'prefilter, a high efficiency particulate air

.. .. ,; t (HEPA) filter, an'activated charcoal adsorber section for removal of

gaseous activity (principally iodines),' and a second HEPA filter follows the adsorb'er section to collect carbon fines. Each pressurization system train

.: 3 consists of a fan, a moisture separator, an electric heater, a HEPAfilter, an activated charcoal adsorber section for removal of gaseous activity

.: ' . . .: '. '(principally iodines),"and 'a'second HEPA filter follows the adsorber section to collect-arbon fines: Ductwork,'valves or dampers, and instrumentation also form part of the CREVS system.

The CREVS is an emergency system which may also operate during normal unit operations. Upon receipt of the actuating signal, normal air

.supply and exhaust to the control room-is isolated, a portion of the I

- ventilation air isrecirculated through the system filter trains, and the pressurization system is started. The prefilters remove any large particles in the air, and a moisture separator removes any entrained water droplets present, to prevent excessive loading of the HEPA filters and charcoal adsorbers. Continuous operation of each pressurization system train for at least 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months per month, with the heaters functioning, reduces moisture buildup on the HEPA filters and adsorbers. The heaters are important to the' effectiveness of the charcoal adsorbers.

Actuation of the CREVS by a Control Room Ventilation Isolation Signal (CRVIS),'places the system in'the eriergency mode of operation.

Actuation of the system to the emerge'ncy mode of operation closes the unfiltered outside air'intake and unfiltered exhaust dampers, and aligns the system for recirculation of the control room air through the redundant trains of HEPA and the charcoal filters. The emergency (CRVIS) mode also initiates pressurization and filtered ventilation of the air supply to the control room.- ' - '-

The control room pressurization system draws in outside air, processing it through a particulate filter charcoal adsorber train for cleanup. This outside air is diluted with air drawn from the cable spreading rooms and the electrical equipment floor levels within the Control Building and distributed back into those spaces for further dilution. The control room KJ filtration units take a portion of air from the exhaust side of the (continued)

CALLAWAY PLANT . I B 3.7.10-1 C A PB'3 0 Revision 5

CREVS B 3.7.10 BASES BACKGROUND system, upstream of the outside air intake, for dilution with portions of the (continued) exhaust air from the control room air-conditioning system and processes it through the control room filtration system adsorption train for additional cleanup. This air is then further diluted with the remaining control room air-conditioning system return air, cooled, and supplied to the control room. This process will maintain the control room under a positive pressure of 1/8 inch water gauge (min.) with respect to the outside atmosphere. This will assure exfiltration from the control room, thus preventing any unprocessed contaminants from entering the control room.

The air entering the control building during normal operation is continuously monitored by radiation, carbon dioxide/monoxide, and smoke detectors. A high radiation signal initiates the emergency (CRVIS) mode of operation; the other detectors provide an alarm in the control room. A CRVIS is initiated by the radiation monitors (GKRE0004 and GKRE0005), Fuel Building Ventilation Isolation Signal, Containment Isolation Phase A, the containment purge exhaust radiation monitors (GTRE0022 and GTRE0033), and manually. The instrumentation associated with actuation of the CREVS is addressed in LCO 3.3.7, "Control Room Emergency Ventilation System (CREVS) Actuation Instrumentation."

A single train is capable of pressurizing the control room to 2 0.125 inchesK>

water gauge. The CREVS operation in maintaining the control room habitable is discussed in the FSAR, Section 6.4 (Ref. 1).

Redundant pressurization and filtration trains provide the required filtration should an excessive pressure drop develop across the other filter train. Normally open isolation dampers are arranged in series pairs so that the failure of one damper to shut will not result in a breach of isolation. The CREVS is designed in accordance with Seismic Category I requirements.

The CREVS is designed to maintain the control room environment for 30 days of continuous occupancy after a Design Basis Accident (DBA) without exceeding a 5 rem whole body dose or its equivalent to any part of the body.

APPLICABLE The CREVS components are arranged in redundant, safety related SAFETY ventilation trains. The location of components and ducting within the ANALYSES control room envelope ensures an adequate supply of filtered air to all areas requiring access. The CREVS provides airborne radiological protection for the control room operators, as demonstrated by the control room accident dose analyses for the most limiting design basis loss of (continued)

CALLAWAY PLANT B 3.7.10-2 Revision 5

I-' i- i. t. 1 tti

,i .

CREVS B 3.7.10 BASES APPLICABLE coolant acciaerit, fission product release presented in the FSAR, SAFETY 'Chapter 15A.3 (Ref. 2).:'

ANALYSES (continued) The worst case single active failure of a component of the CREVS, assuming a loss of offsite power, does not impair'the ability of the system to perform its design function.

The CREVS satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

-LCO Two independent and redundant CREVS trains are required to be OPERABLE toWensure that at least one is available assuming a single failure disables the other train. Total system failure could result in exceeding a dose of 5 rem to the control room operator in the event of a large radioactive release.

The CREVS is considered OPERABLE when the individual components necessary to limit operator exposure are OPERABLE in both trains. A CREVS train is 'OPERABLE when the'associated:

- - a. Control Room Air Conditioner, filtration and pressurization fans are OPERABLE;.

b. HEPA filters and charcoal adsorbers are not excessively restricting flow, and are capable of performing their filtration functions;

c. Heater, moisture separator, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

In addition, the control room pressure boundary must be maintained,

'including the integrity of the walls, floors, ceilings, ductwork, and access

'doors.' -

The LCO is modified by a Note allowing the control room boundary to be

-. ' opened intermittently under administrative controls. For entry and exit

'through doors the administrative control of the opening is performed by

'L the person(s) entering or exiting the area: For other openings these controls consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual will have a method to rapidly close the opening when a need for control room isolation is indicated. Plant administrative controls (Ref. 5) address the breached pressure boundary.

Note that the Control Room Air Conditioning System (CRACS) forms a subsystem to the CREVS. The CREVS remains capable of performing its safety function provided the CRACS air flow path is intact and air circulation can be maintained. Isolation or breach of the CRACS air flow (continued)

CALLAWAY PLANT B 3.7.10-3 . Revision 5

CREVS B 3.7.10 BASES LCO path can also render the CREVS flow path inoperable. In these (continued) situations, LCOs 3.7.10 and 3.7.11 may be applicable.

APPLICABILITY In MODES 1, 2, 3, and 4, CREVS must be OPERABLE to control operator exposure during and following a LOCA or SGTR.

In MODE 5 or 6, the CREVS is required to cope with the design basis release from the rupture of a waste gas decay tank.

During movement of irradiated fuel assemblies, the CREVS must be OPERABLE to cope with the release from a design basis fuel handling accident inside containment or in the fuel building.

ACTIONS A.1 When one CREVS train is inoperable, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CREVS train is adequate to perform the control room protection function. However, the overall reliability is reduced because a single failure in the OPERABLE CREVS train could result in loss of CREVS function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.

B.1 If the control room boundary is inoperable in MODE 1, 2, 3, or 4 such that neither CREVS train can establish the required positive pressure (but the trains are not otherwise inoperable), action must be taken to restore an OPERABLE control room boundary within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . During the period that the control room boundary is inoperable, appropriate compensatory measures (consistent with the intent of GDC 19) should be utilized to I protect control room operators from potential hazards such as radioactive contamination, toxic chemicals, smoke, temperature and relative humidity, and physical security. (Appropriate compensatory measures include those such as described for the LCO Note in the LCO Bases above).

For the purposes of assessing whether Condition B applies, "control room boundary" may include portions of the Control Building boundary due to analyzed interaction between the Control Building and control room atmospheres during emergency operation of the CREVS, including the (continued)

CALLAWAY PLANT B 3.7.10-4 Revision 5

CREVS B 3.7.10 BASES

- .. .... ti ,,.. ..,

ACTIONS B.1 (continued) effect of Control Building boundary leakage, as modeled in the control room dose analyses for the DBA LOCA.'

C ,

The 24'hour Completion Time is reas6nable based on the low probability of a DBA occurring during this time period, the availability of the CREVS to'provide a filtered environment (albiet with potential control room inleakage), and the use of compensatory measures. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is a reasonable time to diagnose, plan, repair, and test most problems with the control room boundary.

-C.1 and C.2 I - I 1 In MODE 1, 2, 3, or 4, if the inoperable CREVS train or control room boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be pla'ced in a MODE that mninimizes accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

D.1.1, D.1.2, D.2.1,and D.2.2:

In MODE 5 or 6, or during movement of irradiated fuel assemblies, if the

inoperable CREVS train cannot be restored to OPERABLE status within the required Completion'Time, action must be taken to immediately place the OPERABLE CREVS train in the CRVIS mode. This action ensures "that the remaining train is OPERABLE, that no failures preventing automatic 'actuation will occur, and that any active failure would be readily

-detected.

Action DA1.2 reqdires th6 CREVS train placed in operation be capable of being powered by an emergency power source. This action assures OPERABILITY of the CREVS train in the unlikely event of a Fuel Handling Accident or Decay Tank rupture while shutdown concurrent with a loss of offsite power.

An alternative to Required Actions D.1.1.1 and D.1.2 is to immediately suspend activities'that could result in a release of radioactivity that might require isolation of the control room. - Required Actions D.2.1 and D.2.2 would place the unit in a condition that minimizes risk. This does not preclude the movement of fuel to a safe position.

(continued)

: \ ~-N I..

CALLAWAY PLANT B 3.7.10-5 Revision 5

CREVS B 3.7.1 0 BASES ACTIONS E.1 and E.2 (continued)

In MODE 5 or 6, or during movement of irradiated fuel assemblies, with two CREVS trains inoperable, action must be taken immediately to suspend activities that could result in a release of radioactivity that might enter the control room. This places the unit in a condition that minimizes accident risk. This does not preclude the movement of fuel to a safe position.

F.1 If both CREVS trains are inoperable in MODE 1, 2, 3, or 4, for reasons other than an inoperable control room boundary (i.e., Condition B), the CREVS may not be capable of performing the intended function and the unit is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.7.10.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not severe, testing each train once every month, by initiating from the control room, flow through the HEPA filters and charcoal adsorbers of both the filtration and pressurization systems, provides an adequate check of this system.

Monthly heater operations dry out any moisture accumulated in the charcoal from humidity in the ambient air. Each pressurization system train must be operated for 2 10 continuous hours with the heaters functioning. Functioning heaters will not necessarily have the heating elements energized continuously for 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months ; but will cycle depending on the air temperature. Each filtration system train need only be operated for 2 15 minutes to demonstrate the function of the system. The 31 day Frequency is based on the reliability of the equipment and the two train redundancy availability.

SR 3.7.10.2 This SR verifies that the required CREVS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP).

The CREVS filter tests use the test procedure guidance in Regulatory Guide 1.52 (Ref. 3). The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and the (continued) of CALLAWAY PLANT B 3.7.10-6 Revision 5

CREVS B 3.7.10 BASES SURVEILLANCE SR 3.7.10.2 (continued)

REQUIREMENTS physical properties of the activated charcoal. Specific test Frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.10.3 This SR verifies that each CREVS train starts and operates on an actual or simulated actuation signal. The actuation signal includes Control Room Ventilation Isolation or Fuel Building Ventilation Isolation. The CREVS train automatically switches on an actual or simulated CRVIS signal into a CRVIS mode of operation with flow through the HEPA filters and charcoal adsorber banks. The Surveillance Requirement also verifies that a control room ventilation isolation signal (CRVIS) will be received by the LOCA sequencer to enable an automatic start of the Diesel Generator loads that are associated with a CRVIS. Verification that these loads will start and operate at the appropriate step in the LOCA sequencer and that other auto-start signals for these loads will be inhibited until the LOCA sequencer is reset is accomplished under Surveillance Requirement SR 3.8.1.12. The Frequency of 18 months is consistent with the typical operating cycle. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

SR 3.7.10.4 This SR verifies the integrity of the control room enclosure, and the assumed inleakage rates of the potentially contaminated air. The control room positive pressure, with respect to the outside atmosphere, is periodically tested to verify proper functioning of the CREVS. During the CRVIS mode of operation, the CREVS is designed to pressurize the control room 2 0.125 inches water gauge positive pressure with respect to the outside atmosphere in order to prevent unfiltered inleakage. The CREVS is designed to maintain this positive pressure with one train. The Frequency of 18 months on a STAGGERED TEST BASIS is consistent with the guidance provided in NUREG-0800 (Ref. 4).

REFERENCES 1. FSAR, Section 6.4, Habitability Systems.

2. FSAR, Chapter 15A.3, Control Room Radiological Consequences Calculation Models.

(continued)

CA;. A P.N ;, 3..1- Reiso 5 CALLAWAY PLANT B 3.7.10-7 Revision 5

CREVS B 3.7.10 BASES REFERENCES 3. Regulatory Guide 1.52, Rev. 2, Design, Testing, and Maintenance (continued) Criteria for Atmospheric Cleanup System Air Filtration and Adsorption Units of Light Water Cooled Nuclear Power Plants.

4. NUREG-0800, Section 6.4, Rev. 2, July 1981, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants.

5. Procedure EDP-ZZ-04107, HVAC Pressure Boundary and Watertight Door Control.

CALLAWAY PLANT B 3.7.10-8 Revision 5

Emergency Exhaust System B 3.7.13

- B 3.7 PLANT. SYSTEMS.

B3 .7.13'Emergency Exhaust System (EES-!' II . I I '. .

I_ .I

-RASES l '.

' BACKGROUND ' The Emergency Exhaust System serves both the auxiliary building and

Vt*

,1 . .1 I-, .-.. ,, 1*, . , -. the fuel building. Following a safety injection signal (SIS), safety related dampers is6late the auxiliary building, and the Emergency Exhaust I ~I :- .- System exhausts'potentially contaminated air due to leakage from ECCS systems.' The Emergency Exhaust System also can filter airborne radioactive particulates from the area of the fuel pool following a fuel I:' handling accident.

I I .. I The Emergency Exhaust System'consists of two independent and redundant trains.' Each train consists of a heater, a prefilter, a high efficiency particulate air (HEPA) filter bank, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, dampers, and instrumentation also form part of the system. A second bank of.HEPA filters follows the adsorber section to collect carbon fines.

The Emergency Exhaust System is on standby for an automatic start

>,IK following receipt of a fuel building ventilation isolation signal (FBVIS) or a

'safety injection'signal (SIS).' Initiation of the SIS mode of operation takes precedence over any other mode of operation. In the SIS mode, the system is aligned to exhaust the auxiliary building. The instrumentation associated with actuation of the SIS mode of operation is addressed in LCO 3.3.2, ESFAS Instrumentation.

Upon receipt of a fuel building ventilation-isolation signal generated by gaseous radioactivity monitors in the fuel building exhaust line, normal air discharges from the building are terminated, the fuel building is isolated, the stream of ventilation air discharges through the system filter trains, anda control room ventilation isolation signal (CRVIS) is generated. The instrumentation associated with actuation of the FBVIS mode of operation is addressed in LCO 3.3.8, EES Actuation Instrumentation.

~~~~-. ... . . .

.: . i

\...

':The' EmergencyExhaust System is' discussed in the FSAR, Sections 6.5.1, 9.4.2,'9.4.3, and 15.7A (Refs. 1, 2, 3 and 4 respectively) because it may be used for normal, as well as post accident, atmospheric cleanup functions.

(continued)

CALLAWAY PLANT . ! .'-.1' 'B 3.7.13-1 Revision 4

Emergency Exhaust System B 3.7.13 RASES (continued) _,J APPLICABLE The Emergency Exhaust System design basis is established by the SAFETY consequences of two Design Basis Accidents (DBAs), which are a loss of ANALYSES coolant accident (LOCA) and a fuel handling accident (FHA). The analysis of the fuel handling accident, given in Reference 4, assumes that all fuel rods in an assembly are damaged. The analysis of the LOCA assumes that radioactive materials leaked from the Emergency Core Cooling System (ECCS) and Containment Spray System during the recirculation mode are filtered and adsorbed by the Emergency Exhaust System. The DBA analysis of the fuel handling accident and of the LOCA assumes that only one train of the Emergency Exhaust System is functional due to a single failure that disables the other train. The accident analysis accounts for the reduction in airborne radioactive material provided by the one remaining train of this filtration system. The amount of fission products available for release from the fuel building is determined for a fuel handling accident and for a LOCA. These assumptions and the analysis follow the guidance provided in Regulatory Guides 1.4 (Ref. 6) and 1.25 (Ref. 5).

The Emergency Exhaust System satisfies Criterion 3 of 10 CFR 50.36 (c) (2) (ii).

, LCO Two independent and redundant trains of the Emergency Exhaust Systerr >

are required to be OPERABLE to ensure that at least one train is available, assuming a single failure that disables the other train. Total system failure could result in the atmospheric release from the auxiliary building or fuel building exceeding regulatory release limits in the event of a LOCA or fuel handling accident.

In MODES 1, 2, 3 and 4 the Emergency Exhaust System (EES) is considered OPERABLE when the individual components necessary to control releases from the auxiliary building are OPERABLE in both trains (i.e., the components required for the SIS mode of operation and the auxiliary building pressure boundary). During movement of irradiated fuel assemblies in the fuel building, the EES is considered OPERABLE when the individual components necessary to control releases from the fuel building are OPERABLE in both trains (i.e. the components required for the FBVIS mode of operation and the fuel building pressure boundary).

An Emergency Exhaust System train is considered OPERABLE when its associated:

a. Fan is OPERABLE; N

(continued)

CALLAWAY PLANT B 3.7.1 3-2 Revision 5

Emergency Exhaust System B 3.7.13 BASES LCO b. HEPA filter and charcoal adsorber are not excessively restricting (continued) flow, and are capable of performing their filtration function, and

c. Heater, ductwork, and dampers are OPERABLE, and air circulation can be maintained:

The LCO is modified by a Note allowing the auxiliary or fuel building boundary to be opened intermittently under administrative controls. For entry and exit through doors the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings these controls consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual will have a method to rapidly close the opening when a need for auxiliary or fuel building isolation is indicated. Plant administrative

-controls address th6 breached pressuib boundary.

-APPLICABILITY In MODE 1, 2, 3, or4, the Emergency Exhaust System is required to be OPERABLE to support the SIS mode of operation to provide fission product removal associated with ECCS leaks due to a LOCA and leakage from containment and annulus.

In MODE 5 or 6, the Emergency Exhaust System is not required to be OPERABLE since the ECCS is not required to be OPERABLE.

During movement of irradiated fuel in thelfuel building, the Emergency Exhaust System is required to be OPERABLE to support the FBVIS mode of operation to alleviate the consequences of a fuel handling accident.

The Applicability is modified by a Note. The Note clarifies the Applicability for the two safety-related modes of operation of the Emergency Exhaust

-System, i.e., the Safety Injection Signal (SIS) mode and the Fuel Building Ventilation Isolation Signal (FBVIS) mode. The SIS mode which aligns the system to the'auxiliary building is applicable when the ECCS is required to be OPERABLE. In the FBVIS mode the system is aligned to the fuel building. This mode is applicable while handling irradiated fuel in

- -the fuel building.: - -; 1-ACTIONS A.1 With'one Emergency Exhaust System train inoperable in MODE 1, 2, 3, or 4,; actionr'must be taken to restore OPERABLE status within 7 days.

During'this period, the remaining OPERABLE train is adequate to perform the Emergency Exhaust System function.'This condition only applies to the EES components required to support the SIS mode of operation. The 7 day Completion Time is'based on the risk from an event occurring (continued)

CALLAWAY PLANT . B 3.7.13-3 Revision 4

Emergency Exhaust System B 3.7.13 BASES ACTIONS A.1 (continued) requiring the inoperable Emergency Exhaust System train, and the remaining Emergency Exhaust System train providing the required protection.

B.1 If the auxiliary building boundary is inoperable in MODE 1, 2, 3, and 4 such that neither EES train can establish the required negative pressure, action must be taken to restore an OPERABLE auxiliary building boundary within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . During the period that the auxiliary building boundary is inoperable, appropriate compensatory measures (consistent with the intent, as applicable, of GDC 19, 60, 61, 63, 64, and 10CFR Part 100) should be utilized to protect plant personnel from potential hazards such as radioactive contamination and physical security. Compensatory measures address entries into Condition B. See also the LCO Bases above. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable based on the low probability of a DBA occurring during this time period, the availability of the EES to provide a filtered environment (albiet with potential auxiliary building exfiltration), and the use of compensatory measures. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is a reasonable time to diagnose, plan, repair, and test most problems with the auxiliary building boundary.

C.1 and C.2 In MODE 1, 2, 3, or 4, when Required Action A.1 or B.1 cannot be completed within the associated Completion Time, or when both Emergency Exhaust System trains are inoperable for reasons other than due to an inoperable auxiliary building boundary (i.e., Condition B), the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This condition only applies to the EES components required to support the SIS mode of operation. The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

D.1 and D.2 With one Emergency Exhaust System train inoperable during movement of irradiated fuel assemblies in the fuel building, the OPERABLE Emergency Exhaust System train must be immediately started in the FBVIS mode per Required Action D.1. This action ensures that no undetected failures preventing system operation exist, and that any actively (continued)

CALLAWAY PLANT B 3.7.13-4 Revision 5

Emergency Exhaust System B 3.7.13 IB AS ES ,.'

BASES ACTIONS D.1 and D.2 (continued) failure will be readily detected. In addition, and although not explicitly stated in the Required Action, the EES train that is placed into operation must be capable of being powered by an emergency power source (i.e.,

diesel generator): This supports OPERABILITY of the EES train by ensuring its continued capability to perform its intended safety function in the unlikely event of afuel handling accident in the fuel building during shutdown conditions; concurrent with'a loss of offsite power.

An alternative to Required Action D.1 is to immediately suspend movement of irradiated fuel assemblies in the fuel building per Required Action D.2. This precludes activities that could result in a fuel handling accident and the associated release of radioactivity that might require operation of the Emergency Exhaust System. This action does not

-preclude the movement of fuel assemblies to a safe position.

- E.1

'When two trains of the Emergency Exhaust System are inoperable during

- ' t' -movement of irradiated fuel assemblies in the fuel building, action must be taken to place the unit in a condition in which the LCO does not apply.

'Action must be taken immediately to suspend movement of irradiated fuel

- assemblies in the fuel building. This does not preclude the movement of

- , : fuel to a safe-position- This condition only applies to the EES components required to support'the FBVIS mode of operation, including

the fuel building pressure boundary.

SURVEILLANCE SR 3.7.13.1 REQUIREMENTS- -

- Standby systems should be checked periodically to ensure that they function properly.: As the environmental and normal operating conditions on this system'are not'severe, testing each train once every month, by initiating from the Control Room flow through the HEPA filters and charcoal ads6rbers, provides an adequate check on this system.

'Monthly heater.operation dries out any moisture accumulated in the charcoal from humidity in the ambient air. Each Emergency Exhaust System train must be operated for 2 10 continuous hours with the heaters functioning. Functioning heaters would not necessarily have the heating elements energized continuously for 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , but will cycle depending on the temperature. The 31 day Frequency is based on the known reliability of the equipment and the two train redundancy available. This SR can be satisfied with the EES in the SIS or FBVIS lineup during testing.

(continued)

CALLAWAY PLANT - -I , .., B 3.7.13-5 Revision 5

Emergency Exhaust System B 3.7.13 BASES SURVEILLANCE SR 3.7.13.2 REQUIREMENTS (continued) This SR verifies that the required Emergency Exhaust System filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The Emergency Exhaust System filter tests are in accordance with Regulatory Guide 1.52 (Ref. 7). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal.

Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.13.3 This SR verifies that each Emergency Exhaust System train starts and operates on an actual or simulated actuation signals. These actuation signals include a Safety Injection Signal (applicable in MODE 1, 2, 3 and 4) and high radiation signal from the Fuel Building Exhaust Radiation l

- Gaseous channels (applicable during movement of irradiated fuel in the I fuel building). The 18 month Frequency is consistent with the typical operating cycle. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month frequency.

Therefore, the Frequency is acceptable from a reliability standpoint.

During emergency operations the Emergency Exhaust System will automatically start in either the SIS or FBVIS lineup depending on the initiating signal. In the SIS lineup, the fans operate with dampers aligned to exhaust from the Auxiliary Building and prevent unfiltered leakage. In the FBVIS lineup, which is initiated on a high radiation signal from the Fuel Building Exhaust Radiation - Gaseous channels, the fans operate with the dampers aligned to exhaust from the Fuel Building to prevent unfiltered leakage. Normal exhaust air from the Fuel Building is continuously monitored by radiation detectors. One detector output will automatically align the Emergency Exhaust System in the FBVIS mode of operation. This surveillance requirement demonstrates that each Emergency Exhaust System train can be automatically started and properly configured to.the FBVIS or SIS alignment, as applicable, upon receipt of an actual or simulated SIS signal and an FBVIS signal. It is not required that each Emergency Exhaust System train be started from both actuation signals during the same surveillance test provided each actuation signal is tested independently within the 18 month test frequency.

(continued)

CALLAWAY PLANT B 3.7.1 3-6 Revision 4

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.4 REQUIREMENTS (continued) This SR provides verification that the fuel oil transfer pump starts on low level in the day tank standpipe to automatically maintain the day tank fuel oil level above the DG fuel headers. The minimum fuel oil free surface elevation is required to be at least 130 inches above the baseline of the diesel generator skid. The transfer pump start/stop setpoints are controlled to maintain level in the standpipe in order to ensure there is I

sufficient fuel to meet the 12 second start requirement for the DG This level also ensures adequate fuel oil for a minimum of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of DG operation at full load plus 10%.

The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are provided and facility operators would be aware of any large uses of fuel oil during this period.

SR 3.8.1.5

., , ,, I Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil day tanks once every 31 days eliminates the necessary environment for bacterial survival. -This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may

. . . come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 10). This SR is for preventative

- maintenance.- The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during the performance of this Surveillance.

SR 3.8.1.6 .* - -

;I -- -

This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. This is required to support continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for fuel transfer systems are OPERABLE.

K) (continued)

CALLAWAY PLANT .- B 3.8.1-17 Revision 4

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 (continued)

REQUIREMENTS The Frequency for this SR is 31 days.

SR 3.8.1.7 See SR 3.8.1.2.

SR 3.8.1.8 Not Used SR 3.8.1.9 Not Used SR 3.8.1.10 This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits.

The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions. This test >

simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG does not trip upon loss of the load. These acceptance criteria provide for DG damage protection. While the DG is not expected to experience this transient during an event and continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, testing must be performed using a power factor 2 0.8 and 5 0 9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG would experience.

The 18 month Frequency is consistent with the recommendation of Regulatory Guide 1.108 (Ref. 9) and is intended to be consistent with expected fuel cycle lengths.

(continued)<)

CALLAWAY PLANT B 3.8.1-18 Revision 5

AC Sources - Operating B 3.8.1

_ 'z BASES SURVEILLANCE SR 3.8.1.10 (continued)-' :iV REQUIREMENTS -- ;-'

-Q ~ME*S The reeiirem6rits of the "Single-Load Rejection Test" and the "Full-Load Rejection Test" as described in Regulatory Guide 1.9, Revision 3 have been c6mbined. 'The "Full-Load Rejection Test" is a demonstration of the

-emergencydiesel generator's capability to reject a load equal to 90 to 100 percent of its continubus rating;(5580-6201 kilowatts) while operating at a power factor between 0.8 and 0.9 'and that the voltage does not exceed

4784 vblts-and that the frequency does not exceed 65.4 Hertz following a load rejection of 5580 to 6201 kilowatts. The frequency criteria is from the "Single-Load Rejection Test" and is based on nominal engine speed plus 75 percent of the difference between nominal speed and the over-speed trip setpoint (Refs.13 and 15).

The ESW pumip;, Istarting transient during the LOCA sequencing test, will be demonstrated to be within a minimum voltage of 3120 Vac and to recover to 3680 Vac within 3 seconds and to be within a maximum voltage of 4784 Vac and recover to 4320 Vac within 2 seconds. This is based on Regulatory Guide 1.9 Revision 3 Section 1.4 and past trending of ESW pump starting transient performance (Refs. 14 and 15).

SR 3.8.1.11; As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(1), this Surveillance demonstrates the as designed operation of the standby power s6urces during loss of the 6ffsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads'from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG autostart time of 12 seconds is derived from requirements of the accident analysis to respond to a'design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability is

-achieved.

The requirement toverify the connection and power supply of permanent and autoconnected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, EmergencyCore Cooling Systems (ECCS) injection valves are

- - --(continued)--

CALLAWAY PLANT .1: - B 3.8.1-19 A N 3Revision 0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS not desired to be stroked open, or high pressure injection systems are not capable of being operated at full flow, or residual heat removal (RHR) systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG systems to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(1), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge J safety systems.

The Note 2 restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post-work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.12.

This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (continuedPl-i CALLAWAY PLANT B 3.8.1-20 Revision 5

. .. -- 1i AC Sources - Operating B 3.8.1 BASES

- ?" , .

1~.2._~ ,

SURVE ILLANCE SR 3.8.1.12 (continued) ' ' ' -

REQUIlIREMENTS (12 seconds) from the design basis'aictuation signal (Si signal) and operates for', 5 minutes. Th6 5 'minute'period provides sufficient time to

'demonstrate"'stability. SR 3.8.1.12.d and SR 3.8.1.12.e ensure that permanently connected loadstand emergency loads are energized from the'offsite' electrical power-system on' a safety injection signal without loss

ofoffsitepwer. '

The requirement to verify the connectioniiof permanent and autoconnected loads is intended to satisfactorily show the relationship of these ioads'to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, ECCS injection valves are not desired to be stroked open, or high pressure injection systems are not capable of being operated at full flow, or RHR

' systems

' performirg a decay heat removal function are not desired to be realigned toth6 ECCS mode of operation. In lieu of actual demonstration of cohnection' and loading of loads, testing that adequately shows the capability of thdIDG'system to perforhm these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 18 months takes into consideration unit conditions required to perform the Surveillance and is intended to be consistent with the expected fuel`cy6le'lengths. Operating experience has shown that these components usuallyipass the SR when performed at the 18 month Frequency. Theirefore, the Frequencywas concluded to be acceptable from a reliabiliti'standpoint.'

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is,with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systenms'that could challenge continued steady state operation and, as a result, unit safety systems.

- The'Note 2 restriction-from normally performing the Surveillance in

-MODE'1 or 2 is further amplified to allow portions of the Surveillance to be performed for the' purpose' of reestablishing OPERABILITY (e.g., post-work testing following corrective 'maintenance, corrective modification,

-deficient or incomplete surveillancd tetsting, and other unanticipated OPERABILITY concerns) provided an assessment determines plant

- . . - (corntinuedMA J__. ".. -

CALLAWAY PLANT sl A ALB32 IRevision 5

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 (continued)

REQUIREMENTS safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.13 This Surveillance demonstrates that DG noncritical protective functions are bypassed on a loss of voltage signal concurrent with safety injection signal. The noncritical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the. DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of 'J the DG The 18 month Frequency is based on engineering judgment and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.8.1.14 Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(3), requires demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If the auto-conniected design loads have increased above the continuous duty rating the load shall be increased to 110% of the continuous duty rating for 2 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . and the remainder of the time at a load equivalent to the continuous duty rating of the DG. The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions

- for prelubricating and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

(continued)-

CALLAWAY PLANT B 3.8.1-22 Revision 5

AC Sources - Operating B 3.8.1 BASES _

..t,. If";;.p SURVI EILLANCE SR 3.8.1.14 (continued)'

REQU IREMENTS

-In order to ensure that the'DG is tested under load conditions that are as close to design conditions as' possible,;testing must be performed using a power factor of 2'0.'8 and < 0.9. This 'power factor is chosen to be representative of the'actual design basis'inductive loading that the DG

' ~ would experience. The' load band is provided to avoid routine overloading of the DG. Routine overloading may'result in more frequent teardown

1. 1 .! I .. ' 'inspections'in

' accordance with vendor recommendations in order to maintairi DG -OPERABILITY The generator voltage and frequency is maintained within'4160 + 160 - 420 volts and 60 +/- 1.2 Hz during this test.

Administrative controls for performing this Surveillance in MODES 1 or 2 with the DG connected to the offsite power supply ensure or require that:

a. Weather conditions are conducive for performing the Surveillance.

Id

" . - b. The offsite power supply and switchyard conditions are conducive for performing'thie Surveillance, which includes ensuring that switchyard access'is'restricted and no effective maintenance within the switchyard is performed

c. No equipment or systems assumed to be available for supporting the performance of the Surveillance are removed from service.

' ' The 18 month Frequency is consistent with the recommendations of

- Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(3), and is intended to be I consistent with expected fuel cycle lengths.

- This'Surveillance is modified by two'Notes. Note 1 states that momentary I

'transients due to changig bus loads do not invalidate this test. Similarly, momentary power factor transients above the power factor limit will not invalidate the test. The reason for Note 2 is that operating' I the DG for greater than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in the overloaded condition need not be performed, provided the auto-connected loads remain below the

'6201 KW continuous rating of the DG..*

SR 3:8.1.15 "

This Surveillance demonstrates that'the diesel engine can restart from a

hotconditioi, such as subsequent to shutdown from normal Surveillances, and'achieve the required voltage and frequency within

'12 'seconds. The' 12 second time is derived from the requirements of the accident analysis t6'respood to a design-basis large break LOCA. The 18 month Frequen c'y is consistenit with the recommendations of Regulatory Guide 1.108 (Ref. 9), 'paragraph 2.a.(5).

(continued)

- CALLAWAY PLANT ; ,. B 3.8.1-23 "' ' ' - Revision 5

IU AC Sources - Operating B 3.8.1 BASES KJ SURVEILLANCE SR 3.8.1.15 (continued)

REQUIREMENTS This SR is modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the DG. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. The requirement that the diesel has operated for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months at full load conditions prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.

SR 3.8.1.16 As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(6), this Surveillance ensures that the manual synchronization and automatic load transfer from the DG to the offsite source can be made and the DG can be returned to ready to load status when offsite power is restored. It also ensures that the autostart logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs.

The DG is considered to be in ready to load status when the DG is at rated speed and voltage, the output breaker is open and can receive an autoclose signal on bus undervoltage, and the load sequence timers are reset.

The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(6), and takes into consideration unit conditions required to perform the Surveillance.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

The restriction from normally performing the Surveillance in MODE 1, 2, 3, or 4 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post-work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system ,- - N (continued)

CALLAWAY PLANT B 3.8.1-24 Revision 5

AC Sources - Operating B3.8.1 BASES SURVEILLANCE SR 3.8.1.16 (continued)A : ,:

REQUIREMENTS when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. -These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1, 2, 3 or 4. Risk

-insights or deterministic methods may be used for this assessment.

SR '3.8.1.17 Demonstration of the test mode override ensures that the DG availability under accident conditions will not be'comrpromised as the result of testing and the DG will automatically reset to ready to load operation if a safety injection signal is received during operation in the test mode. Ready to load operation is'defined as the'DG running at rated speed and voltage with the DG'output breaker open. These provisions for automatic switchover are required by IEEE-308 (Ref. 13), paragraph 6.2.6(2).

The requirement to automatically energize the emergency loads with offsite power is essentially identical to that of SR 3.8.1.12. The intent in the requirement associated with SR 3.8.1.17.b is to show that the emergency loading was not affected by the DG operation in test mode. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perform

' these functions is acceptable.

-This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 18 month Frequency is consistent with the recommendations of

- Regulatory Guide1.108 (Ref. 9), paragraph 2.a.(8), takes into consideration unit conditions required to perform the Surveillance, and is

- ' intended to be consistent with expected fuel cycle lengths.

- ~This SR is modified by'a' Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service,

-' perturb the electrical distribution system; and challenge safety systems.

The restriction from normally'performing the Surveillance in MODE I or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post-work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other'unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the (continued)

-CALLAWAY PLANT - : J .'- B 3.8.1-25 : ,, '.Revision 5

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.17 (continued)

REQUIREMENTS potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.18 Under accident and loss of offsite power conditions loads are sequentially connected to the bus by the Load Shedder and Emergency Load Sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents. The 10% load sequence time interval tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated.

Reference 2 provides a summary of the automatic loading of ESF buses. K J The Frequency of 18 months is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(2), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

The restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post-work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a (continued)

CALLAWAY PLANT B 3.8.1-26 Revision 5

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 (continued) ' : *i!

REQUIREMENTS plant'shutdown and startup to determine that plant safety is maintained or

'" ' '- enhanced when the' Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.19

'- In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply'the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

-','This Surveillance demonstrates the DG operation, as discussed in the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with a safety injection signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the

- 'capability of the DG system to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps'so that the entire connection and loading sequence is verified.

The Frequency of 18 months takes into consideration unit conditions required to perform the Surveillance'and is intended to be consistent with an expected fuel cycle length of 18 months.

'This SR is modified by two Notes. 'The reason for Note 1 is to minimize wear and tear on the DGs during' testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for DGs. The reason for Note 2 is that the performance of the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.."

The' Note 2 restriction from'normally performing the Surveillance in MODE 1 or 2 is'furtheramplified to allow portions of the Surveillance to be performed fdr'the purpose of reestablishing OPERABILITY (e.g., post-work testing following corrective inaintenince, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surv6illance, a&successful partial Surveillaricea'rid'a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be (continued)

CALLAWAY PLANT B 3.8.1-27 ; ' -' - ' . Revision 5

_j

AC Sources - Operating B 3.8.1 BASES K-SURVEILLANCE SR 3.8.1.19 (continued)

REQUIREMENTS measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

The ESW pump starting transient during the LOCA sequencing test, will be demonstrated to be within a minimum voltage of 3120 Vac and to recover to 3680 Vac within 3 seconds and to be within a maximum voltage of 4784 Vac and recover to 4320 Vac within 2 seconds. This is based on Regulatory Guide 1.9 Revision 3 Section 1.4 and past trending of ESW pump starting transient performance (Refs. 14 and 15).

SR 3.8.1.20 This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.

The 10 year Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9). K)

This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.

SR 3.8.1.21 SR 3.8.1.21 is the performance of an ACTUATION LOGIC TEST for each Load Shedder and Emergency Load Sequencer train, except that the continuity check does not have to be performed, as explained in the Note.

This test is performed every 31 days on a STAGGERED TEST BASIS.

The Frequency is adequate based on industry operating experience, considering instrument reliability and operating history data.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. FSAR, Chapter 8.

3. Regulatory Guide 1.9, Rev. 3, July 1993.

(continued)- 2 CALLAWAY PLANT B 3.8.1-28 Revision 5

AC Sources - Operating B 3.8.1

'to A' - _, . . .

I BASES REFERENCES 4. FSAR, Chapter 6.

(continued)

5. FSAR, Chapter 15.

6. Regulatory Guide 1.93, Rev. 0, December 1974.

7. Generic Letter 84-15, "Proposed Staff Actions to Improve and Maintain Diesel Generator Reliability," July 2, 1984.

8. 10 CFR 50, Appendix A, GDC 18.

9. Regulatory Guide 1.108, Rev. 1, August 1977.-

10. Regulatory Guide 1.137, Rev. 0, January. 1978.

' .11- ASME, Boiler and Pressure Vessel Code, Section Xl.

12. IEEE Standard 308-1978.

- 13. ULNRC-3244, dated July 25,1995.

I .14. ULNRC-3342,-dated February 28, 1996.

15. OL Amendment No. 112, dated August 4, 1996.

X ,

I I

! ; ., I , " "

K-)

.CALLAWAY PLANT AB 3.8.1-29 Revision 5

AC Sources - Shutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS >

B 3.8.2 AC Sources - Shutdown BASES BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC Sources -Operating."

APPLICABLE The OPERABILITY of the minimum AC sources during MODES 5 and 6 SAFETY ensures that:

ANALYSES

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.

In general, when the unit is shut down; the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.

The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.

During MODES 1, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In MODES 5 and 6, the activities are generally planned and administratively controlled. Relaxations from MODE 1, 2, 3, and 4 LCO requirements are acceptable during shutdown modes based on:

(continued V.>

CALLAWAY PLANT B 3.8.2-1 Revision 0

. - .- 1 Containment Penetrations B 3.9.4 BASES i; BACKGROUND s action of the containment atmosphere proceeding from containment to (continued) the outside atmosphere without deviation or interruption and having no impairing element.

g.

-, APPLI ICABLE - During CORE ALTERATIONS or movement of irradiated fuel assemblies

- SAFE' TY,, within containment, the most severe radiological consequences result ANAL' YSES from a fuel handling accident. The fuel handling accident is a postulated event that involves damage to irradiated fuel (Ref. 2). The fuel handling accident (in containment) analyzed in Reference 2 consists of dropping a single irradiated fuel assembly onto other irradiated fuel assemblies. The

,' requirements of LCO 3.9.7, "Refueling Pool Water Level," and the minimum decay time of 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months prior to CORE ALTERATIONS ensure thatthe'ielease'of fission product radioactivity, subsequent to a fuel handling accident, results in doses that are well within the guideline values specified in 10 CFR 100. Standard Review Plan, Section 15.7.4, Rev. 1 (Ref. 3), defines "well within" 10 CFR 100 to be 25% or less of the 10 CFR 100 values. The acceptance limits for offsite radiation exposure will be 25% of 10 CFR 100 values.

~~~~C Containment

-ahmh penetrations satisfy Criterion.................................

,ter-io 3 of 10 CFR 50.36(c)(2)(ii).

1U ;

I

. ' L .CO

c This LCO limits the consequences of a fuel handling accident in

containment by limiting the potential escape paths for fission product radioactivity released within containment. The LCO requires any

. penetration providing direct access from the containment atmosphere to the outside atmosphere to be closed except for the OPERABLE containment purge'penetrations and the personnel air lock, the emergency air lock, and the equipment hatch, which must be capable of being closed. For the OPERABLE containment purge penetrations, this.

LCO ensures that these penetrations are isolable by the Containment -

9Purge Isolation System to ensure that releases through the valves are I .. terminated, such that radiological doses are within the acceptance limit.

During CORE ALTERATIONS or during movement of irradiated fuel assemblies within containment, Containment Purge Isolation valves are OPERABLE if they are capable of being closed by manual actuation. For the containment personnel air lock and emergency air lock, one air lock door must b6 capable of being closed. Thus both containment personnel

-'. air lock and emergency air lock doors may be open during movement of irradiated fuel assemblies'within containment or CORE ALTERATIONS, provided an air lock door for each air lock'is capable of being closed.

Administrative controls ensure that 1) appropriate personnel are aware that both personnel air lock and emergency air lock doors are open, 2) a specified individual(s) is designated and available to close the air lock(s) I (continued)

CALLAWAY PLANT B 3.9.4-3 Revision 4

.. . ! ;z . p "- I ~~ 1 .I ~ 1

Containment Penetrations B 3.9.4 BASES LCO following a required evacuation of containment, and 3) any obstruction(s)

(continued) (e.g. cables and hoses) that could prevent closure of an open air lock can be quickly removed (Ref. 1).

The containment equipment hatch may be open during movement of irradiated fuel assemblies within containment or CORE ALTERATIONS provided the hatch is capable of being closed and the water level in the refueling pool is maintained in accordance with FSAR Section 16.9.4 or TS 3.9.7. FSAR 16.9.4 requires that at least 23 feet of water is maintained over the top of the irradiated fuel assemblies within the reactor pressure vessel while in MODE 6 and during movement of control rods within the reactor pressure vessel. TS 3.9.7 requires the refueling pool water level to be maintained 2 23 feet above the top of the reactor vessel flange during the movement of irradiated fuel assemblies within containment.

Administrative controls include 1) appropriate personnel are aware of the open status of the containment during movement of irradiated fuel assemblies within containment or CORE ALTERATIONS, 2) specified individuals are designated and readily available to close the containment equipment hatch following an evacuation that would occur in the event of a fuel handling accident, and 3) any obstructions (e.g., cables and hoses),

that would prevent rapid closure of the containment equipment hatch can be quickly removed. Administrative controls also ensure that during CORE ALTERATIONS or during the movement of irradiated fuel assemblies within containment and when the containment equipment hatch is open, the Containment Purge and Exhaust System is in service; the trip setpoint function for the purge radiation monitor detectors GTRE0022 and GTROO33 is bypassed; and the requirements of TS 3.3.7, CREVS Actuation Instrumentation, are met.

To support the accident analyses and dose consequences for the postulated fuel handling accident (FHA) inside containment and to isolate containment, closure of the containment equipment hatch is required in the event of the postulated FHA inside containment. Closure is defined as the containment equipment hatch installed with four bolts.

Off-Normal plant procedure dictate the Control Room response to a Fuel Handling Accident and direct the operators to manually initiate a Control Room Ventilation Isolation. The Containment Purge and Exhaust System is not secured until the containment equipment hatch, the emergency airlock, and the personnel airlock are closed. The following sequence of actions occur:

(continued)

CALLAWAY PLANT B 3.9.4-4 Revision 5

Containment Penetrations B 3.9.4 BASES ' '-;. '

LCO If the' Equipment Hatch is'open at the time of the FHA'inside containment:

(continued)

Manually initiate CRVIS

Close Containment Hatches in the following order:

- Equipment Hatch Emergency Airlock Personnel Airlock

Following closure of the Personnel Airlock, Manually Initiate CPIS If the Equipment Hatch is closed at the time of the FHA inside containment:

Manually initiate CRVIS i Close Containment Hatches in the following order:

- Emergency Airlock

- Personnel Airlock

Following closure of the Personnel Airlock, Manually Initiate CPIS Continued service of the Containment Purge and Exhaust System during the time interval between the fuel handling accident in containment and closure of the containment equipment hatch, the emergency airlock, and the personnel airlock will not result in any decrease or increase of calculated radiological consequences determined by the Licensing Bases radiological consequences analyses. It ensures that all post-accident releases are monitored.

'In addition 'Section 3.8.2.1.1 of the FSAR states that the containment equipment hatch missile shield (missile shield) is provided to protect the containment equipment hatch. 'Normally,' the containment equipment hatch and the missile'shield are closed during CORE ALTERATIONS or during movement of irradiated fuel inside containment. However, when the containment equipment hatch is open under administrative controls, the missile shield is not required to be closed.

When severe weather conditions are within the plant monitoring radius and for thunderstorms or tornadoes that afre determined to be moving

-toward the plant, the missile shield is required to be closed for protection against weather generated missiles being propelled inside containment.

Plant administrative control require that containment equipment hatch is

o .n.- t (continued)

CALLAWAY PLANT B 3.9.4-5 Revision 5

Containment Penetrations B 3.9.4 RASES '<2J LCO installed (with four bolts) upon the arrival of threatening weather (continued) conditions that could generate missiles.

The administrative controls also require that the missile shield is positioned to provide adequate protection. The containment equipment hatch is closed from inside containment and the missile shield is closed from outside containment. The containment equipment hatch and the missile shield are not interlocked, so that closure sequence is not a factor.

The containment equipment hatch and the missile shield closing may be sequenced at the same time.

The LCO is modified by a NOTE allowing penetration flow paths with direct access from the containment atmosphere to the outside atmosphere to be unisolated under administrative controls.

Administrative controls ensure that 1) appropriate personnel are aware of the open status of the penetration flow path during CORE ALTERATIONS or movement of irradiated fuel assemblies within containment, and

2) specified individuals are designated and readily available to isolate the flow path in the event of a fuel handling accident (Ref. 4).

APPLICABILITY The containment penetration requirements are applicable during CORE ALTERATIONS or movement of irradiated fuel assemblies within II containment because this is when there is a potential for a fuel handling accident. Proper installation and removal of the upper internals with irradiated fuel in the reactor vessel does not constitute a CORE ALTERATION or a movement of irradiated fuel. Therefore, this LCO is not applicable during installation and removal of the reactor vessel upper internals.

In MODES 1, 2, 3, and 4, containment penetration requirements are addressed by LCO 3.6.1, "Containment." In MODES 5 and 6, when CORE ALTERATIONS or movement of irradiated fuel assemblies within containment are not being conducted, the potential for a fuel handling accident does not exist. Therefore, under these conditions no requirements are placed on containment penetration status.

ACTIONS

A.1 andA.2 If the containment equipment hatch, air locks, or any containment penetration that provides direct access from the containment atmosphere to the outside atmosphere is not in the required status, including the Containment Purge Isolation System not capable of automatic actuation when the isolation valves are open, the unit must be placed in a condition where the isolation function is not needed. This is accomplished by ,. N (continued)

CALLAWAY PLANT B 3.9.4-6 Revision 4

RHR and Coolant circulation - High Water Level B 3.9.5 BASES I . LCO : a. Removal fdecalyheat; -d-(continued)

I I

b. Mixing of borated coolant to minimize the possibility of criticality; and ; -

c. Indication of reactor coolant temperature.

An OPERABLE RHR loop includes an RHR pump, a heat exchanger, I -i , A .

. -I, valves, piping, instruments, and controls to ensure an OPERABLE flow

,. .I ;.

path'and to determine the RCS temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs.

If both RHR loops are OPERABLE, either RHR loop may be the operating

.-: . - loop. Electrical power source and distribution requirements for the RHR

- -loop(s) are as specified per LCO 3.8.2, "AC Sources - Shutdown"; LCO -3.8.5, "'DCSources Shutdown"; LCO 3.8.8, "Inverters - Shutdown," and

- LCO 3.8.10, "Distribution Systems - Shutdown," consistent with the Bases for those Technical Specifications for reduced requirements during shutdown conditions, subject to the provisions and limitations described in the Bases. The standby RHR train may be aligned to the Refueling Water Storage Tank to support filling or draining the refuel pool or for the I)

-performance of required testing. -

The LCO is modified by a Note that allows the required operating RHR loop to be removed from service for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period, provided no operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to meet the minimum boron concentration of LCO 3.9.1. Boron concentration reduction with coolant at boron concentrations less than

- :required to assure the minimum required RCS boron concentration is

- maintained is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RHR isolation valve testing. During this 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period, decay heat is removed by natural convection to the large mass of water in the refueling pool.

APPLICABILITY One RHR loop must be OPERABLE and in operation in MODE 6, with the water level Ž 23 ft above the top of the reactor vessel flange, to provide decay heat removal. The 23 ft water level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.7, "Refueling Pool Water Level." -Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, "Reactor

- RCoolant System (RCS)," and Section 3.5, "Emergency Core Cooling X-J,, (continued)

. CALLAWAY PLANT 'B 3.9.5-2 CA P LA -B Revision 5

RHR and Coolant circulation - High Water Level B 3.9.5 BASES ->

APPLICABILITY Systems (ECCS)." RHR loop requirements in MODE 6 with the water (continued) level < 23 ft are located in LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level." Additional RHR loop requirements in MODE 6 with the water level Ž 23 feet above the top of the reactor vessel flange are located in FSAR 16.1.2.1, "Flow Path-Shutdown Limiting Condition For Operation."

ACTIONS RHR loop requirements are met by having one RHR loop OPERABLE and in operation, except as permitted in the Note to the LCO.

A.1 If RHR loop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Administrative controls are placed on refueling decontamination activities (See Bases for LCO 3.9.1). K>

A.2 If RHR loop requirements are not met, actions shall be taken immediately to suspend loading of irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core.

A minimum refueling pool water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase decay heat load, such as loading a fuel assembly, is a prudent action under this condition. Performance of Required Action A.2 shall not preclude completion of movement of a component to a safe condition.

A.3 If RHR loop requirements are not met, actions shall be initiated and continued in order to satisfy RHR loop requirements. With the unit in MODE 6 and the refueling water level Ž 23 ft above the top of the reactor vessel flange, corrective actions shall be initiated immediately.

(continued)

CALLAWAY PLANT B 3.9.5-3 Revision 5

RHR and Coolant circulation - High Water Level B 3.9.5 BASES ACTIONS A4 I, ; . ' .1I .. ,: t (continued)

If RHR loop requirements are not met, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing

.containment penetrations that are open to the outside atmosphere ensures dose limits are not exceeded.

The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable, based on the low probability of the coolant boiling in that time.

SURVEILLANCE SR 3.9.5.1 REQUIREMENTS This Surveillance demonstrates that the RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient, considering the flow, temperature, pump control, and alarm indications available to the operator in the control room for monitoring the RHR System.

REFERENCES 1. FSAR, Section 5.4.7. -

I .

K-)

, i .

B 3.9.5-4 CALLAWAY PLANT Revision 5

U RHR and Coolant Circulation - Low Water Level B 3.9.6 B 3.9 REFUELING OPERATIONS U1 B 3.9.6 Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level BASES BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant, and to prevent boron stratification (Ref. 1). Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass lines. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.

APPLICABLE If the reactor coolant temperature is not maintained below 2000F, boiling SAFETY of the reactor coolant could result. This could lead to a loss of coolant in /

ANALYSES the reactor vessel. Additionally, boiling of the reactor coolant could lead .. )

to boron plating out on components near the areas of the boiling activity.

The loss of reactor coolant and the subsequent plate out of boron will eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two trains of the RHR System are required to be OPERABLE, and one train in operation, in order to prevent this challenge.

The RHR System is retained as a Specification because it meets Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO In MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, both RHR loops must be OPERABLE.

Additionally, one loop of RHR must be in operation in order to provide:

a. Removal of decay heat;

b. Mixing of borated coolant to minimize the possibility of criticality; and

c. Indication of reactor coolant temperature.

(continued)

CALLAWAY PLANT B 3.9.6-1 Revision 0

RHR and Coolant Circulation - Low Water Level B 3.9.6 BASES '

LCO An'OPERABLE RHR loop consists of an RHR pump, a'heat exchanger, (continued) valves, piping, instruments and controls to ensure an OPERABLE flow path and to determine the RCS temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs. An OPERABLE RHR loop must be capable of being realigned to provide an OPERABLE flow path.

The standby RHR train may be aligned to the Refueling Water Storage Tank to support filling or draining the refuel pool or for the performance of required testing as long as the motor-operated valves EJHV871 6A and EJHV8809A are maintained OPERABLE for Train A OPERABILITY and EJHV8716B and EJHV8809B are maintained OPERABLE for Train B OPERABILITY during refuel pool draining. These respective valves plus EJHV8840 must be maintained OPERABLE during refuel pool filling. The standby RHR train may be considered OPERABLE with BN8717 (RHR return to RWST) open as long as it can be isolated by EJHV8716A or B and EJHV8809A or B can be opened to realign the pump discharge to the RCS cold legs. Caution must be exercised whenever BN8717 is open to ensure the operating RHR train's EJHV8716 valve is maintained closed.

This is to prevent draining the RCS to the RWST. See Reference 3.

Electrical power source and distribution requirements for the RHR loops are as specified per LCO 3.8.2, "AC Sources - Shutdown"; LCO 3.8.5, "DC Sources - Shutdown"; LCO 3.8.8, "Inverters - Shutdown," and LCO 3.8.10, "Distribution Systems - Shutdown," consistent with the Bases for those Technical Specifications for reduced requirements during shutdown conditions, subject to the provisions and limitations described in the Bases..

APPLICABILITY Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation in MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to provide decay heat removal. Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, "Emergency Core Cooling Systems (ECCS)." RHR loop requirements in MODE 6 with the water level 2 23 ft are located in LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level."

Additional RHR loop requirements in MODE 6 with the water level 2 23 feet above the top of the reactor vessel flange are located in FSAR 16.1 2.1, "Flow Path-Shutdown Limiting Condition For Operation."

The Applicability is modified by a Note stating that entry into a MODE or other specified condition in the Applicability is not permitted while the LCO is not met. This note specifies an exception to LCO 3.0.4 and would (continued)

CALLAWAY PLANT : - -_`-' B 3.9.6-2 Revision 5

fu RHR and Coolant Circulation - Low Water Level B 3.9.6 BASES K APPLICABILITY prevent the transition into MODE 6 with less than 23 feet of water above (continued) the top of the vessel flange while the RHR function was degraded.

ACTIONS A.1 andA.2 If less than the required number of RHR loops are OPERABLE, action shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status and restored to operation in accordance with the LCO or until 2 23 ft of water level is established above the reactor vessel flange. When the water level is 2 23 ft above the reactor vessel flange, the Applicability changes to that of LCO 3.9.5, and only one RHR loop is required to be OPERABLE and in operation. An immediate Completion Time is necessary for an operator to initiate corrective actions.

B.1 If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining a subcritical operation. Administrative controls are placed on refueling decontamination activities (See Bases for LCO 3.9.1).

B.2 If no RHR loop is in operation, actions shall be initiated immediately, and continued, to restore one RHR loop to operation. Since the unit is in Conditions A and B concurrently, the restoration of two OPERABLE RHR loops and one operating RHR loop should be accomplished expeditiously.

B.3 If no RHR loop is in operation, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing (continued)

CALLAWAY PLANT B 3.9.6-3 Revision 5

RHR and Coolant Circulation - Low Water Level B 3.9.6 BASES ACTIONS 9..3 (continued) - `0>-

containment penetrations that are open to the outside atmosphere ensures that dose limits are not exceeded.

The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable at water levels above reduced inventory,'based on the low probability of the coolant boiling in that time. At reduced inventory conditions, additional actions are taken to

- 'provide containment closure in a reduced period of time (Reference 2).

Reduced inventory is defined as RCS level lower than 3 feet below the reactor vessel flange.

SURVEILLANCE SR 3.9.6.1 REQUIREMENTS This Surveillance demonstrates that one RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to

-prevent thermal and boron stratification in the core. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient, considering the flow, temperature, pump control, and alarm indications available to the operator for monitoring the RHR System in the control room.

SR 3.9.6.2 -

Verification that the required pump is OPERABLE ensures that an additional RHR pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pump.: The Frequency of 7 days is considered reasonable in

- view of other administrative controls available and has been shown to be acceptable by operating experience.

REFERENCES 1. FSAR, Section 5.4.7.

2. Generic Letter No. 88-17, "Loss of Decay Heat Removal."

3. RFR-1 5632A. I CALLAWAY PLANT B 3.9.6-4 Revision 5

In Refueling Pool Water Level B 3.9.7 B 3.9 REFUELING OPERATIONS I B 3.9.7 Refueling Pool Water Level BASES BACKGROUND The movement of irradiated fuel assemblies within containment requires a minimum water level of 23 ft above the top of the reactor vessel flange.

During refueling, this maintains sufficient water level in the fuel transfer canal, refueling pool and spent fuel pool. Sufficient water is necessary to retain iodine fission product activity in the water in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to < 25% of 10 CFR 100 limits, as provided by the guidance of Reference 3 and acceptance in Reference 6.

APPLICABLE During movement of irradiated fuel assemblies, the water level in the SAFETY refueling pool is an initial condition design parameter in the analysis of a ANALYSES fuel handling accident in containment, as postulated by Regulatory Guide 1.25 (Ref. 1). The reactor is assumed to have been subcritical for 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months prior to movement of irradiated fuel in the reactor vessel. A minimum water level of 23 ft (Regulatory Position C. 1.c of Ref. 1) allows a decontamination factor of 100 (Regulatory Position C.1.g of Ref. 1) to be \ J used in the accident analysis for iodine. This relates to the assumption that 99% of the total iodine released from the pellet to cladding gap of the damaged rods is retained by the refueling pool water. In addition, for the analyses for the accident in the reactor building, the dropped assembly is assumed to damage 20% of the rods of a different assembly. The fission product release point is assumed to be at the point of impact at the top of the reactor vessel flange. The fuel pellet to cladding gap is assumed to contain 10% of the total fuel rod iodine inventory (Ref. 1).

The fuel handling accident analysis inside containment is described in Reference 2. With a minimum water level of 23 ft and a minimum decay time of 100 hours0.00116 days 0.0278 hours 1.653439e-4 weeks 3.805e-5 months prior to fuel handling, the analysis and test programs demonstrate that the iodine release due to a postulated fuel handling accident is adequately captured by the water and offsite doses are maintained well within the limits of 10 CFR 100 (Refs. 4, 5, and 6).

Refueling pool water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

(continued)

CALLAWAY PLANT B 3.9.7-1 Revision 0

ULNRC-05101, Union Electric Co. Technical Specification Bases Revision 5

Text

Enclosure:

Navigation menu

ULNRC-05101, Union Electric Co. Technical Specification Bases Revision 5

Text

Enclosure:

Navigation menu

Search