View source for NUREG-1430 Volume 2, Rev. 5, Standard Technical Specifications, Babcock and Wilcox Plants: Bases

{{Adams
| number = ML21272A370
| issue date = 09/30/2021
| title = NUREG-1430, Vol. 2, Rev. 5, Standard Technical Specifications, Babcock and Wilcox Plants: Bases
| author name = Honcharik M
| author affiliation = NRC/NRR
| addressee name = 
| addressee affiliation = 
| docket = 
| license number = 
| contact person = Malone Tina
| document report number = NUREG-1430 V02 R05
| document type = NUREG
| volume number = 2
| page count = 760
}}

=Text=
{{#Wiki_filter:NUREG-1430 Volume 2 Revision 5.0 Standard Technical Specifications Babcock and Wilcox Plants Revision 5.0 Volume 2, Bases Office of Nuclear Reactor Regulation

AVAILABILITY OF REFERENCE MATERIALS IN NRC PUBLICATIONS NRC Reference Material                                       Non-NRC Reference Material As of November 1999, you may electronically access           Documents available from public and special technical NUREG-series publications and other NRC records at the       libraries include all open literature items, such as books, NRCs Library at www.nrc.gov/reading-rm.html. Publicly       journal articles, transactions, Federal Register notices, released records include, to name a few, NUREG-series        Federal and State legislation, and congressional reports.
publications; Federal Register notices; applicant, licensee, Such documents as theses, dissertations, foreign reports and vendor documents and correspondence; NRC                 and translations, and non-NRC conference proceedings correspondence and internal memoranda; bulletins and         may be purchased from their sponsoring organization.
information notices; inspection and investigative reports; licensee event reports; and Commission papers and their      Copies of industry codes and standards used in a attachments.                                                 substantive manner in the NRC regulatory process are maintained at NRC publications in the NUREG series, NRC regulations,              The NRC Technical Library and Title 10, Energy, in the Code of Federal Regulations          Two White Flint North may also be purchased from one of these two sources:                11545 Rockville Pike Rockville, MD 20852-2738
: 1. The Superintendent of Documents U.S. Government Publishing Office                     These standards are available in the library for reference Washington, DC 20402-0001                             use by the public. Codes and standards are usually Internet: www.bookstore.gpo.gov                       copyrighted and may be purchased from the originating Telephone: (202) 512-1800                             organization or, if they are American National Standards, Fax: (202) 512-2104                                   from American National Standards Institute
: 2. The National Technical Information Service                   11 West 42nd Street 5301 Shawnee Road                                            New York, NY 10036-8002 Alexandria, VA 22312-0002                                    Internet: www.ansi.org Internet: www.ntis.gov                                       (212) 642-4900 1-800-553-6847 or, locally, (703) 605-6000 Legally binding regulatory requirements are stated only in A single copy of each NRC draft report for comment is          laws; NRC regulations; licenses, including technical available free, to the extent of supply, upon written          specifications; or orders, not in NUREG-series publications.
The views expressed in contractor prepared publications in request as follows:
this series are not necessarily those of the NRC.
Address: U.S. Nuclear Regulatory Commission                   The NUREG series comprises (1) technical and Office of Administration                            administrative reports and books prepared by the staff (NUREG-XXXX) or agency contractors (NUREG/CR-XXXX),
Division of Resource Management & Analysis (2) proceedings of conferences (NUREG/CP-XXXX),
Washington, DC 20555-0001                           (3) reports resulting from international agreements E-mail: distribution.resource@nrc.gov               (NUREG/IA-XXXX),(4) brochures (NUREG/BR-XXXX), and Facsimile: (301) 415-2289                           (5) compilations of legal decisions and orders of the Commission and the Atomic and Safety Licensing Boards and of Directors decisions under Section 2.206 of the NRCs regulations (NUREG-0750).
Some publications in the NUREG series that are posted at the NRCs Web site address www.nrc.gov/reading-rm/          DISCLAIMER: This report was prepared as an account doc-collections/nuregs are updated periodically and may        of work sponsored by an agency of the U.S. Government.
differ from the last printed version. Although references to   Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or implied, material found on a Web site bear the date the material        or assumes any legal liability or responsibility for any third was accessed, the material available on the date cited         partys use, or the results of such use, of any information, may subsequently be removed from the site.                     apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights.

NUREG-1430 Volume 2 Revision 5.0 Standard Technical Specifications Babcock and Wilcox Plants Revision 5.0 Volume 2, Bases Manuscript Completed: March 2021 Date Published: September 2021 Office of Nuclear Reactor Regulation

ABSTRACT This NUREG contains the improved Standard Technical Specifications (STS) for Babcock and Wilcox (B&W) plants. The changes reflected in Revision 5 result from the experience gained from plant operation using the improved STS and extensive public technical meetings and discussions among the Nuclear Regulatory Commission (NRC) staff and various nuclear power plant licensees and the Nuclear Steam Supply System (NSSS) Owners Groups.
The improved STS were developed based on the criteria in the Final Commission Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors, dated July 22, 1993 (58 FR 39132), which was subsequently codified by changes to Section 36 of Part 50 of Title 10 of the Code of Federal Regulations (10 CFR 50.36) (60 FR 36953). Licensees are encouraged to upgrade their technical specifications consistent with those criteria and conforming, to the practical extent, to Revision 5 to the improved STS. The Commission continues to place the highest priority on requests for complete conversions to the improved STS. Licensees adopting portions of the improved STS to existing technical specifications should adopt all related requirements, as applicable, to achieve a high degree of standardization and consistency.
Users may access the STS NUREGs in the PDF format at https://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/. Users may print or download copies from the NRC Web site.
PAPERWORK REDUCTION ACT STATEMENT This NUREG contains voluntary guidance for implementing the mandatory information collections covered by 10 CFR Part 50 that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et. seq.). These information collections were approved by the Office of Management and Budget (OMB), under control number 3150-0011. Send comments regarding this information collection to the FOIA, Library, and Information Collections Branch (T6-A10M),
U.S. Nuclear Regulatory Commission, Washington, DC 20555 0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0011) Office of Management and Budget, Washington, DC 20503.
PUBLIC PROTECTION NOTIFICATION The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB control number.
Babcock & Wilcox STS                              iii                                     Rev. 5.0

TABLE OF CONTENTS                                                                                                       Page ABSTRACT ......................................................................................................iii B 2.0 SAFETY LIMITS (SLs) .................................................................................... B 2.1.1-1 B 2.1.1   Reactor Core SLs ....................................................................................... B 2.1.1-1 B 2.1.2   Reactor Coolant System (RCS) Pressure SL ............................................. B 2.1.2-1 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY ................ B 3.0-1 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY ............................... B 3.0-16 B 3.1 REACTIVITY CONTROL SYSTEMS .............................................................. B 3.1.1-1 B 3.1.1   SHUTDOWN MARGIN (SDM) ................................................................... B 3.1.1-1 B 3.1.2   Reactivity Balance ...................................................................................... B 3.1.2-1 B 3.1.3   Moderator Temperature Coefficient (MTC) ................................................ B 3.1.3-1 B 3.1.4   CONTROL ROD Group Alignment Limits .................................................. B 3.1.4-1 B 3.1.5   Safety Rod Insertion Limit .......................................................................... B 3.1.5-1 B 3.1.6   AXIAL POWER SHAPING ROD (APSR) Alignment Limits ........................ B 3.1.6-1 B 3.1.7   Position Indicator Channels........................................................................ B 3.1.7-1 B 3.1.8   PHYSICS TESTS Exceptions Systems - MODE 1 ..................................... B 3.1.8-1 B 3.1.9   PHYSICS TESTS Exceptions - MODE 2 ................................................... B 3.1.9-1 B 3.2 POWER DISTRIBUTION LIMITS .................................................................... B 3.2.1-1 B 3.2.1   Regulating Rod Insertion Limits ................................................................. B 3.2.1-1 B 3.2.2   AXIAL POWER SHAPING ROD (APSR) Insertion Limits .......................... B 3.2.2-1 B 3.2.3   AXIAL POWER IMBALANCE Operating Limits .......................................... B 3.2.3-1 B 3.2.4   QUADRANT POWER TILT (QPT) ............................................................. B 3.2.4-1 B 3.2.5   Power Peaking Factors .............................................................................. B 3.2.5-1 B 3.3 INSTRUMENTATION ...................................................................................... B 3.3.1-1 B 3.3.1   Reactor Protection System (RPS) Instrumentation .................................... B 3.3.1-1 B 3.3.2   Reactor Protection System (RPS) Manual Reactor Trip ............................ B 3.3.2-1 B 3.3.3   Reactor Protection System (RPS) - Reactor Trip Module (RTM) ............... B 3.3.3-1 B 3.3.4   CONTROL ROD Drive (CRD) Trip Devices ............................................... B 3.3.4-1 B 3.3.5   Engineered Safety Feature Actuation System (ESFAS)
Instrumentation ..................................................................................... B 3.3.5-1 B 3.3.6   Engineered Safety Feature Actuation System (ESFAS)
Manual Initiation ................................................................................... B 3.3.6-1 B 3.3.7   Engineered Safety Feature Actuation System (ESFAS)
Automatic Actuation Logic .................................................................... B 3.3.7-1 B 3.3.8   Emergency Diesel Generator (EDG) Loss of Power Start (LOPS) ................................................................................................. B 3.3.8-1 B 3.3.9   Source Range Neutron Flux ....................................................................... B 3.3.9-1 B 3.3.10 Intermediate Range Neutron Flux .............................................................. B 3.3.10-1 B 3.3.11 Emergency Feedwater Initiation and Control (EFIC)
Instrumentation ..................................................................................... B 3.3.11-1 B 3.3.12 Emergency Feedwater Initiation and Control (EFIC) Manual Initiation ................................................................................................ B 3.3.12-1 B 3.3.13 Emergency Feedwater Initiation and Control (EFIC) Logic ........................ B 3.3.13-1 Babcock & Wilcox STS                                          v                                                             Rev. 5.0

TABLE OF CONTENTS                                                                                                     Page B 3.3 INSTRUMENTATION (continued)
B 3.3.14 Emergency Feedwater Initiation and Control (EFIC) -
Emergency Feedwater (EFW) - Vector Valve Logic ............................. B 3.3.14-1 B 3.3.15 Reactor Building (RB) Purge Isolation - High Radiation ............................. B 3.3.15-1 B 3.3.16 Control Room Isolation - High Radiation .................................................... B 3.3.16-1 B 3.3.17 Post Accident Monitoring (PAM) Instrumentation ....................................... B 3.3.17-1 B 3.3.18 Remote Shutdown System ......................................................................... B 3.3.18-1 B 3.4 REACTOR COOLANT SYSTEM (RCS) .......................................................... B 3.4.1-1 B 3.4.1  RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits .............................................................. B 3.4.1-1 B 3.4.2  RCS Minimum Temperature for Criticality .................................................. B 3.4.2-1 B 3.4.3  RCS Pressure and Temperature (P/T) Limits ............................................ B 3.4.3-1 B 3.4.4  RCS Loops - MODES 1 and 2.................................................................... B 3.4.4-1 B 3.4.5  RCS Loops - MODE 3 ................................................................................ B 3.4.5-1 B 3.4.6  RCS Loops - MODE 4 ................................................................................ B 3.4.6-1 B 3.4.7  RCS Loops - MODE 5, Loops Filled........................................................... B 3.4.7-1 B 3.4.8  RCS Loops - MODE 5, Loops Not Filled .................................................... B 3.4.8-1 B 3.4.9  Pressurizer ................................................................................................. B 3.4.9-1 B 3.4.10 Pressurizer Safety Valves .......................................................................... B 3.4.10-1 B 3.4.11 Pressurizer Power Operated Relief Valve (PORV) .................................... B 3.4.11-1 B 3.4.12 Low Temperature Overpressure Protection (LTOP) System ..................... B 3.4.12-1 B 3.4.13 RCS Operational LEAKAGE ...................................................................... B 3.4.13-1 B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage ............................................ B 3.4.14-1 B 3.4.15 RCS Leakage Detection Instrumentation ................................................... B 3.4.15-1 B 3.4.16 RCS Specific Activity .................................................................................. B 3.4.16-1 B 3.4.17 Steam Generator (SG) Tube Integrity ........................................................ B 3.4.17-1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) ..................................... B 3.5.1-1 B 3.5.1  Core Flood Tanks (CFTs)........................................................................... B 3.5.1-1 B 3.5.2  ECCS - Operating ...................................................................................... B 3.5.2-1 B 3.5.3  ECCS - Shutdown ...................................................................................... B 3.5.3-1 B 3.5.4  Borated Water Storage Tank (BWST) ........................................................ B 3.5.4-1 B 3.6 CONTAINMENT SYSTEMS ............................................................................ B 3.6.1-1 B 3.6.1  Containment ............................................................................................... B 3.6.1-1 B 3.6.2  Containment Air Locks ............................................................................... B 3.6.2-1 B 3.6.3  Containment Isolation Valves ..................................................................... B 3.6.3-1 B 3.6.4  Containment Pressure................................................................................ B 3.6.4-1 B 3.6.5  Containment Air Temperature .................................................................... B 3.6.5-1 B 3.6.6  Containment Spray and Cooling Systems .................................................. B 3.6.6-1 B 3.6.7  Spray Additive System ............................................................................... B 3.6.7-1 B 3.6.8  Containment Sump..................................................................................... B 3.6.8-1 Babcock & Wilcox STS                                        vi                                                            Rev. 5.0

TABLE OF CONTENTS                                                                                                  Page B 3.7 PLANT SYSTEMS .......................................................................................... B 3.7.1-1 B 3.7.1  Main Steam Safety Valves (MSSVs) .......................................................... B 3.7.1-1 B 3.7.2  Main Steam Isolation Valves (MSIVs) ........................................................ B 3.7.2-1 B 3.7.3  [ Main Feedwater Stop Valves (MFSVs), Main Feedwater Control Valves (MFCVs), and Associated Startup Feedwater Control Valves (SFCVs) ] ................................................... B 3.7.3-1 ]
B 3.7.4  Atmospheric Vent Valves (AVVs) ............................................................... B 3.7.4-1 B 3.7.5  Emergency Feedwater (EFW) System ....................................................... B 3.7.5-1 B 3.7.6  Condensate Storage Tank (CST) ............................................................... B 3.7.6-1 B 3.7.7  Component Cooling Water (CCW) System ................................................ B 3.7.7-1 B 3.7.8  Service Water System (SWS) .................................................................... B 3.7.8-1 B 3.7.9  Ultimate Heat Sink (UHS)........................................................................... B 3.7.9-1 B 3.7.10 Control Room Emergency Ventilation System (CREVS) ........................... B 3.7.10-1 B 3.7.11 Control Room Emergency Air Temperature Control System (CREATCS) .......................................................................................... B 3.7.11-1 B 3.7.12 Emergency Ventilation System (EVS) ........................................................ B 3.7.12-1 B 3.7.13 Fuel Storage Pool Ventilation System (FSPVS)......................................... B 3.7.13-1 B 3.7.14 Fuel Storage Pool Water Level .................................................................. B 3.7.14-1 B 3.7.15 [ Spent Fuel Pool Boron Concentration ...................................................... B 3.7.15-1 ]
B 3.7.16 [ Spent Fuel Pool Storage .......................................................................... B 3.7.16-1 ]
B 3.7.17 Secondary Specific Activity ........................................................................ B 3.7.17-1 B 3.7.18 Steam Generator Level .............................................................................. B 3.7.18-1 B 3.8 ELECTRICAL POWER SYSTEMS ................................................................. B 3.8.1-1 B 3.8.1  AC Sources - Operating ............................................................................. B 3.8.1-1 B 3.8.2  AC Sources - Shutdown ............................................................................. B 3.8.2-1 B 3.8.3  Diesel Fuel Oil, Lube Oil, and Starting Air .................................................. B 3.8.3-1 B 3.8.4  DC Sources - Operating ............................................................................. B 3.8.4-1 B 3.8.5  DC Sources - Shutdown ............................................................................. B 3.8.5-1 B 3.8.6  Battery Parameters .................................................................................... B 3.8.6-1 B 3.8.7  Inverters - Operating .................................................................................. B 3.8.7-1 B 3.8.8  Inverters - Shutdown .................................................................................. B 3.8.8-1 B 3.8.9  Distribution Systems - Operating................................................................ B 3.8.9-1 B 3.8.10 Distribution Systems - Shutdown ............................................................... B 3.8.10-1 B 3.9 REFUELING OPERATIONS ........................................................................... B 3.9.1-1 B 3.9.1  Boron Concentration .................................................................................. B 3.9.1-1 B 3.9.2  Nuclear Instrumentation ............................................................................. B 3.9.2-1 B 3.9.3  Containment Penetrations .......................................................................... B 3.9.3-1 B 3.9.4  Decay Heat Removal (DHR) and Coolant Circulation - High Water Level .......................................................................................... B 3.9.4-1 B 3.9.5  Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level .......................................................................................... B 3.9.5-1 B 3.9.6  Refueling Canal Water Level...................................................................... B 3.9.6-1 Babcock & Wilcox STS                                    vii                                                            Rev. 5.0

Reactor Core SLs B 2.1.1 B 2.0 SAFETY LIMITS (SLs)
B 2.1.1 Reactor Core SLs BASES BACKGROUND           GDC 10 (Ref. 1) requires that reactor core SLs ensure specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs). This is accomplished by having a departure from nucleate boiling (DNB) design basis, which corresponds to a 95%
probability at a 95% confidence level (95/95 DNB criterion) that DNB will not occur and by requiring that the fuel centerline temperature stays below the melting temperature.
The restrictions of this SL prevent overheating of the fuel and cladding and possible cladding perforation that would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate (LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.
Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the fuel centerline temperature to reach the melting point of the fuel. Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the point of failure, allowing an uncontrolled release of activity to the reactor coolant.
Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of DNB and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.
The proper functioning of the Reactor Protection System (RPS) and main steam safety valves (MSSVs) prevents violation of the reactor core SLs.
Babcock & Wilcox STS                     B 2.1.1-1                                         Rev. 5.0

Reactor Core SLs B 2.1.1 BASES APPLICABLE         The fuel cladding must not sustain damage as a result of normal SAFETY             operation and AOOs. The reactor core SLs are established to preclude ANALYSES           violation of the following fuel design criteria:
: a. There must be at least 95% probability at a 95% confidence level (95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB and
: b. The hot fuel pellet in the core must not experience fuel centerline melting.
The RPS setpoints (Ref. 2), in combination with all the LCOs, is designed to prevent any anticipated combination of transient conditions for Reactor Coolant System (RCS) temperature, pressure, and THERMAL POWER level that would result in a departure from nucleate boiling ratio (DNBR) of less than the DNBR limit and preclude the existence of flow instabilities.
Automatic enforcement of these reactor core SLs is provided by the following:
: a. RCS High Pressure trip,
: b. RCS Low Pressure trip,
: c. Nuclear Overpower trip,
: d. RCS Variable Low Pressure trip,
: e. Reactor Coolant Pump to Power trip,
: f. Nuclear Overpower RCS Flow and Axial Power Imbalance trip, and
: g. MSSVs.
The SL represents a design requirement for establishing the RPS trip setpoints identified previously.
SAFETY LIMITS      SL 2.1.1.1, SL 2.1.1.2, and SL 2.1.1.3 ensure that the minimum DNBR is not less than the safety analyses limit and that fuel centerline temperature stays below the melting point, or the average enthalpy in the hot leg is less than or equal to the enthalpy of saturated liquid, or the exit quality is within the limits defined by the DNBR correlation. In addition, SL 2.1.1.3 shows the pressure/temperature operating region that keeps the reactor from reaching an SL when operating up to design power, and it defines the safe operating region from brittle fracture concerns.
Babcock & Wilcox STS                   B 2.1.1-2                                         Rev. 5.0

Reactor Core SLs B 2.1.1 BASES SAFETY LIMITS (continued)
The SLs are preserved by monitoring the process variable AXIAL POWER IMBALANCE to ensure that the core operates within the fuel design criteria. AXIAL POWER IMBALANCE protective limits are provided in the COLR. The trip setpoints are derived by adjusting the measurement system independent AXIAL POWER IMBALANCE protective limit given in the COLR to allow for measurement system observability and instrumentation errors.
Operation within these limits is ensured by compliance with the AXIAL POWER IMBALANCE protective limits preserved by their corresponding RPS setpoints in LCO 3.3.1, "Reactor Protection System (RPS)
Instrumentation," as specified in the COLR. The AXIAL POWER IMBALANCE protective limits are separate and distinct from the AXIAL POWER IMBALANCE operating limits defined by LCO 3.2.3, "AXIAL POWER IMBALANCE Operating Limits." The AXIAL POWER IMBALANCE operating limits in LCO 3.2.3, also specified in the COLR, preserve initial conditions of the safety analyses but are not reactor core SLs.
APPLICABILITY      SL 2.1.1.1, SL 2.1.1.2, and SL 2.1.1.3 only apply in MODES 1 and 2 because these are the only MODES in which the reactor is critical.
Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The MSSVs, or automatic protection actions, serve to prevent RCS heatup to reactor core SL conditions or to initiate a reactor trip function, which forces the unit into MODE 3. Setpoints for the reactor trip functions are specified in LCO 3.3.1.
In MODES 3, 4, 5, and 6, Applicability is not required, since the reactor is not generating significant THERMAL POWER.
SAFETY LIMIT       The following SL violation responses are applicable to the reactor core VIOLATIONS         SLs.
2.2.1 and 2.2.2 If SL 2.1.1.1, SL 2.1.1.2, or SL 2.1.1.3 is violated, the requirement to go to MODE 3 places the plant in a MODE in which these SLs are not applicable.
Babcock & Wilcox STS                   B 2.1.1-3                                         Rev. 5.0

Reactor Core SLs B 2.1.1 BASES SAFETY LIMIT VIOLATIONS (continued)
The allowed Completion Time of 1 hour recognizes the importance of bringing the plant to a MODE of operation where these SLs are not applicable and reduces the probability of fuel damage.
REFERENCES         1. 10 CFR 50, Appendix A, GDC 10.
: 2. FSAR, Section [ ].
Babcock & Wilcox STS                 B 2.1.1-4                                     Rev. 5.0

RCS Pressure SL B 2.1.2 B 2.0 SAFETY LIMITS (SLs)
B 2.1.2 Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND          According to 10 CFR 50, Appendix A, GDC 14, "Reactor Coolant Pressure Boundary," and GDC 15, "Reactor Coolant System Design" (Ref. 1), the reactor coolant pressure boundary (RCPB) design conditions are not to be exceeded during normal operation nor during anticipated operational occurrences (AOOs). GDC 28, "Reactivity Limits" (Ref. 1),
specifies that reactivity accidents including rod ejection do not result in damage to the RCPB greater than limited local yielding.
The design pressure of the RCS is 2500 psig. During normal operation and AOOs, the RCS pressure is kept from exceeding the design pressure by more than 10% in order to remain in accordance with Section III of the ASME Code (Ref. 2). Hence, the safety limit is 2750 psig. To ensure system integrity, all RCS components are hydrostatically tested at 125%
of design pressure prior to initial operation, according to the ASME Code requirements. Inservice operational hydrotesting at 100% of design pressure is also required whenever the reactor vessel head has been removed or if other pressure boundary joint alterations have occurred.
Following inception of unit operation, RCS components shall be pressure tested, in accordance with the requirements of ASME Code, Section XI (Ref. 3).
APPLICABLE          The RCS pressurizer safety valves, operating in conjunction with the SAFETY              Reactor Protection System trip settings, ensure that the RCS pressure ANALYSES            SL will not be exceeded.
The RCS pressurizer safety valves are sized to prevent system pressure from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code for Nuclear Power Plant Components (Ref. 2). The transient that is most influential for establishing the required relief capacity, and hence the valve size requirements and lift settings, is a rod withdrawal from low power. During the transient, no control actions are assumed except that the safety valves on the secondary plant are assumed to open when the steam pressure reaches the secondary plant safety valve settings, and nominal feedwater supply is maintained.
The overpressure protection analyses (Ref. 4) and the safety analyses (Ref. 5) are performed using conservative assumptions relative to pressure control devices.
Babcock & Wilcox STS                    B 2.1.2-1                                         Rev. 5.0

RCS Pressure SL B 2.1.2 BASES APPLICABLE SAFETY ANALYSES (continued)
More specifically, no credit is taken for operation of the following:
: a. Pressurizer power operated relief valves (PORVs),
: b. Steam line turbine bypass valves,
: c. Control system runback of reactor and turbine power, and
: d. Pressurizer spray valve.
SAFETY LIMIT       The maximum transient pressure allowed in the RCS pressure vessel under the ASME Code, Section III, is 110% of design pressure. The maximum transient pressure allowed in the RCS piping, valves, and fittings under USAS, Section B31.1 (Ref. 6), is 120% of design pressure.
The most limiting of these two allowances is the 110% of design pressure; therefore, the SL on maximum allowable RCS pressure is 2750 psig.
Overpressurization of the RCS can result in a breach of the RCPB. If such a breach occurs in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere, raising concerns relative to limits on radioactive releases specified in 10 CFR 100, "Reactor Site Criteria" (Ref. 7).
APPLICABILITY      SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 because this SL could be approached or exceeded in these MODES during overpressurization events. The SL is not applicable in MODE 6 because the reactor vessel head closure bolts are not fully tightened, making it unlikely that the RCS can be pressurized.
SAFETY LIMIT       The following SL violation responses are applicable to the RCS pressure VIOLATIONS         SL.
2.2.3 If the RCS pressure SL is violated when the reactor is in MODE 1 or 2, the requirement is to restore compliance and be in MODE 3 within 1 hour.
Exceeding the RCS pressure SL may cause immediate RCS failure and create a potential for radioactive releases in excess of 10 CFR 100, "Reactor Site Criteria," limits (Ref 7).
Babcock & Wilcox STS                   B 2.1.2-2                                         Rev. 5.0

RCS Pressure SL B 2.1.2 BASES SAFETY LIMIT VIOLATIONS (continued)
The allowed Completion Time of 1 hour is based on the importance of reducing power level to a MODE of operation where the potential for challenges to safety systems is minimized.
2.2.4 If the RCS pressure SL is exceeded in MODE 3, 4, or 5, RCS pressure must be restored to within the SL value within 5 minutes.
Exceeding the RCS pressure SL in MODE 3, 4, or 5 is potentially more severe than exceeding this SL in MODE 1 or 2, since the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5 minutes. This action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress.
REFERENCES         1. 10 CFR 50, Appendix A, GDC 14, GDC 15, and GDC 28, 1988.
: 2. ASME Boiler and Pressure Vessel Code, Section III, Article NB-7000.
: 3. ASME Boiler and Pressure Vessel Code, Section XI, Article IW-5000.
: 4. BAW-10043, May 1972.
: 5. FSAR, Section [14].
: 6. ASME USAS B31.1, Standard Code for Pressure Piping, 1967.
: 7. 10 CFR 100.
Babcock & Wilcox STS                 B 2.1.2-3                                       Rev. 5.0

LCO APPLICABILITY B 3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs               LCO 3.0.1 through LCO 3.0.9 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.
LCO 3.0.1          LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification).
LCO 3.0.2          LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered, unless otherwise specified.
The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:
: a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification and
: b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.
There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.) The second type of Required Action specifies the remedial measures that permit continued operation of the unit that is not further restricted by the Completion Time. In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.
Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications.
Babcock & Wilcox STS                   B 3.0-1                                           Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.2 (continued)
The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Conditions no longer exist. The individual LCO's ACTIONS specify the Required Actions where this is the case. An example of this is in LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits."
The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The ACTIONS for not meeting a single LCO adequately manage any increase in plant risk, provided any unusual external conditions (e.g., severe weather, offsite power instability) are considered. In addition, the increased risk associated with simultaneous removal of multiple structures, systems, trains or components from service is assessed and managed in accordance with 10 CFR 50.65(a)(4). Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed.
When a change in MODE or other specified condition is required to comply with Required Actions, the unit may enter a MODE or other specified condition in which another Specification becomes applicable. In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable and the ACTIONS Condition(s) are entered.
LCO 3.0.3           LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and either:
: a. An associated Required Action and Completion Time is not met and no other Condition applies or
: b. The condition of the unit is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.
Babcock & Wilcox STS                     B 3.0-2                                         Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.3 (continued)
This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS. Planned entry into LCO 3.0.3 should be avoided. If it is not practicable to avoid planned entry into LCO 3.0.3, plant risk should be assessed and managed in accordance with 10 CFR 50.65(a)(4), and the planned entry into LCO 3.0.3 should have less effect on plant safety than other practicable alternatives.
Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to enter lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times.
A unit shutdown required in accordance with LCO 3.0.3 may be terminated and LCO 3.0.3 exited if any of the following occurs:
: a. The LCO is now met,
: b. The LCO is no longer applicable,
: c. A Condition exists for which the Required Actions have now been performed, or
: d. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.
The time limits of LCO 3.0.3 allow 37 hours for the unit to be in MODE 5 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for entering the next lower MODE applies. If a lower MODE is entered in less time than allowed, however, the total allowable time to enter MODE 5, or other applicable MODE, is not reduced. For example, if MODE 3 is entered in 2 hours, then the time allowed for entering MODE 4 Babcock & Wilcox STS                     B 3.0-3                                          Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.3 (continued) is the next 11 hours, because the total time for entering MODE 4 is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to enter a lower MODE of operation in less than the total time allowed.
In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the unit is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.
Exceptions to LCO 3.0.3 are provided in instances where requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in LCO 3.7.14, "Fuel Storage Pool Water Level." LCO 3.7.14 has an Applicability of "During movement of irradiated fuel assemblies in fuel storage pool." Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.14 are not met while in MODE 1, 2, 3, or 4, there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.14 of "Suspend movement of irradiated fuel assemblies in fuel storage pool" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications.
LCO 3.0.4           LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with either LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.
LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered following entry into the MODE or other specified condition in the Applicability will permit continued operation within the MODE or other specified condition for an unlimited period of time. Compliance with ACTIONS that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard Babcock & Wilcox STS                     B 3.0-4                                         Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.4 (continued) to the status of the unit before or after the MODE change. Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made and the Required Actions followed after entry into the Applicability.
For example, LCO 3.0.4.a may be used when the Required Action to be entered states that an inoperable instrument channel must be placed in the trip condition within the Completion Time. Transition into a MODE or other specified condition in the Applicability may be made in accordance with LCO 3.0.4 and the channel is subsequently placed in the tripped condition within the Completion Time, which begins when the Applicability is entered. If the instrument channel cannot be placed in the tripped condition and the subsequent default ACTION ("Required Action and associated Completion Time not met") allows the OPERABLE train to be placed in operation, use of LCO 3.0.4.a is acceptable because the subsequent ACTIONS to be entered following entry into the MODE include ACTIONS (place the OPERABLE train in operation) that permit safe plant operation for an unlimited period of time in the MODE or other specified condition to be entered.
LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate.
The risk assessment may use quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities to be assessed and managed. The risk assessment, for the purposes of LCO 3.0.4.b, must take into account all inoperable Technical Specification equipment regardless of whether the equipment is included in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory Guide 1.160, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." Regulatory Guide 1.160 endorses the guidance in Section 11 of NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants. These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a Babcock & Wilcox STS                     B 3.0-5                                        Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.4 (continued) manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.
LCO 3.0.4.b may be used with single, or multiple systems and components unavailable. NUMARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components.
The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented.
The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated above. However, there is a small subset of systems and components that have been determined to be more important to risk and use of the LCO 3.0.4.b allowance is prohibited. The LCOs governing these systems and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable.
LCO 3.0.4.c allows entry into a MODE or other specified condition in the Applicability with the LCO not met based on a Note in the Specification which states LCO 3.0.4.c is applicable. These specific allowances permit entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time and a risk assessment has not been performed. This allowance may apply to all the ACTIONS or to a specific Required Action of a Specification. The risk assessments performed to justify the use of LCO 3.0.4.b usually only consider systems and components. For this reason, LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., RCS Specific Activity), and may be applied to other Specifications based on NRC plant specific approval.
Babcock & Wilcox STS                     B 3.0-6                                          Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.4 (continued)
The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.
Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the applicable Conditions and Required Actions until the Condition is resolved, until the LCO is met, or until the unit is not within the Applicability of the Technical Specification.
Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.
LCO 3.0.5           LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate either:
: a. The OPERABILITY of the equipment being returned to service or
: b. The OPERABILITY of other equipment.
The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance. LCO 3.0.5 should not be Babcock & Wilcox STS                     B 3.0-7                                          Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.5 (continued) used in lieu of other practicable alternatives that comply with Required Actions and that do not require changing the MODE or other specified conditions in the Applicability in order to demonstrate equipment is OPERABLE. LCO 3.0.5 is not intended to be used repeatedly.
An example of demonstrating equipment is OPERABLE with the Required Actions not met is opening a manual valve that was closed to comply with Required Actions to isolate a flowpath with excessive Reactor Coolant System (RCS) Pressure Isolation Valve (PIV) leakage in order to perform testing to demonstrate that RCS PIV leakage is now within limit.
Examples of demonstrating equipment OPERABILITY include instances in which it is necessary to take an inoperable channel or trip system out of a tripped condition that was directed by a Required Action, if there is no Required Action Note for this purpose. An example of verifying OPERABILITY of equipment removed from service is taking a tripped channel out of the tripped condition to permit the logic to function and indicate the appropriate response during performance of required testing on the inoperable channel. Examples of demonstrating the OPERABILITY of other equipment are taking an inoperable channel or trip system out of the tripped condition 1) to prevent the trip function from occurring during the performance of required testing on another channel in the other trip system, or 2) to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.
The administrative controls in LCO 3.0.5 apply in all cases to systems or components in Chapter 3 of the Technical Specifications, as long as the testing could not be conducted while complying with the Required Actions. This includes the realignment or repositioning of redundant or alternate equipment or trains previously manipulated to comply with ACTIONS, as well as equipment removed from service or declared inoperable to comply with ACTIONS.
Babcock & Wilcox STS                     B 3.0-8                                          Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.6          LCO 3.0.6 establishes an exception to LCO 3.0.2 for supported systems that have a support system LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the unit is maintained in a safe condition are specified in the support system LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions.
When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability. However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCOs' Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the unit is maintained in a safe condition in the support system's Required Actions.
However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system.
This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.
Specification 5.5.14, "Safety Function Determination Program (SFDP),"
ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.
Babcock & Wilcox STS                   B 3.0-9                                           Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.6 (continued)
The following examples use Figure B 3.0-1 to illustrate loss of safety function conditions that may result when a TS support system is inoperable. In this figure, the fifteen systems that comprise Train A are independent and redundant to the fifteen systems that comprise Train B.
To correctly use the figure to illustrate the SFDP provisions for a cross train check, the figure establishes a relationship between support and supported systems as follows: the figure shows System 1 as a support system for System 2 and System 3; System 2 as a support system for System 4 and System 5; and System 4 as a support system for System 8 and System 9. Specifically, a loss of safety function may exist when a support system is inoperable and:
: a. A system redundant to system(s) supported by the inoperable support system is also inoperable (EXAMPLE B 3.0.6-1),
: b. A system redundant to system(s) in turn supported by the inoperable supported system is also inoperable (EXAMPLE B 3.0.6-2), or
: c. A system redundant to support system(s) for the supported systems (a) and (b) above is also inoperable (EXAMPLE B 3.0.6-3).
For the following examples, refer to Figure B 3.0-1.
EXAMPLE B 3.0.6-1 If System 2 of Train A is inoperable and System 5 of Train B is inoperable, a loss of safety function exists in Systems 5, 10, and 11.
EXAMPLE B 3.0.6-2 If System 2 of Train A is inoperable, and System 11 of Train B is inoperable, a loss of safety function exists in System 11.
EXAMPLE B 3.0.6-3 If System 2 of Train A is inoperable, and System 1 of Train B is inoperable, a loss of safety function exists in Systems 2, 4, 5, 8, 9, 10 and 11.
Babcock & Wilcox STS                    B 3.0-10                                         Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.6 (continued)
If an evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.
Figure B 3.0-1 Configuration of Trains and Systems This loss of safety function does not require the assumption of additional single failures or loss of offsite power. Since operations are being restricted in accordance with the ACTIONS of the support system, any resulting temporary loss of redundancy or single failure protection is taken into account. Similarly, the ACTIONS for inoperable offsite circuit(s) and inoperable diesel generator(s) provide the necessary restriction for cross train inoperabilities. This explicit cross train verification for inoperable AC electrical power sources also acknowledges that supported system(s) are not declared inoperable solely as a result of inoperability of a normal or emergency electrical power source (refer to the definition of OPERABILITY).
Babcock & Wilcox STS                    B 3.0-11                                            Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.6 (continued)
When loss of safety function is determined to exist, and the SFDP requires entry into the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists, consideration must be given to the specific type of function affected. Where a loss of function is solely due to a single Technical Specification support system (e.g., loss of automatic start due to inoperable instrumentation, or loss of pump suction source due to low tank level) the appropriate LCO is the LCO for the support system. The ACTIONS for a support system LCO adequately address the inoperabilities of that system without reliance on entering its supported system LCO. When the loss of function is the result of multiple support systems, the appropriate LCO is the LCO for the supported system.
LCO 3.0.7           There are certain special tests and operations required to be performed at various times over the life of the unit. These special tests and operations are necessary to demonstrate select unit performance characteristics, to perform special maintenance activities, and to perform special evolutions.
Test Exception LCOs [3.1.8, 3.1.9, and 3.4.19] allow specified Technical Specification (TS) requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS.
Unless otherwise specified, all the other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.
The Applicability of a Test Exception LCO represents a condition not necessarily in compliance with the normal requirements of the TS.
Compliance with Test Exception LCOs is optional. A special operation may be performed either under the provisions of the appropriate Test Exception LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Test Exception LCO, the requirements of the Test Exception LCO shall be followed.
LCO 3.0.8           LCO 3.0.8 establishes conditions under which systems are considered to remain capable of performing their intended safety function when associated snubbers are not capable of providing their associated support function(s). This LCO states that the supported system is not considered to be inoperable solely due to one or more snubbers not capable of performing their associated support function(s). This is appropriate because a limited length of time is allowed for maintenance, testing, or repair of one or more snubbers not capable of performing their associated Babcock & Wilcox STS                   B 3.0-12                                          Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.8 (continued) support function(s) and appropriate compensatory measures are specified in the snubber requirements, which are located outside of the Technical Specifications (TS) under licensee control. The snubber requirements do not meet the criteria in 10 CFR 50.36(c)(2)(ii), and, as such, are appropriate for control by the licensee.
If the allowed time expires and the snubber(s) are unable to perform their associated support function(s), the affected supported systems LCO(s) must be declared not met and the Conditions and Required Actions entered in accordance with LCO 3.0.2.
LCO 3.0.8.a applies when one or more snubbers are not capable of providing their associated support function(s) to a single train or subsystem of a multiple train or subsystem supported system or to a single train or subsystem supported system. LCO 3.0.8.a allows 72 hours to restore the snubber(s) before declaring the supported system inoperable. The 72 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function and due to the availability of the redundant train of the supported system.
LCO 3.0.8.b applies when one or more snubbers are not capable of providing their associated support function(s) to more than one train or subsystem of a multiple train or subsystem supported system.
LCO 3.0.8.b allows 12 hours to restore the snubber(s) before declaring the supported system inoperable. The 12 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function.
LCO 3.0.8 requires that risk be assessed and managed. Industry and NRC guidance on the implementation of 10 CFR 50.65(a)(4) (the Maintenance Rule) does not address seismic risk. However, use of LCO 3.0.8 should be considered with respect to other plant maintenance activities, and integrated into the existing Maintenance Rule process to the extent possible so that maintenance on any unaffected train or subsystem is properly controlled, and emergent issues are properly addressed. The risk assessment need not be quantified, but may be a qualitative awareness of the vulnerability of systems and components when one or more snubbers are not able to perform their associated support function.
Babcock & Wilcox STS                    B 3.0-13                                        Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.9          -----------------------------------REVIEWER'S NOTE-----------------------------------
Adoption of LCO 3.0.9 requires the licensee to make the following commitments:
: 1. [LICENSEE] commits to the guidance of NUMARC 93-01, Revision [4F], Section 11, which provides guidance and details on the assessment and management of risk during maintenance.
: 2. [LICENSEE] commits to the guidance of NEI 04-08, "Allowance for Non Technical Specification Barrier Degradation on Supported System OPERABILITY (TSTF-427) Industry Implementation Guidance," March 2006.
LCO 3.0.9 establishes conditions under which systems described in the Technical Specifications are considered to remain OPERABLE when required barriers are not capable of providing their related support function(s).
Barriers are doors, walls, floor plugs, curbs, hatches, installed structures or components, or other devices, not explicitly described in Technical Specifications, that support the performance of the safety function of systems described in the Technical Specifications. This LCO states that the supported system is not considered to be inoperable solely due to required barriers not capable of performing their related support function(s) under the described conditions. LCO 3.0.9 allows 30 days before declaring the supported system(s) inoperable and the LCO(s) associated with the supported system(s) not met. A maximum time is placed on each use of this allowance to ensure that as required barriers are found or are otherwise made unavailable, they are restored.
However, the allowable duration may be less than the specified maximum time based on the risk assessment.
If the allowed time expires and the barriers are unable to perform their related support function(s), the supported systems LCO(s) must be declared not met and the Conditions and Required Actions entered in accordance with LCO 3.0.2.
This provision does not apply to barriers which support ventilation systems or to fire barriers. The Technical Specifications for ventilation systems provide specific Conditions for inoperable barriers. Fire barriers are addressed by other regulatory requirements and associated plant programs. This provision does not apply to barriers which are not required to support system OPERABILITY (see NRC Regulatory Issue Summary 2001-09, "Control of Hazard Barriers," dated April 2, 2001).
Babcock & Wilcox STS                       B 3.0-14                                                       Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.9 (continued)
The provisions of LCO 3.0.9 are justified because of the low risk associated with required barriers not being capable of performing their related support function. This provision is based on consideration of the following initiating event categories:
                    ------------------------------------- Reviewers Note -------------------------------------
LCO 3.0.9 may be expanded to other initiating event categories provided plant-specific analysis demonstrates that the frequency of the additional initiating events is bounded by the generic analysis or if plant-specific approval is obtained from the NRC.
* Loss of coolant accidents;
* High energy line breaks;
* Feedwater line breaks;
* Internal flooding;
* External flooding;
* Turbine missile ejection; and
* Tornado or high wind.
The risk impact of the barriers which cannot perform their related support function(s) must be addressed pursuant to the risk assessment and management provision of the Maintenance Rule, 10 CFR 50.65 (a)(4),
and the associated implementation guidance, Regulatory Guide 1.160, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants."
Regulatory Guide 1.160 endorses the guidance in Section 11 of NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." This guidance provides for the consideration of dynamic plant configuration issues, emergent conditions, and other aspects pertinent to plant operation with the barriers unable to perform their related support function(s). These considerations may result in risk management and other compensatory actions being required during the period that barriers are unable to perform their related support function(s).
LCO 3.0.9 may be applied to one or more trains or subsystems of a system supported by barriers that cannot provide their related support function(s), provided that risk is assessed and managed (including consideration of the effects on Large Early Release and from external events). If applied concurrently to more than one train or subsystem of a multiple train or subsystem supported system, the barriers supporting each of these trains or subsystems must provide their related support function(s) for different categories of initiating events. For example, Babcock & Wilcox STS                        B 3.0-15                                                       Rev. 5.0

LCO APPLICABILITY B 3.0 BASES LCO 3.0.9 (continued)
LCO 3.0.9 may be applied for up to 30 days for more than one train of a multiple train supported system if the affected barrier for one train protects against internal flooding and the affected barrier for the other train protects against tornado missiles. In this example, the affected barrier may be the same physical barrier but serve different protection functions for each train.
If during the time that LCO 3.0.9 is being used, the required OPERABLE train or subsystem becomes inoperable, it must be restored to OPERABLE status within 24 hours. Otherwise, the train(s) or subsystem(s) supported by barriers that cannot perform their related support function(s) must be declared inoperable and the associated LCOs declared not met. This 24 hour period provides time to respond to emergent conditions that would otherwise likely lead to entry into LCO 3.0.3 and a rapid plant shutdown, which is not justified given the low probability of an initiating event which would require the barrier(s) not capable of performing their related support function(s). During this 24 hour period, the plant risk associated with the existing conditions is assessed and managed in accordance with 10 CFR 50.65(a)(4).
Babcock & Wilcox STS                    B 3.0-16                                          Rev. 5.0

SR Applicability B 3.0 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRs                SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.
SR 3.0.2 and SR 3.0.3 apply in Chapter 5 only when invoked by a Chapter 5 Specification.
SR 3.0.1           SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO. Surveillances may be performed by means of any series of sequential, overlapping, or total steps provided the entire Surveillance is performed within the specified Frequency. Additionally, the definitions related to instrument testing (e.g., CHANNEL CALIBRATION) specify that these tests are performed by means of any series of sequential, overlapping, or total steps.
Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:
: a. The systems or components are known to be inoperable, although still meeting the SRs or
: b. The requirements of the Surveillance(s) are known to be not met between required Surveillance performances.
Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a Special Test Exception (STE) LCO are only applicable when the STE LCO is used as an allowable exception to the requirements of a Specification.
Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR. This allowance includes those SRs whose performance is normally precluded in a given MODE or other specified condition.
Babcock & Wilcox STS                   B 3.0-17                                         Rev. 5.0

SR Applicability B 3.0 BASES SR 3.0.1 (continued)
Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status.
Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed.
Some examples of this process are:
: a. Emergency feedwater (EFW) pump turbine maintenance during refueling that requires testing at steam pressures > 800 psi.
However, if other appropriate testing is satisfactorily completed, the EFW System can be considered OPERABLE. This allows startup and other necessary testing to proceed until the plant reaches the steam pressure required to perform the EFW pump testing.
: b. High pressure injection (HPI) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPI considered OPERABLE. This allows operation to reach the specified pressure to complete the necessary post maintenance testing.
SR 3.0.2             SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a "once per ..." interval.
SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).
Babcock & Wilcox STS                      B 3.0-18                                         Rev. 5.0

SR Applicability B 3.0 BASES SR 3.0.2 (continued)
When a Section 5.5, "Programs and Manuals," specification states that the provisions of SR 3.0.2 are applicable, a 25% extension of the testing interval, whether stated in the specification or incorporated by reference, is permitted.
The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs.
The exceptions to SR 3.0.2 are those Surveillances for which the 25%
extension of the interval specified in the Frequency does not apply.
These exceptions are stated in the individual Specifications. The requirements of regulations take precedence over the TS. Examples of where SR 3.0.2 does not apply are the Containment Leakage Rate Testing Program required by 10 CFR 50, Appendix J, and the inservice testing of pumps and valves in accordance with applicable American Society of Mechanical Engineers Operation and Maintenance Code, as required by 10 CFR 50.55a. These programs establish testing requirements and Frequencies in accordance with the requirements of regulations. The TS cannot in and of themselves extend a test interval specified in the regulations directly or by reference.
As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per ..." basis. The 25% extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25% extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.
The provisions of SR 3.0.2 are not intended to be used repeatedly to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.
SR 3.0.3             SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been performed within the specified Frequency. A delay period of up to 24 hours or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is Babcock & Wilcox STS                      B 3.0-19                                        Rev. 5.0

SR Applicability B 3.0 BASES SR 3.0.3 (continued) discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met.
When a Section 5.5, "Programs and Manuals," specification states that the provisions of SR 3.0.3 are applicable, it permits the flexibility to defer declaring the testing requirement not met in accordance with SR 3.0.3 when the testing has not been completed within the testing interval (including the allowance of SR 3.0.2 if invoked by the Section 5.5 specification).
This delay period provides an adequate time to perform Surveillances that have been missed. This delay period permits the performance of a Surveillance before complying with Required Actions or other remedial measures that might preclude performance of the Surveillance.
The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.
When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.
SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.
SR 3.0.3 is only applicable if there is a reasonable expectation the associated equipment is OPERABLE or that variables are within limits, and it is expected that the Surveillance will be met when performed.
Many factors should be considered, such as the period of time since the Surveillance was last performed, or whether the Surveillance, or a portion thereof, has ever been performed, and any other indications, tests, or activities that might support the expectation that the Surveillance will be Babcock & Wilcox STS                    B 3.0-20                                            Rev. 5.0

SR Applicability B 3.0 BASES SR 3.0.3 (continued) met when performed. An example of the use of SR 3.0.3 would be a relay contact that was not tested as required in accordance with a particular SR, but previous successful performances of the SR included the relay contact; the adjacent, physically connected relay contacts were tested during the SR performance; the subject relay contact has been tested by another SR; or historical operation of the subject relay contact has been successful. It is not sufficient to infer the behavior of the associated equipment from the performance of similar equipment. The rigor of determining whether there is a reasonable expectation a Surveillance will be met when performed should increase based on the length of time since the last performance of the Surveillance. If the Surveillance has been performed recently, a review of the Surveillance history and equipment performance may be sufficient to support a reasonable expectation that the Surveillance will be met when performed.
For Surveillances that have not been performed for a long period or that have never been performed, a rigorous evaluation based on objective evidence should provide a high degree of confidence that the equipment is OPERABLE. The evaluation should be documented in sufficient detail to allow a knowledgeable individual to understand the basis for the determination.
Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used repeatedly to extend Surveillance intervals. While up to 24 hours or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.160, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The Babcock & Wilcox STS                      B 3.0-21                                         Rev. 5.0

SR Applicability B 3.0 BASES SR 3.0.3 (continued) degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the licensees Corrective Action Program.
If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.
Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.
SR 3.0.4             SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.
This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to a Surveillance not being met in accordance with LCO 3.0.4.
However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change.
When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do Babcock & Wilcox STS                     B 3.0-22                                          Rev. 5.0

SR Applicability B 3.0 BASES SR 3.0.4 (continued) not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability. However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes. SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3.
The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.
The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCOs Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met.
Alternately, the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.
Babcock & Wilcox STS                      B 3.0-23                                        Rev. 5.0

SDM B 3.1.1 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM)
BASES BACKGROUND         The reactivity control systems must be redundant and capable of holding the reactor core subcritical when shut down under cold conditions GDC 26 (Ref. 1). SDM requirements provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational occurrences (AOOs). In MODES 3, 4, and 5, the SDM defines the degree of subcriticality that would be obtained immediately following the insertion of all safety and regulating rods, assuming the single CONTROL ROD assembly of highest reactivity worth is fully withdrawn.
The system design requires that two independent reactivity control systems be provided, and that one of these systems be capable of maintaining the core subcritical under cold conditions. These requirements are provided by the use of movable control assemblies and soluble boric acid in the Reactor Coolant System (RCS). The CONTROL RODS can compensate for the reactivity effects of the fuel and water temperature changes accompanying power level changes over the range from full load to no load. In addition, the CONTROL RODS, together with the Chemical Addition and Makeup System, provide SDM during power operation and are capable of making the core subcritical rapidly enough to prevent exceeding acceptable fuel damage limits, assuming that the rod of highest reactivity worth remains fully withdrawn.
The Chemical Addition and Makeup System can compensate for fuel depletion, during operation and all xenon burnout reactivity changes, and maintain the reactor subcritical under cold conditions.
During power operation, SDM control is ensured by operating with the safety rods fully withdrawn (LCO 3.1.5, "Safety Rod Insertion Limits") and the regulating rods within the limits of LCO 3.2.1, "Regulating Rod Insertion Limits." When the unit is in the shutdown and refueling modes, the SDM requirements are met by means of adjustments to the RCS boron concentration. Adjusted SDM limits defined in the COLR preclude recriticality in the event of a main steam line break (MSLB) in MODE 3, 4, or 5 when high steam generator levels exist.
Babcock & Wilcox STS                    B 3.1.1-1                                     Rev. 5.0

SDM B 3.1.1 BASES APPLICABLE         The minimum required SDM is assumed as an initial condition in safety SAFETY             analysis. The safety analysis (Ref. 2) establishes an SDM that ensures ANALYSES           specified acceptable fuel design limits are not exceeded for normal operation and AOOs, with assumption of the highest worth rod stuck out following a reactor trip.
The acceptance criteria for SDM requirements are that specified acceptable fuel design limits are maintained. The SDM requirements must ensure that:
: a. The reactor can be made subcritical from all operating conditions, transients, and Design Basis Events,
: b. The reactivity transients associated with postulated accident conditions are controllable with acceptable limits (departure from nucleate boiling ratio (DNBR), fuel centerline temperature limits for AOOs, and  280 cal/gm energy deposition for the rod ejection accident), and
: c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.
The most limiting accident for the SDM requirements is based on an MSLB, as described in the accident analysis (Ref. 2).
In addition to the limiting MSLB transient, the SDM requirement must also protect against:
: a. Inadvertent boron dilution,
: b. An uncontrolled rod withdrawal from a subcritical or low power condition,
: c. Startup of an inactive reactor coolant pump,
: d. Rod ejection, and
: e. Return to criticality if an MSLB occurs during high steam generator level operations in MODE 3, 4, or 5.
The basis for the shutdown requirement when high steam generator levels exist is the heat removal potential in the secondary system fluid and the negative reactivity added via MTC. At any given initial primary system temperature and its associated secondary system pressure, the Babcock & Wilcox STS                   B 3.1.1-2                                         Rev. 5.0

SDM B 3.1.1 BASES APPLICABLE SAFETY ANALYSES (continued) secondary system liquid levels can be equated to a final primary system temperature assuming the entire mass is boiled. The resulting RCS temperature determines the required SDM.
SDM satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                Shutdown boron concentration requirements assume the highest worth rod is stuck in the fully withdrawn position to account for a postulated inoperable or untrippable rod prior to reactor shutdown.
SDM is a core design condition that can be ensured through CONTROL ROD positioning (control and shutdown groups) and through the soluble boron concentration.
The MSLB (Ref. 2) accident is the most limiting analysis that establishes the SDM value of the LCO.
For MSLB accidents, if the LCO is violated, there is a potential to exceed the DNBR limit and to exceed 10 CFR 100 limits (Ref. 3).
To compensate for the potential heat removal associated with an MSLB accident when high steam generator levels exist during secondary system chemistry control and steam generator cleaning, the initial SDM in the core must be adjusted. The Figure in the COLR represents a series of initial conditions that ensure the core will remain subcritical following an MSLB accident from those conditions.
APPLICABILITY      In MODES 3, 4, and 5, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analysis discussed above. The Figure in the COLR is used to define the SDM when high steam generator levels exist during secondary system chemistry control and steam generator cleaning in MODES 3, 4, and 5.
In MODES 1 and 2, SDM is ensured by complying with LCO 3.1.5 and LCO 3.2.1. In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, "Boron Concentration."
ACTIONS            A.1 If the SDM requirements are not met, boration must be initiated promptly.
A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that boration will be continued until the SDM requirements are met. If the SDM is below the limit for the steam generator level and RCS temperature specified in the COLR, RCS boration must be continued until the limit specified in the COLR is met.
Babcock & Wilcox STS                   B 3.1.1-3                                          Rev. 5.0

SDM B 3.1.1 BASES ACTIONS (continued)
In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Since it is imperative to raise the boron concentration of the RCS as soon as possible, the boron concentration should be a highly concentrated solution, such as that normally found in the boric acid storage tank or the borated water storage tank. The operator should borate with the best source available for the plant conditions.
In determining the boration flow rate, the time in core life must be considered. For instance, the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle, when the boron concentration may approach or exceed 2000 ppm. Assuming that a value of [1]% k/k must be recovered and a boration flow rate is [ ] gpm, it is possible to increase the boron concentration of the RCS by 100 ppm in approximately 35 minutes. If a boron worth of 10 pcm/ppm is assumed, this combination of parameters will increase the SDM by [1]% k/k.
These boration parameters of [ ] gpm and [ ] ppm represent typical values and are provided for the purpose of offering a specific example.
SURVEILLANCE         SR 3.1.1.1 REQUIREMENTS The SDM is verified by performing a reactivity balance calculation, considering the listed reactivity effects:
: a. RCS boron concentration,
: b. Regulating rod position,
: c. RCS average temperature,
: d. Fuel burnup based on gross thermal energy generation,
: e. Xenon concentration,
: f. Samarium concentration, and
: g. Isothermal temperature coefficient (ITC).
Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS.
[ The Frequency of 24 hours is based on the generally slow change in required boron concentration, and also allows sufficient time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the calculation.
Babcock & Wilcox STS                    B 3.1.1-4                                          Rev. 5.0

SDM B 3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 50, Appendix A, GDC 26.
: 2. FSAR, Chapter [14].
: 3. 10 CFR 100, "Reactor Site Criteria."
Babcock & Wilcox STS                      B 3.1.1-5                                                       Rev. 5.0

Reactivity Balance B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.2 Reactivity Balance BASES BACKGROUND            According to GDC 26, GDC 28, and GDC 29 (Ref. 1), reactivity shall be controllable, such that subcriticality is maintained under cold conditions, and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences. Therefore, the reactivity balance is used as a measure of the predicted versus measured core reactivity during power operation. The periodic confirmation of core reactivity is necessary to ensure that safety analyses of design basis transients and accidents remain valid. A large reactivity difference could be the result of unanticipated changes in fuel, CONTROL ROD, or burnable poison worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity. These could potentially result in a loss of SDM or violation of acceptable fuel design limits. Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to cold, subcritical conditions.
When the reactor core is critical or in normal power operation, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance, since parameters are being maintained relatively stable under steady state power conditions. The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers, producing zero net reactivity.
Excess reactivity can be inferred from the boron letdown curve (or critical boron curve), which provides an indication of the soluble boron concentration in the Reactor Coolant System (RCS) versus cycle burnup.
Periodic measurement of the RCS boron concentration for comparison with the predicted value with other variables fixed, (such as rod height, temperature, pressure, and power), provides a convenient method of ensuring that core reactivity is within design expectations, and that the calculational models used to generate the safety analysis are adequate.
In order to achieve the required fuel cycle energy output, the uranium enrichment in the new fuel loading and the fuel remaining from the previous cycle provides excess positive reactivity beyond that required to sustain steady state operation throughout the cycle. When the reactor is critical at RTP and moderator temperature, the excess positive reactivity is compensated by burnable absorbers (if any), CONTROL RODS, whatever neutron poisons (mainly xenon and samarium) are present in the fuel, and the RCS boron concentration.
Babcock & Wilcox STS                      B 3.1.2-1                                        Rev. 5.0

Reactivity Balance B 3.1.2 BASES BACKGROUND (continued)
When the core is producing THERMAL POWER, the fuel is being depleted and excess reactivity is decreasing. As the fuel depletes, the RCS boron concentration is reduced to decrease negative reactivity and maintain constant THERMAL POWER. The boron letdown curve is based on steady state operation at RTP. Therefore, deviations from the predicted boron letdown curve may indicate deficiencies in the design analysis, deficiencies in the calculational models, or abnormal core conditions, and must be evaluated.
APPLICABLE         The acceptance criteria for core reactivity are the establishment of SAFETY             the reactivity balance limit to ensure that plant operation is maintained ANALYSES           within the assumptions of the safety analyses.
Accurate prediction of core reactivity is either an explicit or implicit assumption in the accident analysis evaluations. Every accident evaluation (Ref. 2) is, therefore, dependent upon accurate evaluation of core reactivity. In particular, SDM and reactivity transients, such as CONTROL ROD withdrawal accidents or rod ejection accidents, are very sensitive to accurate prediction of core reactivity. These accident analysis evaluations rely on computer codes which have been qualified against available test data, operating plant data, and analytical benchmarks. Monitoring reactivity balance ensures that the nuclear methods provide an accurate representation of the core reactivity.
Design calculations and safety analyses are performed for each fuel cycle for the purpose of predetermining reactivity behavior and the RCS boron concentration requirements for reactivity control during fuel depletion.
The comparison between measured and predicted initial core reactivity provides a normalization for the calculational models used to predict core reactivity. If the measured and predicted RCS boron concentrations for identical core conditions at beginning of cycle (BOC) do not agree, then the assumptions used in the reload cycle design analysis or the calculational models used to predict soluble boron requirements may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured boron concentration. Thereafter, any significant deviations in the measured boron concentration from the predicted boron letdown curve, which is developed during fuel depletion, may be an indication that the calculational model is not adequate for core burnups beyond BOC, or that an unexpected change in core conditions has occurred.
Babcock & Wilcox STS                   B 3.1.2-2                                          Rev. 5.0

Reactivity Balance B 3.1.2 BASES APPLICABLE SAFETY ANALYSES (continued)
The normalization of predicted RCS boron concentration to the measured value is typically performed after reaching RTP following startup from a refueling outage, with the CONTROL RODS in their normal positions for power operation. The normalization is performed at BOC conditions, so that core reactivity relative to predicted values can be continually monitored and evaluated, as core conditions change during the cycle.
Reactivity balance satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                Long term core reactivity behavior is a result of the core physics design and cannot be easily controlled, once the core design is fixed. During operation, therefore, the conditions of the LCO can only be ensured through measurement and tracking, and appropriate actions taken as necessary. Large differences between actual and predicted core reactivity may indicate that the assumptions of the Design Basis Accident (DBA) and transient analyses are no longer valid, or that the uncertainties in the nuclear design methodology are larger than expected. A limit on the reactivity of +/- 1% k/k has been established, based on engineering judgment. A +/- 1% k/k deviation in reactivity from that predicted is larger than expected for normal operation and should therefore be evaluated.
When measured core reactivity is within 1% k/k of the predicted value at steady state thermal conditions, the core is considered to be operating within acceptable design limits. Since deviations from the limit are normally detected by comparing predicted and measured steady state RCS critical boron concentrations, the difference between measured and predicted values would be approximately 100 ppm (depending on the boron worth) before the limit is reached. These values are well within the uncertainty limits for analysis of boron concentration samples, so that spurious violations of the limit due to uncertainty in measuring the RCS boron concentration are unlikely.
APPLICABILITY      In MODES 1 and 2 during fuel cycle operation with keff  1, the limits on core reactivity must be maintained because a reactivity balance must exist when the reactor is critical or producing THERMAL POWER. As the fuel depletes, core conditions are changing, and confirmation of the reactivity balance ensures the core is operating as designed.
This Specification does not apply in MODES 3, 4, and 5, because the reactor is shutdown and changes to core reactivity due to fuel depletion cannot occur.
Babcock & Wilcox STS                   B 3.1.2-3                                        Rev. 5.0

Reactivity Balance B 3.1.2 BASES APPLICABILITY (continued)
In MODE 6, fuel loading results in a continually changing core reactivity.
Boron concentration requirements (LCO 3.9.1, "Refueling Boron Concentration") ensure that fuel movements are performed within the bounds of the safety analysis, and an SDM demonstration is required during the first startup following operations that could have altered core reactivity (e.g., fuel movement or CONTROL ROD replacement or shuffling).
ACTIONS            A.1 and A.2 Should an anomaly develop between measured and predicted core reactivity, an evaluation of the core design and safety analysis must be performed. Core conditions are evaluated to determine their consistency with input to design calculations. Measured core and process parameters are evaluated to determine that they are within the bounds of the safety analysis, and safety analysis calculational models are reviewed to verify that they are adequate for representation of the core conditions. The required Completion Time of 7 days is based on the low probability of a DBA occurring during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.
Following evaluations of the core design and safety analysis, the cause of the reactivity anomaly may be resolved. If the cause of the reactivity anomaly is a mismatch in core conditions at the time of RCS boron concentration sampling, then a recalculation of the RCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected. If an unexpected physical change in the condition of the core has occurred, it must be evaluated and corrected, if possible. If the cause of the reactivity anomaly is in the calculation technique, then the calculational models must be revised to provide more accurate predictions. If any of these results are demonstrated, and it is concluded that the reactor core is acceptable for continued operation, then the boron letdown curve may be renormalized, and power operation may continue. If operational restrictions or additional surveillance requirements are necessary to ensure the reactor core is acceptable for continued operation, then they must be defined.
The required Completion Time of 7 days is adequate for preparing operating restrictions or surveillances that may be required to allow continued reactor operation.
Babcock & Wilcox STS                   B 3.1.2-4                                         Rev. 5.0

Reactivity Balance B 3.1.2 BASES ACTIONS (continued)
B.1 If the core reactivity cannot be restored to within the 1% k/k limit, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours. If the SDM for MODE 3 is not met, then boration required by Required Action A.1 of LCO 3.1.1 would occur. The allowed Completion Time of 6 hours is reasonable, based on operating experience to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE       SR 3.1.2.1 REQUIREMENTS Core reactivity is verified by periodic comparisons of measured and predicted RCS boron concentrations. The comparison is made considering that other core conditions are fixed or stable, including CONTROL ROD positions, moderator temperature, fuel temperature, fuel depletion, xenon concentration, and samarium concentration. The Surveillance is performed prior to entering MODE 1 as an initial check on core conditions and design calculations at BOC. A Note is included in the SR to indicate that the normalization of predicted core reactivity to the measured value must take place within the first 60 effective full power days (EFPD) after each fuel loading. This allows sufficient time for core conditions to reach steady state, but prevents operation for a large fraction of the fuel cycle without establishing a benchmark for the design calculations. [ The required subsequent Frequency of 31 EFPD, following the initial 60 EFPD after entering MODE 1 is acceptable, based on the slow rate of core reactivity changes due to fuel depletion and the presence of other indicators (QPT, etc.) for prompt indication of an anomaly.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Another Note is included in the SRs to indicate that the performance of the Surveillance is not required for entry into MODE 2.
Babcock & Wilcox STS                      B 3.1.2-5                                                       Rev. 5.0

Reactivity Balance B 3.1.2 BASES REFERENCES         1. 10 CFR 50, Appendix A, GDC 26, GDC 28, and GDC 29.
: 2. FSAR, Chapter [14].
Babcock & Wilcox STS              B 3.1.2-6                                  Rev. 5.0

MTC B 3.1.3 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.3 Moderator Temperature Coefficient (MTC)
BASES BACKGROUND          According to GDC 11 (Ref. 1), the reactor core and its interaction with the Reactor Coolant System (RCS) must be designed for inherently stable power operation, even in the possible event of an accident. In particular, the net reactivity feedback in the system must compensate for any unintended reactivity increases.
The MTC relates a change in core reactivity to a change in reactor coolant temperature (a positive MTC means that reactivity increases with increasing moderator temperature; conversely, a negative MTC means that reactivity decreases with increasing moderator temperature). The reactor is designed to operate with a negative MTC over the largest possible range of fuel cycle operation. Therefore, a coolant temperature increase will cause a reactivity decrease, so that the coolant temperature tends to return toward its initial value. Reactivity increases that cause a coolant temperature increase will thus be self limiting, and stable power operation will result. The same characteristic is true when the MTC is positive and coolant temperature decreases occur.
MTC values are predicted at selected burnups during the safety evaluation analysis and are confirmed to be acceptable by measurements. Both initial and reload cores are designed so that the beginning of cycle (BOC) MTC is less than zero when THERMAL POWER is 95% RTP or greater. The actual value of the MTC is dependent on core characteristics, such as fuel loading and reactor coolant soluble boron concentration. The core design may require additional burnable absorbers to yield an MTC at BOC within the range analyzed in the plant accident analysis. The end of cycle (EOC) MTC is also limited by the requirements of the accident analysis. Fuel cycles that are designed to achieve high burnups or that have changes to other characteristics are evaluated to ensure the MTC does not exceed the EOC limit.
APPLICABLE          Reference 2 contains analyses of accidents that result in both SAFETY              overheating and overcooling of the reactor core. MTC is one of the ANALYSES            controlling parameters for core reactivity in these accidents. Both the most positive value and most negative value of the MTC are initial conditions in the safety analyses, and both values must be bounded.
Values used in the analyses consider worst case conditions, such as very large soluble boron concentrations, to ensure the accident results are bounding (Ref. 3).
Babcock & Wilcox STS                    B 3.1.3-1                                         Rev. 5.0

MTC B 3.1.3 BASES APPLICABLE SAFETY ANALYSES (continued)
The acceptance criteria for the specified MTC are:
: a. The MTC values must remain within the bounds of those used in the accident analysis (Ref. 2) and
: b. The MTC must be such that inherently stable power operations result during normal operation and accidents, such as overheating and overcooling events.
Accidents that cause core overheating (either decreased heat removal or increased power production) must be evaluated for results when the MTC is positive. Reactivity accidents that cause increased power production include the CONTROL ROD withdrawal transient from either zero or full THERMAL POWER. The limiting overheating event relative to plant response is based on the maximum difference between core power and steam generator heat removal during a transient. The most limiting event with respect to positive MTC is a [rod withdrawal accident from zero power, also referred to as a startup accident (Ref. 4)].
Accidents that cause core overcooling must be evaluated for results when the MTC is most negative. The event that produces the most rapid cooldown of the RCS, and is therefore the most limiting event with respect to the negative MTC, is a steam line break (SLB) event.
Following the reactor trip for the postulated EOC SLB event, the large moderator temperature reduction, combined with the large negative MTC, may produce reactivity increases that are as much as the shutdown reactivity. When this occurs, a substantial fraction of core power is produced with all CONTROL ROD assemblies inserted, except the most reactive one. Even if the reactivity increase produces slightly subcritical conditions, a large fraction of core power may be produced through the effects of subcritical neutron multiplication.
MTC values are bounded in reload safety evaluations, assuming steady state conditions at BOC and EOC. A near EOC measurement is conducted at conditions when the RCS boron concentration reaches approximately 300 ppm. The measured value may be extrapolated to project the EOC value, in order to confirm reload design predictions.
MTC satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                   B 3.1.3-2                                       Rev. 5.0

MTC B 3.1.3 BASES LCO                LCO 3.1.3 requires the MTC to be within specified limits in the COLR to ensure the core operates within the assumptions of the accident analysis.
During the reload core safety evaluation, the MTC is analyzed to determine that its values remain within the bounds of the original accident analysis during operation. The LCO establishes a maximum positive value that can not be exceeded. The limit of +0.9E-4 (% k/k)/&deg;F on positive MTC, when THERMAL POWER is < 95% RTP, ensures that core overheating accidents will not violate the accident analysis assumptions.
The requirement for a negative MTC, when THERMAL POWER is 95% RTP, ensures that core operation will be stable. The negative MTC limit for EOC specified in the COLR ensures that core overcooling accidents will not violate the accident analysis assumptions.
MTC is a core physics parameter determined by the fuel and fuel cycle design and cannot be easily controlled once the core design is fixed during operation, therefore, the LCO can only be ensured through measurement. The surveillance checks at BOC and EOC on MTC provide confirmation that the MTC is behaving as anticipated, so that the acceptance criteria are met.
APPLICABILITY      In MODE 1, the limits on MTC must be maintained to ensure that any accident initiated from THERMAL POWER operation will not violate the design assumptions of the accident analysis. In MODE 2, the limits must also be maintained to ensure that startup and subcritical accidents, such as the uncontrolled CONTROL ROD assembly or group withdrawal, will not violate the assumptions of the accident analysis. In MODES 3, 4, 5, and 6, this LCO is not applicable, since no Design Basis Accidents (DBAs) using the MTC as an analysis assumption are initiated from these MODES. However, the variation of MTC with temperature in MODES 3, 4, and 5 for DBAs initiated in MODES 1 and 2 is accounted for in the subject accident analysis. The variation of MTC with temperature assumed in the safety analysis, is accepted as valid once the BOC and middle of cycle measurements are used for normalization.
ACTIONS            A.1 MTC is a function of the fuel and fuel cycle designs, and cannot be controlled directly once the designs have been implemented in the core.
If MTC exceeds its limits, the reactor must be placed in MODE 3. This eliminates the potential for violation of the accident analysis bounds. The associated Completion Time of 6 hours is reasonable, considering the probability of an accident occurring during the time period that would require an MTC value within the LCO limits, for reaching MODE 3 conditions from full power conditions in an orderly manner and without challenging plant systems.
Babcock & Wilcox STS                  B 3.1.3-3                                        Rev. 5.0

MTC B 3.1.3 BASES SURVEILLANCE       The following two SRs for measurement of the MTC at the beginning and REQUIREMENTS       end of each fuel cycle provide for confirmation of the limiting MTC values.
The MTC changes slowly from most positive (least negative) to most negative value during fuel cycle operation, as the RCS boron concentration is reduced with fuel depletion.
SR 3.1.3.1 The requirement for measurement, prior to initial operation above 5% RTP, satisfies the confirmatory check on the most positive (least negative) MTC value.
SR 3.1.3.2 The requirement for measurement, within 7 effective full power days (EFPD) after reaching an equilibrium boron concentration of 300 ppm for RTP, satisfies the confirmatory check on the most negative (least positive) MTC value. The measurement is performed at any THERMAL POWER equivalent to an RCS boron concentration of 300 ppm (for steady state operation at RTP with all CONTROL RODS fully withdrawn) so that the projected EOC MTC may be evaluated before the reactor actually reaches the EOC condition. MTC values are extrapolated and compensated to permit direct comparison to the specified MTC limits.
The SR is modified by a Note. The Note indicates that SR 3.1.3.2 may be repeated, and shutdown must occur, prior to exceeding the minimum allowable boron concentration at which MTC is projected to exceed the lower limit. The minimum allowable boron concentration is obtained from the EOC MTC versus boron concentration slope with appropriate conservatisms. Thus, the projected EOC MTC is evaluated before the lower limit is actually reached.
REFERENCES         1. 10 CFR 50, Appendix A, GDC 11.
: 2. FSAR, Chapter [14].
: 3. FSAR, Section [ ] .
: 4. FSAR, Section [ ] .
Babcock & Wilcox STS                  B 3.1.3-4                                       Rev. 5.0

CONTROL ROD Group Alignment Limits B 3.1.4 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 CONTROL ROD Group Alignment Limits BASES BACKGROUND         The OPERABILITY (i.e., trippability) of the CONTROL RODS (safety rods and regulating rods) is an initial condition assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial condition assumption in the safety analysis that directly affects core power distributions and assumptions of available SDM.
The applicable criteria for these design requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design," and GDC 26, "Reactivity Control System Redundancy-and Capability" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants" (Ref. 2).
Mechanical or electrical failures may cause a CONTROL ROD to become inoperable or to become misaligned from its group. CONTROL ROD inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown. Therefore, CONTROL ROD alignment and OPERABILITY are related to core operation within design power peaking limits and the core design requirement of a minimum SDM.
Limits on CONTROL ROD alignment and OPERABILITY have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
CONTROL RODS are moved by their CONTROL ROD drive mechanisms (CRDMs). Each CRDM moves its rod 3/4 inch for one revolution of the leadscrew, but at varying rates depending on the signal output from the Control Rod Drive Control System (CRDCS).
The CONTROL RODS are arranged into rod groups that are radially symmetric. Therefore, movement of the CONTROL RODS does not introduce radial asymmetries in the core power distribution. The safety rods and the regulating rods provide required reactivity worth for immediate reactor shutdown upon a reactor trip. The regulating rods provide reactivity (power level) control during normal operation and transients, and their movement is normally governed by the automatic control system.
Babcock & Wilcox STS                  B 3.1.4-1                                          Rev. 5.0

CONTROL ROD Group Alignment Limits B 3.1.4 BASES BACKGROUND (continued)
The axial position of safety rods and regulating rods is indicated by two separate and independent systems, which are the relative position indicator transducers and the absolute position indicator transducers (see LCO 3.1.7, "Position Indicator Channels").
The relative position indicator transducer is a potentiometer that is driven by electrical pulses from the CRDCS. There is one counter for each CONTROL ROD drive. Individual rods in a group all receive the same signal to move; therefore, the counters for all rods in a group should indicate the same position. The Relative Position Indicator System is considered highly precise (one rotation of the leadscrew is 3/4 inch in rod motion). If a rod does not move for each demand pulse, the counter will still count the pulse and incorrectly reflect the position of the rod.
The Absolute Position Indicator System provides a highly accurate indication of actual CONTROL ROD position, but at a lower precision than relative position indicators. This system is based on inductive analog signals from a series of reed switches spaced along a tube with a center to center distance of 3.75 inches.
APPLICABLE         CONTROL ROD misalignment and inoperability accidents are analyzed in SAFETY             the safety analysis (Ref. 3). The acceptance criteria for addressing ANALYSES           CONTROL ROD inoperability or misalignment are that:
: a. There shall be no violations of:
: 1. Specified acceptable fuel design limits or
: 2. Reactor Coolant System (RCS) pressure boundary damage and
: b. The core must remain subcritical after accident transients.
Three types of misalignment are distinguished. During movement of a CONTROL ROD group, one rod may stop moving, while the other rods in the group continue. This condition may cause excessive power peaking.
The second type of misalignment occurs if one rod fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition requires an evaluation to determine that sufficient reactivity worth is held in the CONTROL RODS to meet the SDM requirement with the maximum worth rod stuck fully withdrawn. If a CONTROL ROD is stuck in the fully withdrawn position, its worth is accounted for in the calculation of SDM, since the safety analysis does not take two stuck rods into account. The third type of misalignment occurs when one rod drops partially or fully into the reactor core. This event causes an initial power reduction followed by a return towards the original power due to positive reactivity feedback Babcock & Wilcox STS                   B 3.1.4-2                                          Rev. 5.0

CONTROL ROD Group Alignment Limits B 3.1.4 BASES APPLICABLE SAFETY ANALYSES (continued) from the negative moderator temperature coefficient. Increased peaking during the power increase may result in excessive local linear heat rates (LHRs).
The accident analysis and reload safety evaluations define regulating rod insertion limits that ensure the required SDM can always be achieved if the maximum worth CONTROL ROD is stuck fully withdrawn (Ref. 4). If a CONTROL ROD is stuck in or dropped in, continued operation is permitted if the increase in local LHR is within the design limits. The Required Action statements in the LCOs provide conservative reductions in THERMAL POWER and verification of SDM to ensure continued operation remains within the bounds of the safety analysis (Ref. 5).
Continued operation of the reactor with a misaligned or dropped CONTROL ROD is allowed if the FQ(Z) and the FN H are verified to be within their limits in the COLR. When a CONTROL ROD is misaligned, the assumptions that are used to determine the regulating rod insertion limits, APSR insertion limits, AXIAL POWER IMBALANCE limits, and QPT limits are not preserved. Therefore, the limits may not preserve the design peaking factors, and FQ(Z) and FN H must be verified directly by incore mapping. Bases Section 3.2, Power Distribution Limits, contains a more complete discussion of the relation of FQ(Z) and FN H to the operating limits.
The CONTROL ROD group alignment limits and OPERABILITY requirements satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The limits on CONTROL ROD group alignment, safety rod insertion, and APSR alignment, together with the limits on regulating rod insertion, APSR insertion, AXIAL POWER IMBALANCE, and QPT, ensure the reactor will operate within the fuel design criteria. The Required Actions in these LCOs ensure that deviations from the alignment limits will either be corrected or that THERMAL POWER will be adjusted, so that excessive local LHRs will not occur and the requirements on SDM and ejected rod worth are preserved.
The requirements on rod OPERABILITY ensure that upon reactor trip, the assumed reactivity will be available and will be inserted. The rod OPERABILITY requirements (i.e., trippability) are separate from the alignment requirements. The rod OPERABILITY requirement is satisfied provided the rod will fully insert in the required rod drop time assumed in the safety analysis. Rod control malfunctions that result in the inability to move a rod (e.g., rod lift coil failures), but that do not impact trippability, do not result in rod inoperability.
Babcock & Wilcox STS                    B 3.1.4-3                                          Rev. 5.0

CONTROL ROD Group Alignment Limits B 3.1.4 BASES LCO (continued)
The limit for individual CONTROL ROD misalignment is [6.5]% (9 inches) deviation from the group average position. This value is established, based on the distance between reed switches, with additional allowances for uncertainty in the absolute position indicator amplifiers, group maximum or minimum synthesizer, and asymmetric alarm or fault detector outputs. The position of an inoperable rod is not included in the calculation of the rod group average position.
Failure to meet the requirements of this LCO may produce unacceptable power peaking factors and LHRs, or unacceptable SDM or ejected rod worth, all of which may constitute initial conditions inconsistent with the safety analysis.
APPLICABILITY      The requirements on CONTROL ROD OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated, and the OPERABILITY (i.e., trippability) and alignment of rods have the potential to affect the safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the CONTROL RODS are typically bottomed, and the reactor is shut down and not producing fission power. In the shutdown MODES, the OPERABILITY of the safety and regulating rods has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the RCS. See LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," for SDM in MODES 3, 4, and 5, and LCO 3.9.1, "Boron Concentration," for boron concentration requirements during refueling.
ACTIONS            A.1 Alignment of the misaligned CONTROL ROD may be accomplished by either moving the single CONTROL ROD to the group average position, or by moving the remainder of the group to the position of the single misaligned CONTROL ROD. Either action can be used to restore the CONTROL RODS to a radially symmetric pattern. However, this must be done without violating the CONTROL ROD group sequence, overlap, and insertion limits of LCO 3.2.1, "Regulating Rod Insertion Limits," given in the COLR. THERMAL POWER must also be restricted, as necessary, to the value allowed by the insertion limits of LCO 3.2.1. The required Completion Time of 1 hour is acceptable because local xenon redistribution during this short interval will not cause a significant increase in LHR. This option is not available if a safety rod is misaligned, since the limits of LCO 3.1.5, "Safety Rod Insertion Limits," would be violated.
Babcock & Wilcox STS                     B 3.1.4-4                                         Rev. 5.0

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS (continued)
A.2.1.1 Compliance with Required Actions A.2.1.1 through A.2.5 allows for continued power operation with one CONTROL ROD misaligned from its group average position. These Required Actions comprise the final alternate for Condition A.
Since the rod may be inserted farther than the group average insertion for a long time, SDM must be evaluated. Ensuring the SDM meets the minimum requirement within 1 hour is adequate to determine that further degradation of the SDM is not occurring.
A.2.1.2 Restoration of the required SDM requires increasing the RCS boron concentration, since the CONTROL ROD may remain misaligned and not be providing its normal negative reactivity on tripping. RCS boration must occur as described in Bases Section 3.1.1. The required Completion Time of 1 hour to initiate boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to complete the action. This allows the operator sufficient time for aligning the required valves and starting the boric acid pumps. Boration will continue until the required SDM is restored.
A.2.2 Reduction of THERMAL POWER to  60% ALLOWABLE THERMAL POWER ensures that local LHR increases, due to a misaligned rod, will not cause the core design criteria to be exceeded. The required Completion Time of 2 hours allows the operator sufficient time for reducing THERMAL POWER.
A.2.3 Reduction of the nuclear overpower trip setpoint to  70% ALLOWABLE THERMAL POWER, after THERMAL POWER has been reduced to 60%
ALLOWABLE THERMAL POWER, maintains both core protection and an operating margin at reduced power similar to that at RTP. The required Completion Time of 10 hours allows the operator 8 additional hours after completion of the THERMAL POWER reduction in Required Action A.2.2 to adjust the trip setpoint.
Babcock & Wilcox STS                   B 3.1.4-5                                         Rev. 5.0

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS (continued)
A.2.4 The existing CONTROL ROD configuration must not cause an ejected rod to exceed the limit of 0.65% k/k at RTP or 1.00% k/k at zero power (Ref. 6). This evaluation may require a computer calculation of the maximum ejected rod worth based on nonstandard configurations of the CONTROL ROD groups. The evaluation must determine the ejected rod worth for the remainder of the fuel cycle to ensure a valid evaluation, should fuel cycle conditions at some later time become more bounding than those at the time of the rod misalignment. The required Completion Time of 72 hours is acceptable because LHRs are limited by the THERMAL POWER reduction and sufficient time is provided to perform the required evaluation.
A.2.5 Performance of SR 3.2.5.1 provides a determination of the power peaking factors using the Incore Detector System. Verification of the FQ(Z) and FN H from an incore power distribution map is necessary to ensure that excessive local LHRs will not occur due to CONTROL ROD misalignment. This is necessary because the assumption that all CONTROL RODS are aligned (used to determine the regulating rod insertion, AXIAL POWER IMBALANCE, and QPT limits) is not valid when the CONTROL RODS are not aligned. The required Completion Time of 72 hours is acceptable because LHRs are limited by the THERMAL POWER reduction and adequate time is allowed to obtain an incore power distribution map.
Required Action A.2.5 is modified by a Note that requires the performance of SR 3.2.5.1 only when THERMAL POWER is greater than 20% RTP. This establishes a Required Action that is consistent with the Applicability of LCO 3.2.5, "Power Peaking Factors."
B.1 If the Required Actions and associated Completion Times for Condition A cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
Babcock & Wilcox STS                  B 3.1.4-6                                        Rev. 5.0

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS (continued)
C.1.1 More than one CONTROL ROD becoming misaligned, is not expected and may violate the minimum SDM requirement. Therefore, SDM must be evaluated. Ensuring the SDM meets the minimum requirement within 1 hour allows the operator adequate time to determine the SDM.
C.1.2 Restoration of the required SDM requires increasing the RCS boron concentration to provide negative reactivity. RCS boration must occur as described in Bases Section 3.1.1. The required Completion Time of 1 hour for initiating boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to complete the action. This allows the operator sufficient time for aligning the required valves and starting the boric acid pumps. Boration will continue until the required SDM is restored.
C.2 If more than one CONTROL ROD is misaligned, continued operation of the reactor may cause the misalignment to increase, as the regulating rods insert or withdraw to control reactivity. If the CONTROL ROD misalignment increases, local power peaking may also increase, and local LHRs will also increase if the reactor continues operation at THERMAL POWER. The SDM is decreased when one or more CONTROL RODS become misaligned by insertion from the group average position.
Therefore, it is prudent to place the reactor in MODE 3. LCO 3.1.4 does not apply in MODE 3 since excessive power peaking cannot occur and the minimum required SDM is ensured. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
Babcock & Wilcox STS                   B 3.1.4-7                                        Rev. 5.0

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS (continued)
D.1.1 and D.1.2 When one or more rods are inoperable, the SDM may be adversely affected. Under these conditions, it is important to determine the SDM and, if it is less than the required value, initiate boration until the required SDM is recovered. The Completion Time of 1 hour is adequate for determining SDM and, if necessary, for initiating emergency boration to restore SDM.
In this situation, SDM verification must include the worth of the inoperable rod(s) as well as a rod of maximum worth.
D.2 If the inoperable rod(s) cannot be restored to OPERABLE status, the plant must be brought to a MODE or condition in which the LCO requirements are not applicable. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours.
The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.1.4.1 REQUIREMENTS Verification that individual rods are aligned within [6.5]% of their group average height limits allows the operator to detect a rod that is beginning to deviate from its expected position. [ The 12 hour specified Frequency takes into account other rod position information that is continuously available to the operator in the control room, so that during actual rod motion, deviations can immediately be detected.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.1.4-8                                                       Rev. 5.0

CONTROL ROD Group Alignment Limits B 3.1.4 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.1.4.2 Verifying each CONTROL ROD is OPERABLE would require that each rod be tripped. However, in MODES 1 and 2, tripping each CONTROL ROD could result in radial tilts. Exercising each individual CONTROL ROD provides increased confidence that all rods continue to be OPERABLE without exceeding the alignment limit, even if they are not regularly tripped. Moving each CONTROL ROD by 3% will not cause radial or axial power tilts, or oscillations, to occur. [ The 92 day Frequency takes into consideration other information available to the operator in the control room and SR 3.1.4.1, which is performed more frequently and adds to the determination of OPERABILITY of the rods.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Between required performances of SR 3.1.4.2 (determination of CONTROL ROD OPERABILITY by movement), if a CONTROL ROD(S) is discovered to be immovable, but is determined to be trippable, the CONTROL ROD(S) is considered to be OPERABLE. At any time, if a CONTROL ROD(S) is immovable, a determination of the trippability (OPERABILITY) of the CONTROL ROD(S) must be made, and appropriate action taken.
SR 3.1.4.3 Verification of rod drop time allows the operator to determine that the maximum rod drop time permitted is consistent with the assumed rod drop time used in the safety analysis. The rod drop time given in the safety analysis is 1.4 seconds to b insertion. Using the identical rod drop curve gives a value of [1.66] seconds to 3/4 insertion. The latter value is used in the Surveillance because the zone reference lights are located at 25% insertion intervals. The zone reference lights will activate at 3/4 Babcock & Wilcox STS                      B 3.1.4-9                                                       Rev. 5.0

CONTROL ROD Group Alignment Limits B 3.1.4 BASES SURVEILLANCE REQUIREMENTS (continued) insertion to give an indication of the rod drop time and rod location.
Measuring rod drop times, prior to reactor criticality after reactor vessel head removal and after CONTROL ROD drive system maintenance or modification, ensures that the reactor internals and CRDM will not interfere with CONTROL ROD motion or rod drop time. This Surveillance is performed during a plant outage, due to the plant conditions needed to perform the SR and the potential for an unplanned plant transient if the Surveillance were performed with the reactor at power.
This testing is normally performed with all reactor coolant pumps operating and average moderator temperature  525&deg;F to simulate a reactor trip under actual conditions. However, if the rod drop times are determined with less than four reactor coolant pumps operating, a Note allows power operation to continue, provided operation is restricted to the pump combination utilized during the rod drop time determination.
REFERENCES         1. 10 CFR 50, Appendix A, GDC 10 and GDC 26.
: 2. 10 CFR 50.46.
: 3. FSAR, Chapter [14].
: 4. FSAR, Section [ ] .
: 5. FSAR, Section [ ] .
: 6. FSAR, Section [ ] .
Babcock & Wilcox STS                 B 3.1.4-10                                          Rev. 5.0

Safety Rod Insertion Limit B 3.1.5 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.5 Safety Rod Insertion Limit BASES BACKGROUND           The insertion limits of the safety and regulating rods are initial condition assumptions in all safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power distributions and assumptions of available SDM, ejected rod worth, and initial reactivity insertion rate.
The applicable criteria for the reactivity and power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design,"
GDC 26, "Reactivity Control System Redundancy-and Capability," GDC 28, "Reactivity Limits" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" (Ref. 2).
Limits on safety rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the reactivity limits, ejected rod worth, and SDM limits are preserved.
The regulating groups are used for precise reactivity control of the reactor. The positions of the regulating groups are normally automatically controlled by the automatic control system, but they can also be manually controlled. They are capable of adding negative reactivity very quickly (compared to borating). The regulating groups must be maintained above designed insertion limits and are typically near the fully withdrawn position during normal operations. Hence, they are not capable of adding a large amount of positive reactivity. Boration or dilution of the Reactor Coolant System (RCS) compensates for the reactivity changes associated with large changes in RCS temperature and fuel burnup.
The safety groups can be fully withdrawn without the core going critical.
This provides available negative reactivity in the event of boration errors.
The safety groups are controlled manually by the control room operator.
During normal full power operation, the safety groups are fully withdrawn.
The safety groups must be completely withdrawn from the core prior to withdrawing any regulating groups during an approach to criticality. The safety groups remain in the fully withdrawn position until the reactor is shut down. They add negative reactivity to shut down the reactor upon receipt of a reactor trip signal.
Babcock & Wilcox STS                      B 3.1.5-1                                        Rev. 5.0

Safety Rod Insertion Limit B 3.1.5 BASES APPLICABLE         On a reactor trip, all rods (safety groups and regulating groups), except SAFETY             the most reactive rod, are assumed to insert into the core. The safety ANALYSES           groups shall be at their fully withdrawn limits and available to insert the maximum amount of negative reactivity on a reactor trip signal. The regulating groups may be partially inserted in the core as allowed by LCO 3.2.1, "Regulating Rod Insertion Limits." The safety group and regulating rod insertion limits are established to ensure that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM (see LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") following a reactor trip from full power. The combination of regulating groups and safety groups (less the most reactive rod, which is assumed to be fully withdrawn) is sufficient to take the reactor from full power conditions at rated temperature to zero power and to maintain the required SDM at rated no load temperature (Ref. 3). The safety group insertion limit also limits the reactivity worth of an ejected safety rod.
The acceptance criteria for addressing safety and regulating rod group insertion limits and inoperability or misalignment are that:
: a. There shall be no violations of:
: 1. Specified acceptable fuel design limits or
: 2. RCS pressure boundary integrity and
: b. The core must remain subcritical after accident transients.
The safety rod insertion limits satisfy Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The safety groups must be fully withdrawn any time the reactor is critical or approaching criticality. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip.
This LCO has been modified by a Note indicating the LCO requirement is suspended for those safety rods which are inserted solely due to testing in accordance with SR 3.1.4.2. This SR verifies the freedom of the rods to move, and requires the safety group to move below the LCO limits, which would normally violate the LCO.
APPLICABILITY      The safety groups must be within their insertion limits with the reactor in MODES 1 and 2. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip. Refer to LCO 3.1.1 for SDM requirements in MODES 3, 4, and 5. LCO 3.9.1, "Boron Concentration," ensures adequate SDM in MODE 6.
Babcock & Wilcox STS                   B 3.1.5-2                                           Rev. 5.0

Safety Rod Insertion Limit B 3.1.5 BASES ACTIONS            A.1.1, A.1.2, and A.2 The safety rod must be declared inoperable within a 1 hour time frame.
This requires entry into LCO 3.1.4, "CONTROL ROD Group Alignment Limits." In addition, since the safety rod may be inserted farther than the group average insertion for a long time, SDM must be evaluated.
Ensuring the SDM meets the minimum requirement within 1 hour is adequate to determine that further degradation of the SDM is not occurring.
Restoration of the required SDM requires increasing the boron concentration, since the safety rod may remain misaligned and not be providing its normal negative reactivity on tripping. RCS boration must occur as described in Bases Section 3.1.1. The required Completion Time of 1 hour for initiating boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to complete the action. This allows the operator sufficient time for aligning the required valves and starting the boric acid pumps. Boration will continue until the required SDM is restored.
The allowed Completion Time of 1 hour provides an acceptable time for evaluating and repairing minor problems without allowing the plant to remain in an unacceptable condition for an extended period of time.
B.1.1 and B.1.2 When more than one safety rod is inoperable, there is a possibility that the required SDM may be adversely affected. Under these conditions, it is important to determine the SDM, and if it is less than the required value, initiate boration until the required SDM is recovered. The Completion Time of 1 hour is adequate for determining SDM and, if necessary, for initiating emergency boration to restore SDM.
In this situation, SDM verification must include the worth of the untrippable rod as well as the rod of maximum worth.
B.2 If more than one safety rod is inoperable the unit must be brought to a MODE where the LCO is not applicable. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
Babcock & Wilcox STS                   B 3.1.5-3                                         Rev. 5.0

Safety Rod Insertion Limit B 3.1.5 BASES SURVEILLANCE         SR 3.1.5.1 REQUIREMENTS Verification that each safety rod is fully withdrawn ensures the rods are available to provide reactor shutdown capability.
[ Verification that individual safety rod positions are fully withdrawn at a 12 hour Frequency allows the operator to detect a rod beginning to deviate from its expected position. Also, the 12 hour Frequency takes into account other information available in the control room for the purpose of monitoring the status of the safety rods.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
REFERENCES           1. 10 CFR 50, Appendix A, GDC 10 and GDC 26.
: 2. 10 CFR 50.46.
: 3. FSAR, Section [ ] .
Babcock & Wilcox STS                        B 3.1.5-4                                                       Rev. 5.0

APSR Alignment Limits B 3.1.6 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 AXIAL POWER SHAPING ROD (APSR) Alignment Limits BASES BACKGROUND         The OPERABILITY of the APSRs and rod misalignment are initial condition assumptions in the safety analysis that directly affect core power distributions. The applicable criteria for these power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design," and GDC 26, "Reactivity Limits" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" (Ref. 2).
Mechanical or electrical failures may cause an APSR to become inoperable or to become misaligned from its group. APSR inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution. Therefore, APSR alignment and OPERABILITY are related to core operation within design power peaking limits.
Limits on APSR alignment and OPERABILITY have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution limits defined by the design peaking limits are preserved.
CONTROL RODS and APSRs are moved by their CONTROL ROD drive mechanisms (CRDMs). Each CRDM moves its rod 3/4 inch for one revolution of the leadscrew at varying rates depending on the signal output from the Rod Control System.
The APSRs are arranged into rod groups that are radially symmetric.
Therefore, movement of the APSRs does not introduce radial asymmetries in the core power distribution. The APSRs, which control the axial power distribution, are positioned manually and do not trip.
LCO 3.1.6 is conservatively based on use of black (Ag-In-Cd) APSRs and bounds use of gray (Inconel) APSRs. The reactivity worth of black APSRs is greater than that of gray APSRs; thus the impact of black APSR misalignment on the core power distribution is greater.
APPLICABLE         APSR misalignment and inoperability are analyzed in the safety analysis SAFETY             (Ref. 3). The acceptance criteria for addressing APSR inoperability or ANALYSES           misalignment are that there shall be no violations of:
: a. Specified acceptable fuel design limits and
: b. Reactor Coolant System (RCS) pressure boundary integrity.
Babcock & Wilcox STS                  B 3.1.6-1                                        Rev. 5.0

APSR Alignment Limits B 3.1.6 BASES APPLICABLE SAFETY ANALYSES (continued)
Two types of misalignment or inoperability are distinguished. During movement of an APSR group, one rod may stop moving while the other rods in the group continue. This condition may cause excessive power peaking. The second type of misalignment occurs when one rod drops partially or fully into the reactor core. This event causes an initial power reduction, followed by a return towards the original power, due to positive reactivity feedback from the negative moderator temperature coefficient.
Increased peaking during the power increase may result in excessive local linear heat rates (LHRs). The accident analysis and reload safety evaluations define APSR insertion limits that ensure that if an APSR is stuck in or dropped in, the increase in local LHR is within the design limits. The Required Action statement in the LCO provides a conservative approach to ensure that continued operation remains within the bounds of the safety analysis (Ref. 4).
Continued operation of the reactor with a misaligned APSR is allowed if AXIAL POWER IMBALANCE limits are preserved.
The APSR alignment limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The limits on CONTROL ROD group alignment, safety rod insertion, and APSR alignment, together with the limits on regulating rod insertion, APSR insertion, AXIAL POWER IMBALANCE, and QPT, ensure the reactor will operate within the fuel design criteria. The Required Action in this LCO ensures deviations from the alignment limits will be adjusted so that excessive local LHRs will not occur.
The limit for individual APSR misalignment is [6.5]% (9 inches) deviation from the group average position. This value is established based on the distance between reed switches, with additional allowances for uncertainty in the absolute position indicator amplifiers, group maximum or minimum synthesizer, and asymmetric alarm or fault detector outputs.
The position of an inoperable rod is not included in the calculation of the rod group's average position.
Failure to meet the requirements of this LCO may produce unacceptable power peaking factors, and LHRs, which may constitute initial conditions inconsistent with the safety analysis.
APPLICABILITY      The requirements on APSR OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated and the OPERABILITY and alignment of rods have the potential to affect the safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the reactor is shut down and not producing fission power, and excessive local LHRs cannot occur from APSR misalignment.
Babcock & Wilcox STS                    B 3.1.6-2                                         Rev. 5.0

APSR Alignment Limits B 3.1.6 BASES ACTIONS            A.1 The ACTIONS described below are required if one APSR is inoperable.
The plant is not allowed to operate with more than one inoperable APSR.
This would require the reactor to be shut down, in accordance with LCO 3.0.3.
An alternate to realigning a single misaligned APSR to the group average position is to align the remainder of the APSR group to the position of the misaligned or inoperable APSR, while maintaining APSR insertion, in accordance with the limits in the COLR. This restores the alignment requirements. Deviations up to 2 hours will not cause significant xenon redistribution to occur. This alternative assumes the APSR group movement does not cause the limits of LCO 3.2.2, "AXIAL POWER SHAPING ROD (APSR) Insertion Limits," to be exceeded. For this reason, APSR group movement is only practical for instances where small movements of the APSR group are sufficient to re-establish APSR alignment.
The reactor may continue in operation with the APSR misaligned if the limits on AXIAL POWER IMBALANCE are surveilled within 2 hours to determine if the AXIAL POWER IMBALANCE is still within limits. Also, since any additional movement of the APSRs may result in additional imbalance, Required Action A.1 also requires the AXIAL POWER IMBALANCE Surveillance to be performed again within 2 hours after each APSR movement. The required Completion Time of up to 2 hours will not cause significant xenon redistribution to occur.
B.1 The plant must be brought to a MODE in which the LCO does not apply if the Required Actions and associated Completion Times cannot be met.
To achieve this status, the plant must be brought to at least MODE 3 within 6 hours. The Completion Time of 6 hours is reasonable, based on operating experience, for reaching MODE 3 from RTP in an orderly manner and without challenging plant systems. In MODE 3, APSR group alignment limits are not required because the reactor is not generating THERMAL POWER and excessive local LHRs cannot occur from APSR misalignment.
Babcock & Wilcox STS                   B 3.1.6-3                                      Rev. 5.0

APSR Alignment Limits B 3.1.6 BASES SURVEILLANCE       SR 3.1.6.1 REQUIREMENTS Verification [at a 12 hour Frequency] that individual APSR positions are within [6.5]% of the group average height limits allows the operator to detect an APSR beginning to deviate from its expected position. In addition, APSR position is continuously available to the operator in the control room so that during actual rod motion, deviations can immediately be detected.
[ OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 50, Appendix A, GDC 10 and GDC 26.
: 2. 10 CFR 50.46.
: 3. FSAR, Section [ ] .
: 4. FSAR, Section [ ] .
Babcock & Wilcox STS                      B 3.1.6-4                                                       Rev. 5.0

Position Indicator Channels B 3.1.7 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.7 Position Indicator Channels BASES BACKGROUND            According to GDC 13 (Ref. 1), instrumentation to monitor variables and systems over their operating ranges during normal operation, anticipated operational occurrences, and accident conditions must be OPERABLE.
LCO 3.1.7 is required to ensure OPERABILITY of the CONTROL ROD and APSR position indicators, and thereby ensure compliance with the CONTROL ROD and APSR alignment and insertion limits.
The OPERABILITY, including position indication, of the safety and regulating rods is an initial condition assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment for the safety rods, regulating rods, and APSRs is assumed in the safety analysis, which directly affect core power distributions and assumptions of available SDM.
Mechanical or electrical failures may cause a CONTROL ROD or APSR to become misaligned from its group. CONTROL ROD or APSR misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown. Therefore, CONTROL ROD and APSR alignment are related to core operation within design power peaking limits and the core design requirement of a minimum SDM. Rod position indication is needed to assess rod OPERABILITY and alignment.
Limits on CONTROL ROD alignment, APSR alignment, and safety rod position have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
Two methods of CONTROL ROD and APSR position indication are provided in the CONTROL ROD Drive Control System. The two means are by absolute position indicator and relative position indicator transducers. The absolute position indicator transducer consists of a series of magnetically operated reed switches mounted in a tube parallel to the CONTROL ROD drive mechanism (CRDM) motor tube extension.
Switch contacts close when a permanent magnet mounted on the upper end of the CONTROL ROD assembly (CRA) leadscrew extension comes near. As the leadscrew and CRA move, the switches operate sequentially, producing an analog voltage proportional to position. Other reed switches included in the same tube with the position indicator matrix provide full in and full out limit indications, and absolute position indications at 0%, 25%, 50%, 75%, and 100% travel (called zone Babcock & Wilcox STS                     B 3.1.7-1                                            Rev. 5.0

Position Indicator Channels B 3.1.7 BASES BACKGROUND (continued) reference indicators). The relative position indicator transducer is a potentiometer, driven by a step motor that produces a signal proportional to CONTROL ROD position, based on the electrical pulse steps that drive the CRDM.
Two absolute position indicator channel designs may be used in the unit:
type A absolute position indicators and type A-R4C absolute position indicators. The type A absolute position indicator transducer is a voltage divider circuit made up of 48 resistors of equal value connected in series.
One end of 48 reed switches is connected at a junction between each of the resistors, so that as the magnet mounted on the leadscrew moves, either one or two reed switches are closed in the vicinity of the magnet.
The type A-R4C (redundant four channel) absolute position indicator transducer has two parallel sets of voltage divider circuits made up of 36 resistors each, connected in series (channels A and B). One end of 36 reed switches is connected at a junction between each of the resistors of the two parallel circuits. The reed switches making up each circuit are offset, such that the switches for channel A are staggered with the switches for channel B. The type A-R4C is designed such that either two or three reed switches are closed in the vicinity of the magnet. By its design, the type A-R4C absolute position indicator provides redundancy, with the two three sequence of pickup and drop out of reed switches to enable a continuity of position signal when a single reed switch fails to close.
CONTROL ROD position indicating readout devices located in the control room consist of single CRA position meters on a wall mounted position indication panel and four group average position meters on the console.
A selector switch permits either relative or absolute position indication to be displayed on all of the single rod meters. Indicator lights are provided on the single CRA meter panel to indicate when each CRA is fully withdrawn, fully inserted, enabled, or transferred, and whether a CRA position asymmetry alarm condition is present. Indicators on the console show full insertion, full withdrawal, and enabled for motion for each CONTROL ROD group. Identical instrumentation and devices exist for the APSR group. The consequence of continued operation with an inoperable absolute position indicator or relative position indicator channel is a decreased reliability in determining CONTROL ROD position.
Therefore, the potential for operation in violation of design peaking factors or SDM is increased.
Babcock & Wilcox STS                  B 3.1.7-2                                          Rev. 5.0

Position Indicator Channels B 3.1.7 BASES APPLICABLE         CONTROL ROD and APSR position accuracy is essential during power SAFETY             operation. Power peaking, ejected rod worth, or SDM limits may be ANALYSES           violated in the event of a Design Basis Accident (Ref. 2) with CONTROL RODS or APSRs operating outside their limits undetected. Regulating rod, safety rod, and APSR positions must be known in order to verify the core is operating within the group sequence, overlap, design peaking limits, ejected rod worth, and with minimum SDM (LCO 3.1.5, "Safety Rod Insertion Limits," LCO 3.2.1, "Regulating Rod Insertion Limits," and LCO 3.2.2, "AXIAL POWER SHAPING ROD (APSR) Insertion Limits").
The rod positions must also be known in order to verify the alignment limits are preserved (LCO 3.1.4, "CONTROL ROD Group Alignment Limits," and LCO 3.1.6, "AXIAL POWER SHAPING ROD (APSR)
Alignment Limits"). CONTROL ROD and APSR positions are continuously monitored to provide operators with information that ensures the plant is operating within the bounds of the accident analysis assumptions. The CONTROL ROD position indicator channels satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). The CONTROL ROD position indicators monitor CONTROL ROD position, which is an accident initial condition.
LCO                LCO 3.1.7 specifies that one absolute position indicator channel and one relative position indicator channel be OPERABLE for each CONTROL ROD and APSR.
The agreement between the relative position indicator channel and the absolute position indicator channel, within the limit given in the COLR, indicates that relative position indicators are adequately calibrated and can be used for indication of the measurement of CONTROL ROD group position. A deviation of less than the allowable limit, given in the COLR, in position indication for a single CONTROL ROD or APSR, ensures confidence that the position uncertainty of the corresponding CONTROL ROD group or APSR group is within the assumed values used in the analysis that specifies CONTROL ROD group and APSR insertion limits.
These requirements ensure that CONTROL ROD position indication during power operation and PHYSICS TESTS is accurate, and that design assumptions are not challenged. OPERABILITY of the position indicator channels ensures that inoperable, misaligned, or mispositioned CONTROL RODS or APSRs can be detected. Therefore, power peaking and SDM can be controlled within acceptable limits.
APPLICABILITY      In MODES 1 and 2, OPERABILITY of position indicator channels is required, since the reactor is, or is capable of, generating THERMAL POWER in these MODES. In MODES 3, 4, 5, and 6, Applicability is not required because the reactor is shut down with the required minimum SDM and is not generating THERMAL POWER.
Babcock & Wilcox STS                   B 3.1.7-3                                         Rev. 5.0

Position Indicator Channels B 3.1.7 BASES ACTIONS            A.1 If the relative position indicator channel is inoperable for one or more rods, the position of the rod(s) is still monitored by the absolute position indicator channel for each affected rod. The absolute position indicator channel may be used if it is determined to be OPERABLE. The required Completion Time of 8 hours is reasonable to provide adequate time for the operator to determine position indicator channel status. Continuing the verification every 8 hours thereafter in the applicable condition is acceptable, based on the fact that during normal power operation excessive movement of the groups is not required. Also, if the rod is out of position during this 8 hour period, the simultaneous occurrence of an event sensitive to the rod position has a small probability.
B.1.1 If the absolute position indicator channel is inoperable for one or more rods, the position of the rod(s) is monitored by the relative position indicator channel for each affected rod. However, the relative position indicator channel is not as reliable a method of monitoring rod position as the absolute position indicator because it counts electrical pulse steps driving the CRDM motor rather than actuating a switch located at a known elevation. Therefore, the affected rod's position can be determined with more certainty by actuating one of its zone reference indicator switches located at discrete elevations. The required Completion Time of 8 hours provides the operator adequate time for adjusting the affected rod's position to an appropriate zone reference indicator location. If the rod is out of position during this 8 hour period, the simultaneous occurrence of an event sensitive to the rod position has a small probability.
B.1.2 To allow continued operation, the rods with inoperable absolute position indicator channels are maintained at the zone reference indicator position. In addition, the affected rods are maintained within the limits of LCO 3.1.5 (when the affected rod is a safety rod), LCO 3.2.1 (when the affected rod is a regulating rod), or LCO 3.2.2 (when the affected rod is an APSR). This Required Action ensures safety rods remain fully withdrawn, and that regulating rods and APSRs remain aligned within their insertion limits. The required Completion Time of 8 hours is reasonable for allowing the operator adequate time to determine the affected rods are in compliance with these LCOs. Continuing to verify the rod positions every 8 hours thereafter is reasonable for ensuring that rod alignment and insertion are not changing, and provides the operator adequate time to correct any deviation that may occur. Continuing the Babcock & Wilcox STS                   B 3.1.7-4                                          Rev. 5.0

Position Indicator Channels B 3.1.7 BASES ACTIONS (continued) verification every 8 hours thereafter in the applicable condition is acceptable, based on the fact that during normal power operation excessive movement of the groups is not required. Also, if the rod is out of position during this 8 hour period, the simultaneous occurrence of an event sensitive to the rod position has a small probability.
B.2.1 If the absolute position indicator is inoperable for one or more rods, the position of the rod is monitored by the relative position indicator channel for each affected rod. However, the relative position indicator channel is not as reliable a method of monitoring rod position as the absolute position indicator because it counts electrical pulse steps. The fixed incore system can be used to indirectly determine the absolute position of the affected rod. The fixed incore instrumentation can provide a continual update of CONTROL ROD position, therefore this method can be used to allow continued operation of the reactor with a manual CONTROL ROD movement, while maintaining verification of CONTROL ROD insertion and alignment. Required Action B.2.1. restricts rod motion by placing the groups with nonindicating rods in manual control; thus, even if the rod fails to move in alignment with the group, misalignment is limited. The required Completion Time of 8 hours provides the operator adequate time for placing the rods in manual control, and is consistent with the required Completion Time for Required Action B.1.1. If the rod is out of position during this 8 hour period, the simultaneous occurrence of an event sensitive to the rod position has a small probability.
B.2.2 Continuing to verify the rod positions every 8 hours is reasonable for ensuring that rod alignment and insertion are not changing, and provides the operator adequate time to correct any deviation that may occur. The additional Completion Time of 1 hour after motion of nonindicating rods, which exceeds 15 inches in one direction since the last determination of the rod's position, ensures that the rod with inoperable position indication will not be misaligned for a significant period of time, in the event the rod is moved. The specified Completion Times are acceptable because the simultaneous occurrence of a mispositioned rod and an event sensitive to the rod position has a small probability.
Babcock & Wilcox STS                  B 3.1.7-5                                          Rev. 5.0

Position Indicator Channels B 3.1.7 BASES ACTIONS (continued)
C.1 If both the absolute position indicator channel and relative position indicator channel are inoperable for one or more rods, or if the Required Actions and associated Completion Times are not met, the position of the rod(s) is not known with certainty. Therefore, each affected rod must be declared inoperable, and the limits of LCO 3.1.4 or LCO 3.1.6 apply. The required Completion Time for declaring the rod(s) inoperable is immediately. Therefore LCO 3.1.4 or LCO 3.1.6 is entered immediately, and the required Completion Times for the appropriate Required Actions in those LCOs apply without delay.
SURVEILLANCE       SR 3.1.7.1 REQUIREMENTS Verification is required that the Absolute Position Indicator channels and Relative Position Indicator channels agree within the limit given in the COLR. This verification ensures that the Relative Position Indicator channels, which are regarded as the potentially less reliable means of position indication, remain OPERABLE and accurate. [ The required Frequency of 12 hours is adequate for verifying that no degradation in system OPERABILITY has occurred.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 50, Appendix A, GDC 13.
: 2. FSAR, Section [14.1.2.2], Section [14.1.2.3], Section [14.1.2.6],
Section [14.1.2.7], Section [14.2.2.4], and Section [14.2.2.5].
Babcock & Wilcox STS                      B 3.1.7-6                                                       Rev. 5.0

PHYSICS TESTS Exceptions - MODE 1 B 3.1.8 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.8 PHYSICS TESTS Exceptions Systems - MODE 1 BASES BACKGROUND         The purpose of this MODE 1 LCO is to permit PHYSICS TESTS to be conducted by providing exemptions from the requirements of other LCOs.
Establishment of a test program to verify that structures, systems, and components will perform satisfactorily in service is required by Section XI of 10 CFR 50, Appendix B (Ref. 1). Testing is required as an integral part of the design, fabrication, construction, and operation of the power plant.
All functions necessary to ensure that specified design conditions are not violated during normal operation and anticipated operational occurrences must be tested. Requirements for notification of the NRC, for the purpose of conducting tests and experiments, are specified in 10 CFR 50.59 (Ref. 2).
The key objectives of a test program are to (Ref. 3):
: a. Ensure that the facility has been adequately designed,
: b. Validate the analytical models used in the design and analysis,
: c. Verify the assumptions used to predict unit response,
: d. Ensure that installation of equipment in the facility has been accomplished in accordance with the design, and
: e. Verify that the operating and emergency procedures are adequate.
To accomplish these objectives, testing is performed prior to initial criticality; during startup, low power operations, and power ascension; at high powers; and after each fueling. The PHYSICS TESTS requirements for reload fuel cycles ensure that the operating characteristics of the core are consistent with the design predictions, and that the core can be operated as designed (Ref. 4).
PHYSICS TESTS procedures are written and approved in accordance with established guidelines. The procedures include all information necessary to permit a detailed execution of testing required to ensure the design intent is met. PHYSICS TESTS are performed in accordance with these procedures, and test results are approved prior to continued power escalation and long term power operation. Examples of PHYSICS TESTS include determination of critical boron concentration, CONTROL ROD group worths, reactivity coefficients, flux symmetry, and core power distribution.
Babcock & Wilcox STS                    B 3.1.8-1                                       Rev. 5.0

PHYSICS TESTS Exceptions - MODE 1 B 3.1.8 BASES APPLICABLE         It is acceptable to suspend certain LCOs for PHYSICS TESTS because SAFETY             reactor protection criteria are preserved by the LCOs still in effect and by ANALYSES           the SRs. Even if an accident occurs during PHYSICS TESTS with one or more LCOs suspended, fuel damage criteria are preserved because the limits on nuclear hot channel factors, ejected rod worth, and shutdown capability are maintained during the PHYSICS TESTS.
Reference 5 defines requirements for initial testing of the facility, including PHYSICS TESTS. Tables 13-3 and 13-4 (Ref. 6) summarize the zero, low power, and power tests. Requirements for reload fuel cycle PHYSICS TESTS are given in Table 1 ANSI/ANS-19.6.1-1985 (Ref. 4).
Although these PHYSICS TESTS are generally accomplished within the limits of all LCOs, one or more LCOs must sometimes be suspended to make completion of PHYSICS TESTS possible or practical.
This is acceptable as long as the fuel design criteria are not violated.
When one or more of the limits specified in:
LCO 3.1.4,      "CONTROL ROD Group Alignment Limits,"
LCO 3.1.5,      "Safety Rod Insertion Limits,"
LCO 3.1.6,      "AXIAL POWER SHAPING ROD (APSR) Alignment Limits,"
LCO 3.2.1,      "Regulating Rod Insertion Limits," for the restricted operation region only, LCO 3.2.3,      "AXIAL POWER IMBALANCE Operating Limits," or LCO 3.2.4,      "QUADRANT POWER TILT (QPT)"
are suspended for PHYSICS TESTS, the fuel design criteria are preserved by maintaining the nuclear hot channel factors (in MODE 1 PHYSICS TESTS) within their limits, maintaining ejected rod worth within limits by restricting regulating rod insertion to within the acceptable operating region or the restricted operating region, by limiting maximum THERMAL POWER and by maintaining SDM within the limits specified in the COLR. Therefore, surveillance of the FQ(Z), the FN H , and SDM is required to verify that their limits are not exceeded. The limits for the nuclear hot channel factors are specified in the COLR. Refer to the Bases for LCO 3.2.5 for a complete discussion of FQ(Z) and FN H . During PHYSICS TESTS, one or more of the LCOs that normally preserve the FQ(Z) and FN H limits may be suspended. However, the results of the safety analysis are not adversely impacted if verification that FQ(Z) and FN H are within their limits is obtained, while one or more of the LCOs is suspended. Therefore, SRs are placed on FQ(Z) and FN H during MODE 1 PHYSICS TESTS when THERMAL POWER exceeds 20% RTP to verify that these factors remain within their limits. Periodic verification of these factors allows PHYSICS TESTS to be conducted while continuing to maintain the design criteria.
Babcock & Wilcox STS                   B 3.1.8-2                                          Rev. 5.0

PHYSICS TESTS Exceptions - MODE 1 B 3.1.8 BASES APPLICABLE SAFETY ANALYSES (continued)
PHYSICS TESTS include measurement of core nuclear parameters or exercise of control components that affect process variables. Among the process variables involved are AXIAL POWER IMBALANCE and QPT, which represent initial condition input (power peaking) for the accident analysis. Also involved are the movable control components, i.e., the regulating rods and the APSRs, which affect power peaking and are required for shutdown of the reactor. The limits for these variables are specified for each fuel cycle in the COLR.
As described in LCO 3.0.7, compliance with Test Exceptions LCOs is optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test Exceptions LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.
LCO                This LCO permits individual CONTROL RODS to be positioned outside of their specified group alignment and withdrawal limits and to be assigned to other than specified CONTROL ROD groups, and permits AXIAL POWER IMBALANCE and QPT limits to be exceeded during the performance of PHYSICS TESTS. In addition, this LCO permits verification of the fundamental core characteristics and nuclear instrumentation operation.
The requirements of LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, LCO 3.2.1 (for the restricted operation region only), LCO 3.2.3, and LCO 3.2.4 may be suspended during the performance of PHYSICS TESTS provided:
: a. THERMAL POWER is maintained  85% RTP,
: b. Nuclear overpower trip setpoint is  10% RTP higher than the THERMAL POWER at which the test is performed, with a maximum setting of 90% RTP,
: c. FQ(Z) and FN H are maintained within limits specified in the COLR while operating at greater than 20% RTP, and
: d. SDM is maintained within the limits specified in the COLR.
Operation with THERMAL POWER  85% RTP during PHYSICS TESTS provides an acceptable thermal margin when one or more of the applicable LCOs is out of specification. Eighty-five percent RTP is consistent with the maximum power level for conducting the intermediate core power distribution test specified in Reference 4. The nuclear overpower trip setpoint is reduced so that a similar margin exists between the steady state condition and trip setpoint as exists during normal operation at RTP.
Babcock & Wilcox STS                    B 3.1.8-3                                        Rev. 5.0

PHYSICS TESTS Exceptions - MODE 1 B 3.1.8 BASES LCO (continued)
LCO provision c is modified by a Note that requires the adherence to power peaking factor requirements only when THERMAL POWER is greater than 20% RTP. This establishes an LCO provision that is consistent with the Applicability of LCO 3.2.5, "Power Peaking Factors."
APPLICABILITY      This LCO is applicable in MODE 1, when the reactor has completed low power testing and is in power ascension, or during power operation with THERMAL POWER > 5% RTP but  85% RTP. This LCO is applicable for power ascension testing, as defined by Regulatory Guide 1.68 (Ref. 3). In MODE 2, Applicability of this LCO is not required because LCO 3.1.9, "PHYSICS TESTS Exceptions - MODE 2," addresses PHYSICS TESTS exceptions in MODE 2. In MODES 3, 4, 5, and 6, Applicability is not required because PHYSICS TESTS are not performed in these MODES.
ACTIONS            A.1 and A.2 If the SDM requirements are not met, boration must be initiated promptly.
A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. The operator should begin boration with the best source available for the plant conditions. Boration will be continued until SDM is within limit. In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied.
Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification.
B.1 If THERMAL POWER exceeds 85% RTP, then 1 hour is allowed for the operator to reduce THERMAL POWER to within limits or to complete an orderly suspension of PHYSICS TESTS exceptions. Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable individual LCOs to within specification. This required Completion Time is consistent with, or more conservative than, those specified for the individual LCO, addressed by PHYSICS TESTS exceptions.
If the nuclear overpower trip setpoint is not within the specified limits, then 1 hour is allowed for the operator to restore the nuclear overpower trip setpoint within limits or to complete an orderly suspension of PHYSICS TESTS exceptions. Suspension of PHYSICS TESTS exceptions requires Babcock & Wilcox STS                  B 3.1.8-4                                          Rev. 5.0

PHYSICS TESTS Exceptions - MODE 1 B 3.1.8 BASES ACTIONS (continued) restoration of each of the applicable individual LCOs to within specification. This required Completion Time is consistent with, or more conservative than, those specified for the individual LCO, addressed by these PHYSICS TESTS exceptions.
If the results of the incore flux map indicate that either FQ(Z) or FN H has exceeded its limit when THERMAL POWER is greater than 20% RTP, then PHYSICS TESTS are suspended. This action is required because of direct indication that the core peaking factors, which are fundamental initial conditions for the safety analysis, are excessive. Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification.
This Condition is modified by a Note that requires performance of the Required Action only when THERMAL POWER is greater than 20% RTP.
This establishes an ACTIONS entry Condition that is consistent with LCO provision c and the Applicability of LCO 3.2.5, "Power Peaking Factors."
SURVEILLANCE       SR 3.1.8.1 REQUIREMENTS Verification that THERMAL POWER is  85% RTP ensures that the required additional thermal margin has been established prior to and during PHYSICS TESTS. [ The required Frequency of once per hour allows the operator adequate time to determine any degradation of the established thermal margin during PHYSICS TESTS.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.1.8.2 Verification that FQ(Z) and FN H are within their limits ensures that core local linear heat rate and departure from nucleate boiling ratio will remain within their limits, while one or more of the LCOs that normally control these design limits are out of specification. [ The required Frequency of Babcock & Wilcox STS                      B 3.1.8-5                                                       Rev. 5.0

PHYSICS TESTS Exceptions - MODE 1 B 3.1.8 BASES SURVEILLANCE REQUIREMENTS (continued) 2 hours allows the operator adequate time for collecting a flux map and for performing the hot channel factor verifications, based on operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
If SR 3.2.5.1 is not met, PHYSICS TESTS are suspended and LCO 3.2.5 applies. This Frequency is more conservative than the Completion Time for restoration of the individual LCOs that preserve the FQ(Z) and FN H limits.
This SR is modified by a Note that requires performance only when THERMAL POWER is greater than 20% RTP. This establishes a performance requirement that is consistent with the Applicability of LCO 3.2.5, "Power Peaking Factors."
SR 3.1.8.3 Verification that the nuclear overpower trip setpoint is within the limit specified for each PHYSICS TEST ensures that core protection at the reduced power level is established and will remain in place during the PHYSICS TESTS. [ Performing the verification once every 8 hours allows the operator adequate time for determining any degradation of the established trip setpoint margin before and during PHYSICS TESTS and for adjusting the nuclear overpower trip setpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                      B 3.1.8-6                                                       Rev. 5.0

PHYSICS TESTS Exceptions - MODE 1 B 3.1.8 BASES SURVEILLANCE REQUIREMENTS (continued)
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.1.8.4 The SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects:
: a. Reactor Coolant System (RCS) boron concentration,
: b. CONTROL ROD position,
: c. Doppler defect,
: d. Fuel burnup based on gross thermal energy generation,
: e. Samarium concentration,
: f. Xenon concentration, and
: g. Moderator defect.
[ The Frequency of 24 hours is based on the generally slow change in required boron concentration and on the low probability of an accident occurring without the required SDM.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                        B 3.1.8-7                                                       Rev. 5.0

PHYSICS TESTS Exceptions - MODE 1 B 3.1.8 BASES REFERENCES         1. 10 CFR 50, Appendix B, Section XI.
: 2. 10 CFR 50.59.
: 3. Regulatory Guide 1.68, Revision 2, August 1978.
: 4. ANSI/ANS-19.6.1-1985, December 13, 1985.
: 5. FSAR, Section [13.4.8].
: 6. FSAR, Section [13.4.8], [Tables 13-3 and 13-4, Am. 49, September 30, 1976].
Babcock & Wilcox STS              B 3.1.8-8                                   Rev. 5.0

PHYSICS TESTS Exceptions - MODE 2 B 3.1.9 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.9 PHYSICS TESTS Exceptions - MODE 2 BASES BACKGROUND         The purpose of this MODE 2 LCO is to permit PHYSICS TESTS to be conducted by providing exemptions from the requirements of other LCOs.
Establishment of a test program to verify that structures, systems, and components will perform satisfactorily in service is required by 10 CFR 50, Appendix B (Ref. 1). Testing is required as an integral part of the design, fabrication, construction, and operation of the power plant. All functions necessary to ensure that specified design conditions are not violated during normal operation and anticipated operational occurrences must be tested. Requirements for notification of the NRC, for the purpose of conducting tests and experiments, are specified in 10 CFR 50.59 (Ref. 2).
The key objectives of a test program are to (Ref. 3):
: a. Ensure that the facility has been adequately designed,
: b. Validate the analytical models used in the design and analysis,
: c. Verify the assumptions used to predict unit response,
: d. Ensure that installation of equipment in the facility has been accomplished in accordance with the design, and
: e. Verify that the operating and emergency procedures are adequate.
To accomplish these objectives, testing is performed prior to initial criticality; during startup, low power operations, and power ascension; at high powers; and after each refueling. The PHYSICS TESTS requirements for reload fuel cycles ensure that the operating characteristics of the core are consistent with the design predictions, and that the core can be operated as designed (Ref. 4).
PHYSICS TESTS procedures are written and approved in accordance with established guidelines. The procedures include all information necessary to permit a detailed execution of testing required to ensure that the design intent is met. PHYSICS TESTS are performed in accordance with these procedures, and test results are approved prior to continued power escalation and long term power operation.
Examples of MODE 2 PHYSICS TESTS include determination of critical boron concentration, CONTROL ROD group worth, and reactivity coefficients.
Babcock & Wilcox STS                    B 3.1.9-1                                       Rev. 5.0

PHYSICS TESTS Exceptions - MODE 2 B 3.1.9 BASES APPLICABLE         Reference 5 defines requirements for initial testing of the facility, including SAFETY             PHYSICS TESTS. Tables 13-3 and 13-4 (Ref. 6) summarize the zero, ANALYSES           low power, and power tests. Requirements for reload fuel cycle PHYSICS TESTS are given in Table 1 of ANSI/ANS-19.6.1-1985 (Ref. 4).
Although these PHYSICS TESTS are generally accomplished within the limits of all LCOs, conditions may occur when one or more of the LCOs must be suspended to make completion of PHYSICS TESTS possible or practical.
It is acceptable to suspend the following LCOs for PHYSICS TESTS because reactor protection criteria are preserved by the LCOs still maintained and by the SRs:
LCO 3.1.3,      "Moderator Temperature Coefficient (MTC),"
LCO 3.1.4,      "CONTROL ROD Group Alignment Limits,"
LCO 3.1.5,      "Safety Rod Insertion Limits,"
LCO 3.1.6,      "AXIAL POWER SHAPING ROD (APSR) Alignment Limits,"
LCO 3.2.1,      "Regulating Rod Insertion Limits" for the restricted operation region only, and LCO 3.4.2,      "RCS Minimum Temperature for Criticality."
Even if an accident occurs during PHYSICS TESTS with one or more LCOs suspended, fuel damage criteria are preserved because the limits on THERMAL POWER and shutdown capability are maintained during the PHYSICS TESTS.
Shutdown capability is preserved by limiting maximum obtainable THERMAL POWER and maintaining adequate SDM, when in MODE 2 PHYSICS TESTS. In MODE 2, the Reactor Coolant System (RCS) temperature must be within the narrow range instrumentation for plant control. The narrow range temperature instrumentation goes on scale at 520&deg;F. Therefore, it is considered safe to allow the minimum RCS temperature to decrease to 520&deg;F during MODE 2 PHYSICS TESTS, based on the low probability of an accident occurring and on prior operating experience.
PHYSICS TESTS include measurement of core nuclear parameters or exercise of control components that affect process variables.
As described in LCO 3.0.7, compliance with Test Exceptions LCOs is optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test Exceptions LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.
Babcock & Wilcox STS                    B 3.1.9-2                                         Rev. 5.0

PHYSICS TESTS Exceptions - MODE 2 B 3.1.9 BASES LCO                This LCO permits individual CONTROL RODS to be positioned outside of their specified group alignment and withdrawal limits and to be assigned to other than specified CONTROL ROD groups during the performance of PHYSICS TESTS. In addition, this LCO permits verification of the fundamental core characteristics.
This LCO also allows suspension of LCO 3.1.3, LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, LCO 3.2.1, and LCO 3.4.2, provided:
: a. THERMAL POWER is  5% RTP,
: b. Nuclear overpower trip setpoints on the OPERABLE nuclear power range channels are set to  25% RTP,
: c. Nuclear instrumentation high startup rate CONTROL ROD withdrawal inhibit is OPERABLE, and
: d. SDM is maintained within the limits specified in the COLR.
The limits of LCO 3.2.3 and LCO 3.2.4 do not apply in MODE 2.
Inhibiting CONTROL ROD withdrawal, based on startup rate, also limits local linear heat rate (LHR), departure from nucleate boiling ratio (DNBR),
and peak RCS pressure during accidents initiated from low power.
APPLICABILITY      This LCO is applicable when the reactor is either subcritical or critical with THERMAL POWER  5% RTP. The Applicability is stated as "during PHYSICS TESTS initiated in MODE 2" to ensure that the 5% RTP maximum power level is not exceeded. Should the THERMAL POWER exceed 5% RTP, and consequently the unit enter MODE 1, this Applicability statement prevents exiting this Specification and its Required Actions. This LCO is applicable for initial criticality or low power testing, as defined by Regulatory Guide 1.68 (Ref. 3). In MODE 1, Applicability of this LCO is not required because LCO 3.1.8, "PHYSICS TESTS Exceptions," addresses PHYSICS TESTS exceptions in MODE 1. In MODES 3, 4, 5, and 6, Applicability is not required because physics testing is not performed in these MODES.
ACTIONS            A.1 If THERMAL POWER exceeds 5% RTP, a positive reactivity addition could be occurring, and a nuclear excursion could result. To ensure that local LHR, DNBR, and RCS pressure limits are not violated, the reactor is tripped. The necessary prompt action requires manual operator action to open the CONTROL ROD drive trip breakers without attempts to reduce THERMAL POWER by actuating the control system (i.e., CONTROL ROD insertion or RCS boration).
Babcock & Wilcox STS                  B 3.1.9-3                                          Rev. 5.0

PHYSICS TESTS Exceptions - MODE 2 B 3.1.9 BASES ACTIONS (continued)
B.1 and B.2 If the SDM requirements are not met, boration must be initiated promptly.
A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. The operator should begin boration with the best source available for the plant conditions. Boration will be continued until SDM is within limit. In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied.
Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification.
C.1 If the nuclear overpower trip setpoint is > 25% RTP, then 1 hour is allowed for the operator to restore the nuclear overpower trip setpoint within limits or to complete an orderly suspension of PHYSICS TESTS exceptions. Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable individual LCOs to within specification, in order to ensure that continuity of reactor operation is within initial condition limits. This required Completion Time is consistent with, or more conservative than, those specified for the individual LCOs addressed by PHYSICS TESTS exceptions.
If the nuclear instrumentation high startup rate CONTROL ROD withdrawal inhibit function is inoperable, then 1 hour is allowed for the operator to restore the function to OPERABLE status or to complete an orderly suspension of PHYSICS TESTS exceptions. Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable individual LCOs to within specification. This required Completion Time is consistent with, or more conservative than, those specified for the individual LCOs addressed by PHYSICS TESTS exceptions.
The nuclear instrumentation high startup rate CONTROL ROD withdrawal inhibit function is not required when the reactor power level is above the operating range of the instrumentation channel. For example, if the reactor power level is above the source range channel operating range, then only the intermediate range high startup rate CONTROL ROD withdrawal inhibit is required to be functional.
Babcock & Wilcox STS                   B 3.1.9-4                                        Rev. 5.0

PHYSICS TESTS Exceptions - MODE 2 B 3.1.9 BASES SURVEILLANCE       SR 3.1.9.1 REQUIREMENTS Verification that THERMAL POWER is  5% RTP ensures that an adequate margin is maintained between the THERMAL POWER level and the nuclear overpower trip setpoint. [ Hourly verification is adequate for the operator to determine any change in core conditions, such as xenon redistribution occurring after a THERMAL POWER reduction, that could cause THERMAL POWER to exceed the specified limit.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.1.9.2 Verification that the nuclear overpower trip setpoint is within the limit specified for PHYSICS TESTS ensures that core protection at the reduced power level is established and will remain in place during PHYSICS TESTS. [ Performing the verification once per 8 hours allows the operator adequate time for determining any degradation of the established trip setpoint margin before and during PHYSICS TESTS and for adjusting the nuclear overpower trip setpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.1.9-5                                                       Rev. 5.0

PHYSICS TESTS Exceptions - MODE 2 B 3.1.9 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.1.9.3 The SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects:
: a. RCS boron concentration,
: b. CONTROL ROD position,
: c. RCS average temperature,
: d. Fuel burnup based on gross thermal energy generation,
: e. Samarium concentration,
: f. Xenon concentration,
: g. Isothermal temperature coefficient (ITC), when below the point of adding heat (POAH),
: h. Moderator defect, when above the POAH, and
: i. Doppler defect, when above the POAH.
Using the ITC accounts for Doppler reactivity in this calculation when the reactor is subcritical or critical but below the POAH, and the fuel temperature will be changing at the same rate as the RCS.
[ The Frequency of 24 hours is based on the generally slow change in required boron concentration and on the low probability of an accident occurring without the required SDM.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                        B 3.1.9-6                                                       Rev. 5.0

PHYSICS TESTS Exceptions - MODE 2 B 3.1.9 BASES REFERENCES         1. 10 CFR 50, Appendix B, Section XI.
: 2. 10 CFR 50.59.
: 3. Regulatory Guide 1.68, Revision 2, August 1978.
: 4. ANSI/ANS-19.6.1-1985, December 13, 1985.
: 5. FSAR, Section [13.4.8].
: 6. FSAR, Section [13.4.8], [Table 13-3 and Table 13-4].
Babcock & Wilcox STS              B 3.1.9-7                                   Rev. 5.0

Regulating Rod Insertion Limits B 3.2.1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 Regulating Rod Insertion Limits BASES BACKGROUND           The insertion limits of the regulating rods are initial condition assumptions used in all safety analyses that assume rod insertion upon reactor trip.
The insertion limits directly affect the core power distributions, the worth of a potential ejected rod, the assumptions of available SDM, and the initial reactivity insertion rate.
The applicable criteria for these reactivity and power distribution design requirements are described in 10 CFR 50, Appendix A, GDC 10, "Reactor Design," GDC-26, "Reactivity Control System Redundancy-and Capability," GDC 28, "Reactivity Limits" (Ref. 1), and in 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants" (Ref. 2).
Limits on regulating rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are not violated.
The regulating rod groups operate with a predetermined amount of position overlap, in order to approximate a linear relation between rod worth and rod position (integral rod worth). To achieve this approximately linear relationship, the regulating rod groups are withdrawn and operated in a predetermined sequence. The automatic control system controls reactivity by moving the regulating rod groups in sequence within analyzed ranges. The group sequence and overlap limits are specified in the COLR.
The regulating rods are used for precise reactivity control of the reactor.
The positions of the regulating rods are normally controlled automatically by the automatic control system but can also be controlled manually.
They are capable of adding reactivity quickly compared with borating or diluting the Reactor Coolant System (RCS).
The power density at any point in the core must be limited to maintain specified acceptable fuel design limits, including limits that ensure that the criteria specified in 10 CFR 50.46 (Ref. 2) are not violated. Together, LCO 3.2.1, "Regulating Rod Insertion Limits," LCO 3.2.2, "AXIAL POWER SHAPING ROD (APSR) Insertion Limits," LCO 3.2.3, "AXIAL POWER IMBALANCE Operating Limits," and LCO 3.2.4, "QUADRANT POWER TILT (QPT)," provide limits on control component operation and on monitored process variables to ensure that the core operates within the FQ(Z) and FN H limits in the COLR. Operation within the FQ(Z) limits given Babcock & Wilcox STS                      B 3.2.1-1                                        Rev. 5.0

Regulating Rod Insertion Limits B 3.2.1 BASES BACKGROUND (continued) in the COLR prevents power peaks that would exceed the loss of coolant accident (LOCA) limits derived from the analysis of the Emergency Core Cooling Systems (ECCS). Operation within the FN H limits given in the COLR prevents departure from nucleate boiling (DNB) during a loss of forced reactor coolant flow accident. In addition to the FQ(Z) and FN H limits, certain reactivity limits are met by regulating rod insertion limits.
The regulating rod insertion limits also restrict the ejected CONTROL ROD worth to the values assumed in the safety analysis and maintain the minimum required SDM in MODES 1 and 2.
This LCO is required to minimize fuel cladding failures that breach the primary fission product barrier and release fission products into the reactor coolant in the event of a LOCA, loss of flow accident, ejected rod accident, or other postulated accidents requiring termination by a Reactor Protection System trip function.
APPLICABLE         The fuel cladding must not sustain damage as a result of normal SAFETY             operation (Condition 1) or anticipated operational occurrences ANALYSES           (Condition 2). The LCOs governing regulating rod insertion, APSR position, AXIAL POWER IMBALANCE, and QPT preclude core power distributions that violate the following fuel design criteria:
: a. During a large break LOCA, the peak cladding temperature must not exceed 2200&deg;F (Ref. 2).
: b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB condition (Ref. 1).
: c. During an ejected rod accident, the fission energy input to the fuel must not exceed 280 cal/gm (Ref. 3).
: d. The CONTROL RODS must be capable of shutting down the reactor with a minimum required SDM with the highest worth CONTROL ROD stuck fully withdrawn (Ref. 1).
Fuel cladding damage does not occur when the core is operated outside the conditions of these LCOs during normal operation. However, fuel cladding damage could result if an accident occurs with the simultaneous violation of one or more of the LCOs limiting the regulating rod position, the APSR position, the AXIAL POWER IMBALANCE, and the QPT. This potential for fuel cladding damage exists because changes in the power distribution can cause increased power peaking and correspondingly increased local linear heat rates (LHRs).
Babcock & Wilcox STS                   B 3.2.1-2                                           Rev. 5.0

Regulating Rod Insertion Limits B 3.2.1 BASES APPLICABLE SAFETY ANALYSES (continued)
The SDM requirement is met by limiting the regulating and safety rod insertion limits such that sufficient inserted reactivity is available in the rods to shut down the reactor to hot zero power with a reactivity margin that assumes that the maximum worth rod remains fully withdrawn upon trip (Ref. 4). Operation at the SDM based regulating rod insertion limit may also indicate that the maximum ejected rod worth could be equal to the limiting value.
Operation at the regulating rod insertion limits may cause the local core power to approach the maximum linear heat generation rate or peaking factor with the allowed QPT present.
The regulating rod and safety rod insertion limits ensure that the safety analysis assumptions for SDM, ejected rod worth, and power distribution peaking factors remain valid (Refs. 3, 5, and 6).
The regulating rod insertion limits LCO satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The limits on CONTROL ROD sequence, including group overlap, and insertion positions as defined in the COLR, must be maintained because they ensure that the resulting power distribution is within the range of analyzed power distributions and that the SDM and ejected rod worth are maintained.
The overlap between regulating groups provides more uniform rates of reactivity insertion and withdrawal and is imposed to maintain acceptable power peaking during regulating rod motion.
Error adjusted maximum allowable setpoints for regulating rod insertion are provided in the COLR. The setpoints are derived by an adjustment of the measurement system independent limits to allow for THERMAL POWER level uncertainty and rod position errors.
Actual alarm setpoints implemented in the unit may be more restrictive than the maximum allowable setpoint values to provide additional conservatism between the actual alarm setpoint and the measurement system independent limit.
LCO 3.2.1 has been modified by a Note that suspends the LCO requirement for those regulating rods not within the limits of the COLR solely due to testing in accordance with SR 3.1.4.2, which verifies the freedom of the rods to move. This SR may require the regulating rods to move below the LCO limit, which would otherwise violate the LCO.
Babcock & Wilcox STS                   B 3.2.1-3                                            Rev. 5.0

Regulating Rod Insertion Limits B 3.2.1 BASES APPLICABILITY      The regulating rod sequence, overlap, and physical insertion limits shall be maintained with the reactor in MODES 1 and 2. These limits maintain the validity of the assumed power distribution, ejected rod worth, SDM, and reactivity insertion rate assumptions used in the safety analyses.
Applicability in MODES 3, 4, and 5 is not required, because neither the power distribution nor ejected rod worth assumptions are exceeded in these MODES. SDM in MODES 3, 4, and 5 is governed by LCO 3.1.1, "SHUTDOWN MARGIN (SDM)."
ACTIONS            The regulating rod insertion alarm setpoints provided in the COLR are based on both the initial conditions assumed in the accident analyses and on the SDM. Specifically, separate insertion limits are specified to determine whether the unit is operating in violation of the initial conditions (e.g., the range of power distributions) assumed in the accident analyses or whether the unit is in violation of the SDM or ejected rod worth limits.
Separate insertion limits are provided because different Required Actions and Completion Times apply, depending on which insertion limit has been violated. The area between the boundaries of acceptable operation and unacceptable operation, illustrated on the regulating rod insertion limit figures in the COLR, is the restricted region. The actions required when operation occurs in the restricted region are described under Condition A.
The actions required when operation occurs in the unacceptable region are described under Condition C.
A.1 Operation with the regulating rods in the restricted region shown on the regulating rod insertion figures specified in the COLR or with any group sequence or overlap outside the limits specified in the COLR potentially violates the LOCA LHR limits (FQ(Z) limits), or the loss of flow accident DNB peaking limits FN H limits). The design calculations assume no deviation in nominal overlap between regulating rod groups. However, deviations of 5% of the core height above or below the nominal overlap may be typical and do not cause significant differences in core reactivity, in power distribution, or in rod worth, relative to the design calculations.
The group sequence must be maintained because design calculations assume the regulating rods withdraw and insert in a predetermined order.
For verification that FQ(Z) and FN H are within their limits, SR 3.2.5.1 is performed using the Incore Detector System to obtain a three dimensional power distribution map. Verification that FQ(Z) and FN H are within their limits ensures that operation with the regulating rods inserted into the restricted region does not violate the ECCS or DNB criteria (Ref. 7). The required Completion Time of 2 hours is acceptable in that it allows the operator sufficient time for obtaining a power distribution map Babcock & Wilcox STS                   B 3.2.1-4                                          Rev. 5.0

Regulating Rod Insertion Limits B 3.2.1 BASES ACTIONS (continued) and for verifying the power peaking factors. Repeating SR 3.2.5.1 every 2 hours is acceptable because it ensures that continued verification of the power peaking factors is performed as core conditions (primarily regulating rod insertion and induced xenon redistribution) change.
Monitoring the power peaking factors FQ(Z) and FN H does not provide verification that the reactivity insertion rate on the rod trip or the ejected rod worth limit is maintained, because worth is a reactivity parameter rather than a power peaking parameter. However, if the COLR figures do not show that a rod insertion limit is ejected rod worth limited, then the ejected rod worth is no more limiting than the SDM based rod insertion limit in the core design (Ref. 8). Ejected rod worth limits are independently maintained by the Required Actions of Conditions A and C.
Required Action A.1 is modified by a Note that requires the performance of SR 3.2.5.1 only when THERMAL POWER is greater than 20% RTP.
This establishes a Required Action that is consistent with the Applicability of LCO 3.2.5, "Power Peaking Factors."
A.2 Indefinite operation with the regulating rods inserted in the restricted region, or in violation of the group sequence or overlap limits, is not prudent. Even if power peaking monitoring per Required Action A.1 is continued, reactivity limits may not be met and the abnormal regulating rod insertion or group configuration may cause an adverse xenon redistribution, may cause the limits on AXIAL POWER IMBALANCE to be exceeded, or may adversely affect the long term fuel depletion pattern.
Therefore, power peaking monitoring is allowed for up to 24 hours after discovery of failure to meet the requirements of this LCO. This required Completion Time is reasonable based on the low probability of an event occurring simultaneously with the limit out of specification in this relatively short time period. In addition, it precludes long term depletion with abnormal group insertions or configurations, thereby limiting the potential for an adverse xenon redistribution.
B.1 If the regulating rods cannot be restored within the acceptable operating limits shown on the figures in the COLR within the required Completion Time (i.e., Required Action A.2 not met), then the limits can be restored by reducing the THERMAL POWER to a value allowed by the regulating Babcock & Wilcox STS                   B 3.2.1-5                                            Rev. 5.0

Regulating Rod Insertion Limits B 3.2.1 BASES ACTIONS (continued) rod insertion limits in the COLR. The required Completion Time of 2 hours is sufficient to allow the operator to complete the power reduction in an orderly manner and without challenging the plant systems.
Operation for up to 2 hours more in the restricted region shown in the COLR is acceptable, based on the low probability of an event occurring simultaneously with the limit out of specification in this relatively short time period. In addition, it precludes long term depletion with abnormal group insertions or configurations and limits the potential for an adverse xenon redistribution.
C.1 Operation in the unacceptable region shown on the figures in the COLR corresponds to power operation with an SDM less than the minimum required value or with the ejected rod worth greater than the allowable value. The regulating rods may be inserted too far to provide sufficient negative reactivity insertion following a reactor trip and the ejected rod worth may exceed its initial condition limit. Therefore, the RCS boron concentration must be increased to restore the regulating rod insertion to a value that preserves the SDM and ejected rod worth limits. The RCS boration must occur as described in Section B 3.1.1. The required Completion Time of 15 minutes to initiate boration is reasonable, based on limiting the potential xenon redistribution, the low probability of an accident occurring in this relatively short time period, and the number of steps required to complete this Action. This period allows the operator sufficient time for aligning the required valves and for starting the boric acid pumps. Boration continues until the regulating rod group positions are restored to at least within the restricted operational region, which restores the minimum SDM capability and reduces the potential ejected rod worth to within its limit.
C.2.1 The required Completion Time of 2 hours from initial discovery of a regulating rod group in the unacceptable region until its restoration to within the restricted operating region shown on the figures in the COLR allows sufficient time for borated water to enter the RCS from the chemical addition and makeup systems, thereby allowing the regulating rods to be withdrawn to the restricted region. Operation in the restricted region for up to an additional 2 hours is reasonable, based on limiting the potential for an adverse xenon redistribution, the low probability of an accident occurring in this relatively short time period, and the number of steps required to complete this Action.
Babcock & Wilcox STS                   B 3.2.1-6                                          Rev. 5.0

Regulating Rod Insertion Limits B 3.2.1 BASES ACTIONS (continued)
C.2.2 The SDM and ejected rod worth limit can also be restored by reducing the THERMAL POWER to a value allowed by the regulating rod insertion limits in the COLR. The required Completion Time of 2 hours is sufficient to allow the operator to complete the power reduction in an orderly manner and without challenging the plant systems. Operation for up to 2 hours more in the restricted region shown in the COLR is acceptable, based on the low probability of an event occurring simultaneously with the limit out of specification in this relatively short time period. In addition, it precludes long term depletion with abnormal group insertions or configurations and limits the potential for an adverse xenon redistribution.
D.1 If the regulating rods cannot be restored to within the acceptable operating limits for the original THERMAL POWER, or if the power reduction cannot be completed within the required Completion Time, then the reactor is placed in MODE 3, in which this LCO does not apply. This Action ensures that the reactor does not continue operating in violation of the peaking limits, the ejected rod worth, the reactivity insertion rate assumed as initial conditions in the accident analyses, or the required minimum SDM assumed in the accident analyses. The required Completion Time of 6 hours is reasonable, based on operating experience regarding the amount of time required to reach MODE 3 from RTP without challenging plant systems.
SURVEILLANCE       SR 3.2.1.1 REQUIREMENTS This Surveillance ensures that the sequence and overlap limits are not violated. [ A Surveillance Frequency of 12 hours is acceptable because little rod motion occurs in 12 hours due to fuel burnup and the probability of a deviation occurring simultaneously with an inoperable sequence monitor in this relatively short time frame is low. Also, the Frequency takes into account other information available in the control room for monitoring the status of the regulating rods.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                   B 3.2.1-7                                           Rev. 5.0

Regulating Rod Insertion Limits B 3.2.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.2.1.2 With an OPERABLE regulating rod insertion limit alarm, verification of the regulating rod insertion limits as specified in the COLR is sufficient to ensure the OPERABILITY of the regulating rod insertion limit alarm and to detect regulating rod banks that may be approaching the group insertion limits. [ The Frequency is appropriate because little rod motion due to fuel burnup occurs in 12 hours. Also, the Frequency takes into account other information available in the control room for monitoring the status of the regulating rods.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.2.1.3 Prior to achieving criticality, an estimated critical position for the CONTROL RODS is determined. Verification that SDM meets the minimum requirements ensures that sufficient SDM capability exists with the CONTROL RODS at the estimated critical position if it is necessary to shut down or trip the reactor after criticality. The Frequency of 4 hours prior to criticality provides sufficient time to verify SDM capability and establish the estimated critical position.
Babcock & Wilcox STS                      B 3.2.1-8                                                       Rev. 5.0

Regulating Rod Insertion Limits B 3.2.1 BASES REFERENCES         1. 10 CFR 50, Appendix A, GDC 10 and GDC 26.
: 2. 10 CFR 50.46.
: 3. FSAR, Section [ ] .
: 4. FSAR, Section [ ] .
: 5. FSAR, Section [ ] .
: 6. FSAR, Section [ ] .
: 7. FSAR, Section [ ] .
: 8. FSAR, Section [ ] .
Babcock & Wilcox STS              B 3.2.1-9                                    Rev 5.0

APSR Insertion Limits B 3.2.2 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 AXIAL POWER SHAPING ROD (APSR) Insertion Limits BASES BACKGROUND         The insertion limits of the APSRs are initial condition assumptions in all safety analyses that are affected by core power distributions. The applicable criterion for these power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants" (Ref. 2).
Limits on APSR insertion have been established, and all APSR positions are monitored and controlled during power operation to ensure that the power distribution defined by the design power peaking limits is maintained.
The power density at any point in the core must be limited to maintain specified acceptable fuel design limits, including limits that meet the criteria specified in Reference 2. Together, LCO 3.2.1, "Regulating Rod Insertion Limits," LCO 3.2.2, "AXIAL POWER SHAPING ROD (APSR)
Insertion Limits," LCO 3.2.3, "AXIAL POWER IMBALANCE Operating Limits," and LCO 3.2.4, "QUADRANT POWER TILT (QPT)," provide limits on control component operation and on monitored process variables to ensure that the core operates within the FQ(Z) and FN H limits in the COLR. Operation within the FQ(Z) limits given in the COLR prevents power peaks that exceed the loss of coolant accident (LOCA) limits derived from the analysis of the Emergency Core Cooling Systems (ECCS). Operation within the FN H limits given in the COLR prevents departure from nucleate boiling (DNB) during a loss of forced reactor coolant flow accident. The APSRs are not required for reactivity insertion rate on trip or SDM and, therefore, they do not trip upon a reactor trip.
This LCO is required to minimize fuel cladding failures that would breach the primary fission product barrier and release fission products to the reactor coolant in the event of a LOCA, loss of flow accident, ejected rod accident, or other postulated accident requiring termination by a Reactor Protection System trip function.
APPLICABLE         The fuel cladding must not sustain damage as a result of normal SAFETY             operation (Condition 1) or anticipated operational occurrences ANALYSES           (Condition 2). Acceptance criteria for the safety and regulating rod insertion, APSR position, AXIAL POWER IMBALANCE, and QPT LCOs preclude core power distributions that violate the following fuel design criteria:
: a. During a large break LOCA, the peak cladding temperature must not exceed 2200&deg;F (Ref. 2),
Babcock & Wilcox STS                   B 3.2.2-1                                        Rev. 5.0

APSR Insertion Limits B 3.2.2 BASES APPLICABLE SAFETY ANALYSES (continued)
: b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB condition,
: c. During an ejected rod accident, the fission energy input to the fuel must not exceed 280 cal/gm (Ref. 3), and
: d. CONTROL RODS must be capable of shutting down the reactor with a minimum required SDM with the highest worth CONTROL ROD stuck fully withdrawn (GDC 26, Ref. 1).
Fuel cladding damage does not occur when the core is operated outside these LCOs during normal operation. However, fuel cladding damage could result should an accident occur simultaneously with violation of one or more of these LCOs. This potential for fuel cladding damage exists because changes in the power distribution can cause increased power peaking and corresponding increased local linear heat rates.
Operation at the APSR insertion limits may approach the maximum allowable linear heat generation rate or peaking factor with the allowed QPT present.
The APSR insertion limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The limits on APSR physical insertion as defined in the COLR must be maintained because they serve the function of controlling the power distribution within an acceptable range.
The fuel cycle design assumes APSR withdrawal at the effective full power days (EFPD) burnup window specified in the COLR. Prior to this window, the APSRs cannot be maintained fully withdrawn in steady state operation. After this window, the APSRs are not allowed to be reinserted for the remainder of the fuel cycle.
Error adjusted maximum allowable setpoints for APSR insertion are provided in the COLR. The setpoints are derived by adjustment of the measurement system independent limits to allow for THERMAL POWER level uncertainty and rod position errors.
Actual alarm setpoints implemented in the unit may be more restrictive than the maximum allowable setpoint values to allow for additional conservatism between the actual alarm setpoints and the measurement system independent limits.
Babcock & Wilcox STS                   B 3.2.2-2                                        Rev. 5.0

APSR Insertion Limits B 3.2.2 BASES APPLICABILITY      The APSR physical insertion limits shall be maintained with the reactor in MODES 1 and 2. These limits maintain the power distribution within the range assumed in the accident analyses. In MODE 1, the limits on APSR insertion specified by this LCO maintain the axial fuel burnup design conditions assumed in the reload safety evaluation analysis. In MODE 2, applicability is required because keff  0.99. Applicability in MODES 3, 4, and 5 is not required, because the power distribution assumptions in the accident analyses would not be exceeded in these MODES.
ACTIONS            For steady state power operation, a normal position for APSR insertion is specified in the station operating procedures. The APSRs may be positioned as necessary for transient AXIAL POWER IMBALANCE control until the fuel cycle design requires them to be fully withdrawn.
(Not all fuel cycles may incorporate APSR withdrawal.) APSR position limits are not imposed for gray APSRs, with two exceptions. If the fuel cycle design incorporates an APSR withdrawal (usually near end of cycle (EOC)), the APSRs may not be maintained in the fully withdrawn position prior to the fuel cycle burnup for the APSR withdrawal. If this occurs, the APSRs must be restored to their normal inserted position. Conversely, after the fuel cycle burnup for the APSR withdrawal occurs, the APSRs may not be reinserted for the remainder of the fuel cycle. These restrictions apply to ensure the axial burnup distribution that accumulates in the fuel will be consistent with the expected (as designed) distribution.
A.1 For verification that the core parameters FQ(Z) and FN H are within their limits, SR 3.2.5.1 is performed using the Incore Detector System to obtain a three dimensional power distribution map. Successful verification that FQ(Z) and FN H are within their limits ensures that operation with the APSRs inserted or withdrawn in violation of the times specified in the COLR do not violate either the ECCS or DNB criteria (Ref. 4). The required Completion Time of 2 hours is reasonable to allow the operator to obtain a power distribution map and to verify the power peaking factors. Repeating SR 3.2.5.1 every 2 hours is reasonable to ensure that continued verification of the power peaking factors is obtained as core conditions (primarily the regulating rod insertion and induced xenon redistribution) change.
Required Action A.1 is modified by a Note that requires the performance of SR 3.2.5.1 only when THERMAL POWER is greater than 20% RTP.
This establishes a Required Action that is consistent with the Applicability of LCO 3.2.5, "Power Peaking Factors."
Babcock & Wilcox STS                   B 3.2.2-3                                         Rev. 5.0

APSR Insertion Limits B 3.2.2 BASES ACTIONS (continued)
A.2 Indefinite operation with the APSRs inserted or withdrawn in violation of the times specified in the COLR is not prudent. Even if power peaking monitoring per Required Action A.1 is continued, the abnormal APSR insertion or withdrawal may cause an adverse xenon redistribution, may cause the limits on AXIAL POWER IMBALANCE to be exceeded, or may affect the long term fuel depletion pattern. Therefore, power peaking monitoring is allowed for up to 24 hours. This required Completion Time is reasonable based on the low probability of an event occurring simultaneously with the APSR limit out of specification. In addition, it precludes long term depletion with the APSRs in positions that have not been analyzed, thereby limiting the potential for an adverse xenon redistribution. This time limit also ensures that the intended burnup distribution is maintained, and allows the operator sufficient time to reposition the APSRs to correct their positions.
Because the APSRs are not operated by the automatic control system, manual action by the operator is required to restore the APSRs to the positions specified in the COLR.
B.1 If the APSRs cannot be restored to their intended positions within the required Completion Time of 24 hours, the reactor must be placed in MODE 3, in which this LCO does not apply. This action ensures that the fuel does not continue to be depleted in an unintended burnup distribution. The required Completion Time of 6 hours is reasonable, based on operating experience regarding the time required to reach MODE 3 from RTP in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.2.2.1 REQUIREMENTS Fuel cycle designs that allow APSR withdrawal near EOC do not permit reinsertion of APSRs after the time of withdrawal. When the plant computer is OPERABLE, the operator will receive a computer alarm if the APSRs insert after that time in core life when the APSR withdrawal occurs. [ Verification that the APSRs are within their insertion limits at a 12 hour Frequency is sufficient to ensure that the APSR insertion limits are preserved and the computer alarm remains OPERABLE. The 12 hour Frequency required for performing this verification is sufficient because APSRs are positioned by manual control and are normally Babcock & Wilcox STS                  B 3.2.2-4                                         Rev. 5.0

APSR Insertion Limits B 3.2.2 BASES SURVEILLANCE REQUIREMENTS (continued) moved infrequently. The probability of a deviation occurring simultaneously with an inoperable computer alarm is low in this relatively short time frame. Also, the Frequency takes into account other information available in the control room for monitoring the axial power distribution in the reactor core.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 50, Appendix A, GDC 10 and GDC 26.
: 2. 10 CFR 50.46.
: 3. FSAR, Chapter [ ] .
: 4. FSAR, Chapter [ ] .
Babcock & Wilcox STS                      B 3.2.2-5                                                       Rev. 5.0

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.3 AXIAL POWER IMBALANCE Operating Limits BASES BACKGROUND         This LCO is required to limit the core power distribution based on accident initial condition criteria.
The power density at any point in the core must be limited to maintain specified acceptable fuel design limits, including limits that satisfy the criteria specified in 10 CFR 50.46 (Ref. 1). This LCO provides limits on AXIAL POWER IMBALANCE to ensure that the core operates within the FQ(Z) and FN H limits given in the COLR. Operation within the FQ(Z) limits given in the COLR prevents power peaks that exceed the loss of coolant accident (LOCA) limits derived from the analysis of the Emergency Core Cooling Systems (ECCS). Operation within the FN H limits given in the COLR prevents departure from nucleate boiling (DNB) during a loss of forced reactor coolant flow accident.
This LCO is required to limit fuel cladding failures that breach the primary fission product barrier and release fission products into the reactor coolant in the event of a LOCA, loss of forced reactor coolant flow accident, or other postulated accident requiring termination by a Reactor Protection System trip function. This LCO limits the amount of damage to the fuel cladding during an accident by maintaining the validity of the assumptions in the safety analyses related to the initial power distribution and reactivity.
Fuel cladding failure during a postulated LOCA is limited by restricting the maximum linear heat rate (LHR) so that the peak cladding temperature does not exceed 2200&deg;F (Ref. 2). Peak cladding temperatures > 2200&deg;F cause severe cladding failure by oxidation due to a Zircaloy water reaction. Other criteria must also be met (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long term cooling). However, peak cladding temperature is usually most limiting.
Proximity to the DNB condition is expressed by the departure from nucleate boiling ratio (DNBR), defined as the ratio of the cladding surface heat flux required to cause DNB to the actual cladding surface heat flux.
The minimum DNBR value during both normal operation and anticipated transients is limited to the DNBR correlation limit for the particular fuel design in use and is accepted as an appropriate margin to DNB. The DNB correlation limit ensures that there is at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB.
Babcock & Wilcox STS                   B 3.2.3-1                                         Rev. 5.0

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 BASES BACKGROUND (continued)
The measurement system independent limits on AXIAL POWER IMBALANCE are determined directly by the reload safety evaluation analysis without adjustment for measurement system error and uncertainty. Operation beyond these limits could invalidate the assumptions used in the accident analyses regarding the core power distribution.
APPLICABLE         The fuel cladding must not sustain damage as a result of normal SAFETY             operation (Condition 1) and anticipated operational occurrences ANALYSES           (Condition 2). The LCOs based on power distribution, LCO 3.2.1, "Regulating Rod Insertion Limits," LCO 3.2.2, "AXIAL POWER SHAPING ROD (APSR) Insertion Limits," LCO 3.2.3, "AXIAL POWER IMBALANCE Operating Limits," and LCO 3.2.4, "QUADRANT POWER TILT (QPT),"
preclude core power distributions that would violate the following fuel design criteria:
: a. During a large break LOCA, peak cladding temperature must not exceed 2200&deg;F (Ref. 1).
: b. During a loss of forced reactor coolant flow accident, there must be at least a 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB condition.
The regulating rod positions, the APSR positions, the AXIAL POWER IMBALANCE, and the QPT are process variables that characterize and control the three dimensional power distribution of the reactor core.
Fuel cladding damage does not occur when the core is operated outside this LCO during normal operation. However, fuel cladding damage could result should an accident occur with simultaneous violation of one or more of the LCOs governing the four process variables cited above. This potential for fuel cladding damage exists because changes in the power distribution can cause increased power peaking and corresponding increased local LHRs.
The regulating rod insertion, the APSR positions, the AXIAL POWER IMBALANCE, and the QPT are monitored and controlled during power operation to ensure that the power distribution is within the bounds set by the safety analyses. The axial power distribution is maintained primarily by the AXIAL POWER IMBALANCE and the APSR position limits; and the radial power distribution is maintained primarily by the QPT limits.
The regulating rod insertion limits affect both the radial and axial power distributions.
Babcock & Wilcox STS                   B 3.2.3-2                                         Rev. 5.0

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 BASES APPLICABLE SAFETY ANALYSES (continued)
The dependence of the core power distribution on burnup, regulating rod insertion, APSR position, and spatial xenon distribution is taken into account when the reload safety evaluation analysis is performed.
Operation at the AXIAL POWER IMBALANCE limit must be interpreted as operating the core at the maximum allowable FQ(Z) or FN H peaking factors assumed as initial conditions for the accident analyses with the allowed QPT present.
AXIAL POWER IMBALANCE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The power distribution LCO limits have been established based on correlations between power peaking and easily measured process variables: regulating rod position, APSR position, AXIAL POWER IMBALANCE, and QPT. The AXIAL POWER IMBALANCE envelope contained in the COLR represents the setpoints for which the core power distribution would either exceed the LOCA LHR limits or cause a reduction in the DNBR below the Safety Limit during the loss of flow accident with the allowable QPT present and with the APSR positions consistent with the limitations on APSR withdrawal determined by the fuel cycle design and specified by LCO 3.2.2.
Operation beyond the power distribution based LCO limits for the corresponding ALLOWABLE THERMAL POWER and simultaneous occurrence of either the LOCA or loss of forced reactor coolant flow accident has an acceptably low probability. Therefore, if the LCO limits are violated, a short time is allowed for corrective action before a significant power reduction is required.
The AXIAL POWER IMBALANCE maximum allowable setpoints (measurement system dependent limits) applicable for the full Incore Detector System, the Minimum Incore Detector System, and the Excore Detector System are provided in the COLR.
Actual alarm setpoints implemented in the unit may be more restrictive than the maximum allowable setpoint values to provide additional conservatism between the actual alarm setpoints and the measurement system independent limit.
Babcock & Wilcox STS                 B 3.2.3-3                                          Rev. 5.0

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 BASES APPLICABILITY      In MODE 1, the limits on AXIAL POWER IMBALANCE must be maintained when THERMAL POWER is > 40% RTP to prevent the core power distribution from exceeding the LOCA and loss of flow assumptions used in the accident analyses. Applicability of these limits at < 40% RTP in MODE 1 is not required. This operation is acceptable because the combination of AXIAL POWER IMBALANCE with the maximum allowable THERMAL POWER level will not result in LHRs sufficiently large to violate the fuel design limits. In MODES 2, 3, 4, 5, and 6, this LCO is not applicable because the reactor is not generating sufficient THERMAL POWER to produce fuel damage.
In MODE 1, it may be necessary to suspend the AXIAL POWER IMBALANCE limits during PHYSICS TESTS per LCO 3.1.8, "PHYSICS TESTS Exceptions - MODE 1." Suspension of these limits is permissible because the reactor protection criteria are maintained by the remaining LCOs governing the three dimensional power distribution and by the Surveillances required by LCO 3.1.8.
ACTIONS            A.1 The AXIAL POWER IMBALANCE operating limits that maintain the validity of the assumptions regarding the power distributions in the accident analyses of the LOCA and the loss of flow accident are provided in the COLR. Operation within the AXIAL POWER IMBALANCE limits given in the COLR is the acceptable region of operation. Operation in violation of the AXIAL POWER IMBALANCE limits given in the COLR is the restricted region of operation.
Operation with AXIAL POWER IMBALANCE in the restricted region shown on the AXIAL POWER IMBALANCE figures in the COLR potentially violates the LOCA LHR limits (FQ(Z) limits) or the loss of flow accident DNB peaking limits FN H limits) or both. For verification that FQ(Z) and FN H are within their specified limits, SR 3.2.5.1 is performed using the Incore Detector System to obtain a three dimensional power distribution map. Verification that FQ(Z) and FN H are within their specified limits ensures that operation with the AXIAL POWER IMBALANCE in the restricted region does not violate the ECCS or 95/95 DNB criteria. The required Completion Time of 2 hours provides reasonable time for the operator to obtain a power distribution map and to determine and verify that the power peaking factors are within their specified limits. The 2 hour Frequency provides reasonable time to ensure that continued verification of the power peaking factors is obtained as core conditions (primarily regulating rod insertion and induced xenon redistribution) change, because little rod motion occurs in 2 hours due to fuel burnup, the potential for xenon redistribution is limited, and the probability of an event occurring in this short time frame is low.
Babcock & Wilcox STS                  B 3.2.3-4                                           Rev. 5.0

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 BASES ACTIONS (continued)
A.2 Indefinite operation with the AXIAL POWER IMBALANCE in the restricted region is not prudent. Even if power peaking monitoring per Required Action A.1 is continued, excessive AXIAL POWER IMBALANCE over an extended period of time may cause a potentially adverse xenon redistribution to occur. Therefore, power peaking monitoring is only allowed for a maximum of 24 hours. This required Completion Time is reasonable based on the low probability of a limiting event occurring simultaneously with the AXIAL POWER IMBALANCE outside the limits of this LCO. In addition, this limited Completion Time precludes long term depletion of the reactor fuel with excessive AXIAL POWER IMBALANCE and gives the operator sufficient time to reposition the APSRs or regulating rods to reduce the AXIAL POWER IMBALANCE because adverse effects of xenon redistribution and fuel depletion are limited.
B.1 If the Required Actions and the associated Completion Times of Condition A cannot be met, the AXIAL POWER IMBALANCE may exceed its specified limits and the reactor may be operating with a global axial power distribution mismatch. Continued operation in this configuration may induce an axial xenon oscillation and may result in an increased linear heat generation rate when the xenon redistributes. Reducing THERMAL POWER to  40% RTP reduces the maximum LHR to a value that does not exceed the FQ(Z) and FN H initial condition limits assumed in the accident analyses. The required Completion Time of 2 hours is reasonable based on limiting a potentially adverse xenon redistribution, the low probability of an accident occurring in this relatively short time period, and the number of steps required to complete this Action.
SURVEILLANCE       The AXIAL POWER IMBALANCE can be monitored by both the Incore REQUIREMENTS       and Excore Detector Systems. The AXIAL POWER IMBALANCE maximum allowable setpoints are derived from their corresponding measurement system independent limits by adjusting for both the system observability errors and instrumentation errors. Although they may be based on the same measurement system independent limits, the setpoints for the different systems are not identical because of differences in the errors applicable for each of these systems. The uncertainty analysis that defines the required error adjustment to convert the measurement system independent limits to alarm setpoints assumes that 75% of the detectors in each quadrant are OPERABLE. Detectors located on the core major axes are assumed to contribute one half of their output to each quadrant; detectors in the center assembly are assumed to Babcock & Wilcox STS                   B 3.2.3-5                                          Rev. 5.0

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 BASES SURVEILLANCE REQUIREMENTS (continued) contribute one quarter of their output to each quadrant. For AXIAL POWER IMBALANCE measurements using the Incore Detector System, the Minimum Incore Detector System consists of OPERABLE detectors configured as follows:
: a. Nine detectors shall be arranged such that there are three detectors in each of three strings and there are three detectors lying in the same axial plane, with one plane at the core midplane and one plane in each axial core half,
: b. The axial planes in each core half shall be symmetrical about the core midplane, and
: c. The detector strings shall not have radial symmetry.
Figure B 3.2.3-1 (Minimum Incore Detector System for AXIAL POWER IMBALANCE Measurement) depicts an example of this configuration.
This arrangement is chosen to reduce the uncertainty in the measurement of the AXIAL POWER IMBALANCE by the Minimum Incore Detector System. For example, the requirement for placing one detector of each of the three strings at the core midplane puts three detectors in the central region of the core where the neutron flux tends to be higher. It also helps prevent measuring an AXIAL POWER IMBALANCE that is excessively large when the reactor is operating at low THERMAL POWER levels. The third requirement for placement of detectors (i.e.,
radial asymmetry) reduces uncertainty by measuring the neutron flux at core locations that are not radially symmetric.
SR 3.2.3.1
[ Verification of the AXIAL POWER IMBALANCE indication every 12 hours ensures that the AXIAL POWER IMBALANCE limits are not violated and takes into account other information and alarms available to the operator in the control room. This Surveillance Frequency is acceptable because the mechanisms that can cause AXIAL POWER IMBALANCE, such as xenon redistribution or CONTROL ROD drive mechanism malfunctions that cause slow AXIAL POWER IMBALANCE increases, can be discovered by the operator before the specified limits are violated.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                    B 3.2.3-6                                         Rev. 5.0

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 50.46.
: 2. FSAR, Chapter [15].
Babcock & Wilcox STS                      B 3.2.3-7                                                       Rev. 5.0

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 Babcock & Wilcox STS B 3.2.3-8                              Rev. 5.0

QPT B 3.2.4 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.4 QUADRANT POWER TILT (QPT)
BASES BACKGROUND         This LCO is required to limit the core power distribution based on accident initial condition criteria.
The power density at any point in the core must be limited to maintain specified acceptable fuel design limits, including limits that preserve the criteria specified in 10 CFR 50.46 (Ref. 1). Together, LCO 3.2.1, "Regulating Rod Insertion Limits," LCO 3.2.2, "AXIAL POWER SHAPING ROD (APSR) Insertion Limits," LCO 3.2.3, "AXIAL POWER IMBALANCE Operating Limits," and LCO 3.2.4, "QUADRANT POWER TILT (QPT),"
provide limits on control component operation and on monitored process variables to ensure that the core operates within the FQ(Z) and FN H limits given in the COLR. Operation within the FQ(Z) limits given in the COLR prevents power peaks that exceed the loss of coolant accident (LOCA) limits derived by Emergency Core Cooling Systems (ECCS) analysis.
Operation within the FN H limits given in the COLR prevents departure from nucleate boiling (DNB) during a loss of forced reactor coolant flow accident.
This LCO is required to limit fuel cladding failures that breach the primary fission product barrier and release fission products to the reactor coolant in the event of a LOCA, loss of forced reactor coolant flow, or other accident requiring termination by a Reactor Protection System trip function. This LCO limits the amount of damage to the fuel cladding during an accident by maintaining the validity of the assumptions used in the safety analysis related to the initial power distribution and reactivity.
Fuel cladding failure during a postulated LOCA is limited by restricting the maximum linear heat rate (LHR) so that the peak cladding temperature does not exceed 2200&deg;F (Ref. 2). Peak cladding temperatures > 2200&deg;F cause severe cladding failure by oxidation due to a Zircaloy water reaction. Other criteria must also be met (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long term cooling). However, peak cladding temperature is usually most limiting.
Proximity to the DNB condition is expressed by the departure from nucleate boiling ratio (DNBR), defined as the ratio of the cladding surface heat flux required to cause DNB to the actual cladding surface heat flux.
The minimum DNBR value during both normal operation and anticipated transients is limited to the DNBR correlation limit for the particular fuel Babcock & Wilcox STS                   B 3.2.4-1                                         Rev. 5.0

QPT B 3.2.4 BASES BACKGROUND (continued) design in use, and is accepted as an appropriate margin to DNB. The DNBR correlation limit ensures that there is at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB.
The measurement system independent limits on QPT are determined directly by the reload safety evaluation analysis without adjustment for measurement system error and uncertainty. Operation beyond these limits could invalidate core power distribution assumptions used in the accident analysis. The error adjusted maximum allowable alarm setpoints (measurement system dependent limits) for QPT are specified in the COLR.
APPLICABLE         The fuel cladding must not sustain damage as a result of normal SAFETY             operation (Condition 1) and anticipated operational occurrences ANALYSES           (Condition 2). The LCOs based on power distribution (LCO 3.2.1, LCO 3.2.2, LCO 3.2.3, and LCO 3.2.4) preclude core power distributions that violate the following fuel design criteria:
: a. During a large break LOCA, the peak cladding temperature must not exceed 2200&deg;F (Ref. 3).
: b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB condition.
QPT is one of the process variables that characterize and control the three dimensional power distribution of the reactor core.
Fuel cladding damage does not occur when the core is operated outside this LCO during normal operation. However, fuel cladding damage could result if an accident occurs with simultaneous violation of one or more of the LCOs governing the core power distribution. Changes in the power distribution can cause increased power peaking and correspondingly increased local LHRs.
The dependence of the core power distribution on burnup, regulating rod insertion, APSR position, and spatial xenon distribution is taken into account during the reload safety evaluation analysis. An allowance for QPT is accommodated in the analysis and resultant LCO limits. The increase in peaking taken for QPT is developed from a database of full core power distribution calculations (Ref. 4). The calculations consist of simulations of many power distributions with tilt causing mechanisms (e.g., dropped or misaligned CONTROL RODS, broken APSR fingers Babcock & Wilcox STS                   B 3.2.4-2                                        Rev. 5.0

QPT B 3.2.4 BASES APPLICABLE SAFETY ANALYSES (continued) fully inserted, misloaded assemblies, and burnup gradients). An increase of < 2% peak power per 1% QPT is supported by the analysis, therefore a value of 2% peak power increase per 1% QPT is used to bound peak power increases due to QPT.
Operation at the AXIAL POWER IMBALANCE or rod insertion limits must be interpreted as operating the core at the maximum allowable FQ(Z) or FN H peaking factors for accident initial conditions with the allowed QPT present.
QPT satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The power distribution LCO limits have been established based on correlations between power peaking and easily measured process variables: regulating rod position, APSR position, AXIAL POWER IMBALANCE, and QPT. The regulating rod insertion limits and the AXIAL POWER IMBALANCE boundaries contained in the COLR represent the measurement system independent limits at which the core power distribution either exceeds the LOCA LHR limits or causes a reduction in DNBR below the safety limit during a loss of flow accident with the allowable QPT present and with an APSR position consistent with the limitations on APSR withdrawal determined by the fuel cycle design and specified by LCO 3.2.2.
Operation beyond the power distribution based LCO limits for the corresponding allowable THERMAL POWER and simultaneous occurrence of one of a LOCA, loss of forced reactor coolant flow accident, or ejected rod accident has an acceptably low probability. Therefore, if these LCO limits are violated, a short time is allowed for corrective action before a significant power reduction is required.
The maximum allowable setpoints for steady state, transient, and maximum limits for QPT applicable for the full symmetrical Incore Detector System, Minimum Incore Detector System, and Excore Detector System are provided; the setpoints are given in the COLR. The setpoints for the three systems are derived by adjustment of the measurement system independent QPT limits given in the COLR to allow for system observability and instrumentation errors.
Actual alarm setpoints implemented in the plant may be more restrictive than the maximum allowable setpoint values to allow for additional conservatism between the actual alarm setpoint and the measurement system independent limit.
Babcock & Wilcox STS                   B 3.2.4-3                                          Rev. 5.0

QPT B 3.2.4 BASES LCO (continued)
It is desirable for an operator to retain the ability to operate the reactor when a QPT exists. In certain instances, operation of the reactor with a QPT may be helpful or necessary to discover the cause of the QPT. The combination of power level restriction with QPT in each Required Action statement restricts the local LHR to a safe level, allowing movement through the specified applicability conditions in the exception to Specification 3.0.3.
APPLICABILITY      In MODE 1, the limits on QPT must be maintained when THERMAL POWER is > 20% RTP to prevent the core power distribution from exceeding the design limits. The minimum power level of 20% RTP is large enough to obtain meaningful QPT indications without compromising safety. Operation at or below 20% RTP with QPT up to 20% is acceptable because the resulting maximum LHR is not high enough to cause violation of the LOCA LHR limit (FQ(Z) limit) or the initial condition DNB allowable peaking limit ( FN H limit) during accidents initiated from this power level.
In MODE 2, the combination of QPT with maximum ALLOWABLE THERMAL POWER level does not result in LHRs sufficiently large to violate the fuel design limits, and therefore, applicability in this MODE is not required. Although not specifically addressed in the LCO, QPTs
                   > 20% in MODE 1 with THERMAL POWER < 20% RTP are allowed for the same reason.
In MODES 3, 4, 5, and 6, this LCO is not applicable, because the reactor is not generating THERMAL POWER and QPT is indeterminate.
In MODE 1, it may be necessary to suspend the QPT limits during PHYSICS TESTS per LCO 3.1.8, "PHYSICS TESTS Exceptions -
MODE 1." Suspension of these limits is permissible because the reactor protection criteria are maintained by the remaining LCOs governing the three dimensional power distribution and by the Surveillances required by LCO 3.1.8.
ACTIONS            A.1.1 The steady state limit specified in the COLR provides an allowance for QPT that may occur during normal operation. A peaking increase to accommodate QPTs up to the steady state limit is allowed by the regulating rod insertion limits of LCO 3.2.1 and the AXIAL POWER IMBALANCE limits of LCO 3.2.3.
Babcock & Wilcox STS                   B 3.2.4-4                                          Rev. 5.0

QPT B 3.2.4 BASES ACTIONS (continued)
Operation with QPT greater than the steady state limit specified in the COLR potentially violates the LOCA LHR limits (FQ(Z) limits), or loss of flow accident DNB peaking limits ( FN H limits), or both. For verification that FQ(Z) and FN H are within their specified limits, SR 3.1.5.2 is performed using the Incore Detector System to obtain a three dimensional power distribution map. Verification that FQ(Z) and FN H are within their limits ensures that operation with QPT greater than the steady state limit does not violate the ECCS or 95/95 DNB criteria. The required Completion Time of once per 2 hours is a reasonable amount of time to allow the operator to obtain a power distribution map and to verify the power peaking factors. Repeating SR 3.2.5.1 every 2 hours is a reasonable Frequency at which to ensure that continued verification of the power peaking factors is obtained as core conditions that influence QPT change.
A.1.2.1 The safety analysis has shown that a conservative corrective action is to reduce THERMAL POWER by 2% RTP or more from the ALLOWABLE THERMAL POWER for each 1% of QPT in excess of the steady state limit. This action limits the local LHR to a value corresponding to steady state operation, thereby reducing it to a value within the assumed accident initial condition limits. The required Completion Time of 2 hours is reasonable, based on limiting the potential for xenon redistribution, the low probability of an accident occurring, and the steps required to complete the Required Action.
If QPT can be reduced to less than or equal to the steady state limit in
                   < 2 hours, the reactor may return to normal operation without undergoing a power reduction. Significant radial xenon redistribution does not occur within this amount of time.
The required Completion Time of 2 hours after the last performance of SR 3.5.2.1 allows reduction of THERMAL POWER in the event the operators cannot or choose not to continue to perform SR 3.5.2.1 as required by Required Action A.1.1.
A.1.2.2 Power operation is allowed to continue if THERMAL POWER is reduced in accordance with Required Action A.1.2.1. The same reduction (i.e.,
2% RTP or more) is also applicable to the nuclear overpower trip setpoint and the nuclear overpower based on Reactor Coolant System (RCS) flow and AXIAL POWER IMBALANCE trip setpoint, for each 1% of QPT in Babcock & Wilcox STS                   B 3.2.4-5                                         Rev. 5.0

QPT B 3.2.4 BASES ACTIONS (continued) excess of the steady state limit. This reduction maintains both core protection and an OPERABILITY margin at the reduced THERMAL POWER level similar to that at RTP. The required Completion Time of 10 hours is reasonable based on the need to limit the potentially adverse xenon redistribution, the low probability of an accident occurring while operating out of specification, and the number of steps required to complete the Required Action.
A.2 Although the actions directed by Required Action A.1.2.1 restore margins, if the source of the QPT is not established and corrected, it is prudent to establish increased margins. A required Completion Time of 24 hours to reduce QPT to less than the steady state limit is a reasonable time for investigation and corrective measures.
B.1 If QPT exceeds the transient limit but is equal to or less than the maximum limit due to a misaligned CONTROL ROD or APSR, then power operation is allowed to continue if the THERMAL POWER is reduced 2% RTP or more from the ALLOWABLE THERMAL POWER for each 1%
of QPT in excess of the steady state limit. Thus, the transient limit is the upper bound within which the 2% for 1% power reduction rule may be applied, but only for QPTs caused by CONTROL ROD or APSR misalignment. The required Completion Time of 30 minutes ensures that the operator completes the THERMAL POWER reduction before significant xenon redistribution occurs.
B.2 When a misaligned CONTROL ROD or APSR occurs, a local xenon redistribution may occur. The required Completion Time of 2 hours allows the operator sufficient time to relatch or realign a CONTROL ROD or APSR, but is short enough to limit xenon redistribution so that large increases in the local LHR do not occur due to xenon redistribution resulting from the QPT.
Babcock & Wilcox STS                  B 3.2.4-6                                        Rev. 5.0

QPT B 3.2.4 BASES ACTIONS (continued)
C.1 If the Required Action and associated Completion Time of Condition A or B are not met, a further power reduction is required. Power reduction to < 60% RTP provides conservative protection from increased peaking due to xenon redistribution. The required Completion Time of 2 hours is reasonable to allow the operator to reduce THERMAL POWER to < 60%
of ALLOWABLE THERMAL POWER without challenging plant systems.
C.2 Reduction of the nuclear overpower trip setpoint to  65.5% of ALLOWABLE THERMAL POWER after THERMAL POWER has been reduced to < 60% of ALLOWABLE THERMAL POWER maintains both core protection and OPERABILITY margin at reduced power similar to that at full power. The required Completion Time of 10 hours allows the operator sufficient time to reset the trip setpoint and is reasonable based on operating experience.
D.1 Power reduction to 60% of the ALLOWABLE THERMAL POWER is a conservative method of limiting the maximum core LHR for QPTs up to 20%. Although the power reduction is based on the correlation used in Required Actions A.1.2.1 and B.1, the database for a power peaking increase as a function of QPT is less extensive for tilt mechanisms other than misaligned CONTROL RODS and APSRs. Because greater uncertainty in the potential power peaking increase exists with the less extensive database, a more conservative action is taken when the tilt is caused by a mechanism other than a misaligned CONTROL ROD or APSR. The required Completion Time of 2 hours allows the operator to reduce THERMAL POWER to < 60% of the ALLOWABLE THERMAL POWER without challenging plant systems.
D.2 Reduction of the nuclear overpower trip setpoint to  65.5% of the ALLOWABLE THERMAL POWER after THERMAL POWER has been reduced to < 60% of the ALLOWABLE THERMAL POWER maintains both core protection and an operating margin at reduced power similar to that at full power. The required Completion Time of 10 hours allows the operator sufficient time to reset the trip setpoint and is reasonable based on operating experience.
Babcock & Wilcox STS                  B 3.2.4-7                                         Rev. 5.0

QPT B 3.2.4 BASES ACTIONS (continued)
E.1 If the Required Actions for Condition C or D cannot be met within the required Completion Time, then the reactor will continue in power operation with significant QPT. Either the power level has not been reduced to comply with the Required Action or the nuclear overpower trip setpoint has not been reduced within the required Completion Time. To preclude risk of fuel damage in any of these conditions, THERMAL POWER is reduced further. Specification 3.0.3 normally requires a shutdown to MODE 3. However, operation at 20% RTP allows the operator to investigate the cause of the QPT and to correct it. Local LHRs with a large QPT do not violate the fuel design limits at or below 20% RTP. The required Completion Time of 2 hours is acceptable based on limiting the potential increase in local LHRs that could occur due to xenon redistribution with the QPT out of specification.
F.1 The maximum limit of 20% QPT is set as the upper bound within which power reduction to 60% of ALLOWABLE THERMAL POWER or power reduction of 2% for 1% (for misaligned CONTROL RODS only) applies (Ref. 4).
The maximum limit of 20% QPT is consistent with allowing power operation up to 60% of ALLOWABLE THERMAL POWER when QPT setpoints are exceeded. QPT in excess of the maximum limit can be an indication of a severe power distribution anomaly, and a power reduction to at most 20% RTP ensures local LHRs do not exceed allowable limits while the cause is being determined and corrected.
The required Completion Time of 2 hours is reasonable to allow the operator to reduce THERMAL POWER to  20% RTP without challenging plant systems.
SURVEILLANCE       QPT can be monitored by both the incore and excore detector systems.
REQUIREMENTS       The QPT setpoints are derived from their corresponding measurement system independent limits by adjustment for system observability errors and instrumentation errors. Although they may be based on the same measurement system independent limit, the setpoints for the different systems are not identical because of differences in the errors applicable for these systems. For QPT measurements using the Incore Detector System, the Minimum Incore Detector System consists of OPERABLE detectors configured as follows:
Babcock & Wilcox STS                  B 3.2.4-8                                        Rev. 5.0

QPT B 3.2.4 BASES SURVEILLANCE REQUIREMENTS (continued)
: a. Two sets of four detectors shall lie in each core half. Each set of detectors shall lie in the same axial plane. The two sets in the same core half may lie in the same axial plane.
: b. Detectors in the same plane shall have quarter core radial symmetry.
Figure B 3.2.4-2 (Minimum Incore Detector System for QPT Measurement) depicts an example of this configuration. The symmetric incore system for QPT uses the Incore Detector System as described above and is configured such that at least 75% of the detectors in each core quadrant are OPERABLE.
SR 3.2.4.1
[ Checking the QPT indication every 7 days ensures that the operator can determine whether the plant computer software and Incore Detector System inputs for monitoring QPT are functioning properly and takes into account other information and alarms available to the operator in the control room. This procedure allows the QPT mechanisms, such as xenon redistribution, burnup gradients, and CONTROL ROD drive mechanism malfunctions, which can cause slow development of a QPT, to be detected. Operating experience has confirmed the acceptability of a Surveillance Frequency of 7 days.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Following restoration of the QPT to within the steady state limit, operation at  95% RTP may proceed provided the QPT is determined to remain within the steady state limit at the increased THERMAL POWER level. In case QPT exceeds the steady state limit for more than 24 hours or exceeds the transient limit (Condition A, B, or D), the potential for xenon Babcock & Wilcox STS                        B 3.2.4-9                                                       Rev. 5.0

QPT B 3.2.4 BASES SURVEILLANCE REQUIREMENTS (continued) redistribution is greater. Therefore, the QPT is monitored for 12 consecutive hourly intervals to determine whether the period of any oscillation due to xenon redistribution causes the QPT to exceed the steady state limit again.
REFERENCES         1. 10 CFR 50.46.
: 2. FSAR, Section [ ] .
: 3. ANSI N18.2-1973, American National Standards Institute, August 6, 1973.
: 4. BAW 10122A, Rev. 1, May 1984.
Babcock & Wilcox STS                  B 3.2.4-10                                     Rev. 5.0

QPT B 3.2.4 Babcock & Wilcox STS B 3.2.4-11 Rev. 5.0

Power Peaking Factors B 3.2.5 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.5 Power Peaking Factors BASES BACKGROUND          The purpose of this LCO is to establish limits that constrain the core power distribution within design limits during normal operation (Condition 1) and during anticipated operational occurrences (Condition 2) such that accident initial condition protection criteria are preserved. The accident initial condition criteria are preserved by bounding operation at THERMAL POWER within specified acceptable fuel design limits.
FQ(Z) is a specified acceptable fuel design limit that preserves the initial conditions for the Emergency Core Cooling Systems (ECCS) analysis.
FQ(Z) is defined as the maximum local fuel rod linear power density divided by the average fuel rod linear power density, assuming nominal fuel pellet and rod dimensions. Because FQ(Z) is a ratio of local power densities, it is related to the maximum local (pellet) power density in a fuel rod. Operation within the FQ(Z) limits given in the COLR prevents power peaking that would exceed the loss of coolant accident (LOCA) linear heat rate (LHR) limits derived from the analysis of the ECCS.
The FN H limit is a specified acceptable fuel design limit that preserves the initial conditions for the limiting loss of flow transient. FN H is defined as the ratio of the integral of linear power along the fuel rod on which the minimum departure from nucleate boiling ratio (DNBR) occurs to the average integrated rod power. Because FN H is a ratio of integrated powers, it is related to the maximum total power produced in a fuel rod.
Operation within the FN H limits given in the COLR prevents departure from nucleate boiling (DNB) during a postulated loss of forced reactor coolant flow accident.
Measurement of the core power peaking factors using the Incore Detector System to obtain a three dimensional power distribution map provides direct confirmation that FQ(Z) and FN H are within their limits, and may be used to verify that the power peaking factors remain bounded when one or more normal operating parameters exceed their limits.
Babcock & Wilcox STS                     B 3.2.5-1                                            Rev. 5.0

Power Peaking Factors B 3.2.5 BASES APPLICABLE         The limits on FQ(Z) are determined by the ECCS analysis in order to limit SAFETY             peak cladding temperatures to 2200&deg;F during a LOCA. The maximum ANALYSES           acceptable cladding temperature is specified by 10 CFR 50.46 (Ref. 1).
Higher cladding temperatures could cause severe cladding failure by oxidation due to a Zircaloy water reaction. Other criteria must also be met (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long term cooling). However, peak cladding temperature is usually most limiting.
The limits on FN H provide protection from DNB during a limiting loss of flow transient. Proximity to the DNB condition is expressed by the DNBR, defined as the ratio of the cladding surface heat flux required to cause DNB to the actual cladding surface heat flux. The minimum DNBR value during both normal operation and anticipated transients is limited to the DNBR correlation limit for the particular fuel design in use, and is accepted as an appropriate margin to DNB. The DNBR correlation limit ensures that there is at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB.
This LCO precludes core power distributions that violate the following fuel design criteria:
: a. During a large break LOCA, peak cladding temperature must not exceed 2200&deg;F (Ref. 1).
: b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB condition.
The reload safety evaluation analysis determines limits on global core parameters that characterize the core power distribution. The primary parameters used to monitor and control the core power distribution are the regulating rod position, the APSR position, the AXIAL POWER IMBALANCE, and the QPT. These parameters are normally used to monitor and control the core power distribution because their measurements are continuously observable. Limits are placed on these parameters to ensure that the core power peaking factors remain Babcock & Wilcox STS                   B 3.2.5-2                                        Rev. 5.0

Power Peaking Factors B 3.2.5 BASES APPLICABLE SAFETY ANALYSES (continued) bounded during operation in MODE 1 with THERMAL POWER greater than 20% RTP. Nuclear design model calculational uncertainty, manufacturing tolerances (e.g., the engineering hot channel factor),
effects of fuel densification and rod bow, and modeling simplifications (such as treatment of the spacer grid effects) are accommodated through use of peaking augmentation factors in the reload safety evaluation analysis.
FQ(Z) and FN H satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                This LCO for the power peaking factors FQ(Z) and FN H ensures that the core operates within the bounds assumed for the ECCS and thermal hydraulic analyses. Verification that FQ(Z) and FN H are within the limits of this LCO as specified in the COLR allows continued operation at THERMAL POWER when the Required Actions of LCO 3.1.4, "CONTROL ROD Group Alignment Limits," LCO 3.2.1, "Regulating Rod Insertion Limits," LCO 3.2.2, "AXIAL POWER SHAPING ROD Insertion Limits," LCO 3.2.3, "AXIAL POWER IMBALANCE Operating Limits," and LCO 3.2.4, "QUADRANT POWER TILT," are entered. Conservative THERMAL POWER reductions are required if the limits on FQ(Z) and FN H are exceeded. Verification that FQ(Z) and FN H are within limits is also required during MODE 1 PHYSICS TESTS per LCO 3.1.8, "PHYSICS TESTS Exceptions - MODE 1."
Measurement uncertainties are applied when FQ(Z) and FN H are determined using the Incore Detector System. The measurement uncertainties applied to the measured values of FQ(Z) and FN H account for uncertainties in observability and instrument string signal processing.
APPLICABILITY      In MODE 1 with THERMAL POWER greater than 20% RTP, the limits on FQ(Z) and FN H must be maintained in order to prevent the core power distribution from exceeding the limits assumed in the analyses of the LOCA and loss of flow accidents. In MODE 1 with THERMAL POWER less than or equal to 20% RTP and in MODES 2, 3, 4, 5, and 6, this LCO is not applicable because the reactor has insufficient stored energy in the fuel or energy being transferred to the coolant to require a limit on the distribution of core power.
Babcock & Wilcox STS                  B 3.2.5-3                                         Rev. 5.0

Power Peaking Factors B 3.2.5 BASES APPLICABILITY (continued)
The minimum THERMAL POWER level of 20% RTP was chosen based on the ability of the Incore Detector System to satisfactorily obtain meaningful power distribution data.
ACTIONS            The operator must take care in interpreting the relationship of the power peaking factors FQ(Z) and FN H to their limits. Limit values of FQ(Z) and FN H in the COLR may be expressed in either LHR or in peaking units.
Because FQ(Z) and FN H are power peaking factors, constant LHR is maintained as THERMAL POWER is reduced, thereby allowing power peaking to be increased in inverse proportion to THERMAL POWER.
Therefore, the FQ(Z) and FN H limits increase as THERMAL POWER decreases (assuming FQ(Z) and FN H are expressed in peaking units) so that a constant LHR limit is maintained.
A.1 When FQ(Z) is determined not to be within its specified limit as determined by a three dimensional power distribution map, a THERMAL POWER reduction is taken to reduce the maximum LHR in the core.
Design calculations have verified that a conservative THERMAL POWER reduction is 1% RTP or more for each 1% by which FQ(Z) exceeds its limit (Ref. [ ] ). The Completion Time of 15 minutes provides an acceptable time to reduce power in an orderly manner and without allowing the plant to remain in an unacceptable condition for an extended period of time.
A.2 Power operation is allowed to continue by Required Action A.1 if THERMAL POWER is reduced by 1% RTP or more from the ALLOWABLE THERMAL POWER for each 1% by which FQ(Z) exceeds its limit. The same reduction in nuclear overpower trip setpoint and nuclear overpower based on the Reactor Coolant System (RCS) flow and the AXIAL POWER IMBALANCE trip setpoint is required for each 1% by which FQ(Z) is in excess of its limit. These reductions maintain both core protection and OPERABILITY margin at the reduced THERMAL POWER.
The required Completion Time of 8 hours is reasonable based on the low probability of an accident occurring in this short time period and the number of steps required to complete the Required Action.
Babcock & Wilcox STS                   B 3.2.5-4                                        Rev. 5.0

Power Peaking Factors B 3.2.5 BASES ACTIONS (continued)
A.3 Continued operation with FQ(Z) exceeding its limit is not permitted, because the initial conditions assumed in the accident analyses are no longer valid. The required Completion Time of 24 hours to restore FQ(Z) within its limits at the reduced THERMAL POWER level is reasonable based on the low probability of a limiting event occurring simultaneously with FQ(Z) exceeding its limit. In addition, it precludes long term depletion with local LHRs higher than the limiting values, and limits the potential for inducing an adverse perturbation in the axial xenon distribution.
B.1 When FN H is determined not to be within its acceptable limit as determined by a three dimensional power distribution map, a THERMAL POWER reduction is taken to reduce the maximum LHR in the core. The parameter RH by which THERMAL POWER is decreased per 1%
increase in FN H above the limit has been verified to be conservative by design calculations, and is defined in the COLR. The parameter RH is the inverse of the increase in FN H allowed as THERMAL POWER decreases by 1% RTP, and is based on an analysis of the DNBR during the limiting loss of forced reactor coolant flow transient from various initial THERMAL POWER levels. The required Completion Time of 15 minutes is reasonable for the operator to take the actions necessary to reduce the unit power.
B.2 When a decrease in THERMAL POWER is required because FN H has exceeded its limit, Required Action B.2 requires reduction of the high flux trip setpoint and the nuclear overpower based on RCS flow and AXIAL POWER IMBALANCE trip setpoint. The amount of reduction of these trip setpoints is governed by the same factor (RH(%) for each 1% that FN H exceeds its limit) that determines the THERMAL POWER reduction. This process maintains core protection by providing margin to the trip setpoints at the reduced THERMAL POWER similar to that at RTP. The parameter RH is specified in the COLR. The required Completion Time of 8 hours is reasonable based on the low probability of an accident occurring in this short time period and the number of steps required to complete this Action.
Babcock & Wilcox STS                    B 3.2.5-5                                       Rev. 5.0

Power Peaking Factors B 3.2.5 BASES ACTIONS (continued)
B.3 Continued operation with FN H exceeding its limit is not permitted, because the initial conditions assumed in the accident analyses are no longer valid. The required Completion Time of 24 hours to restore FN H within its limit at the reduced THERMAL POWER level is reasonable based on the low probability of a limiting event occurring simultaneously with FN H exceeding its limit. In addition, this Completion Time precludes long term depletion with an unacceptably high local power and limits the potential for inducing an adverse perturbation in the radial xenon distribution.
C.1 If a THERMAL POWER reduction is not sufficient to restore FQ(Z) or FN H within its limit (i.e., the Required Actions and associated Completion Times for Condition A or B are not met), then THERMAL POWER operation should be significantly reduced. The reactor is placed in MODE 1 with THERMAL POWER less than or equal to 20% RTP in which this LCO does not apply. The required Completion Time of 2 hours is a reasonable amount of time for the operator to reduce THERMAL POWER in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.2.5.1 REQUIREMENTS Core monitoring is performed using the Incore Detector System to obtain a three dimensional power distribution map. Maximum values of FQ(Z) and FN H obtained from this map may then be compared with the FQ(Z) and limits in the COLR to verify that the limits have not been exceeded.
Measurement of the core power peaking factors in this manner may be used to verify that the measured values of FQ(Z) and FN H remain within their specified limits when one or more of the limits specified by LCO 3.1.4, LCO 3.2.1, LCO 3.2.2, LCO 3.2.3, or LCO 3.2.4 is exceeded, or when LCO 3.1.8 is applicable. If FQ(Z) and FN H remain within their limits when one or more of these parameters exceed their limits, operation at THERMAL POWER may continue because the true initial conditions (the power peaking factors) remain within their specified limits.
Babcock & Wilcox STS                     B 3.2.5-6                                      Rev. 5.0

Power Peaking Factors B 3.2.5 BASES SURVEILLANCE REQUIREMENTS (continued)
Because the limits on FQ(Z) and FN H are preserved when the parameters specified by LCO 3.1.4, LCO 3.2.1, LCO 3.2.2, LCO 3.2.3, and LCO 3.2.4 are within their limits, a Note is provided in the SR to indicate that monitoring of the power peaking factors is required only when complying with the Required Actions of these LCOs and when LCO 3.1.8 is applicable.
Frequencies for monitoring of the power peaking factors are specified in the Action statements of the individual LCOs. These Frequencies are reasonable based on the low probability of a limiting event occurring simultaneously with either FQ(Z) or FN H exceeding its limit, and they provide sufficient time for the operator to obtain a power distribution map from the Incore Detector System. Indefinite THERMAL POWER operation in a Required Action of LCO 3.1.4, LCO 3.2.1, LCO 3.2.2, LCO 3.2.3, or LCO 3.2.4 is not permitted, in order to limit the potential for exceeding both the power peaking factors assumed in the accident analyses due to operation with unanalyzed core power distributions and spatial xenon distributions beyond their analyzed ranges.
REFERENCES         1. 10 CFR 50.46.
Babcock & Wilcox STS                   B 3.2.5-7                                          Rev. 5.0

RPS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protection System (RPS) Instrumentation BASES BACKGROUND           The RPS initiates a reactor trip to protect against violating the core fuel design limits and the Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs). By tripping the reactor, the RPS also assists the Engineered Safety Feature (ESF)
Systems in mitigating accidents.
The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as the LCOs on other reactor system parameters and equipment performance.
Technical Specifications are required by 10 CFR 50.36 to include LSSS for variables that have significant safety functions. LSSS are defined by the regulation as "Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytical Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
                     ---------------------------------REVIEWER'S NOTE-------------------------------------
The term "Limiting Trip Setpoint" [LTSP] is generic terminology for the calculated trip setting (setpoint) value calculated by means of the plant specific setpoint methodology documented in a document controlled under 10 CFR 50.59. The term [LTSP] indicates that no additional margin has been added between the Analytical Limit and the calculated trip setting.
                     "Nominal Trip Setpoint [NTSP]" is the suggested terminology for the actual setpoint implemented in the plant surveillance procedures where margin has been added to the calculated [LTSP]. The as-found and as-left tolerances will apply to the [NTSP] implemented in the Surveillance procedures to confirm channel performance.
Babcock & Wilcox STS                        B 3.3.1-1                                          Rev. 5.0

RPS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
Licensees are to insert the name of the document(s) controlled under 10 CFR 50.59 that contain the methodology for calculating the as-left and as-found tolerances, in Note d of Table 3.3.1-1 for the phrase "[insert the name of a document controlled under 10 CFR 50.59 such as the Technical Requirements Manual or any document incorporated into the facility FSAR]" throughout these Bases.
Where the [LTSP] is not included in Table 3.3.1.1 for the purpose of compliance with 10 CFR 50.36, the plant specific location for the [LTSP]
or [NTSP] must be cited in Note d of Table 3.3.1-1. The brackets indicate plant specific terms may apply, as reviewed and approved by the NRC.
The [Limiting Trip Setpoint (LTSP)] specified in Table 3.3.1-1 is a predetermined setting for a protection channel chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit and thus ensuring that the SL would not be exceeded. As such, the
[LTSP] accounts for uncertainties in setting the channel (e.g., calibration),
uncertainties in how the channel might actually perform (e.g.,
repeatability), changes in the point of action of the channel over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the [LTSP] ensures that SLs are not exceeded. Therefore, the [LTSP] meets the definition of a LSSS (Ref. 1).
Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as "...being capable of performing its safety function(s)." Relying solely on the [LTSP] to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as-found" value of a protection channel setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protection channel with a setting that has been found to be different from the [LTSP] due to some drift of the setting may still be OPERABLE because drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the [LTSP] and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as-found" setting of the protection channel. Therefore, the channel would still be OPERABLE because it would have performed its safety function and the only corrective action required would be to reset the channel within the established as-left tolerance around the [LTSP] to account for further drift during the next surveillance interval.
Babcock & Wilcox STS                      B 3.3.1-2                                                       Rev. 5.0

RPS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
Note that, although the channel is OPERABLE under these circumstances, the trip setpoint must be left adjusted to a value within the as-left tolerance in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned (as-found criteria).
However, there is also some point beyond which the channel may not be able to perform its function due to, for example, greater than expected drift. This value needs to be specified in the Technical Specifications in order to define OPERABILITY of the channels and is designated as the Allowable Value.
If the actual setting (as-found setpoint) of the channel is found to be conservative with respect to the Allowable Value but is beyond the as-found tolerance band, the channel is OPERABLE, but degraded. The degraded condition of the channel will be further evaluated during performance of the SR. This evaluation will consist of resetting the channel setpoint to the [Nominal Trip Setpoint (NTSP)] (within the allowed tolerance), and evaluating the channel response. If the channel is functioning as required and is expected to pass the next surveillance, then the channel is OPERABLE and can be restored to service at the completion of the surveillance. After the surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.
During AOOs, which are those events expected to occur one or more times during the unit's life, the acceptable limits are:
: a. The departure from nucleate boiling ratio (DNBR) shall be maintained above the SL value,
: b. Fuel centerline melt shall not occur, and
: c. The RCS pressure SL of [2750] psig shall not be exceeded.
Maintaining the parameters within the above values ensures that the offsite dose will be within the 10 CFR 20 and 10 CFR 100 criteria during AOOs.
Accidents are events that are analyzed even though they are not expected to occur during the unit's life. The acceptable limit during accidents is that the offsite dose shall be maintained within 10 CFR 100 limits. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.
Babcock & Wilcox STS                   B 3.3.1-3                                        Rev. 5.0

RPS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
RPS Overview The RPS consists of four separate redundant protection channels that receive inputs of neutron flux, RCS pressure, RCS flow, RCS temperature, RCS pump status, reactor building (RB) pressure, main feedwater (MFW) pump status, and turbine status.
Figure [ ] , FSAR, Chapter [7] (Ref. 2), shows the arrangement of a typical RPS protection channel. A protection channel is composed of measurement channels, a manual trip channel, a reactor trip module (RTM), and CONTROL ROD drive (CRD) trip channels. LCO 3.3.1 provides requirements for the individual measurement channels. These channels encompass all equipment and electronics from the point at which the measured parameter is sensed through the bistable relay contacts in the trip string. LCO 3.3.2, "Reactor Protection System (RPS)
Manual Reactor Trip," LCO 3.3.3, "Reactor Protection System (RPS) -
Reactor Trip Module (RTM)," and LCO 3.3.4, "CONTROL ROD Drive (CRD) Trip Devices," discuss the remaining RPS elements.
The RPS instrumentation measures critical unit parameters and compares these to predetermined setpoints. If the setpoint is exceeded, a channel trip signal is generated. The generation of any two trip signals in any of the four RPS channels will result in the trip of the reactor.
The Reactor Trip System (RTS) contains multiple CRD trip channels, two AC trip breakers, and two DC trip breaker pairs that provide a path for power to the CRD System. Additionally, the power for most of the CRDs passes through electronic trip assembly (ETA) relays. The system has two separate paths (or channels), with each path having either two breakers or a breaker and an ETA relay in series. Each path provides independent power to the CRDs. Either path can provide sufficient power to operate all CRDs. Two separate power paths to the CRDs ensure that a single failure that opens one path will not cause an unwanted reactor trip.
The RPS consists of four independent protection channels, each containing an RTM. The RTM receives signals from its own measurement channels that indicate a protection channel trip is required.
The RTM transmits this signal to its own two-out-of-four trip logic and to the two-out-of-four logic of the RTMs in the other three RPS channels.
Whenever any two RPS channels transmit channel trip signals, the RTM logic in each channel actuates to remove 120 VAC power from its associated CRD trip breaker.
Babcock & Wilcox STS                  B 3.3.1-4                                          Rev. 5.0

RPS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
The reactor is tripped by opening circuit breakers that interrupt the power supply to the CRDs. Six breakers are installed to increase reliability and allow testing of the trip system. A one-out-of-two taken twice logic is used to interrupt power to the rods.
The RPS has two bypasses: a shutdown bypass and a channel bypass.
Shutdown bypass allows the withdrawal of safety rods for SDM availability and rapid negative reactivity insertion during unit cooldowns or heatups. Channel bypass is used for maintenance and testing. Test circuits in the trip strings allow complete testing of all RPS trip Functions.
The RPS operates from the instrumentation channels discussed next.
The specific relationship between measurement channels and protection channels differs from parameter to parameter. Three basic configurations are used:
: a. Four completely redundant measurements (e.g., reactor coolant flow) with one channel input to each protection channel,
: b. Four channels that provide similar, but not identical, measurements (e.g., power range nuclear instrumentation where each RPS channel monitors a different quadrant), with one channel input to each protection channel, and
: c. Redundant measurements with combinational trip logic outside of the protection channels and the combined output provided to each protection channel (e.g., main turbine trip instrumentation).
These arrangements and the relationship of instrumentation channels to trip Functions are discussed next to assist in understanding the overall effect of instrumentation channel failure.
Power Range Nuclear Instrumentation Power Range Nuclear Instrumentation channels provide inputs to the following trip Functions:
: 1. Nuclear Overpower
: a. Nuclear Overpower - High Setpoint,
: b. Nuclear Overpower - Low Setpoint,
: 7. Reactor Coolant Pump to Power, Babcock & Wilcox STS                    B 3.3.1-5                                         Rev. 5.0

RPS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
: 8. Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE (Power Imbalance Flow),
: 9. Main Turbine Trip (Control Oil Pressure), and
: 10. Loss of Main Feedwater (LOMFW) Pumps (Control Oil Pressure).
The power range instrumentation has four linear level channels, one for each core quadrant. Each channel feeds one RPS protection channel.
Each channel originates in a detector assembly containing two uncompensated ion chambers. The ion chambers are positioned to represent the top half and bottom half of the core. The individual currents from the chambers are fed to individual linear amplifiers. The summation of the top and bottom is the total reactor power. The difference of the top minus the bottom neutron signal is the measured AXIAL POWER IMBALANCE of the reactor core.
Reactor Coolant System Outlet Temperature The Reactor Coolant System Outlet Temperature provides input to the following Functions:
: 2. RCS High Outlet Temperature and
: 5. RCS Variable Low Pressure.
The RCS Outlet Temperature is measured by two resistance elements in each hot leg, for a total of four. One temperature detector is associated with each protection channel.
Reactor Coolant System Pressure The Reactor Coolant System Pressure provides input to the following Functions:
: 3. RCS High Pressure,
: 4. RCS Low Pressure,
: 5. RCS Variable Low Pressure, and
: 11. Shutdown Bypass RCS High Pressure.
The RPS inputs of reactor coolant pressure are provided by two pressure transmitters in each hot leg, for a total of four. One sensor is associated with each protection channel.
Babcock & Wilcox STS                   B 3.3.1-6                                         Rev. 5.0

RPS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
Reactor Building Pressure The Reactor Building Pressure measurements provide input only to the Reactor Building High Pressure trip, Function 6. There are four RB High Pressure sensors, one associated with each protection channel.
Reactor Coolant Pump Power Monitoring Reactor coolant pump power monitors are inputs to the Reactor Coolant Pump to Power trip, Function 7. Each RCP, operating current, and voltage is measured by four current transformers and four potential transformers driving four overpower and four underpower relays. Each power monitoring channel consists of an overpower relay and an underpower relay. One channel for each pump is associated with each protection channel.
Reactor Coolant System Flow The Reactor Coolant System Flow measurements are an input to the Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE trip, Function 8. The reactor coolant flow inputs to the RPS are provided by eight high accuracy differential pressure transmitters, four on each loop, which measure flow through calibrated flow tubes. One flow input in each loop is associated with each protection channel.
Main Turbine Automatic Stop Oil Pressure Main Turbine Automatic Stop Oil Pressure is an input to the Main Turbine Trip (Control Oil Pressure) reactor trip, Function 9. Each of the four protection channels receives turbine status information from the same four pressure switches monitoring main turbine automatic stop oil pressure. An open indication will be provided to the RPS on a turbine trip. Contact buffers in each protection channel continuously monitor the status of the contact inputs and initiate an RPS trip when a turbine trip is indicated.
Feedwater Pump Control Oil Pressure Feedwater Pump Control Oil Pressure is an input to the Loss of Main Feedwater Pumps (Control Oil Pressure) trip, Function 10. Control oil pressure is measured by four switches on each feedwater pump. One switch on each pump is associated with each protection channel.
Babcock & Wilcox STS                  B 3.3.1-7                                        Rev. 5.0

RPS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
RPS Bypasses The RPS is designed with two types of bypasses: channel bypass and shutdown bypass.
Channel bypass provides a method of placing all Functions in one RPS protection channel in a bypassed condition, and shutdown bypass provides a method of leaving the safety rods withdrawn during cooldown and depressurization of the RCS. Each bypass is discussed next.
Channel Bypass A channel bypass provision is provided to allow for maintenance and testing of the RPS. The use of channel bypass keeps the protection channel trip relay energized regardless of the status of the instrumentation channel of the bistable relay contacts. To place a protection channel in channel bypass, the other three channels must not be in channel bypass. This is ensured by contacts from the other channels being in series with the channel bypass relay. If any contact is open, the second channel cannot be bypassed. The second condition is the closing of the key switch. When the bypass relay is energized, the bypass contact closes, maintaining the channel trip relay in an energized condition. All RPS trips are reduced to a two-out-of-three logic in channel bypass.
Shutdown Bypass During unit cooldown, it is desirable to leave the safety rods withdrawn to provide shutdown capabilities in the event of unusual positive reactivity additions (moderator dilution, etc.).
However, the unit is also depressurized as coolant temperature is decreased. If the safety rods are withdrawn and coolant pressure is decreased, an RCS Low Pressure trip will occur at 1800 psig and the rods will fall into the core. To avoid this, the protection system allows the operator to bypass the low pressure trip and maintain shutdown capabilities. During the cooldown and depressurization, the safety rods are inserted prior to the low pressure trip of 1800 psig. The RCS pressure is decreased to less than 1720 psig, then each RPS channel is placed in shutdown bypass.
Babcock & Wilcox STS                    B 3.3.1-8                                        Rev. 5.0

RPS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
In shutdown bypass, a normally closed contact opens and the operator closes the shutdown bypass key switch. This action bypasses the RCS Low Pressure trip, Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE trip, Reactor Coolant Pump to Power trip, and the RCS Variable Low Pressure trip, and inserts a new RCS High Pressure, 1720 psig trip. The operator can now withdraw the safety rods for additional SDM.
The insertion of the new high pressure trip performs two functions. First, with a trip setpoint of 1720 psig, the bistable prevents operation at normal system pressure, 2155 psig, with a portion of the RPS bypassed. The second function is to ensure that the bypass is removed prior to normal operation. When the RCS pressure is increased during a unit heatup, the safety rods are inserted prior to reaching 1720 psig. The shutdown bypass is removed, which returns the RPS to normal, and system pressure is increased to greater than 1800 psig. The safety rods are then withdrawn and remain at the full out condition for the rest of the heatup.
In addition to the Shutdown Bypass RCS High Pressure trip, the high flux trip setpoint is administratively reduced to 5% RTP while the RPS is in shutdown bypass. This provides a backup to the Shutdown Bypass RCS High Pressure trip and allows low temperature physics testing while preventing the generation of any significant amount of power.
Module Interlock and Test Trip Relay Each channel and each trip module is capable of being individually tested. When a module is placed into the test mode, it causes the test trip relay to open and to indicate an RPS channel trip. Under normal conditions, the channel to be tested is placed in bypass before a module is tested.
[Limiting Trip Setpoints]/Allowable Value The trip setpoints are the normal values at which the bistables are set.
Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION accuracy (i.e.,
                   +/- [rack calibration + comparator setting accuracy]).
The trip setpoints used in the bistables are based on the analytical limits stated in FSAR, Chapter [14] (Ref. 3). The calculation of the [LTSP]
specified in Table 3.3.1-1 is such that adequate protection is provided when all sensor and processing uncertainties and time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those Babcock & Wilcox STS                  B 3.3.1-9                                        Rev. 5.0

RPS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
RPS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 4), the Allowable Values specified in Table 3.3.1-1 in the accompanying LCO are conservatively adjusted with respect to the analytical limits. A detailed description of the methodology used to calculate the [LTSPs], including their explicit uncertainties, is provided in
                   "[Unit Specific Setpoint Methodology]" (Ref. 5). The as-left tolerance and as-found tolerance band methodology is provided in [insert the name of a document controlled under 10 CFR 50.59 such as the Technical Requirements Manual or any document incorporated into the facility FSAR]. The actual trip setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a CHANNEL FUNCTIONAL TEST (CFT). The Allowable Value serves as the as-found trip setpoint Technical Specification OPERABILITY limit for the purpose of the CFT.
The [LTSP] is the value at which the bistable is set and is the expected value to be achieved during calibration. The [LTSP] value is the LSSS and ensures the safety analysis limits are met for the surveillance interval selected when a channel is adjusted based on stated channel uncertainties.
[LTSPs], in conjunction with the use of as-found and as-left tolerances, consistent with the requirements of the Allowable Value ensure that the limits of Chapter 2.0, "Safety Limits," in the Technical Specifications are not violated during AOOs and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed. Note that in LCO 3.3.1 the Allowable Values listed in Table 3.3.1-1 are the least conservative value of the as-found setpoint that a channel can have during a periodic CHANNEL CALIBRATION or CHANNEL FUNCTIONAL TEST.
Each channel can be tested online to verify that the signal and setpoint accuracy are within the specified allowance requirements of Reference 5.
Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated.
Surveillances for the channels are specified in the SR section.
The Allowable Values listed in Table 3.3.1-1 are based on the methodology described in "[Unit Specific Setpoint Methodology]" (Ref. 5),
which incorporates all of the known uncertainties applicable for each channel. The magnitudes of those uncertainties are factored into the Babcock & Wilcox STS                  B 3.3.1-10                                         Rev. 5.0

RPS Instrumentation B 3.3.1 BASES BACKGROUND (continued) determination of each [LTSP]. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes.
APPLICABLE         The RPS Functions to preserve the SLs during all AOOs and mitigates SAFETY             the consequences of DBAs. Each of the analyzed accidents and ANALYSES, LCO,     transients can be detected by one or more RPS Functions. The accident and APPLICABILITY  analysis contained in Reference 6 takes credit for most RPS trip Functions. Functions not specifically credited in the accident analysis were implicitly credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions are high RB pressure, high temperature, turbine trip, and loss of main feedwater. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. These Functions also serve as backups to Functions that were credited in the safety analysis.
Permissive and interlock setpoints allow the blocking of trips during plant startups, and restoration of trips when the permissive conditions are not satisfied, but they are not explicitly modeled in the Safety Analyses.
These permissives and interlocks ensure that the starting conditions are consistent with the safety analysis, before preventive or mitigating actions occur. Because these permissives or interlocks are only one of multiple conservative starting assumptions for the accident analysis, they are generally considered as nominal values without regard to measurement accuracy.
The LCO requires all instrumentation performing an RPS Function to be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. The four channels of each Function in Table 3.3.1-1 of the RPS instrumentation shall be OPERABLE during its specified Applicability to ensure that a reactor trip will be actuated if needed. Additionally, during shutdown bypass with any CRD trip breaker closed, the applicable RPS Functions must also be available. This ensures the capability to trip the withdrawn CONTROL RODS exists at all times that rod motion is possible. The trip Function channels specified in Table 3.3.1-1 are considered OPERABLE when all channel components necessary to provide a reactor trip are functional and in service for the required MODE or Other Specified Condition listed in Table 3.3.1-1.
Required Actions allow maintenance (protection channel) bypass of individual channels, but the bypass activates interlocks that prevent operation with a second channel bypass. Bypass effectively places the unit in a two-out-of-three logic configuration that can still initiate a reactor trip, even with a single failure within the system.
Babcock & Wilcox STS                  B 3.3.1-11                                            Rev. 5.0

RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
For most RPS Functions, the [LTSP] ensures that the departure from nucleate boiling (DNB) or the RCS Pressure SL is not challenged. Cycle specific figures for use during operation are contained in the COLR.
Certain RPS trips function to indirectly protect the SLs by detecting specific conditions that do not immediately challenge SLs but will eventually lead to challenge if no action is taken. These trips function to minimize the unit transients caused by the specific conditions. The Allowable Value for these Functions is selected at the minimum deviation from normal values that will indicate the condition, without risking spurious trips due to normal fluctuations in the measured parameter.
The Allowable Values for bypass removal Functions are stated in the Applicable MODE or Other Specified Condition column of Table 3.3.1-1.
The safety analyses applicable to each RPS Function are discussed next.
: 1. Nuclear Overpower
: a. Nuclear Overpower - High Setpoint The Nuclear Overpower - High Setpoint trip provides protection for the design thermal overpower condition based on the measured out of core fast neutron leakage flux.
The Nuclear Overpower - High Setpoint trip initiates a reactor trip when the neutron power reaches a predefined setpoint at the design overpower limit. Because THERMAL POWER lags the neutron power, tripping when the neutron power reaches the design overpower will limit THERMAL POWER to a maximum value of the design overpower. Thus, the Nuclear Overpower -
High Setpoint trip protects against violation of the DNBR and fuel centerline melt SLs. However, the RCS Variable Low Pressure, and Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE, provide more direct protection. The role of the Nuclear Overpower - High Setpoint trip is to limit reactor THERMAL POWER below the highest power at which the other two trips are known to provide protection.
The Nuclear Overpower - High Setpoint trip also provides transient protection for rapid positive reactivity excursions during power operations. These events include the rod withdrawal accident, the rod ejection accident, and the steam line break accident. By providing a trip during these events, the Nuclear Babcock & Wilcox STS                  B 3.3.1-12                                         Rev. 5.0

RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Overpower - High Setpoint trip protects the unit from excessive power levels and also serves to reduce reactor power to prevent violation of the RCS pressure SL.
Rod withdrawal accident analyses cover a large spectrum of reactivity insertion rates (rod worths), which exhibit slow and rapid rates of power increases. At high reactivity insertion rates, the Nuclear Overpower - High Setpoint trip provides the primary protection. At low reactivity insertion rates, the high pressure trip provides primary protection.
The specified Allowable Value is selected to ensure that a trip occurs before reactor power exceeds the highest point at which the RCS Variable Low Pressure and the Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE trips are analyzed to provide protection against DNB and fuel centerline melt. The Allowable Value does not account for harsh environment induced errors, because the trip will actuate prior to degraded environmental conditions being reached.
: b. Nuclear Overpower - Low Setpoint While in shutdown bypass, with the Shutdown Bypass RCS High Pressure trip OPERABLE, the Nuclear Overpower - Low Setpoint trip must be reduced to  5% RTP. The low power setpoint, in conjunction with the lower Shutdown Bypass RCS High Pressure setpoint, ensure that the unit is protected from excessive power conditions when other RPS trips are bypassed.
The setpoint Allowable Value was chosen to be as low as practical and still lie within the range of the out of core instrumentation.
: 2. RCS High Outlet Temperature The RCS High Outlet Temperature trip, in conjunction with the RCS Low Pressure and RCS Variable Low Pressure trips, provides protection for the DNBR SL. A trip is initiated whenever the reactor vessel outlet temperature approaches the conditions necessary for DNB. Portions of each RCS High Outlet Temperature trip channel are common with the RCS Variable Low Pressure trip. The RCS High Outlet Temperature trip provides steady state protection for the DNBR SL.
Babcock & Wilcox STS               B 3.3.1-13                                         Rev. 5.0

RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The RCS High Outlet Temperature trip limits the maximum RCS temperature to below the highest value for which DNB protection by the Variable Low Pressure trip is ensured. The trip setpoint Allowable Value is selected to ensure that a trip occurs before hot leg temperatures reach the point beyond which the RCS Low Pressure and Variable Low Pressure trips are analyzed. Above the high temperature trip, the variable low pressure trip need not provide protection, because the unit would have tripped already. The setpoint Allowable Value does not reflect errors induced by harsh environmental conditions that the equipment is expected to experience because the trip is not required to mitigate accidents that create harsh conditions in the RB.
: 3. RCS High Pressure The RCS High Pressure trip works in conjunction with the pressurizer and main steam safety valves to prevent RCS overpressurization, thereby protecting the RCS High Pressure SL.
The RCS High Pressure trip has been credited in the accident analysis calculations for slow positive reactivity insertion transients (rod withdrawal accidents and moderator dilution) and loss of feedwater accidents. The rod withdrawal accidents cover a large spectrum of reactivity insertion rates and rod worths that exhibit slow and rapid rates of power increases. At high reactivity insertion rates, the Nuclear Overpower - High Setpoint trip provides the primary protection. At low reactivity insertion rates, the RCS High Pressure trip provides the primary protection.
The setpoint Allowable Value is selected to ensure that the RCS High Pressure SL is not challenged during steady state operation or slow power increasing transients. The setpoint Allowable Value does not reflect errors induced by harsh environmental conditions because the equipment is not required to mitigate accidents that create harsh conditions in the RB.
: 4. RCS Low Pressure The RCS Low Pressure trip, in conjunction with the RCS High Outlet Temperature and Variable Low Pressure trips, provides protection for the DNBR SL. A trip is initiated whenever the system pressure approaches the conditions necessary for DNB. The RCS Low Pressure trip provides DNB low pressure limit for the RCS Variable Low Pressure trip.
Babcock & Wilcox STS                B 3.3.1-14                                         Rev. 5.0

RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The RCS Low Pressure setpoint Allowable Value is selected to ensure that a reactor trip occurs before RCS pressure is reduced below the lowest point at which the RCS Variable Low Pressure trip is analyzed. The RCS Low Pressure trip provides protection for primary system depressurization events and has been credited in the accident analysis calculations for small break loss of coolant accidents (LOCAs). Consequently, harsh RB conditions created by small break LOCAs can affect performance of the RCS pressure sensors and transmitters. Therefore, degraded environmental conditions are considered in the Allowable Value determination.
: 5. RCS Variable Low Pressure The RCS Variable Low Pressure trip, in conjunction with the RCS High Outlet Temperature and RCS Low Pressure trips, provides protection for the DNBR SL. A trip is initiated whenever the system parameters of pressure and temperature approach the conditions necessary for DNB. The RCS Variable Low Pressure trip provides a floating low pressure trip based on the RCS High Outlet Temperature within the range specified by the RCS High Outlet Temperature and RCS Low Pressure trips.
The RCS Variable Low Pressure setpoint Allowable Value is selected to ensure that a trip occurs when temperature and pressure approach the conditions necessary for DNB while operating in a temperature pressure region constrained by the low pressure and high temperature trips. The RCS Variable Low Pressure trip is not assumed for transient protection in the unit safety analysis; therefore, determination of the setpoint Allowable Value does not account for errors induced by a harsh RB environment.
: 6. Reactor Building High Pressure The Reactor Building High Pressure trip provides an early indication of a high energy line break (HELB) inside the RB. By detecting changes in the RB pressure, the RPS can provide a reactor trip before the other system parameters have varied significantly. Thus, this trip acts to minimize accident consequences. It also provides a backup for RPS trip instruments exposed to an RB HELB environment.
The Allowable Value for RB High Pressure trip is set at the lowest value consistent with avoiding spurious trips during normal operation.
The electronic components of the RB High Pressure trip are located in an area that is not exposed to high temperature steam Babcock & Wilcox STS                 B 3.3.1-15                                       Rev. 5.0

RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) environments during HELB transients. The components are exposed to high radiation conditions. Therefore, the determination of the setpoint Allowable Value accounts for errors induced by the high radiation.
: 7. Reactor Coolant Pump to Power The Reactor Coolant Pump to Power trip provides protection for changes in the reactor coolant flow due to the loss of multiple RCPs.
Because the flow reduction lags loss of power indications due to the inertia of the RCPs, the trip initiates protective action earlier than a trip based on a measured flow signal.
The trip also prevents operation with both pumps in either coolant loop tripped. Under these conditions, core flow and core fluid mixing are insufficient for adequate heat transfer. Thus, the Reactor Coolant Pump to Power trip functions to protect the DNBR and fuel centerline melt SLs.
The Reactor Coolant Pump to Power trip has been credited in the accident analysis calculations for the loss of four RCPs. The trip also provides the primary protection for the loss of a pump or pumps, which would result in both pumps in a single steam generator loop being tripped.
The Allowable Value for the Reactor Coolant Pump to Power trip setpoint is selected to prevent normal power operation unless at least three RCPs are operating. RCP status is monitored by power transducers on each pump. These relays indicate a loss of an RCP on overpower with an Allowable Value of  14,400 kW and on underpower with an Allowable Value of  1752 kW. The overpower Allowable Value is selected low enough to detect locked rotor conditions (although credit is not allowed for this capability) but high enough to avoid a spurious trip on the in rush current when the pumps start. The underpower Allowable Value is selected to reliably trip on loss of voltage to the RCPs. Neither the reactor power nor the pump power Allowable Value account for instrumentation errors caused by harsh environments because the trip Function is not required to respond to events that could create harsh environments around the equipment.
Babcock & Wilcox STS                B 3.3.1-16                                           Rev. 5.0

RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 8. Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE The Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE trip provides steady state protection for the power imbalance SLs. A reactor trip is initiated when the core power, AXIAL POWER IMBALANCE, and reactor coolant flow conditions indicate an approach to DNB or fuel centerline melt limits.
This trip supplements the protection provided by the Reactor Coolant Pump to Power trip, through the power to flow ratio, for loss of reactor coolant flow events. The power to flow ratio provides direct protection for the DNBR SL for the loss of a single RCP and for locked RCP rotor accidents. The imbalance portion of the trip is credited for steady state protection only.
The power to flow ratio of the Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE trip also provides steady state protection to prevent reactor power from exceeding the allowable power when the primary system flow rate is less than full four pump flow. Thus, the power to flow ratio prevents overpower conditions similar to the Nuclear Overpower trip. This protection ensures that during reduced flow conditions the core power is maintained below that required to begin DNB.
The Allowable Value is selected to ensure that a trip occurs when the core power, axial power peaking, and reactor coolant flow conditions indicate an approach to DNB or fuel centerline melt limits. By measuring reactor coolant flow and by tripping only when conditions approach a SL, the unit can operate with the loss of one pump from a four pump initial condition. The Allowable Value for this Function is given in the unit COLR because the cycle specific core peaking changes affect the Allowable Value.
: 9. Main Turbine Trip (Control Oil Pressure)
The Main Turbine Trip Function trips the reactor when the main turbine is lost at high power levels. The Main Turbine Trip Function provides an early reactor trip in anticipation of the loss of heat sink associated with a turbine trip. The Main Turbine Trip Function was added to the B&W designed units in accordance with NUREG-0737 (Ref. 7) following the Three Mile Island Unit 2 accident. The trip lowers the probability of an RCS power operated relief valve (PORV) actuation for turbine trip cases. This trip is activated at higher power levels, thereby limiting the range through which the Integrated Control System must provide an automatic runback on a turbine trip.
Babcock & Wilcox STS                B 3.3.1-17                                         Rev. 5.0

RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Each of the four turbine oil pressure switches feeds all four protection channels through buffers that continuously monitor the status of the contacts. Therefore, failure of any pressure switch affects all protection channels.
For the Main Turbine Trip (Control Oil Pressure) bistable, the Allowable Value of 45 psig is selected to provide a trip whenever feedwater pump control oil pressure drops below the normal operating range. To ensure that the trip is enabled as required by the LCO, the reactor power bypass is set with an Allowable Value of 45% RTP. The turbine trip is not required to protect against events that can create a harsh environment in the turbine building.
Therefore, errors induced by harsh environments are not included in the determination of the setpoint Allowable Value.
: 10. Loss of Main Feedwater Pumps (Control Oil Pressure)
The Loss of Main Feedwater Pumps (Control Oil Pressure) trip provides a reactor trip at high power levels when both MFW pumps are lost. The trip provides an early reactor trip in anticipation of the loss of heat sink associated with the LOMFW. This trip was added in accordance with NUREG-0737 (Ref. 7) following the Three Mile Island Unit 2 accident. This trip provides a reactor trip at high power levels for an LOMFW to minimize challenges to the PORV.
For the feedwater pump control oil pressure bistable, the Allowable Value of 55 psig is selected to provide a trip whenever feedwater pump control oil pressure drops below the normal operating range.
To ensure that the trip is enabled as required by the LCO, the reactor power bypass is set with an Allowable Value of 15% RTP. The Loss of Main Feedwater Pumps (Control Oil Pressure) trip is not required to protect against events that can create a harsh environment in the turbine building. Therefore, errors caused by harsh environments are not included in the determination of the setpoint Allowable Value.
: 11. Shutdown Bypass RCS High Pressure The RPS Shutdown Bypass RCS High Pressure is provided to allow for withdrawing the CONTROL RODS prior to reaching the normal RCS Low Pressure trip setpoint. The shutdown bypass provides trip protection during deboration and RCS heatup by allowing the operator to withdraw the safety groups of CONTROL RODS. This makes their negative reactivity available to terminate inadvertent reactivity excursions. Use of the shutdown bypass trip requires that the neutron power trip setpoint be reduced to 5% of full power or Babcock & Wilcox STS                 B 3.3.1-18                                          Rev. 5.0

RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) less. The Shutdown Bypass RCS High Pressure trip forces a reactor trip to occur whenever the unit switches from power operation to shutdown bypass or vice versa. This ensures that the CONTROL RODS are all inserted and the flux distribution is known before power operation can begin. The operator is required to remove the shutdown bypass, reset the Nuclear Overpower - High Power trip setpoint, and again withdraw the safety rod groups before proceeding with startup.
Accidents analyzed in the FSAR, Chapter [14] (Ref. 3), do not describe events that occur during shutdown bypass operation, because the consequences of these events are enveloped by the events presented in the FSAR.
During shutdown bypass operation with the Shutdown Bypass RCS High Pressure trip active with a setpoint of  [1720] psig and the Nuclear Overpower - Low Setpoint set at or below 5% RTP, the (numbered) trip Functions listed below can be bypassed. Under these conditions, the Shutdown Bypass RCS High Pressure trip and the Nuclear Overpower - Low Setpoint trip act to prevent unit conditions from reaching a point where actuation of these trip Functions is necessary.
1.a Nuclear Overpower - High Setpoint,
: 4. RCS Low Pressure,
: 5. RCS Variable Low Pressure,
: 7. Reactor Coolant Pump to Power, and
: 8. Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE.
The Shutdown Bypass RCS High Pressure Function's Allowable Value is selected to ensure a trip occurs before producing THERMAL POWER.
The RPS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
In MODES 1 and 2, the following (numbered) trip Functions shall be OPERABLE because the reactor is critical in these MODES. These trips are designed to take the reactor subcritical to maintain the SLs during AOOs and to assist the ESFAS in providing acceptable consequences during accidents.
Babcock & Wilcox STS                  B 3.3.1-19                                       Rev. 5.0

RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 1.a Nuclear Overpower - High Setpoint,
: 2. RCS High Outlet Temperature,
: 3. RCS High Pressure,
: 4. RCS Low Pressure,
: 5. RCS Variable Low Pressure,
: 6. Reactor Building High Pressure,
: 7. Reactor Coolant Pump to Power, and
: 8. Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE.
Functions 1, 3, 4, 5, 7, and 8 just listed may be bypassed in MODE 2 when RCS pressure is below [1720] psig, provided the Shutdown Bypass RCS High Pressure and the Nuclear Overpower - Low setpoint trip are placed in operation. Under these conditions, the Shutdown Bypass RCS High Pressure trip and the Nuclear Overpower - Low setpoint trip act to prevent unit conditions from reaching a point where actuation of these Functions is necessary.
In MODE 3 when not operating in shutdown bypass but with any CRD trip breaker in the closed position and the CRD System capable of rod withdrawal, the Nuclear Overpower-High Setpoint trip and the RCS High Pressure trip are required to be OPERABLE.
Two other Functions are required to be OPERABLE during portions of MODE 1. These are the Main Turbine Trip (Control Oil Pressure) and the Loss of Main Feedwater Pumps (Control Oil Pressure) trip. These Functions are required to be OPERABLE above [45]% RTP and
[15]% RTP, respectively. Analyses presented in BAW-1893 (Ref. 8) have shown that for operation below these power levels, these trips are not necessary to minimize challenges to the PORVs as required by NUREG-0737 (Ref. 7).
Because the only safety function of the RPS is to trip the CONTROL RODS, the RPS is not required to be OPERABLE in MODE 3, 4, or 5 if the reactor trip breakers are open, or the CRD System is incapable of rod withdrawal. Similarly, the RPS is not required to be OPERABLE in MODE 6 when the CONTROL RODS are decoupled from the CRDs.
Babcock & Wilcox STS                  B 3.3.1-20                                      Rev. 5.0

RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
However, in MODE 2, 3, 4, or 5, the Shutdown Bypass RCS High Pressure and Nuclear Overpower - Low setpoint trips are required to be OPERABLE if the CRD trip breakers are closed and the CRD System is capable of rod withdrawal. Under these conditions, the Shutdown Bypass RCS High Pressure and Nuclear Overpower - Low setpoint trips are sufficient to prevent an approach to conditions that could challenge SLs.
ACTIONS            Conditions A, B, and C are applicable to all RPS protection Functions. If a channel's trip setpoint is found nonconservative with respect to the required Allowable Value in Table 3.3.1-1, or the channel is not functioning as required, or the transmitter, instrument loop, signal processing electronics or bistable is found inoperable, the channel must be declared inoperable and Condition A or Conditions A and B entered immediately.
When the number of inoperable channels in a trip Function exceed those specified in the related Conditions associated with a trip Function, then the unit is outside the safety analysis. Therefore, LCO 3.0.3 must be immediately entered if applicable in the current MODE of operation.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
If a unit is to take credit for topical reports as the basis for justifying Completion Times, the reports must be supported by an NRC Staff Safety Evaluation Report (SER) that establishes the acceptability of each topical report for that unit.
A.1 If one or more Functions in one protection channel become inoperable, the affected protection channel must be placed in bypass or trip. If the channel is bypassed, all RPS Functions are placed in a two-out-of-three logic configuration and the bypass of any other channel is prevented. In this configuration, the RPS can still perform its safety function in the presence of a random failure of any single channel. Alternatively, the inoperable channel can be placed in trip. Tripping the affected protection channel places all RPS Functions in a one-out-of-three configuration.
Operation in the two-out-of-three configuration or in the one-out-of-three configuration may continue indefinitely based on the NRC SER for BAW-10167, Supplement 2 (Ref. 9). In this configuration, the RPS is capable of performing its trip Function in the presence of any single random failure. The 1 hour Completion Time is sufficient to perform Required Action A.1.
Babcock & Wilcox STS                      B 3.3.1-21                                                      Rev. 5.0

RPS Instrumentation B 3.3.1 BASES ACTIONS (continued)
B.1 and B.2 For Required Action B.1 and Required Action B.2, if one or more Functions in two protection channels become inoperable, one of two inoperable protection channels must be placed in trip and the other in bypass. These Required Actions place all RPS Functions in a one-out-of-two logic configuration and prevent bypass of a second channel. In this configuration, the RPS can still perform its safety functions in the presence of a random failure of any single channel. The 1 hour Completion Time is sufficient time to perform Required Action B.1 and Required Action B.2. [Alternatively, a Completion Time can be determined for Required Action B 1 in accordance with the Risk Informed Completion Time Program.]
C.1 Required Action C.1 directs entry into the appropriate Condition referenced in Table 3.3.1-1. The applicable Condition referenced in the table is Function dependent. If the Required Action and the associated Completion Time of Condition A or B are not met or if more than two channels are inoperable, Condition C is entered to provide for transfer to the appropriate subsequent Condition.
D.1 and D.2 If the Required Action and associated Completion Time of Condition A or B are not met and Table 3.3.1-1 directs entry into Condition D, the unit must be brought to a MODE in which the specified RPS trip Functions are not required to be OPERABLE. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and to open all CRD trip breakers without challenging plant systems.
E.1 If the Required Action and associated Completion Time of Condition A or B are not met and Table 3.3.1-1 directs entry into Condition E, the unit must be brought to a MODE in which the specified RPS trip Functions are not required to be OPERABLE. To achieve this status, all CRD trip breakers must be opened. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to open CRD trip breakers without challenging plant systems.
Babcock & Wilcox STS                 B 3.3.1-22                                         Rev. 5.0

RPS Instrumentation B 3.3.1 BASES ACTIONS (continued)
F.1 If the Required Action and associated Completion Time of Condition A or B are not met and Table 3.3.1-1 directs entry into Condition F, the unit must be brought to a MODE in which the specified RPS trip Function is not required to be OPERABLE. To achieve this status, THERMAL POWER must be reduced < [45]% RTP. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach
[45]% RTP from full power conditions in an orderly manner without challenging plant systems.
G.1 If the Required Action and associated Completion Time of Condition A or B are not met and Table 3.3.1-1 directs entry into Condition G, the unit must be brought to a MODE in which the specified RPS trip Function is not required to be OPERABLE. To achieve this status, THERMAL POWER must be reduced < [15]% RTP. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach
[15]% RTP from full power conditions in an orderly manner without challenging plant systems.
SURVEILLANCE       The SRs for each RPS Function are identified by the SRs column of REQUIREMENTS       Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, CHANNEL CALIBRATION, and RPS RESPONSE TIME testing.
The SRs are modified by a Note. The [first] Note directs the reader to Table 3.3.1-1 to determine the correct SRs to perform for each RPS Function.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
The CHANNEL FUNCTIONAL TEST Frequencies are based on approved topical reports. For a licensee to use these times, the licensee must justify the Frequencies as required by the NRC Staff SER for the topical report.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Notes c and d are applied to the setpoint verification Surveillances for each RPS Instrumentation Function in Table 3.3.1-1 unless one or more of the following exclusions apply:
Babcock & Wilcox STS                      B 3.3.1-23                                                      Rev. 5.0

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
: 1. Manual actuation circuits, automatic actuation logic circuits or instrument functions that drive input from contacts which have no associated sensor or adjustable device e.g., limit switches, breaker position switches, manual actuation switches, float switches, proximity detectors, etc. are excluded. In addition, those permissives and interlocks that derive input from a sensor or adjustable device that is tested as part of another TS function are excluded.
: 2. Settings associated with safety relief valves are excluded. The performance of these components is already controlled (i.e., trended with as-left and as-found limits) under ASME Code for Operation and Maintenance of Nuclear Power Plants testing program.
: 3. Functions and Surveillance Requirements which test only digital components are normally excluded. There is no expected change in result between SR performances for these components. Where separate as-left and as-found tolerance is established for digital component SRs, the requirements would apply.
SR 3.3.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; therefore, it is key in verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If the channels are normally off scale during times when surveillance is required, the CHANNEL CHECK will only verify that they are off scale in the same direction. Off scale low current loop channels are verified to be reading at the bottom of the range and not failed downscale.
Babcock & Wilcox STS                      B 3.3.1-24                                                      Rev. 5.0

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
The agreement criteria includes an expectation of one decade of overlap when transitioning between neutron flux instrumentation. For example, during a power increase near the top of the scale of the intermediate range monitors, a power range monitor reading is expected with at least one decade overlap. Without such an overlap, the power range monitors are considered inoperable unless it is clear that an intermediate range monitor inoperability is responsible for the lack of the expected overlap.
[ The Frequency of once every 12 hours, about once every shift, is based on operating experience that demonstrates channel failure is rare. Since the probability of two random failures in redundant channels in any 12 hour period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
The CHANNEL CHECK supplements less formal but more frequent checks of channel OPERABILITY during normal operational use of the displays associated with the LCO's required channels.
For Functions that trip on a combination of several measurements, such as the Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE Function, the CHANNEL CHECK must be performed on each input.
SR 3.3.1.2 This SR is the performance of a heat balance calibration for the power range channels when reactor power is > 15% RTP. The heat balance calibration consists of a comparison of the results of the calorimetric with the power range channel output. The outputs of the power range channels are normalized to the calorimetric. Note 1 to the SR states if the absolute difference between the calorimetric and the Nuclear Instrumentation System (NIS) channel output is > [2]% RTP, the NIS is Babcock & Wilcox STS                        B 3.3.1-25                                                      Rev. 5.0

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) not declared inoperable but must be adjusted. If the NIS channel cannot be properly adjusted, the channel is declared inoperable. Note 2 clarifies that this Surveillance is required only if reactor power is  15% RTP and that 24 hours is allowed for performing the first Surveillance after reaching 15% RTP. At lower power levels, calorimetric data are inaccurate.
The power range channel's output shall be adjusted consistent with the calorimetric results if the absolute difference between the calorimetric and the power range channel's output is > [2]% RTP. The value of [2]% is adequate because this value is assumed in the safety analyses of FSAR, Chapter [14] (Ref. 3). These checks and, if necessary, the adjustment of the power range channels ensure that channel accuracy is maintained within the analyzed error margins. [ The 24 hour Frequency is adequate, based on unit operating experience, which demonstrates the change in the difference between the power range indication and the calorimetric results rarely exceeds a small fraction of [2]% in any 24 hour period.
Furthermore, the control room operators monitor redundant indications and alarms to detect deviations in channel outputs.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.3.1.3 A comparison of power range nuclear instrumentation channels against incore detectors shall be performed when reactor power is > 15% RTP.
The SR is modified by two Notes. Note 2 clarifies that 24 hours is allowed for performing the first Surveillance after reaching 15% RTP.
Note 1 states if the absolute difference between the power range and incore measurements is  [2]% RTP, the power range channel is not inoperable, but an adjustment of the measured imbalance to agree with the incore measurements is necessary. If the power range channel cannot be properly recalibrated, the channel is declared inoperable. The Babcock & Wilcox STS                      B 3.3.1-26                                                      Rev. 5.0

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) calculation of the Allowable Value envelope assumes a difference in out of core to incore measurements of 2.5%. Additional inaccuracies beyond those that are measured are also included in the [LTSP] envelope calculation. [ The 31 day Frequency is adequate, considering that long term drift of the excore linear amplifiers is small and burnup of the detectors is slow. Also, the excore readings are a strong function of the power produced in the peripheral fuel bundles, and do not represent an integrated reading across the core. The slow changes in neutron flux during the fuel cycle can also be detected at this interval.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.3.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required RPS channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Setpoints must be found conservative with respect to the Allowable Values specified in Table 3.3.1-1. Any setpoint adjustment shall be consistent with the assumptions of the current unit specific setpoint analysis.
The as-found and as-left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in BAW-10167 (Ref. 10).
Babcock & Wilcox STS                      B 3.3.1-27                                                      Rev. 5.0

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
[ The Frequency of [45] days on a STAGGERED TEST BASIS is consistent with the calculations of Reference 9 that indicate the RPS retains a high level of reliability for this test interval.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.3.1.4 is modified by two Notes as identified in Table 3.3.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value.
Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.
The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the [LTSP]. Where a setpoint more conservative than the [LTSP] is used in the plant surveillance procedures [NTSP], the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the [LTSP], then the channel shall be declared inoperable.
The second Note also requires that [LTSP] and the methodologies for calculating the as-left and the as-found tolerances be in [insert the facility FSAR reference or the name of any document incorporated into the facility FSAR by reference].
Babcock & Wilcox STS                        B 3.3.1-28                                                      Rev. 5.0

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.1.5 A Note to the Surveillance indicates that neutron detectors are excluded from CHANNEL CALIBRATION. This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response.
A CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor. The test verifies that the channel responds to the measured parameter within the necessary range and accuracy.
CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift to ensure that the instrument channel remains operational between successive tests. CHANNEL CALIBRATION shall find that measurement errors and bistable setpoint errors are within the assumptions of the unit specific setpoint analysis. CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint analysis.
Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the resistance temperature detectors (RTD) sensors is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.
[ The Frequency is justified by the assumption of an [18] month calibration interval in the determination of the magnitude of equipment drift in the
[LTSP] analysis.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                        B 3.3.1-29                                                      Rev. 5.0

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.1 5 is modified by two Notes as identified in Table 3.3.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value.
Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.
The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the [LTSP]. Where a setpoint more conservative than the [LTSP] is used in the plant surveillance procedures [NTSP], the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the [LTSP], then the channel shall be declared inoperable.
The second Note also requires that [LTSP] and the methodologies for calculating the as-left and the as-found tolerances be in [insert the facility FSAR reference or the name of any document incorporated into the facility FSAR by reference].
SR 3.3.1.6 This SR verifies individual channel actuation response times are less than or equal to the maximum values assumed in the accident analysis.
Individual component response times are not modeled in the analyses.
The analyses model the overall, or total, elapsed time from the point at which the parameter exceeds the analytical limit at the sensor to the point of rod insertion. Response time testing acceptance criteria for this unit are included in Reference 2.
Babcock & Wilcox STS                  B 3.3.1-30                                         Rev. 5.0

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
A Note to the Surveillance indicates that neutron detectors are excluded from RPS RESPONSE TIME testing. This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response.
[ Response time tests are conducted on an [18] month STAGGERED TEST BASIS. Testing of the final actuation devices, which make up the bulk of the response time, is included in the testing of each channel.
Therefore, staggered testing results in response time verification of these channels every [18] months. The [18] month Frequency is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
REFERENCES         1.      Regulatory Guide 1.105, Revision 3, "Setpoints for Safety Related Instrumentation."
: 2.      FSAR, Chapter [7].
: 3.      FSAR, Chapter [14].
: 4.      10 CFR 50.49.
: 5.      [Unit Specific Setpoint Methodology].
: 6.      [Unit Specific Accident Analysis].
: 7.      NUREG-0737, November 1979.
: 8.      BAW-1893.
Babcock & Wilcox STS                        B 3.3.1-31                                                      Rev. 5.0

RPS Instrumentation B 3.3.1 BASES REFERENCES (continued)
: 9. NRC SER for BAW-10167, Supplement 2, July 8, 1992.
: 10. BAW-10167, May 1986.
Babcock & Wilcox STS            B 3.3.1-32                                  Rev. 5.0

RPS Manual Reactor Trip B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Reactor Protection System (RPS) Manual Reactor Trip BASES BACKGROUND           The RPS Manual Reactor Trip provides the operator with the capability to trip the reactor from the control room in the absence of any other trip condition. Manual trip is provided by a trip push button on the main control board. This push button operates four electrically independent switches, one for each train. This trip is independent of the automatic trip system. As shown in Figure [ ] , FSAR, Chapter [7] (Ref. 1), power for the CONTROL ROD drive (CRD) breaker undervoltage coils and contactor coils comes from the reactor trip modules (RTMs). The manual trip switches are located between the RTM output and the breaker undervoltage coils. Opening of the switches opens the lines to the breakers, tripping them. The switches also energize the breaker shunt trip mechanisms. There is a separate switch in series, with the output of each of the four RTMs. All switches are actuated through a mechanical linkage from a single push button.
APPLICABLE           The Manual Reactor Trip ensures that the control room operator can SAFETY               initiate a reactor trip at any time. The Manual Reactor Trip Function is ANALYSES             required as a backup to the automatic trip functions and allows operators to shut down the reactor whenever any parameter is rapidly trending toward its trip setpoint.
The Manual Reactor Trip Function satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                  The LCO on the RPS Manual Reactor Trip requires that the trip shall be OPERABLE whenever the reactor is critical or any time any control rod breaker is closed and rods are capable of being withdrawn, including shutdown bypass. This enables the operator to terminate any reactivity excursion that in the operator's judgment requires protective action, even if no automatic trip condition exists.
The Manual Reactor Trip Function is composed of four electrically independent trip switches sharing a common mechanical push button.
Babcock & Wilcox STS                     B 3.3.2-1                                      Rev. 5.0

RPS Manual Reactor Trip B 3.3.2 BASES APPLICABILITY      The Manual Reactor Trip Function is required to be OPERABLE in MODES 1 and 2. It is also required to be OPERABLE in MODES 3, 4, and 5 if any CRD trip breaker is in the closed position and if the CRD System is capable of rod withdrawal. The only safety function of the RPS is to trip the CONTROL RODS; therefore, the Manual Reactor Trip Function is not needed in MODE 3, 4, or 5 if the reactor trip breakers are open or if the CRD System is incapable of rod withdrawal. Similarly, the RPS Manual Reactor Trip is not needed in MODE 6 when the CONTROL RODS are decoupled from the CRDs.
ACTIONS            A.1 Condition A applies when the Manual Reactor Trip Function is found inoperable. One hour is allowed to restore Function to OPERABLE status. The automatic functions and various alternative manual trip methods, such as removing power to the RTMs, are still available. The 1 hour Completion Time is sufficient time to correct minor problems.
B.1 and B.2 With the Manual Reactor Trip Function inoperable and unable to be returned to OPERABLE status within 1 hour in MODE 1, 2, or 3, the unit must be placed in a MODE in which manual trip is not required. Required Action B.1 and Required Action B.2 place the unit in at least MODE 3 with all CRD trip breakers open within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.
C.1 With the Manual Reactor Trip Function inoperable and unable to be returned to OPERABLE status within 1 hour in MODE 4 or 5, the unit must be placed in a MODE in which manual trip is not required. To achieve this status, all CRD trip breakers must be opened. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to open all CRD trip breakers without challenging unit systems.
Babcock & Wilcox STS                 B 3.3.2-2                                         Rev. 5.0

RPS Manual Reactor Trip B 3.3.2 BASES SURVEILLANCE       SR 3.3.2.1 REQUIREMENTS This SR requires the performance of a CHANNEL FUNCTIONAL TEST of the Manual Reactor Trip Function. This test verifies the OPERABILITY of the Manual Reactor Trip by actuation of the CRD trip breakers. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Frequency shall be once prior to each reactor startup if not performed within the preceding 7 days to ensure the OPERABILITY of the Manual Reactor Trip Function prior to achieving criticality. The Frequency was developed in consideration that these Surveillances are only performed during a unit outage.
REFERENCES         1. FSAR, Chapter [7].
Babcock & Wilcox STS                   B 3.3.2-3                                       Rev. 5.0

RPS - RTM B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Reactor Protection System (RPS) - Reactor Trip Module (RTM)
BASES BACKGROUND           The RPS consists of four independent protection channels, each containing an RTM. Figure [ ], FSAR, Chapter [7] (Ref. 1), shows a typical RPS protection channel and the relationship of the RTM to the RPS instrumentation, manual trip, and CONTROL ROD drive (CRD) trip devices. The RTM receives bistable trip signals from the functions in its own channel and channel trip signals from the other three RPS - RTMs.
The RTM provides these signals to its own two-out-of-four trip logic and transmits its own channel trip signal to the two-out-of-four logic of the RTMs in the other three RPS channels. Whenever any two RPS channels transmit channel trip signals, the RTM logic in each channel actuates to remove 120 VAC power from its associated CRD trip device.
The RPS trip scheme consists of series contacts that are operated by bistables. During normal unit operations, all contacts are closed and the RTM channel trip relay remains energized. However, if any trip parameter exceeds its setpoint, its associated contact opens, which de-energizes the channel trip relay.
When an RTM channel trip relay de-energizes, several things occur:
: a. Each of the four (4) output logic relays "informs" its associated RPS channel that a reactor trip signal has occurred in the tripped RPS channel,
: b. The contacts in the trip device circuitry, powered by the tripped channel, open, but the trip device remains energized through the closed contacts from the other RTMs. (This condition exists in each RPS - RTM. Each RPS - RTM controls power to a trip device.), and
: c. The contact in parallel with the channel reset switch opens and the trip is sealed in. To re-energize the channel trip relay, the channel reset switch must be depressed after the trip condition has cleared.
When the second RPS channel senses a reactor trip condition, the output logic relays for the second channel de-energize and open contacts that supply power to the trip devices. With contacts opened by two separate RPS channels, power to the trip devices is interrupted and the CONTROL RODS fall into the core.
Babcock & Wilcox STS                     B 3.3.3-1                                         Rev. 5.0

RPS - RTM B 3.3.3 BASES BACKGROUND (continued)
A minimum of two out of four RTMs must sense a trip condition to cause a reactor trip. Also, because the bistable relay contacts for each function are in series with the channel trip relays, two channel trips caused by different trip functions can result in a reactor trip.
APPLICABLE         Accident analyses rely on a reactor trip for protection of reactor core SAFETY             integrity, reactor coolant pressure boundary integrity, and reactor building ANALYSES           OPERABILITY. A reactor trip must occur when needed to prevent accident conditions from exceeding those calculated in the accident analyses. More detailed descriptions of the applicable accident analyses are found in the bases for each of the RPS trip Functions in LCO 3.3.1, "Reactor Protection System (RPS) Instrumentation."
RTM response time is included in the overall required response time for each RPS trip and is not specified separately.
The RTMs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The RTM LCO requires all four RTMs to be OPERABLE. Failure of any RTM renders a portion of the RPS inoperable and reduces the reliability of the affected Functions.
Four RTMs must be OPERABLE to ensure that a reactor trip would occur if needed any time the reactor is critical. OPERABILITY is defined as the RTM being able to receive and interpret trip signals from its own and other RPS channels and to open its associated trip device.
The requirement of four channels to be OPERABLE ensures that a minimum of two RPS channels will remain OPERABLE if a single failure has occurred in one channel and if a second channel has been bypassed for surveillance or maintenance. This two-out-of-four trip logic also ensures that a single RPS channel failure will not cause an unwanted reactor trip. Violation of this LCO could result in a trip signal not causing a reactor trip when needed.
APPLICABILITY      The RTMs are required to be OPERABLE in MODES 1 and 2. They are also required to be OPERABLE in MODES 3, 4, and 5 if any CRD trip breakers are in the closed position and the CRD System is capable of rod withdrawal. The RTMs are designed to ensure a reactor trip would occur, if needed, any time the reactor is critical. This condition can exist in all of these MODES; therefore, the RTMs must be OPERABLE.
Babcock & Wilcox STS                   B 3.3.3-2                                          Rev. 5.0

RPS - RTM B 3.3.3 BASES ACTIONS            A.1.1, A.1.2, and A.2 When an RTM is inoperable, the associated CRD trip breaker must then be placed in a condition that is equivalent to a tripped condition for the RTM. Required Action A.1.1 or Required Action A.1.2 requires this either by tripping the CRD trip breaker or by removing power to the CRD trip device. Tripping one RTM or removing power opens one set of CRD trip devices. Power to hold up CONTROL RODS is still provided via the parallel CRD trip device(s). Therefore, a reactor trip will not occur until a second protection channel trips.
To ensure the trip signal is registered in the other channels, Required Action A.2 requires that the inoperable RTM be removed from the cabinet. This action causes the electrical interlocks to indicate a tripped channel in the remaining three RTMs. Operation in this condition is allowed indefinitely because the actions put the RPS into a one-out-of-three configuration. The 1 hour Completion Time is sufficient time to perform the Required Actions.
B.1, B.2.1, and B.2.2 Condition B applies if two or more RTMs are inoperable or if the Required Actions of Condition A are not met within the required Completion Time in MODE 1, 2, or 3. In this case, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 with all CRD trip breakers open or with power from all CRD trip breakers removed within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.
C.1 and C.2 Condition C applies if two or more RTMs are inoperable or if the Required Actions of Condition A are not met within the required Completion Time in MODE 4 or 5. In this case, the unit must be placed in a MODE in which the LCO does not apply. This is done by opening all CRD trip breakers or removing power from all CRD trip breakers. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to open all CRD trip breakers or remove power from all CRD trip breakers without challenging unit systems.
Babcock & Wilcox STS                  B 3.3.3-3                                         Rev. 5.0

RPS - RTM B 3.3.3 BASES SURVEILLANCE       SR 3.3.3.1 REQUIREMENTS
                   -----------------------------------REVIEWERS NOTE-----------------------------------
The CHANNEL FUNCTIONAL TEST Frequency is approved for all B&W power plants except for TMI based on an approved topical report. No further evaluations or justifications are required for the evaluated plants to incorporate the 23 day STAGGERED TEST BASIS Frequency.
The SRs include performance of a CHANNEL FUNCTIONAL TEST. This test shall verify the OPERABILITY of the RTM and its ability to receive and properly respond to channel trip and reactor trip signals. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. [ Calculations have shown that the Frequency (23 days) maintains a high level of reliability of the Reactor Trip System in BAW-10167A, Supplement 3 (Ref. 2). There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Chapter [7].
: 2. BAW-10167A, Supplement 3, February 1998.
Babcock & Wilcox STS                      B 3.3.3-4                                                       Rev. 5.0

CRD Trip Devices B 3.3.4 B 3.3 INSTRUMENTATION B 3.3.4 CONTROL ROD Drive (CRD) Trip Devices BASES BACKGROUND         The Reactor Protection System (RPS) contains multiple CRD trip devices:
two AC trip breakers, two DC trip breaker pairs, and eight electronic trip assembly (ETA) relays. The system has two separate paths (or channels), with each path having one AC breaker in series with either a pair of DC breakers or four ETA relays in parallel. Each path provides independent power to the CRDs. Either path can provide sufficient power to operate the entire CRD System.
Figure [ ], FSAR, Chapter [7] (Ref. 1), illustrates the configuration of CRD trip devices. To trip the reactor, power to the CRDs must be removed.
Loss of power causes the CRD's mechanisms to release the CONTROL RODS, which then fall by gravity into the core.
Power to CRDs is supplied from two separate unit sources through the AC trip circuit breakers. These breakers are designated A and B, and their undervoltage and shunt trip coils are powered by RPS channels A and B, respectively. From the circuit breakers, the CRD power travels through voltage regulators and stepdown transformers. These devices in turn supply redundant buses that feed the DC power supplies and the regulating rod power supplies.
The DC power supplies rectify the AC input and supply power to hold the safety rods in their fully withdrawn position. One of the redundant power sources supplies phase A; the other, phase C. Either phase being energized is sufficient to hold the rod. Two breakers are located on the output of each power supply. Each breaker controls power to one of the four safety rod groups. The undervoltage and shunt trip coils on the two circuit breakers on the output of one of the power supplies is controlled by RPS channel C. The other two breakers are controlled by RPS channel D.
In addition to the DC power supplies, the redundant buses also supply power to the regulating and auxiliary power supplies. These power supplies consist of ETAs that are gated on by programming lamps.
Programming lamp power is controlled by contactors (E and F), which are controlled by RPS power. One of the redundant programming lamp supplies is controlled by RPS channel C; the other, by RPS channel D.
The AC breaker and DC breakers are in series in one of the power supplies; whereas, the redundant AC breaker and DC breakers are in series in the other power supply to the CONTROL RODS. The logic required to cause a reactor trip is the opening of a circuit breaker in each Babcock & Wilcox STS                  B 3.3.4-1                                         Rev. 5.0

CRD Trip Devices B 3.3.4 BASES BACKGROUND (continued) of the redundant power supplies. (The pair of DC circuit breakers on the output of the power supply are treated as one breaker.) This is known as a one-out-of-two taken twice logic. The following examples illustrate the operation of the reactor trip circuit breakers.
: a. If the A AC circuit breaker opens:
: 1. The input power to associated DC power supply is lost and
: 2. The SCR supply from the associated power source is lost.
: b. If the D DC circuit breaker(s) and F contactors open:
: 1. The output of the redundant DC power supply is lost and the safety rods de-energize and
: 2. When the F contactor opens, programming lamp power is lost and the regulating rods will be de-energized.
: c. The combination of (a) and (b) causes a reactor trip.
Any other combination of at least one circuit breaker opening in each power supply will cause a reactor trip.
In summary, two tripped RPS channels will cause a reactor trip. For example, a reactor trip occurs if RPS channel B senses a low Reactor Coolant System (RCS) pressure condition and if RPS channel C senses a variable low RCS pressure condition. When the channel B bistable relay de-energizes, the channel trip relay de-energizes and opens its associated contacts. The same thing occurs in channel C, except the variable lower pressure bistable relay de-energizes the channel C trip relay. When the output logic relays de-energize, the B and C contacts in the undervoltage and E and F contacts de-energize, all circuit breakers open, and programming lamp power is removed. All rods fall into the core, resulting in a reactor trip.
APPLICABLE         Accident analyses rely on a reactor trip for protection of reactor core SAFETY             integrity, reactor coolant pressure boundary integrity, and reactor building ANALYSES           OPERABILITY. A reactor trip must occur when needed to prevent accident consequences from exceeding those calculated in the accident analyses. The control rod insertion limits ensure that adequate rod worth is available upon reactor trip to shut down the reactor to the required SDM. Further, OPERABILITY of the CRD trip devices ensures that all CONTROL RODS (except Group 8) will trip when required. More detailed Babcock & Wilcox STS                   B 3.3.4-2                                        Rev. 5.0

CRD Trip Devices B 3.3.4 BASES APPLICABLE SAFETY ANALYSES (continued) descriptions of the applicable accident analyses are found in the Bases for each of the individual RPS trip Functions in LCO 3.3.1, "Reactor Protection System (RPS) Instrumentation."
The CRD trip devices satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The LCO requires all of the CRD trip devices to be OPERABLE. Failure of any CRD trip device renders a portion of the RPS inoperable and reduces the reliability of the affected Functions. Without reliable CRD reactor trip circuit breakers and associated support circuitry, a reactor trip cannot occur when initiated either automatically or manually.
All CRD trip devices shall be OPERABLE to ensure that the reactor remains capable of being tripped any time it is critical. OPERABILITY is defined as the CRD trip device being able to receive a reactor trip signal and to respond to this trip signal by interrupting AC power to the CRDs.
Both of the AC breaker's trip devices and the breaker itself must be functioning properly for the AC breaker to be OPERABLE.
Requiring all breakers and ETA relays to be OPERABLE ensures that at least one device in each of the two power paths to the CRDs will remain OPERABLE even with a single failure. Requiring all devices OPERABLE also ensures that a single failure will not cause an unwanted reactor trip.
APPLICABILITY      The CRD trip devices shall be OPERABLE in MODES 1 and 2, and in MODES 3, 4, and 5 when any CRD trip breaker is in the closed position and the CRD System is capable of rod withdrawal.
The CRD trip devices are designed to ensure that a reactor trip would occur if needed any time the reactor is critical. Since this condition can exist in all of these MODES, the CRD trip devices shall be OPERABLE.
ACTIONS            A Note has been added to the ACTIONS indicating separate Condition entry is allowed for each CRD trip device.
Condition A Condition A represents reduced redundancy in the CRD trip Function.
Condition A applies when:
* One diverse trip Function (undervoltage or shunt trip device) is inoperable in one or more CRD trip breaker(s) [or breaker pair] or
* One diverse trip Function is inoperable in both DC trip breakers associated with one protection channel. In this case, the inoperable trip Function does not need to be the same for both breakers.
Babcock & Wilcox STS                   B 3.3.4-3                                        Rev. 5.0

CRD Trip Devices B 3.3.4 BASES ACTIONS (continued)
A.1 and A.2 If one of the diverse trip Functions on a CRD trip breaker [or breaker pair]
becomes inoperable, actions must be taken to preclude the inoperable CRD trip device from preventing a reactor trip when needed. This is done by manually tripping the inoperable CRD trip breaker or by removing power from the channel containing the inoperable CRD trip breaker.
Either of these actions places the affected CRDs in a one-out-of-two trip configuration, which precludes a single failure, which in turn could prevent tripping of the reactor. The 48 hour Completion Time has been shown to be acceptable through operating experience.
Condition B Condition B represents a loss of redundancy for the CRD trip Function.
Condition B applies when:
* One or more CRD trip breaker(s) [or breaker pair] will not function on either undervoltage or shunt trip Functions or
* Both diverse trip Functions are inoperable in one or both DC trip breakers associated with one protection channel.
B.1 and B.2 Required Action B.1 and Required Action B.2 are the same as Required Action A.1 and Required Action A.2, but the Completion Time is shortened. The 1 hour Completion Time allowed to trip or remove power from the CRD trip breaker allows the operator to take all the appropriate actions for the inoperable breaker and still ensures that the risk involved is acceptable.
C.1 and C.2 Condition C represents a loss of redundancy for the CRD trip Function.
Condition C applies when one or more ETA relays are inoperable. The preferred action is to restore the ETA relay to OPERABLE status. If this cannot be done, the operator can perform one of two actions to eliminate reliance on the failed ETA relay. This first option is to switch the affected control rod group to an alternate power supply. This removes the failed ETA relay from the trip sequence, and the unit can operate indefinitely.
The second option is to trip the corresponding AC CRD trip breaker. This Babcock & Wilcox STS                  B 3.3.4-4                                          Rev. 5.0

CRD Trip Devices B 3.3.4 BASES ACTIONS (continued) results in the safety function being performed, thereby eliminating the failed ETA relay from the trip sequence. The 1 hour Completion Time is sufficient to perform the Required Action.
D.1, D.2.1, and D.2.2 If the Required Actions of Condition A, B, or C are not met within the required Completion Time in MODE 1, 2, or 3, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3, with all CRD trip breakers open or with power from all CRD trip breakers removed within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.
E.1 and E.2 If the Required Actions of Condition A, B, or C are not met within the required Completion Time in MODE 4 or 5, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, all CRD trip breakers must be opened or power from all CRD trip breakers removed within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to open all CRD trip breakers or remove power from all CRD trip breakers without challenging unit systems.
SURVEILLANCE       SR 3.3.4.1 REQUIREMENTS
                   -----------------------------------REVIEWERS NOTE-----------------------------------
The CHANNEL FUNCTIONAL TEST Frequency is approved for all B&W plants except for TMI based on an approved topical report. No further evaluations or justifications are required for the evaluated plants to incorporate the 23 day STAGGERED TEST BASIS Frequency.
SR 3.3.4.1 is to perform a CHANNEL FUNCTIONAL TEST. This test verifies the OPERABILITY of the trip devices by actuation of the end devices. Also, this test independently verifies the undervoltage and shunt trip mechanisms of the AC breakers. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable Babcock & Wilcox STS                      B 3.3.4-5                                                       Rev. 5.0

CRD Trip Devices B 3.3.4 BASES SURVEILLANCE REQUIREMENTS (continued) because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. [ Calculations have shown that the Frequency (23 days) maintains a high level of reliability of the Reactor Trip System in BAW-10167A, Supplement 3 (Ref. 2). There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Chapter [7].
: 2. BAW-10167A, Supplement 3, February 1998.
Babcock & Wilcox STS                      B 3.3.4-6                                                       Rev. 5.0

ESFAS Instrumentation B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND          The ESFAS initiates necessary safety systems, based on the values of selected unit Parameters, to protect against violating core design limits and reactor coolant pressure boundary and to mitigate accidents. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the ESFAS, as well as the LCOs on other reactor system parameters and equipment performance.
Technical Specifications are required by 10 CFR 50.36 to include LSSSs for variables that have significant safety functions. LSSS are defined by the regulation as "Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytical Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
                    ---------------------------------REVIEWER'S NOTE-------------------------------------
The term "Limiting Trip Setpoint" [LTSP] is generic terminology for the calculated trip setting (setpoint) value calculated by means of the plant specific setpoint methodology documented in a document controlled under 10 CFR 50.59. The term [LTSP] indicates that no additional margin has been added between the Analytical Limit and the calculated trip setting.
                    "Nominal Trip Setpoint [NTSP]" is the suggested terminology for the actual setpoint implemented in the plant surveillance procedures where margin has been added to the calculated [LTSP]. The as-found and as-left tolerances will apply to the [NTSP] implemented in the Surveillance procedures to confirm channel performance.
Licensees are to insert the name of the document(s) controlled under 10 CFR 50.59 that contain the methodology for calculating the as-left and as-found tolerances, in Note b of Table 3.3.5-1 for the phrase "[insert the name of a document controlled under 10 CFR 50.59 such as the Technical Requirements Manual or any document incorporated into the facility FSAR]" throughout these Bases.
Babcock & Wilcox STS                       B 3.3.5-1                                          Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES BACKGROUND (continued)
Where the [LTSP] is not included in Table 3.3.5-1, the plant specific location for the [LTSP] or [NTSP] must be cited in Note b of Table 3.3.5-1.
The brackets indicate plant specific terms may apply, as reviewed and approved by the NRC.
The [Limiting Trip Setpoint (LTSP)] specified in Table 3.3.5-1 is a predetermined setting for a protection channel chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit and thus ensuring that the SL would not be exceeded. As such, the
[LTSP] accounts for uncertainties in setting the channel (e.g., calibration),
uncertainties in how the channel might actually perform (e.g.,
repeatability), changes in the point of action of the channel over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the [LTSP] ensures that SLs are not exceeded. Therefore, the [LTSP] meets the definition of an LSSS (Ref. 1).
Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as "...being capable of performing its safety function(s)." Relying solely on the [LTSP] to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as-found" value of a protection channel setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protection channel with a setting that has been found to be different from the [LTSP] due to some drift of the setting may still be OPERABLE because drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the [LTSP] and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as-found" setting of the protection channel. Therefore, the channel would still be OPERABLE because it would have performed its safety function and the only corrective action required would be to reset the channel within the established as-left tolerance around the [LTSP] to account for further drift during the next surveillance interval. Note that, although the channel is OPERABLE under these circumstances, the trip setpoint must be left adjusted to a value within the as-left tolerance, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned (as-found criteria).
Babcock & Wilcox STS                      B 3.3.5-2                                                       Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES BACKGROUND (continued)
However, there is also some point beyond which the channel may not be able to perform its function due to, for example, greater than expected drift. This value needs to be specified in the Technical Specifications in order to define OPERABILITY of the channels and is designated as the Allowable Value.
If the actual setting (as-found setpoint) of the channel is found to be conservative with respect to the Allowable Value but is beyond the as-found tolerance band, the channel is OPERABLE, but degraded. The degraded condition of the channel will be further evaluated during performance of the SR. This evaluation will consist of resetting the channel setpoint to the [Nominal Trip Setpoint (NTSP)] (within the allowed tolerance), and the channel's response evaluated. If the channel is functioning as required and is expected to pass the next surveillance, then the channel is OPERABLE and can be restored to service at the completion of the surveillance. After the surveillance is completed, the channel's as-found condition will be entered into the Corrective Action Program for further evaluation.
During anticipated operational occurrences (AOOs), which are those events expected to occur one or more times during the unit's life, the acceptable limits are:
: a. The departure from nucleate boiling ratio (DNBR) shall be maintained above the SL value,
: b. Fuel centerline melt shall not occur, and
: c. The RCS pressure SL of [2750] psig shall not be exceeded.
Maintaining the parameters within the above values ensures that the offsite dose will be within the 10 CFR 20 and 10 CFR 100 criteria during AOOs.
Accidents are events that are analyzed even though they are not expected to occur during the unit's life. The acceptable limit during accidents is that the offsite dose shall be maintained within 10 CFR 100 limits. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.
ESFAS actuates the following systems:
* High pressure injection (HPI) Actuation,
* Low pressure injection (LPI) Actuation, Babcock & Wilcox STS                   B 3.3.5-3                                        Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES BACKGROUND (continued)
* Reactor building (RB) Cooling,
* RB Spray,
* RB Isolation, and
* Emergency diesel generator (EDG) Start.
ESFAS also provides a signal to the Emergency Feedwater Isolation and Control (EFIC) System. This signal initiates emergency feedwater (EFW) when HPI is initiated.
The ESFAS operates in a distributed manner to initiate the appropriate systems. The ESFAS does this by determining the need for actuation in each of three channels monitoring each actuation Parameter. Once the need for actuation is determined, the condition is transmitted to automatic actuation logics, which perform the two-out-of-three logic to determine the actuation of each end device. Each end device has its own automatic actuation logic, although all automatic actuation logics take their signals from the same point in each channel for each Parameter.
Four Parameters are used for actuation:
* Low Reactor Coolant System (RCS) Pressure,
* Low Low RCS Pressure,
* High RB Pressure, and
* High High RB Pressure.
LCO 3.3.5 covers only the instrumentation channels that measure these Parameters. These channels include all intervening equipment necessary to produce actuation before the measured process Parameter exceeds the limits assumed by the accident analysis. This includes sensors, bistable devices, operational bypass circuitry, block timers, and output relays. LCO 3.3.6, "Engineered Safety Feature Actuation System (ESFAS) Manual Initiation," and LCO 3.3.7, "Engineered Safety Feature Actuation System (ESFAS) Automatic Actuation Logic," provide requirements on the manual initiation and automatic actuation logic Functions.
The ESFAS consists of three protection channels. Each channel provides input to logics that initiate equipment with a two-out-of-three logic on each component. Each protection channel includes bistable Babcock & Wilcox STS                  B 3.3.5-4                                         Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES BACKGROUND (continued) inputs from one instrumentation channel of Low RB Pressure, Low Low RCS Pressure, High RB Pressure, and High High RB Pressure.
Automatic actuation logics combine the three protection channel trips in each train to actuate the individual Engineered Safety Feature (ESF) components needed to initiate each ESF System. Figure [ ] , FSAR, Chapter [7] (Ref. 2), illustrates how instrumentation channel trips combine to cause protection channel trips.
The RCS pressure sensors are common to both trains. Isolation is provided via separate bistables for each train. Separate RB pressure sensors are used for the high and high high pressure Functions in each train, and separate sensors are used for each train.
The following matrix identifies the measurement channels and the Function actuated by each.
PARAMETER         LOW RCS          LOW LOW        HIGH RB         HIGH PRESSURE             RCS       PRESSURE HIGH RB PRESSURE                    PRESSURE HPI                X              X             X LPI                               X                           X RB Cooling              X              X             X            (b)
RB Spray              (b)
RB Isolation(a)          X              X             X EDG Start              X              X             X Control Room                                          X Isolation (a) Only isolates systems not required for RB or RCS heat removal.
(b) Actuates on High High RB Pressure coincident with HPI actuation.
Babcock & Wilcox STS                 B 3.3.5-5                                         Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES BACKGROUND (continued)
Engineered safeguards bus undervoltage will also sequence on the HPI loads started by the HPI block timers. However, HPI will not occur unless the ESFAS HPI signal is also present. LCO 3.3.8, "Emergency Diesel Generator (EDG) Loss of Power Start (LOPS)," contains the requirements for the undervoltage channels.
The ESF equipment is divided between the two redundant actuation trains A and B. The division of the equipment between the two actuation trains is based on the equipment redundancy and function and is accomplished in such a manner that the failure of one of the actuation channels and the related safeguards equipment will not inhibit the overall ESF Functions. Where a motor operated or a solenoid operated valve is driven by either of two matrices, one is from actuation channel A and one from actuation channel B. Redundant ESF pumps are controlled from separate and independent actuation channels.
The actuation of ESF equipment is also available by manual actuation switches located on the control room console.
The ESFAS, in conjunction with the actuated equipment, provides protective functions necessary to mitigate Design Basis Accidents (DBAs), specifically the loss of coolant accident (LOCA) and steam line break (SLB) events. The ESFAS relies on the OPERABILITY of the automatic actuation logic for each component to perform the actuation of the selected systems of LCO 3.3.7.
Engineered Safety Feature Actuation System Bypasses No provisions are made for maintenance bypass of ESFAS instrumentation channels. Operational bypass of certain channels is necessary to allow accident recovery actions to continue and, for some channels, to allow reactor shutdown without spurious ESFAS actuation.
The ESFAS RCS pressure instrumentation channels include permissive bistables that allow manual bypass when reactor pressure is below the point at which the low and low low pressure trips are required to be OPERABLE. Once permissive conditions are sensed, the RCS pressure trips may be manually bypassed. Bypasses are automatically removed when bypass permissive conditions are exceeded.
Each High RB Pressure channel may be manually bypassed after the other two channels in the Parameter have tripped. The manual bypass allows operators to take manual control of ESF Functions after initiation to allow recovery actions. The bypass may be manually removed and is automatically removed when RB pressure returns to below the trip setpoint.
Babcock & Wilcox STS                  B 3.3.5-6                                       Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES BACKGROUND (continued)
Reactor Coolant System Pressure The RCS pressure is monitored by three independent pressure transmitters located in the RB. These transmitters are separate from the transmitters that feed the Reactor Protection System (RPS). Each of the pressure signals generated by these transmitters is monitored by four bistables to provide two trip signals, at 1500 psig and 500 psig, and two bypass permissive signals, at 1700 psig and 900 psig.
The outputs of the three bistables, associated with the low RCS pressure, 1500 psig, trip drive relays in two sets (actuation channels A and B) of identical and independent channels. These two sets of HPI channels each use three logic channels used in two-out-of-three coincidence networks for HPI Actuation. The outputs of the three bistables associated with the Low Low RCS Pressure [500 psig] trip drive relays in two sets (actuation channels A and B) of identical and independent channels.
These two sets of LPI channels each use three logic channels used in two-out-of-three coincidence networks for LPI Actuation. The outputs of the three Low Low RCS Pressure bistables also trip the drive relays in the corresponding HPI Actuation channel as previously described.
Reactor Building Pressure RB pressure inputs to the ESFAS are provided by 12 pressure switches.
Six pressure switches are used for the High RB Pressure Parameter, and six pressure switches are used for the High High Pressure Parameter.
The output contacts of six High RB Pressure switches are used in two sets of identical and independent actuation trains. These two trains each use three logic channels. The outputs of these channels are used in two-out-of-three coincidence networks. The output contacts of the six RB pressure switches also trip the drive relays in the corresponding HPI and LPI Actuation channels as previously described.
The output contacts of six High High RB Pressure switches are used in two sets of identical and independent actuation trains. These two trains each use three logic channels (RB4, RB5, and RB6). The outputs of these channels are used in two-out-of-three coincident networks for RB Spray Actuation. Each high high pressure train actuates one RB Spray train when the High High RB signal and the HPI signal are coincident in that train.
Babcock & Wilcox STS                  B 3.3.5-7                                        Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES BACKGROUND (continued)
[Limiting Trip Setpoints] and Allowable Values Trip setpoints are the nominal value at which the bistables are set. Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION accuracy (i.e., +/- [rack calibration + comparator setting accuracy]).
The trip setpoints used in the bistables are based on the analytical limits stated in Figure [ ] , FSAR, Chapter [7] (Ref. 2). The calculation of the
[LTSP] specified in Table 3.3.5-1 is such that adequate protection is provided when all sensor and processing uncertainties and time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment induced errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 3), the Allowable Values specified in Table 3.3.5-1 in the accompanying LCO are conservatively adjusted with respect to the analytical limits. A detailed description of the methodology used to calculate the [LTSPs], including their explicit uncertainties, is provided in the "Unit Specific Setpoint Methodology" (Ref. 4). The as-left tolerance and as-found tolerance band methodology is provided in [insert the name of a document controlled under 10 CFR 50.59 such as the Technical Requirements Manual or any document incorporated into the facility FSAR]. The actual trip setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a CHANNEL FUNCTIONAL TEST. The Allowable Value serves as the as-found trip setpoint Technical Specification OPERABILITY limit for the purpose of the CHANNEL FUNCTIONAL TEST.
The [LTSP] is the value at which the bistable is set and is the expected value to be achieved during calibration. The [LTSP] value is the LSSS and ensures the safety analysis limits are met for the surveillance interval selected when a channel is adjusted based on stated channel uncertainties.
[LTSPs] in conjunction with the use of as-found and as-left tolerances, consistent with the requirements of the Allowable Values, ensure that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed. Note that in LCO 3.3.5 the Allowable Value listed in Table 3.3.5-1 are the least conservative value of the as-found setpoint that a channel can have during a periodic CHANNEL CALIBRATION or CHANNEL FUNCTIONAL TEST.
Babcock & Wilcox STS                  B 3.3.5-8                                         Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES BACKGROUND (continued)
Each channel can be tested online to verify that the signal and setpoint accuracy is within the specified allowance requirements of Reference 4.
Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated.
The Allowable Values listed in Table 3.3.5-1 are based on the methodology described in FSAR, Chapter [14] (Ref. 5), which incorporates all of the known uncertainties applicable for each channel.
The magnitudes of these uncertainties are factored into the determination of each [LTSP]. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
The ESFAS LCOs in the BWOG Standard Technical Specifications are based on a system representative of the Crystal River Unit 3 design.
As discussed earlier, this arrangement involves measurement channels shared among all actuation functions, with separate actuation logic channels for each actuated component. In this arrangement, multiple components are affected by each instrumentation channel failure, but a single automatic actuation logic failure affects only one component. The organization of BWOG STS ESFAS LCOs reflects the described logic arrangement by identifying instrumentation requirements on an instrumentation channel rather than on a protective function basis. This greatly simplifies delineation of ESFAS LCOs. Furthermore, the LCO requirements on instrumentation channels, automatic actuation logics, and manual initiation are specified separately to reflect the different impact each has on ESFAS OPERABILITY.
APPLICABLE         The following ESFAS Functions have been assumed within the accident SAFETY             analyses.
ANALYSES High Pressure Injection The ESFAS actuation of HPI has been assumed for core cooling in the LOCA analysis and is credited with boron addition in the SLB analysis.
Low Pressure Injection The ESFAS actuation of LPI has been assumed for large break LOCAs.
Babcock & Wilcox STS                      B 3.3.5-9                                                       Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES APPLICABLE SAFETY ANALYSES (continued)
Reactor Building Spray, Reactor Building Cooling, and Reactor Building Isolation The ESFAS actuation of the RB coolers and RB Spray have been credited in RB analysis for LOCAs, both for RB performance and equipment environmental qualification pressure and temperature envelope definition. Accident dose calculations have credited RB Isolation and RB Spray.
Emergency Diesel Generator Start The ESFAS initiated EDG Start has been assumed in the LOCA analysis to ensure that emergency power is available throughout the limiting LOCA scenarios.
The small and large break LOCA analyses assume a conservative 35 second delay time for the actuation of HPI and LPI in FSAR, Chapter [14] (Ref. 5). This delay time includes allowances for EDG starting, EDG loading, Emergency Core Cooling Systems (ECCS) pump starts, and valve openings. Similarly, the RB Cooling, RB Isolation, and RB Spray have been analyzed with delays appropriate for the entire system analyzed. Typical values used in the analysis are 35 seconds for RB Cooling, 60 seconds for RB Isolation, and 56 seconds for RB Spray.
Accident analyses rely on automatic ESFAS actuation for protection of the core temperature and containment pressure limits and for limiting off site dose levels following an accident. These include LOCA, SLB, and feedwater line break events that result in RCS inventory reduction or severe loss of RCS cooling.
The ESFAS channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The LCO requires three channels of ESFAS instrumentation for each Parameter in Table 3.3.5-1 to be OPERABLE in each ESFAS train.
Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
Only the Allowable Value is specified for each ESFAS Function in the LCO. [LTSPs] are specified in the unit specific setpoint calculations. The
[LTSPs] are selected to ensure the setpoints measured by CHANNEL FUNCTIONAL TESTS do not exceed the Allowable Value if the bistable is performing as required. Operation with a trip setpoint less conservative than the [LTSP], but within its Allowable Value, is acceptable provided that operation and testing are consistent with the assumptions of the unit Babcock & Wilcox STS                 B 3.3.5-10                                       Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES LCO (continued) specific setpoint calculations. Each Allowable Value specified is more conservative than the analytical limit assumed in the safety analysis to account for instrument uncertainties appropriate to the trip Parameter.
These uncertainties are defined in the "Unit Specific Setpoint Methodology" (Ref. 4).
The Allowable Values for bypass removal functions are stated in the Applicable MODES or Other Specified Condition column of Table 3.3.5-1.
Three ESFAS instrumentation channels shall be OPERABLE in each ESFAS train to ensure that a single failure in one channel will not result in loss of the ability to automatically actuate the required safety systems.
Permissive and interlock setpoints allow the blocking of trips during plant startups, and restoration of trips when the permissive conditions are not satisfied, but they are not explicitly modeled in the Safety Analyses.
These permissives and interlocks ensure that the starting conditions are consistent with the safety analysis, before preventive or mitigating actions occur. Because these permissives or interlocks are only one of multiple conservative starting assumptions for the accident analysis, they are generally considered as nominal values without regard to measurement accuracy.
The bases for the LCO on ESFAS Parameters include the following.
Reactor Coolant System Pressure Three channels each of RCS Pressure - Low and RCS Pressure - Low Low are required OPERABLE in each train. Each channel includes a sensor, trip bistable, bypass bistable, bypass relays, output relays, and block timers. The analog portion of each pressure channel is common to both trains of both RCS Pressure Parameters. Therefore, failure of one analog channel renders one channel of the low pressure and low low pressure Functions in each train inoperable. The bistable portions of the channels are Function and train specific. Therefore, a bistable failure renders only one Function in one train inoperable. Failure of a bypass bistable or bypass circuitry, such that a trip channel cannot be bypassed, does not render the channel inoperable. Output relays and block timer relays are train specific but may be shared among Parameters.
Therefore, output or block timer relay failure renders all affected Functions in one train inoperable.
Babcock & Wilcox STS                  B 3.3.5-11                                        Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES LCO (continued)
: 1. Reactor Coolant System Pressure - Low Setpoint The RCS Pressure - Low Setpoint is based on HPI actuation for small break LOCAs. The setpoint ensures that the HPI will be actuated at a pressure greater than or equal to the value assumed in accident analyses plus the instrument uncertainties. The maximum value assumed for the setpoint of the RCS Pressure - Low trip of HPI in safety analyses is 1480 psig. The setpoint for the low RCS and Allowable Value of  [1600] psig for the low pressure Parameter is selected to ensure actuation occurs when actual RCS pressure is above 1480 psig. The RCS Pressure instrumentation must function while subject to the severe environment created by a LOCA.
Therefore, the [LTSP] and Allowable Value accounts for severe environment induced errors.
To ensure the RCS Pressure - Low trip is not bypassed when required to be OPERABLE by the safety analysis, each channel's bypass removal bistable must be set with an Allowable Value of
[1800] psig. The bypass removal does not need to function for accidents initiated from RCS Pressures below the bypass removal setpoint. Therefore, the bypass removal setpoint Allowable Value need not account for severe environment induced errors.
: 2. Reactor Coolant System Pressure - Low Low Setpoint The RCS Pressure - Low Low Setpoint LPI actuation occurs in sufficient time to ensure LPI flow prior to the emptying of the core flood tanks during a large break LOCA. The Allowable Value of
[400] psig ensures sufficient overlap of the core flood tank flow and the LPI flow to keep the reactor vessel downcomer full during a large break LOCA. The RCS Pressure instrumentation must function while subject to the severe environment created by a LOCA. Therefore, the [LTSP] and Allowable Value accounts for severe environment induced errors.
To ensure the RCS Pressure - Low Low trip is not bypassed when assumed OPERABLE by the safety analysis, each channel's bypass removal bistable must be set with an Allowable Value of  [900] psig.
The bypass removal does not need to function for accidents initiated by RCS Pressure below the bypass removal setpoint. Therefore, the bypass removal setpoint Allowable Value need not account for severe environment induced errors.
Babcock & Wilcox STS                B 3.3.5-12                                        Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES LCO (continued)
Reactor Building Pressure Three channels each of RCS Pressure - Low and RB Pressure - High are required to be OPERABLE in each train. Each channel includes a pressure switch, bypass relays, and output relays. The high pressure channels also include block timers. Each pressure switch is Function and train specific, so there are 12 pressure switches total. Therefore, a pressure switch renders only one Function in one train inoperable.
Output relays and block timer relays are train specific but may be shared among Parameters. Therefore, output or block timer relay failure renders all affected Functions in one train inoperable.
The RB Pressure switches may be subjected to high radiation conditions during the accidents that they are intended to mitigate. The sensor portion of the switches is also exposed to the steam environment present in the RB following a LOCA or high energy line break. Therefore, the
[LTSP] and Allowable Value accounts for measurement errors induced by these environments.
: 1. Reactor Building Pressure - High Setpoint The RB Pressure - High Setpoint Allowable Value  [5] psig was selected to be low enough to detect a rise in RB Pressure that would occur due to a small break LOCA, thus ensuring that the RB high pressure actuation of the safety systems will occur for a wide spectrum of break sizes. The trip setpoint also causes the RB coolers to shift to emergency mode to prevent damage to the cooler fans due to the increase in the density of the air steam mixture present in the containment following a LOCA.
: 2. Reactor Building Pressure - High High Setpoint The RB Pressure - High High Setpoint Allowable Value  [30] psig was chosen to be high enough to avoid actuation during a SLB, but also low enough to ensure a timely actuation during a large break LOCA.
APPLICABILITY      Three channels of ESFAS instrumentation for each Parameter listed next shall be OPERABLE in each ESFAS train.
: 1. Reactor Coolant System Pressure - Low Setpoint The RCS Pressure - Low Setpoint actuation Parameter shall be OPERABLE during operation above 1800 psig. This requirement ensures the capability to automatically actuate safety systems and components during conditions indicative of a LOCA or secondary unit Babcock & Wilcox STS                  B 3.3.5-13                                       Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES APPLICABILITY (continued) overcooling. Below 1800 psig, the low RCS Pressure actuation Parameter can be bypassed to avoid actuation during normal unit cooldowns when safety systems actuations are not required.
The allowance for the bypass is consistent with the transition of the unit to a lower energy state, providing greater margins to safety limits. The unit response to any event, given that the reactor is already tripped, will be less severe and allows sufficient time for operator action to provide manual safety system actuations. This is even more appropriate during unit heatups when the primary system and core energy content is low, prior to power operation.
In MODES 5 and 6, there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. Plant pressure and temperature are very low, and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.
: 2. Reactor Coolant System Pressure - Low Low Setpoint The RCS Pressure - Low Low Setpoint actuation Parameter shall be OPERABLE during operation above [900] psig. This requirement ensures the capability to automatically actuate safety systems and components during conditions indicative of a LOCA or secondary unit overcooling. Below [900] psig, the low low RCS Pressure actuation Parameter can be bypassed to avoid actuation during normal unit cooldowns when safety system actuations are not required.
The allowance for the bypass is consistent with the transition of the unit to a lower energy state, providing greater margins to safety limits. The unit response to any event, given that the reactor is already tripped, will be less severe and allows sufficient time for operator action to provide manual safety system actuations. This is even more appropriate during unit heatups when the primary system and core energy content is low, prior to power operation.
In MODES 5 and 6, there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. Plant pressure and temperature are very low, and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.
Babcock & Wilcox STS                B 3.3.5-14                                         Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES APPLICABILITY (continued)
: 3. 4. Reactor Building Pressure - High and Reactor Building Pressure -
High High Setpoints The RB Pressure - High and RB Pressure - High High actuation Functions of ESFAS shall be OPERABLE in MODES 1, 2, 3, and 4 when the potential for a HELB exists. In MODES 5 and 6, the unit conditions are such that there is insufficient energy in the primary and secondary systems to raise the containment pressure to either the RB Pressure - High or RB Pressure - High High Setpoints.
Furthermore, in MODES 5 and 6, there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. Plant pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.
ACTIONS              Required Actions A and B apply to all ESFAS instrumentation Parameters listed in Table 3.3.5-1.
A Note has been added to the ACTIONS indicating separate Condition entry is allowed for each Parameter.
If a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the channel is not functioning as required, or the transmitter, instrument loop, signal processing electronics, or ESFAS bistable is found inoperable, then all affected functions provided by that channel should be declared inoperable and the unit must enter the Conditions for the particular protection Parameter affected.
When the number of inoperable channels in a trip Parameter exceeds those specified, then the unit is outside the safety analysis. Therefore, LCO 3.0.3 shall be immediately entered if applicable in the current MODE of operation.
A.1 Condition A applies when one channel becomes inoperable in one or more Parameters. If one ESFAS channel is inoperable, placing it in a tripped condition leaves the system in a one-out-of-two condition for actuation. Thus, if another channel were to fail, the ESFAS instrumentation could still perform its actuation functions. This action is completed when all of the affected output relays and block timers are tripped. This can normally be accomplished by tripping the affected Babcock & Wilcox STS                    B 3.3.5-15                                          Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES ACTIONS (continued) bistables or tripping the individual output relays and block timers. [At this unit, the specific output relays associated with each ESFAS instrumentation channel are listed in the following document:]
The 1 hour Completion Time is sufficient time to perform the Required Action. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
B.1, B.2.1, B.2.2, and B.2.3 Condition B applies when Required Action A.1 is not met within the required Completion Time or when one or more parameters have more than one inoperable channel. If Condition B applies, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and, for the RCS Pressure - Low Setpoint, to < [1800] psig, for the RCS Pressure - Low Low Setpoint, to < [900] psig, and for the RB Pressure High Setpoint and High High Setpoint, to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 6). In MODE 4 the energy in the RCS is lower resulting in a lower risk of an event occurring which would require the ESFAS instrumentation. The ESFAS functions can be manually initiated if needed. In MODE 4, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action B.2.3 is modified by a second Note. Note 2 states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate.
LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
Babcock & Wilcox STS                  B 3.3.5-16                                        Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE       All ESFAS Parameters listed in Table 3.3.5-1 are subject to CHANNEL REQUIREMENTS       CHECK, CHANNEL FUNCTIONAL TEST, CHANNEL CALIBRATION, and response time testing. The operational bypasses associated with each ESFAS instrumentation channel are also subject to these SRs to ensure OPERABILITY of the ESFAS instrumentation channel.
                   -------------------------------- REVIEWERS NOTE ------------------------------------
Notes a and b are applied to the setpoint verification Surveillances for each ESFAS Function in Table 3.3.5-1 unless one or more of the following exclusions apply:
: 1. Manual actuation circuits, automatic actuation logic circuits or instrument functions that derive input from contacts which have no associated sensor or adjustable device, e.g., limit switches, breaker position switches, manual actuation switches, float switches, proximity detectors, etc. are excluded. In addition, those permissives and interlocks that derive input from a sensor or adjustable device that is tested as part of another TS function are excluded.
: 2. Settings associated with safety relief valves are excluded. The performance of these components is already controlled (i.e., trended with as-left and as-found limits) under the ASME Code for Operation and Maintenance of Nuclear Power Plants testing program.
: 3. Functions and Surveillance Requirements which test only digital components are normally excluded. There is no expected change in result between SR performances for these components. Where separate as-left and as-found tolerance is established for digital component SRs, the requirements would apply.
SR 3.3.5.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; therefore, it is key in verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Babcock & Wilcox STS                      B 3.3.5-17                                                       Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE REQUIREMENTS (continued)
Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit. If the channels are normally off scale during times when surveillance is required, the CHANNEL CHECK will only verify that they are off scale in the same direction. Off scale low current loop channels are verified to be reading at the bottom of the range and not failed downscale.
[ The Frequency, about once every shift, is based on operating experience that demonstrates channel failure is rare. Since the probability of two random failures in redundant channels in any 12 hour period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
The CHANNEL CHECK supplements less formal, but more frequent, checks of channel operability during normal operational use of the displays associated with the LCO's required channels.
SR 3.3.5.2 A Note defines a channel as being OPERABLE for up to 8 hours while bypassed for Surveillance testing provided the remaining two ESFAS channels are OPERABLE or tripped. The Note allows channel bypass for testing without defining it as inoperable, although during this time period it cannot initiate ESFAS. This allowance is based on the inability to perform the Surveillance in the time permitted by the Required Actions. Eight hours is the average time required to perform the Surveillance. It is not acceptable to routinely remove channels from service for more than 8 hours to perform required Surveillance testing.
Babcock & Wilcox STS                        B 3.3.5-18                                                      Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE REQUIREMENTS (continued)
A CHANNEL FUNCTIONAL TEST is performed on each required ESFAS channel to ensure the entire channel will perform the intended functions.
A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current unit specific setpoint analysis.
[ The Frequency of 31 days is based on unit operating experience, with regard to channel OPERABILITY and drift, which demonstrates that failure of more than one channel of a given function in any 31 day interval is a rare event.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.3.5 2 is modified by two Notes as identified in Table 3.3.5-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value.
Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.
The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the [LTSP]. Where a setpoint more conservative than the [LTSP] is used in the plant surveillance procedures [NTSP], the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure Babcock & Wilcox STS                        B 3.3.5-19                                                      Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE REQUIREMENTS (continued) that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the [LTSP], then the channel shall be declared inoperable.
The second Note also requires that [LTSP] and the methodologies for calculating the as-left and the as-found tolerances be in [insert the facility FSAR reference or the name of any document incorporated into the facility FSAR by reference].
SR 3.3.5.3 CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.
CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift to ensure that the instrument channel remains operational between successive tests. CHANNEL CALIBRATION shall find that measurement errors and bistable setpoint errors are within the assumptions of the unit specific setpoint analysis. CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint analysis.
[ This Frequency is justified by the assumption of an [18] month calibration interval to determine the magnitude of equipment drift in the setpoint analysis.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.3.5.3 is modified by two Notes as identified in Table 3.3.5-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value.
Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and Babcock & Wilcox STS                        B 3.3.5-20                                                      Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE REQUIREMENTS (continued) the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.
The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the [LTSP]. Where a setpoint more conservative than the [LTSP] is used in the plant surveillance procedures [NTSP], the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the [LTSP], then the channel shall be declared inoperable.
The second Note also requires that [LTSP] and the methodologies for calculating the as-left and the as-found tolerances be in [insert the facility FSAR reference or the name of any document incorporated into the facility FSAR by reference].
SR 3.3.5.4 SR 3.3.5.4 ensures that the ESFAS actuation channel response times are less than or equal to the maximum times assumed in the accident analysis. The response time values are the maximum values assumed in the safety analyses. Individual component response times are not modeled in the analyses. Response time testing acceptance criteria for this unit are included in Reference 2. The analyses model the overall or total elapsed time from the point at which the parameter exceeds the actuation setpoint value at the sensor to the point at which the end device is actuated. Thus, this SR encompasses the automatic actuation logic components covered by LCO 3.3.7 and the operation of the mechanical ESF components.
[ Response time tests are conducted on an [18] month STAGGERED TEST BASIS. Testing of the final actuation devices, which make up the bulk of the response time, is included in the testing of each channel.
Therefore, staggered testing results in response time verification of these channels every [18] months. The 18 month test Frequency is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation but not channel failure are infrequent occurrences.
Babcock & Wilcox STS                    B 3.3.5-21                                         Rev. 5.0

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety Related Instrumentation."
: 2. FSAR, Chapter [7].
: 3. 10 CFR 50.49.
: 4.    [Unit Specific Setpoint Methodology.]
: 5. FSAR, Chapter [14].
: 6. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                      B 3.3.5-22                                                      Rev. 5.0

ESFAS Manual Initiation B 3.3.6 B 3.3 INSTRUMENTATION B 3.3.6 Engineered Safety Feature Actuation System (ESFAS) Manual Initiation BASES BACKGROUND          The ESFAS manual initiation capability allows the operator to actuate ESFAS Functions from the main control room in the absence of any other initiation condition. Manually actuated Functions include High Pressure Injection, Low Pressure Injection, Reactor Building (RB) Cooling, RB Spray, RB Isolation, and Control Room Isolation. This ESFAS manual initiation capability is provided in the event the operator determines that an ESFAS Function is needed and has not been automatically actuated.
Furthermore, the ESFAS manual initiation capability allows operators to rapidly initiate Engineered Safety Feature (ESF) Functions if the trend of unit parameters indicates that ESF actuation will be needed.
LCO 3.3.6 covers only the system level manual initiation of these Functions. LCO 3.3.5, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," and LCO 3.3.7, "Engineered Safety Feature Actuation System (ESFAS) Automatic Actuation Logic," provide requirements on the portions of the ESFAS that automatically initiate the Functions described earlier.
The ESFAS manual initiation Function relies on the OPERABILITY of the automatic actuation logic (LCO 3.3.7) for each component to perform the actuation of the systems. A manual trip push button is provided on the ESF panel of the control room console for each of the levels of protection for each actuation. Operation of the push button energizes relays whose contacts perform a logical "OR" function with the matrices of the automatic actuation, except for the matrices which are part of the ESF buses loading sequence. Manual actuation of the ESF buses loading sequence is made by de-energizing the timed output relays. The power supply for the manual trip relays is taken from the station batteries.
Different batteries are used for the two actuations.
The ESFAS manual initiation channel is defined as the instrumentation between the console switch and the automatic actuation logic, which actuates the end devices. Other means of manual initiation, such as controls for individual ESF devices, may be available in the control room and other unit locations. These alternative means are not required by this LCO, nor may they be credited to fulfill the requirements of this LCO.
APPLICABLE          The ESFAS, in conjunction with the actuated equipment, provides SAFETY              protective functions necessary to mitigate Design Basis Accidents, ANALYSES            specifically, the loss of coolant accident and steam line break events.
Babcock & Wilcox STS                    B 3.3.6-1                                        Rev. 5.0

ESFAS Manual Initiation B 3.3.6 BASES APPLICABLE SAFETY ANALYSES (continued)
The ESFAS manual initiation ensures that the control room operator can rapidly initiate ESF Functions at any time. The manual initiation trip Function is required as a backup to automatic trip functions and allows operators to initiate ESFAS whenever any parameter is rapidly trending toward its trip setpoint. Furthermore, the ESFAS manual initiation may be specified in operating procedures for verification that ESF systems are running.
The ESFAS manual initiation functions satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                Two ESFAS manual initiation channels of each ESFAS Function shall be OPERABLE whenever conditions exist that could require ESF protection of the reactor or RB. Two OPERABLE channels ensure that no single random failure will prevent system level manual initiation of any ESFAS Function. The ESFAS manual initiation Function allows the operator to initiate protective action prior to automatic initiation or in the event the automatic initiation does not occur.
APPLICABILITY      The ESFAS manual initiation Functions shall be OPERABLE in MODES 1, 2, and 3, and in MODE 4 when the associated engineered safeguard equipment is required to be OPERABLE. The manual initiation channels are required because ESF Functions are designed to provide protection in these MODES. In MODES 5 and 6, ESFAS initiates systems that are either reconfigured or disabled for shutdown cooling operation. Accidents in these MODES are slow to develop and would be mitigated by manual operation of individual components. Adequate time is available to evaluate unit conditions and to respond by manually operating the ESF components, if required.
ACTIONS            A Note has been added to the ACTIONS indicating separate Condition entry is allowed for each ESFAS manual initiation Function.
A.1 Condition A applies when one manual initiation channel of one or more ESFAS Functions becomes inoperable. Required Action A.1 must be taken to restore the channel to OPERABLE status within the next 72 hours [or in accordance with the Risk Informed Completion Time Program]. The Completion Time of 72 hours is based on unit operating experience and administrative controls, which provide alternative means of ESFAS Function initiation via individual component controls. The 72 hour Completion Time is consistent with the allowed outage time for the safety systems actuated by ESFAS.
Babcock & Wilcox STS                   B 3.3.6-2                                           Rev. 5.0

ESFAS Manual Initiation B 3.3.6 BASES ACTIONS (continued)
B.1 and B.2 Required Action B.1 and Required Action B.2 apply if Required Action A.1 cannot be met within the required Completion Time. If Required Action A.1 cannot be met within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 1). In MODE 4 the energy in the RCS is lower resulting in a lower risk of an event occurring which would require the ESFAS instrumentation. The ESFAS functions can be manually initiated via the individual component controls if needed. In MODE 4, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE       SR 3.3.6.1 REQUIREMENTS This SR requires the performance of a CHANNEL FUNCTIONAL TEST of the ESFAS manual initiation. This test verifies that the initiating circuitry is OPERABLE and will actuate the end device (i.e., pump, valves, etc.).
A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of Babcock & Wilcox STS                  B 3.3.6-3                                          Rev. 5.0

ESFAS Manual Initiation B 3.3.6 BASES SURVEILLANCE REQUIREMENTS (continued) the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. [ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency is demonstrated to be sufficient, based on operating experience, which shows these components usually pass the Surveillance when performed on the [18] month Frequency.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                      B 3.3.6-4                                                       Rev. 5.0

ESFAS Automatic Actuation Logic B 3.3.7 B 3.3 INSTRUMENTATION B 3.3.7 Engineered Safety Feature Actuation System (ESFAS) Automatic Actuation Logic BASES BACKGROUND          The automatic actuation logic channels of ESFAS are defined as the logic between the buffers of the sensing channels and the controllers that actuate ESFAS equipment. Each of the components actuated by the ESFAS Functions has an associated automatic actuation logic matrix. If two-out-of-three ESFAS instrumentation channels indicate a trip, or system level manual initiation occurs, the automatic actuation logic is activated and the associated component is actuated. The purpose of requiring OPERABILITY of the ESFAS automatic actuation logic is to ensure that the Functions of the ESFAS can be automatically initiated in the event of an accident. Automatic actuation of some Functions is necessary to prevent the unit from exceeding the Emergency Core Cooling Systems (ECCS) limits in 10 CFR 50.46 (Ref. 1). It should be noted that OPERABLE automatic actuation logic channels alone will not ensure that each Function can be activated; the instrumentation channels and actuated equipment associated with each Function must also be OPERABLE to ensure that the Functions can be automatically initiated during an accident.
LCO 3.3.7 covers only the automatic actuation logic that initiates these Functions. LCO 3.3.5, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," and LCO 3.3.6, "Engineered Safety Feature Actuation System (ESFAS) Manual Initiation," provide requirements on the instrumentation and manual initiation channels that input to the automatic actuation logic.
The ESFAS, in conjunction with the actuated equipment, provides protective functions necessary to mitigate Design Basis Accidents (DBAs), specifically, the loss of coolant accident (LOCA) and steam line break (SLB) events. The ESFAS relies on the OPERABILITY of the automatic actuation logic for each component to perform the actuation of the selected systems.
The small and large break LOCA analyses assume a conservative 35 second delay time for the actuation of high pressure injection (HPI) and low pressure injection (LPI) in BAW-10103A, Rev. 3 (Ref. 2). This delay time includes allowances for emergency diesel generator (EDG) starts, EDG loading, ECCS pump starts, and valve openings. Similarly, the reactor building (RB) Cooling, RB Isolation, and RB Spray have been analyzed with delays appropriate for the entire system.
Babcock & Wilcox STS                   B 3.3.7-1                                        Rev. 5.0

ESFAS Automatic Actuation Logic B 3.3.7 BASES BACKGROUND (continued)
Typical values used in the analyses are 35 seconds for RB Cooling, 60 seconds for RB Isolation, and 58 seconds for RB Spray.
The ESFAS automatic initiation of Engineered Safety Feature (ESF)
Functions to mitigate accident conditions is assumed in the DBA analysis and is required to ensure that consequences of analyzed events do not exceed the accident analysis predictions. Automatically actuated features include HPI, LPI, RB Cooling, RB Spray, and RB Isolation.
The ESFAS LCOs in the BWOG Standard Technical Specifications (STS) are based on a system representative of the Crystal River Unit 3 design.
As discussed earlier, this arrangement involves measurement channels shared among all actuation functions, with separate actuation logic channels for each actuated component. In this arrangement, multiple ESF components are affected by a measurement channel failure, but a single automatic actuation logic failure affects only one component. The organization of BWOG STS ESFAS LCOs reflect the described logic arrangement by linking actions for automatic actuation logic failures directly to the actions for the affected ESF component. The overall philosophy is that if an automatic actuation logic fails, the affected component is put into its engineered safeguard configuration. This action eliminates the need for the automatic actuation logic. If the affected component cannot be placed in its engineered safeguard configuration, actions are taken to address the inoperability of the supported system component. This greatly simplifies delineation of ESFAS LCOs.
Furthermore, the LCO requirements on instrumentation channels, automatic actuation logics, and manual initiation are specified separately to reflect the different impact each has on ESFAS OPERABILITY.
APPLICABLE         Accident analyses rely on automatic ESFAS actuation for protection of SAFETY             of the core and RB and for limiting off site dose levels following an ANALYSES           accident. These include LOCA, SLB, and feedwater line break events that result in Reactor Coolant System (RCS) inventory reduction or severe loss of RCS cooling. The automatic actuation logic is an integral part of the ESFAS.
The ESFAS automatic actuation logics satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The automatic actuation logic matrix for each component actuated by the ESFAS is required to be OPERABLE whenever conditions exist that could require ESF protection of the reactor or the RB. This ensures automatic initiation of the ESF required to mitigate the consequences of accidents.
Babcock & Wilcox STS                   B 3.3.7-2                                         Rev. 5.0

ESFAS Automatic Actuation Logic B 3.3.7 BASES APPLICABILITY      The automatic actuation logic Function shall be OPERABLE in MODES 1, 2, and 3, and in MODE 4 when the associated engineered safeguard equipment is required to be OPERABLE, because ESF Functions are designed to provide protection in these MODES. Automatic actuation in MODE 5 or 6 is not required because the systems initiated by the ESFAS are either reconfigured or disabled for shutdown cooling operation.
Accidents in these MODES are slow to develop and would be mitigated by manual operation of individual components. Adequate time is available to evaluate unit conditions and respond by manually operating the ESF components, if required.
ACTIONS            A Note has been added to the ACTIONS indicating separate Condition entry is allowed for each ESFAS automatic actuation logic matrix.
A.1 and A.2 When one or more automatic actuation logic matrices are inoperable, the associated component(s) can be placed in its engineered safeguard configuration. Required Action A.1 is equivalent to the automatic actuation logic performing its safety function ahead of time. In some cases, placing the component in its engineered safeguard configuration would violate unit safety or operational considerations. In these cases, the component status should not be changed, but the supported system component must be declared inoperable. Conditions which would preclude the placing of a component in its engineered safeguard configuration include, but are not limited to, violation of system separation, activation of fluid systems that could lead to thermal shock, or isolation of fluid systems that are normally functioning. The Completion Time of 1 hour is based on operating experience and reflects the urgency associated with the inoperability of a safety system component.
Required Action A.2 requires entry into the Required Actions of the affected supported systems, since the true effect of automatic actuation logic failure is inoperability of the supported system. The Completion Time of 1 hour is based on operating experience and reflects the urgency associated with the inoperability of a safety system component.
SURVEILLANCE       SR 3.3.7.1 REQUIREMENTS SR 3.3.7.1 is the performance of a CHANNEL FUNCTIONAL TEST. The test simulates the required one-out-of-three inputs to the logic circuit and verifies the successful operation of the automatic actuation logic. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required Babcock & Wilcox STS                   B 3.3.7-3                                        Rev. 5.0

ESFAS Automatic Actuation Logic B 3.3.7 BASES SURVEILLANCE REQUIREMENTS (continued) contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. [ The test demonstrates that every automatic actuation logic associated with one of the two safety system trains successfully performs the two-out-of-three logic combinations every 31 days. All automatic actuation logics are thus retested every 62 days.
The Frequency is based on operating experience that demonstrates the rarity of more than one channel failing within the same 31 day interval.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Automatic actuation logic response time testing is incorporated into the response time testing required by LCO 3.3.5.
REFERENCES         1. 10 CFR 50.46.
: 2. BAW-10103A, Rev. 3, July 1977.
Babcock & Wilcox STS                      B 3.3.7-4                                                       Rev. 5.0

EDG LOPS B 3.3.8 B 3.3 INSTRUMENTATION B 3.3.8 Emergency Diesel Generator (EDG) Loss of Power Start (LOPS)
BASES BACKGROUND         The EDGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation.
Undervoltage protection will generate a LOPS in the event a loss of voltage or degraded voltage condition occurs in the switchyard. There are two LOPS Functions for each 4.16 kV vital bus.
Three undervoltage relays with [inverse voltage time] characteristics are provided on each 4.16 kV Class 1E instrument bus for the purpose of detecting a sustained undervoltage condition or a loss of bus voltage.
The relays are combined in a two-out-of-three logic to generate a LOPS if the voltage is below 75% for a short time or below 90% for a long time.
The LOPS initiated ACTIONS are described in FSAR, Section [8.3]
(Ref. 1).
Trip Setpoints and Allowable Value The trip setpoints used in the bistables are based on the analytical limits presented in accident analysis in FSAR, Chapter [14] (Ref. 2). The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. The actual nominal trip setpoint entered into the bistable is more conservative than that required by the unit specific setpoint calculations. A channel is inoperable if its actuation trip setpoint is not within its required Allowable Value.
Setpoints in accordance with the Allowable Value will assure that limits of Chapter 2.0, "Safety Limits," in the Technical Specifications are not violated during anticipated operational occurrences (AOOs); that the consequences of accidents will be acceptable, providing the unit is operated from within the LCOs at the onset of the AOO or accident; and that the equipment functions as designed.
The undervoltage protection scheme has been designed to protect the unit from spurious trips caused by the offsite power source. This is made possible by the inverse voltage time characteristics of the relays used. A complete loss of offsite power will result in approximately a [1] second delay in LOPS actuation. The EDG starts and is available to accept loads within a 10 second time interval on the Engineered Safety Feature Actuation System (ESFAS) or LOPS. Emergency power is established within the maximum time delay assumed for each event analyzed in the accident analysis (Ref. 2).
Babcock & Wilcox STS                  B 3.3.8-1                                           Rev. 5.0

EDG LOPS B 3.3.8 BASES BACKGROUND (continued)
With three protection channels in a two-out-of-three trip logic for each division of the 4.16 kV power supply, no single failure will cause or prevent protective system actuation. This arrangement meets IEEE-279-1971 criteria (Ref. 3).
APPLICABLE         The EDG LOPS is required for the Engineered Safety Features (ESF)
SAFETY             to function in any accident with a loss of offsite power. Its design basis ANALYSES           is that of the ESFAS.
Accident analyses credit the loading of the EDG, based on the loss of offsite power, during a loss of coolant accident (LOCA). The actual EDG Start has historically been associated with the ESFAS actuation. The diesel loading has been included in the delay time associated with each safety system component requiring EDG supplied power following a loss of offsite power. The analysis assumes a nonmechanistic EDG loading, which does not explicitly account for each individual component of the loss of power detection and subsequent actions. The total actuation time for the limiting systems, high pressure injection, and low pressure injection is 35 seconds. This delay time includes contributions from the EDG Start, EDG loading, and safety injection system component actuation. The response of the EDG to a loss of power must be demonstrated to fall within this analysis response time when including the contributions of all portions of the delay.
The required channels of LOPS, in conjunction with the ESF systems powered from the EDGs, provide unit protection in the event of any of the analyzed accidents discussed in the accident analysis (Ref. 2), in which a loss of offsite power is assumed.
The delay times assumed in the safety analysis for the ESF equipment include the 10 second EDG Start delay and, if applicable, the appropriate sequencing delay. The response times for ESFAS actuated equipment in LCO 3.3.5, "Engineered Safety Feature Actuation System (ESFAS)
Instrumentation," include the appropriate EDG loading and sequencing delay.
The EDG LOPS channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The LCO for the LOPS requires that three channels per bus of each LOPS instrumentation Function shall be OPERABLE in MODES 1, 2, 3, and 4 when the LOPS supports safety systems associated with the ESFAS. In MODES 5 and 6, the three channels must be OPERABLE whenever the associated EDG is required to be OPERABLE to ensure that the automatic start of the EDG is available when needed.
Babcock & Wilcox STS                   B 3.3.8-2                                        Rev. 5.0

EDG LOPS B 3.3.8 BASES LCO (continued)
Loss of LOPS function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents. During the loss of offsite power, which is an AOO, the EDG powers the motor driven emergency feedwater pumps. Failure of these pumps to start would leave only the one turbine driven pump and an increased potential for a loss of decay heat removal through the secondary system.
Only Allowable Values are specified for each Function in the LCO.
Nominal trip setpoints are specified in the unit specific setpoint calculations. The nominal setpoints are selected to ensure that the setpoint measured by CHANNEL FUNCTIONAL TESTS does not exceed the Allowable Value if the bistable is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within the Allowable Value, is acceptable provided that operation and testing is consistent with the assumptions of the unit specific setpoint calculation. Each Allowable Value specified is more conservative than the analytical limit assumed in the transient and accident analysis to account for instrument uncertainties appropriate to the trip function.
These uncertainties are defined in the "[Unit Specific Setpoint Methodology]" (Ref. 4).
Degraded Voltage LOPS Voltage: The minimum Allowable Value includes an allowance for relay coil calibration error and is based on maintaining at least [90%] of rated voltage on the 480 V motor control centers, with a [4.1%] V drop across the [4160/480] V stepdown transformers. The [4.1%] V drop associated with these transformers is the maximum expected due to ESF bus loading, while the MCC contactors are considered to require at least
[90%] V for proper operation.
The maximum Allowable Value is not based on equipment operability concerns, but rather avoidance of unnecessary EDG starts due to spurious channel trip.
Time Delay: The response time includes [5 seconds] for undervoltage relay actuation following detection of degraded ES bus voltage,
[13 seconds] for the bus trip delay timer, and [3 seconds] for the dead bus timer. Note that the acceptance criteria of [21 seconds] does not account for the setpoint tolerance of [10%] or [+/- 2.1 seconds].
Babcock & Wilcox STS                   B 3.3.8-3                                        Rev. 5.0

EDG LOPS B 3.3.8 BASES LCO (continued)
Loss of Voltage LOPS Voltage and Response Time: The Allowable Value for the loss of voltage channels is  0 V. This Allowable Value and the associated channel response time are based on the physical characteristics of the loss of voltage sensing relays. The loss of voltage channels respond to a complete loss of ES bus voltage, providing automatic starting and loading of the associated EDG. However, their response time is not critical to the overall ES equipment response time following an actuation, since the degraded voltage LOPS instrumentation will also respond to the complete loss of voltage, and will do so earlier than the loss of voltage instrumentation. The loss of voltage channel response includes only the time response associated with the undervoltage relays, including the nominal setpoint of [7.8 seconds] and a tolerance of [7%] or
[0.55 seconds].
APPLICABILITY      The EDG LOPS actuation Function shall be OPERABLE in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation is also required whenever the EDG is required to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown," so that the EDG can perform its function on a loss of power or degraded power to the vital bus.
ACTIONS            If a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the function that the channel provides must be declared inoperable and the LCO Condition entered for the particular protection function affected. Since the required channels are specified on a per EDG basis, the Condition may be entered separately for each EDG.
A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function.
A.1 If one channel per EDG in one or more Functions is inoperable, it must be tripped within 1 hour [or in accordance with the Risk Informed Completion Time Program]. With a channel in trip, the LOPS channels are configured to provide a one-out-of-two logic to initiate a trip of the incoming offsite power. In trip, one additional valid actuation will cause a LOPS signal on the bus. The 1 hour Completion Time is reasonable to evaluate and to take action by correcting a degraded condition in an orderly manner and takes into account the low probability of an event requiring LOPS occurring during this interval.
Babcock & Wilcox STS                   B 3.3.8-4                                         Rev. 5.0

EDG LOPS B 3.3.8 BASES ACTIONS (continued)
B.1 Condition B applies when two or more undervoltage or two or more degraded voltage channels on a single bus are inoperable.
Required Action B.1 requires all but one inoperable channel to be restored to OPERABLE status within 1 hour [or in accordance with the Risk Informed Completion Time Program]. With two or more channels inoperable, the logic is not capable of providing an automatic EDG LOPS signal for valid loss of voltage or degraded voltage conditions. The 1 hour Completion Time is reasonable to evaluate and to take action by correcting the degraded condition in an orderly manner and takes into account the low probability of an event requiring LOPS occurring during this interval.
C.1 Condition C applies if the Required Action of Condition A or Condition B and the associated Completion Time is not met.
Required Action C.1 ensures that Required Actions for affected diesel generator inoperabilities are initiated. Depending on unit MODE, the Actions specified in LCO 3.8.1, "AC Sources - Operating," or LCO 3.8.2, are required immediately.
SURVEILLANCE       SR 3.3.8.1 REQUIREMENTS SR 3.3.8.1 is the performance of the CHANNEL CHECK to ensure that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; therefore, it is key in verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE.
Babcock & Wilcox STS                   B 3.3.8-5                                             Rev. 5.0

EDG LOPS B 3.3.8 BASES SURVEILLANCE REQUIREMENTS (continued)
[ The Frequency, about once every shift, is based on operating experience that demonstrates channel failure is rare. Since the probability of two random failures in redundant channels in any 12 hour period is low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with this LCO's required channels.
SR 3.3.8.2 The Note allows channel bypass for testing without defining it as inoperable although during this time period it cannot actuate a diesel start. This allowance is based on the assumption that 4 hours is the average time required to perform channel Surveillance. The 4 hour testing allowance does not significantly reduce the probability that the EDG will start when necessary. It is not acceptable to routinely remove channels from service for more than 4 hours to perform required Surveillance testing.
A CHANNEL FUNCTIONAL TEST is performed on each required EDG LOPS channel to ensure the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. There is a plant specific program which verifies that the instrument channel functions as required Babcock & Wilcox STS                        B 3.3.8-6                                                       Rev. 5.0

EDG LOPS B 3.3.8 BASES SURVEILLANCE REQUIREMENTS (continued) by verifying the as-left and as-found setting are consistent with those established by the setpoint. [The Frequency of 31 days is considered reasonable based on the reliability of the components and on operating experience that demonstrates channel failure is rare.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.3.8.3 A CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor. The setpoints and the response to a loss of voltage and a degraded voltage test shall include a single point verification that the trip occurs within the required delay time, as shown in Reference 1. CHANNEL CALIBRATION shall find that measurement setpoint errors are within the assumptions of the unit specific setpoint analysis. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
[ The Frequency is based on operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 18 month calibration interval in the determination of equipment drift in the setpoint calculation.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                        B 3.3.8-7                                                       Rev. 5.0

EDG LOPS B 3.3.8 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Section [8.3].
: 2. FSAR, Chapter [14].
: 3. IEEE-279-1971, April 1972.
: 4.    [Unit Name], [Unit Specific Setpoint Methodology].
Babcock & Wilcox STS                      B 3.3.8-8                                                       Rev. 5.0

Source Range Neutron Flux B 3.3.9 B 3.3 INSTRUMENTATION B 3.3.9 Source Range Neutron Flux BASES BACKGROUND         The source range neutron flux channels provide the operator with an indication of the approach to criticality at lower power levels than can be seen on the intermediate range neutron flux instrumentation. These channels also provide the operator with a flux indication that reveals changes in reactivity and helps to verify that SDM is being maintained.
The source range instrumentation has two redundant count rate channels originating in two high sensitivity proportional counters. Two source range detectors are externally located on opposite sides of the core 180&deg;.
These channels are used over a counting range of 0.1 cps to 1E6 cps and are displayed on the operator's control console in terms of log count rate. The channels also measure the rate of change of the neutron flux level, which is displayed for the operator in terms of startup rate from -0.5 decades to +5 decades per minute. An interlock provides a control rod withdraw "inhibit" on a high startup rate of +2 decades per minute in either channel.
The proportional counters of the source range channels are BF3 chambers. The detector high voltage is automatically turned off when the flux level is approximately one decade above the useful operating range.
Conversely, the high voltage is turned on automatically when the flux level returns to within approximately one decade of the detectors' maximum useful range. High voltage will be turned off automatically when the flux level is above 1E-10 amp in both intermediate range channels, or 10% power in power range channels.
APPLICABLE         The source range neutron flux channels are necessary to monitor SAFETY             core reactivity changes. It is the primary means for detecting and ANALYSES           triggering operator actions to respond to reactivity transients initiated from conditions in which the Reactor Protection System (RPS) is not required to be OPERABLE. It also triggers operator actions to anticipate RPS actuation in the event of reactivity transients starting from shutdown or low power conditions.
The source range neutron flux channels satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                Two source range neutron flux channels shall be OPERABLE whenever the control rods are capable of being withdrawn to provide the operator with redundant source range neutron instrumentation. The source range instrumentation is the primary power indication at low power levels 1E-10 amp on intermediate range instrumentation and must remain OPERABLE for the operator to continue increasing power.
Babcock & Wilcox STS                  B 3.3.9-1                                          Rev. 5.0

Source Range Neutron Flux B 3.3.9 BASES LCO (continued)
A Note has been added allowing detector high voltage to be de-energized with neutron flux > 1E-10 amp on the intermediate range channels.
Above this point, the source range instrumentation is no longer the primary power indicator. As such, the high voltage to the source range detectors may be de-energized.
APPLICABILITY      Two source range neutron flux channels shall be OPERABLE in MODE 2 to provide redundant indication during an approach to criticality. Neutron flux level is sufficient for monitoring on the intermediate range and on the power range instrumentation prior to entering MODE 1; therefore, source range instrumentation is not required in MODE 1.
In MODES 3, 4, and 5, source range neutron flux instrumentation shall be OPERABLE to provide the operator with a means of monitoring changes in SDM and to provide an early indication of reactivity changes.
The requirements for source range neutron flux instrumentation during MODE 6 refueling operations are addressed in LCO 3.9.2., "Nuclear Instrumentation."
ACTIONS            A.1 The Required Action for one channel of the source range neutron flux indication inoperable with neutron flux  1E-10 amp on the intermediate range neutron flux instrumentation is to delay increasing reactor power until the channel is repaired and restored to OPERABLE status. This limits power increases in the range where the operators rely solely on the source range instrumentation for power indication. The Completion Time ensures the source range is available prior to further power increases.
B.1, B.2, B.3, and B.4 With both source range neutron flux channels inoperable with neutron flux 1E-10 amp on the intermediate range neutron flux instrumentation, the operators must take actions to limit the possibilities for adding positive reactivity. This is done by immediately suspending positive reactivity additions, initiating action to insert all CONTROL RODS, and opening the CONTROL ROD drive trip breakers within 1 hour. Periodic SDM verification is then required to provide a means for detecting the slow reactivity changes that could be caused by mechanisms other than control rod withdrawal or operations involving positive reactivity changes.
Since the source range instrumentation provides the only reliable direct indication of power in this condition, the operators must continue to verify the SDM every 12 hours until at least one channel of the source range Babcock & Wilcox STS                    B 3.3.9-2                                       Rev. 5.0

Source Range Neutron Flux B 3.3.9 BASES ACTIONS (continued) instrumentation is returned to OPERABLE status. Required Action B.1, Required Action B.2, and Required Action B.3 preclude rapid positive reactivity additions. The 1 hour Completion Time for Required Action B.3 and Required Action B.4 provides sufficient time for operators to accomplish the actions. The 12 hour Frequency for performing the SDM verification ensures that the reactivity changes possible with CONTROL RODS inserted are detected before SDM limits are challenged.
Required Action B.1 is modified by a Note which permits plant temperature changes provided the temperature change is accounted for in the calculated SDM. Introduction of temperature changes, including temperature increases when a positive MTC exists, must be evaluated to ensure they do not result in a loss of required SDM.
C.1 With neutron flux > 1E-10 amp in MODE 2, 3, 4, or 5 on the intermediate range neutron flux instrumentation, continued operation is allowed with one or more source range neutron flux channels inoperable. The ability to continue operation is justified because the instrumentation does not provide a safety function during high power operation. However, actions are initiated within 1 hour to restore the channel(s) to OPERABLE status for future availability. The Completion Time of 1 hour is sufficient to initiate the action. The action must continue until channels are restored to OPERABLE status.
SURVEILLANCE       SR 3.3.9.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; therefore, it is key in verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has Babcock & Wilcox STS                   B 3.3.9-3                                          Rev. 5.0

Source Range Neutron Flux B 3.3.9 BASES SURVEILLANCE REQUIREMENTS (continued) drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If the channels are normally off scale during times when surveillance is required, the CHANNEL CHECK will only verify that they are off scale in the same direction. Off scale low current loop channels are verified to be reading at the bottom of the range and not failed downscale.
The agreement criteria includes an expectation of one decade of overlap when transitioning between neutron flux instrumentation. For example, during a power reduction near the bottom of the scale for the intermediate range monitors, a source range monitor reading is expected with at least one decade overlap. Without such an overlap, the source range monitors are considered inoperable unless it is clear that an intermediate range monitor inoperability is responsible for the lack of the expected overlap.
[ The Frequency, about once every shift, is based on operating experience that demonstrates channel failure is rare. Since the probability of two random failures in redundant channels in any 12 hour period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the LCO's required channels. When operating in Required Action A.1, CHANNEL CHECK is still required. However, in this condition, a redundant source range is not available for comparison.
CHANNEL CHECK may still be performed via comparison with intermediate range detectors, if available, and verification that the OPERABLE source range channel is energized and indicating a value consistent with current unit status.
Babcock & Wilcox STS                        B 3.3.9-4                                                       Rev. 5.0

Source Range Neutron Flux B 3.3.9 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.9.2 For source range neutron flux channels, CHANNEL CALIBRATION is a complete check and readjustment of the channels from the preamplifier input to the indicators. This test verifies the channel responds to measured parameters within the necessary range and accuracy.
CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift to ensure that the instrument channel remains operational between successive tests.
The SR is modified by a Note excluding neutron detectors from CHANNEL CALIBRATION. It is not necessary to test the detectors because generating a meaningful test signal is difficult. The detectors are of simple construction, and any failures in the detectors will be apparent as change in channel output.
[ The Frequency of [18] months is based on demonstrated instrument CHANNEL CALIBRATION reliability over an [18] month interval, such that the instrument is not adversely affected by drift.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
REFERENCES           None.
Babcock & Wilcox STS                        B 3.3.9-5                                                       Rev. 5.0

Intermediate Range Neutron Flux B 3.3.10 B 3.3 INSTRUMENTATION B 3.3.10 Intermediate Range Neutron Flux BASES BACKGROUND           The intermediate range neutron flux channels provide the operator with an indication of reactor power at higher power levels than the source range instrumentation and lower power levels than the power range instrumentation.
The intermediate range instrumentation has two log N channels originating in two electrically identical gamma compensated ion chambers. Each channel provides eight decades of flux level information in terms of the log of ion chamber current from 1E-10 amp to 1E-2 amp.
The channels also measure the rate of change of the neutron flux level, which is displayed for the operator in terms of startup rate from -0.5 decades to +5 decades per minute. A high startup rate of +3 decades per minute in either channel will initiate a control rod withdrawal inhibit.
The intermediate range compensated ion chambers are of the electrically adjustable gamma compensating type. Each detector has a separate adjustable high voltage power supply and an adjustable compensating voltage supply.
APPLICABLE           Intermediate range neutron flux channels are necessary to monitor SAFETY               core reactivity changes and are the primary indication to trigger ANALYSES             operator actions to anticipate Reactor Protection System actuation in the event of reactivity transients starting from low power conditions.
The intermediate range neutron flux channels satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                  Two intermediate range neutron flux instrumentation channels shall be OPERABLE to provide the operator with redundant neutron flux indication. These enable operators to control the increase in power and to detect neutron flux transients. This indication is used until the power range instrumentation is on scale. Violation of this requirement could prevent the operator from detecting and controlling neutron flux transients that could result in reactor trip during power escalation.
APPLICABILITY        The intermediate range neutron flux channels shall be OPERABLE in MODE 2 and in MODES 3, 4 and 5 with any CONTROL ROD drive (CRD) trip breaker in the closed position and the CRD System capable of rod withdrawal.
Babcock & Wilcox STS                    B 3.3.10-1                                         Rev. 5.0

Intermediate Range Neutron Flux B 3.3.10 BASES APPLICABILITY (continued)
The intermediate range instrumentation is designed to detect power changes during initial criticality and power escalation when the power range and source range instrumentation cannot provide reliable indications. Since those conditions can exist in all of these MODES, the intermediate range instrumentation must be OPERABLE.
ACTIONS            A.1 If one intermediate range channel becomes inoperable when the channels indicate > 1E-10 amp, the unit is exposed to the possibility that a single failure will disable all neutron monitoring instrumentation. To avoid this, the inoperable channel must be repaired or power must be reduced to the point where source range channels can provide neutron flux indication. Completion of Required Action A.1 places the unit in this state, and LCO 3.3.9, "Source Range Neutron Flux," requires OPERABILITY of two source range detectors once this state is reached.
If the one channel failure occurs when indicated power is  1E-10 amp, the Required Action prohibits increases in power above the source range capability.
The 2 hour Completion Time allows controlled reduction of power into the source range and is based on unit operating experience that demonstrates the improbability of the second intermediate range channel failing during the allowed interval.
B.1 and B.2 With two intermediate range neutron flux channels inoperable when THERMAL POWER is  5% RTP, the operators must place the reactor in the next lowest condition for which the intermediate range instrumentation is not required. This involves providing power level indication on the source range instrumentation by immediately suspending operations involving positive reactivity changes and, within 1 hour, placing the reactor in the tripped condition with the CRD trip breakers open. The Completion Times are based on unit operating experience and allow the operators sufficient time to manually insert the CONTROL RODS prior to opening the CRD breakers.
Required Action B.1 is modified by a Note which permits plant temperature changes provided the temperature change is accounted for in the calculated SDM. Introduction of temperature changes, including temperature increases when a positive MTC exists, must be evaluated to ensure they do not result in a loss of required SDM.
Babcock & Wilcox STS                  B 3.3.10-2                                        Rev. 5.0

Intermediate Range Neutron Flux B 3.3.10 BASES SURVEILLANCE         SR 3.3.10.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; therefore, it is key in verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE.
The agreement criteria includes an expectation of one decade of overlap when transitioning between neutron flux instrumentation. For example, during a power increase near the top of the scale for the source range monitors, an intermediate range monitor reading is expected with at least one decade overlap. Without such an overlap, the intermediate range monitors are considered inoperable unless it is clear that a source range monitor inoperability is responsible for the lack of the expected overlap.
Further, during a power reduction near the bottom of the scale for the power range monitors, an intermediate range monitor reading is expected with at least one decade overlap. Without such an overlap, the intermediate range monitors are considered inoperable unless it is clear that a power range monitor inoperability is responsible for the lack of the expected overlap.
[ The Frequency, about once every shift, is based on operating experience that demonstrates channel failure is rare. Since the probability of two random failures in redundant channels in any 12 hour period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                    B 3.3.10-3                                             Rev. 5.0

Intermediate Range Neutron Flux B 3.3.10 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the LCO's required channels.
When operating in Required Action A.1, CHANNEL CHECK is still required. However, in this condition, a redundant intermediate range is not available for comparison. CHANNEL CHECK may still be performed via comparison with power or source range detectors, if available, and verification that the OPERABLE intermediate range channel is energized and indicates a value consistent with current unit status.
SR 3.3.10.2 For intermediate range neutron flux channels, CHANNEL CALIBRATION is a complete check and readjustment of the channels, from the preamplifier input to the indicators. This test verifies the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift to ensure that the instrument channel remains operational between successive tests. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
The SR is modified by a Note excluding neutron detectors from CHANNEL CALIBRATION. It is not necessary to test the detectors because generating a meaningful test signal is difficult. In addition, the detectors are of simple construction, and any failures in the detectors will be apparent as a change in channel output. [ The Frequency is based on operating experience and consistency with the typical industry refueling cycle and is justified by demonstrated instrument reliability over an
[18] month interval such that the instrument is not adversely affected by drift.
OR Babcock & Wilcox STS                      B 3.3.10-4                                                      Rev. 5.0

Intermediate Range Neutron Flux B 3.3.10 BASES SURVEILLANCE REQUIREMENTS (continued)
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         None.
Babcock & Wilcox STS                      B 3.3.10-5                                                      Rev. 5.0

EFIC Instrumentation B 3.3.11 B 3.3 INSTRUMENTATION B 3.3.11 Emergency Feedwater Initiation and Control (EFIC) Instrumentation BASES BACKGROUND         The EFIC System instrumentation is designed to provide safety grade means of controlling the secondary system as a heat sink for core decay heat removal. To ensure the secondary system remains a heat sink, the EFIC System takes action to initiate emergency feedwater (EFW) when the primary source of feedwater is lost and to isolate functional components from hydraulic faults within the secondary system. These actions ensure that a source of cooling water is available to be fed to a once through steam generator (OTSG) that has a controlled steam pressure, thereby fixing the heat sink temperature at the saturation temperature of the secondary system. The EFIC Functions that are supported and the parameters that are needed for each of these Functions are described next.
The EFIC instrumentation contains devices and circuitry that generate the following signals when monitored variables reach levels that are indicative of conditions requiring protective actions.
: a. EFW Initiation,
: b. EFW Vector Valve Control,
: c. Main Steam Line Isolation, and
: d. Main Feedwater (MFW) Isolation.
EFW is initiated to restore a source of cooling water to the secondary system when conditions indicate that the normal source of feedwater is insufficient to continue heat removal. The two indications used for this are the loss of both MFW pumps and a low level in the steam generator (SG). Also, EFW is initiated when action is being taken to isolate the MFW from the SG during conditions of uncontrolled depressurizations.
This is done by initiating EFW when steam pressure reaches the low SG pressure setpoint for isolation of main steam and MFW, and EFW vector valve control. Finally, EFW is initiated when the primary system experiences a total loss of forced circulation. This initiation, on the loss of all reactor coolant pumps (RCPs), ensures the EFW is available to raise SG levels to promote natural circulation cooling. Additionally, this ensures that EFW is available under the worst-case, small break loss of coolant accident (LOCA) conditions when secondary system cooling with high SG water levels is necessary.
Babcock & Wilcox STS                  B 3.3.11-1                                         Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES BACKGROUND (continued)
The EFIC System also isolates main steam and MFW to an SG that has lost pressure control. With the loss of pressure control, the heat sink temperature control is lost and the heat removal rate cannot be controlled. The main steam and MFW are isolated to an SG when the steam pressure reaches a low setpoint, a condition which is beyond the normal operating point of the secondary system.
The EFIC System also performs an EFW control function to avoid delivering EFW to a depressurized SG when the other SG remains pressurized. This continues the function of isolating functional components from an SG whose pressure cannot be controlled. This function precludes the delivery of fluid to a depressurized SG, thereby avoiding an uncontrolled cooling condition as long as the other SG remains pressurized. When both of the SGs are depressurized, the EFIC logic provides EFW flow to both SGs until a significant pressure difference between the two SGs is developed, thereby ensuring that core cooling is maintained.
Trip Setpoints and Allowable Values The trip setpoints are the nominal value at which the bistables are set.
Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION accuracy (i.e.,
                   +/- [rack calibration + comparator setting accuracy]).
The trip setpoints used in the bistables are based on the analytical limits stated in FSAR, Section [14.1] (Ref. 1). The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. The Allowable Values specified in Table 3.3.11-1 in the accompanying LCO are conservatively adjusted with respect to the analytical limits to allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environmental errors for those EFIC channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 2). A detailed description of the methodology used to calculate the trip setpoints, including their explicit uncertainties, is provided in "[Unit Specific Setpoint Methodology]" (Ref. 3). The actual nominal trip setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a CHANNEL FUNCTIONAL TEST. One example of such a change in measurement error is drift during the surveillance interval. A channel is inoperable if its actuation trip setpoint is not within its required Allowable Value.
Babcock & Wilcox STS                  B 3.3.11-2                                            Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES BACKGROUND (continued)
Setpoints in accordance with the Allowable Value ensure that the consequences of Design Basis Accidents (DBAs) are acceptable, providing the unit is operated from within the LCOs at the onset of the DBA, and that the equipment functions as designed.
Each channel can be tested on line to verify that the setpoint accuracy is within the specified allowance requirements of Figure [ ], FSAR, Chapter [7] (Ref. 4). Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated. The SRs for the channels are specified in the SRs Section.
The Allowable Values listed in Table 3.3.11-1 are based on the "[Unit Specific Setpoint Methodology]" (Ref. 3), which incorporates all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each trip setpoint. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes.
Figure [ ], FSAR, Chapter [7] (Ref. 4), illustrates EFIC EFW Initiation logic operation.
Each EFIC train actuates on a one-out-of-two taken twice combination of trip signals from the instrumentation channels. Each EFIC channel can issue an initiate command, but an EFIC actuation will take place only if at least two channels issue initiate commands. The one-out-of-two taken twice logic combinations are transposed between trains so that failure of two channels prevents actuation of, at most, one train.
More detailed descriptions of the EFIC instrumentation are provided next.
: 1. EFW Initiation Figure [ ], FSAR, Chapter [7] (Ref. 4), illustrates one channel of the EFIC EFW Initiation channel. The individual instrumentation channels that serve EFIC EFW Initiation Function are discussed next.
: a. Loss of MFW Pumps (Control Oil Pressure)
Loss of both MFW Pumps is one of the four parameters within the EFIC System that automatically initiates EFW. Loss of MFW Pumps is detected by MFW Pump turbine control oil pressure.
The MFW Pump status instrumentation is a part of the nuclear instrument (NI) and Reactor Protection System (RPS). Each Babcock & Wilcox STS                  B 3.3.11-3                                           Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES BACKGROUND (continued)
RPS channel receives MFW Pump status information from pressure switches (four per pump). If both switches in a single channel trip, the associated RPS channel trips. Each RPS channel provides both MFW Pumps tripped signal to the associated EFIC channel. The trip Function is bypassed when THERMAL POWER  20% RTP and the RPS is in shutdown bypass. The bypass is automatically removed when THERMAL POWER is greater than 20% RTP.
Loss of both MFW Pumps was chosen as an EFW automatic initiating parameter because it is a direct and immediate indicator of loss of MFW.
: b. SG Level - Low Four EFIC dedicated low range level transmitters per SG Level -
Low are used to generate the signals used for detection for low level conditions for EFW actuation. There is one transmitter for each of the four channels A, B, C, and D. The signals are also used after EFW is actuated to control SG level at the low level setpoint [30 inches] when one or more RCPs are operational.
The lower and upper taps for the low range level transmitters are located at 6 inches and 277 inches, respectively, above the upper face of the SG's lower tube sheet. The calibrated range is 0-150 inches.
SG Level - Low was chosen as an EFW automatic initiating parameter because it indicates that the primary feedwater source is insufficient to meet the heat removal requirements and, therefore, additional cooling water is necessary to ensure core decay heat removal.
: c. SG Pressure - Low Four transmitters per SG provide the EFIC System with channels A through D of SG Pressure - Low. These are the same transmitters used by the MFW and Main Steam Line Isolation Functions. When the SG pressure drops below the bistable setpoint of 600 psig on a given channel, an EFW Initiation signal is sent to the automatic actuation logic. The low pressure Function may be manually bypassed when both SGs are less than 750 psig. If either SG input channel exceeds 750 psig, the EFIC channel bypass is automatically removed.
The low pressure operational bypass allows for normal cooldown without EFIC actuation.
Babcock & Wilcox STS              B 3.3.11-4                                         Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES BACKGROUND (continued)
SG Pressure - Low is a primary indication and actuation signal for steam line breaks (SLBs) or feedwater line breaks (FWLBs).
For small breaks, which do not depressurize the SG or take a long time to depressurize, automatic actuation is not required.
The operator has time to diagnose the problem and take the appropriate actions.
: d. RCP Status A loss of power to all four RCPs is an indication of a pending loss of forced flow in the Reactor Coolant System. These sensing signals are input into the four channels of EFIC.
When at least two channels issue initiate commands based on loss of all RCPs, the EFIC System will automatically actuate EFW and switch the level control setpoint to approximately 50%
in the SG. This higher setpoint provides a thermal center in the SG at a higher elevation than that of the reactor to ensure natural circulation of the reactor coolant.
To allow heatup and cooldown operations without actuation, a bypass permissive of 10% RTP is used. The 10% bypass permissive was chosen because it was an available, qualified Class 1E signal at the time the EFIC System was designed.
When the first RCP is started, the "loss of four RCPs" initiation signal may be manually reset. If the bypass is not manually reset, it will be automatically reset when the unit reaches 10%
power. During cooldown, the bypass may be inserted at any time the power has been reduced below 10%. However, for most operating conditions, it is recommended that this trip function remain active until after the Decay Heat Removal System has been initiated and the system is ready for the last RCP to be tripped. This trip function must be bypassed prior to stopping the last RCP.
: 2. EFW Vector Valve Control Figure [ ], FSAR, Chapter [7] (Ref. 4), illustrates one channel of the EFIC EFW Vector Valve Control logic. The function of the EFW vector logic is to determine whether EFW should not be fed to one or the other SG. This is to preclude the continued addition of EFW to a depressurized SG and, thus, to minimize the overcooling effects of a steam leak.
Babcock & Wilcox STS                 B 3.3.11-5                                       Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES BACKGROUND (continued)
Each set of vector logic receives SG pressure information from bistables located in the input logic of the same EFIC channel. The pressure information received is:
: a. SG A pressure less than 600 psig,
: b. SG B pressure less than 600 psig,
: c. SG A pressure 125 psid greater than SG B pressure, and
: d. SG B pressure 125 psid greater than SG A pressure.
Each vector logic also receives a vector/control enable signal from both EFIC channel A and channel B when EFW is initiated. [Each logic also receives an SG high level signal. High level in an SG prevents opening the associated vector valves and enables closing the valves without either EFIC train vector valve enable.]
The vector logic develops signals to open or to close SG A and B EFW valves.
The vector logic outputs are in a neutral state until enabled by the control/vector enable from the channel A or B trip logics. When enabled, the vector logic can issue open or close commands to the EFW control valves and EFW isolation valves per the selected channel assignments.
Each vector logic may isolate EFW to one SG or the other, never both.
The valve open or close commands are determined by the relative values of SG pressures as follows:
Babcock & Wilcox STS              B 3.3.11-6                                        Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES BACKGROUND (continued)
SG VALVES PRESSURE STATUS                                     "A"            "B" SG A and SG B > 600 psig                          Open           Open l SG A - SG B l < 125 psid                        Open           Open SG A or SG B  600 psig                           Open           Close and SG A - SG B  125 psid SG A or SG B  600 psig                           Close          Open and SG B - SG A  125 psid Bypass One of the four initiation channels can be put into "maintenance bypass."
Bypassing one initiation channel isolates that channel's signal to the functions fed from initiation channel but does not bypass the trip logic within the actuation channel. An interlock feature prevents bypassing more than one channel at a time. In addition, since the EFIC System receives signals from NI and RPS, the maintenance bypass from the NI and RPS is interlocked with the EFIC System. If one channel of the NIS and RPS is in maintenance bypass, only the corresponding channel of the EFIC may be bypassed (e.g., channel A, NI or RPS, and channel A, EFIC). This ensures that only the corresponding channels of the EFIC and NI and RPS are placed in maintenance bypass at the same time.
EFIC channel maintenance bypass does not bypass EFW Initiation from Engineered Safety Feature Actuation System (ESFAS) high pressure injection (HPI). The EFIC HPI Actuation Function is, however, bypassed when ESFAS is bypassed.
Babcock & Wilcox STS                 B 3.3.11-7                                        Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES BACKGROUND (continued)
The operational bypass provisions were discussed as part of the individual Functions described earlier.
Operational bypass of the OTSG Level - High input to the vector valve logic is possible after EFIC initiation. [For this unit, bypassing the overfill function is for the following reasons:]
3, 4. Main Steam Line and MFW Isolation Figure [ ], FSAR, Chapter [7] (Ref. 4) illustrates one channel of the EFIC Main Steam Line and MFW Isolation logic. Four pressure transmitters per SG provide EFIC with channels A through D logic of SG pressure. The channels are as described for EFW Initiation mentioned earlier.
Once isolated, manual action is required to defeat the isolation command if desired. The EFIC System is designed to perform its intended function with one channel in maintenance bypass (in effect, inoperable) with a single failure in one of the remaining channels.
This is in compliance with IEEE-279-1971 (Ref. 5) due to the redundancy and independence in the EFIC design.
APPLICABLE           1. EFW Initiation SAFETY ANALYSES                  Although loss of both MFW pumps is a direct and immediate indicator of loss of MFW, other scenarios such as valve closures could potentially cause loss of feedwater. The loss of MFW analysis, therefore, conservatively assures the actuation of EFW on low SG level. If the loss of feedwater is due to loss of MFW pumps, EFW will be actuated much earlier than assumed in the analysis, which will increase the SG heat transfer capability and will lessen the severity of the transient.
The DBA which forms the basis for initiation of the EFW systems is a loss of MFW transient. In the analysis of this transient, SG Level -
Low is the parameter assumed to automatically initiate EFW. This assumption yields the least SG inventory available for heat removal and is, therefore, conservative for evaluation of this DBA. SG Level -
Low would be an indicator of all accidents involving a loss of primary to secondary heat removal.
Babcock & Wilcox STS                     B 3.3.11-8                                        Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES APPLICABLE SAFETY ANALYSES (continued)
SG Pressure - Low is a primary indication and provides the actuation signal for SLBs or FWLBs. For small breaks, which do not depressurize the SG or take a long time to depressurize, automatic actuation is not required. The operator has sufficient time to diagnose the problem and take the appropriate actions.
Loss of four RCPs is a primary indicator of the need for auxiliary feedwater (AFW) in the safety analyses for loss of electric power and loss of coolant flow. It also serves as a backup indicator for SLBs and small break LOCAs.
: 2. EFW Vector Valve Control Most of the FSAR SLB analyses were performed prior to the development of the safety grade EFIC System. Therefore, the EFIC vector valve control was not credited in the original licensing basis for a main SLB analysis. Instead, operator action was credited with isolating AFW to the affected SG within the first 60 seconds.
However, isolating the affected SG is a function automatically performed by the EFIC System. Therefore, the FSAR analysis remains conservative relative to the inclusion of the vector valve control.
3, 4. Main Steam Line and MFW Isolation The FSAR analysis assumed integrated control system action for MFW and Main Steam Line Isolation. The analysis took credit for turbine stop valve closure and feedwater valve isolation on reactor trip and considered the isolation functions occurring on SG pressure
                         < 600 psig as backup. These isolation functions are currently provided by the safety grade EFIC System. Use of the EFIC System in the original safety analysis would have been consistent with the licensing position allowing mitigative functions to be performed by safety grade systems in accident analysis. For these reasons, the SLB accident analysis remains conservative with the assumed integrated control system actions.
The EFIC System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                   B 3.3.11-9                                        Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES LCO                All instrumentation performing an EFIC System Function in Table B 3.3.11-1 shall be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
Four channels are required OPERABLE for all EFIC instrumentation channels to ensure that no single failure prevents actuation of a train.
Each EFIC instrumentation channel is considered to include the sensors and measurement channels for each Function, the operational bypass switches, and permissives. Failures that disable the capability to place a channel in operational bypass, but which do not disable the trip Function, do not render the protection channel inoperable.
Only the Allowable Values are specified for each EFIC initiation and bypass removal function in the LCO. In Table 3.3.11-1, Allowable Values for the bypass removal functions are specified in terms of applicability limits on the associated trip Function. Nominal trip setpoints are specified in the unit specific setpoint calculations. The nominal setpoints are selected to ensure the setpoints measured by CHANNEL FUNCTIONAL TESTS do not exceed the Allowable Value if the bistable is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable provided that operation and testing are consistent with the assumptions of the unit specific setpoint calculations. Each Allowable Value specified is more conservative than the analytical limit assumed in the safety analysis to account for instrument uncertainties appropriate to the trip Function.
These uncertainties are defined in the "[Unit Specific Setpoint Methodology]" (Ref. 3).
The Bases for the LCO requirements of each specific EFIC Function are discussed next.
Loss of MFW Pumps Four EFIC channels shall be OPERABLE with MFW pump turbines A and B control oil low pressure actuation setpoints of > [55] psig. The 55 psig setpoint is about half of the normal operating control oil pressure.
The 55 psig setpoint Allowable Value was arbitrarily chosen as a good indication of Loss of MFW Pumps. Analysis only assumes Loss of MFW Pumps and a specific value of MFW pump control oil pressure is not used in the analysis. The Loss of MFW Pumps Function includes a bypass enable and removal function from the NI/RPS. The bypass removal function is based on maintaining consistency with RPS LCO and design of system.
Babcock & Wilcox STS                 B 3.3.11-10                                        Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES LCO (continued)
SG Level - Low Four EFIC dedicated low range level transmitters per SG shall be OPERABLE with SG Level - Low actuation setpoints of  [9] inches, to generate the signals used for detection for low level conditions for EFW Initiation. There is one transmitter for each of the four channels A, B, C, and D. The signals are also used after EFW is actuated to control at the low level setpoint of 30 inches when one or more RCPs are in operation.
In the determination of the low level setpoint, it is desired to place the setpoint as low as possible, considering instrument errors, to give the maximum operability margin between the integrated control system low load control setpoint and the EFW Initiation setpoint. This will minimize spurious or unwanted initiation of EFW. Credit is only taken for low level actuation for those transients which do not involve a degraded environment. Therefore, normal environment errors only are used for determining the SG Level - Low level setpoint.
SG Pressure - Low Four EFIC channels per SG shall be OPERABLE with SG low pressure actuation setpoints of  [600] psig. The setpoint is chosen to avoid actuation under transient conditions not requiring secondary system isolation, preferring to maintain a steaming path to the condenser, if possible. Small break LOCA analyses have indicated minimum secondary system pressures of approximately 700 psig. The SG Pressure - Low Function includes a bypass enable and removal function.
The bypass removal Allowable Value is chosen to allow sufficient operating margin for the operator to bypass when cooling down.
SG Differential Pressure - High Four EFIC channels for SG differential pressure shall be OPERABLE with setpoints of  [125] psid. The setpoint ensures that automatic EFW isolation to a depressurized SG occurs for the range of sizes of SLBs that require rapid actuation early in the event. The setpoint has also been chosen to avoid spurious isolation of EFW during conditions due to relatively small deviations in SG pressures that can be caused by primary system conditions. The SG Differential Pressure - High Function includes a bypass enable and removal function. The bypass removal Allowable Value is chosen to allow sufficient operating margin for the operator to bypass when cooling down.
Babcock & Wilcox STS                 B 3.3.11-11                                         Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES LCO (continued)
RCP Status Four EFIC channels for RCP status shall be OPERABLE. This ensures that upon the loss of four RCPs, EFW will be automatically initiated with the EFW control level automatically raised to approximately 50%,
providing a higher SG level for establishing and maintaining natural circulation conditions when the forced reactor coolant flow is lost. No setpoint is specified since the status indication as used by EFIC is binary in nature. The RCP Status Function includes a bypass enable and removal function from the RPS. The Allowable Value for the bypass removal is set high enough to avoid spurious actuations during low power operation.
SG Level - High
[ For this unit, the basis for SG Level - High signal is as follows: ]
APPLICABILITY        The EFIC System instrumentation Functions shall be OPERABLE in accordance with Table 3.3.11-1. Each Function has its own requirements that are based on the specific accidents and conditions that it is designed to protect against.
The initiation of EFW on the Loss of MFW Pumps shall only be required in MODE 1 and in MODES 2 and 3 when not in shutdown bypass, when core power production and heat removal requirements are the greatest.
Below these unit conditions, the EFW Initiation on low SG level is rapid enough to avoid unnecessary primary system overheating.
EFW Initiation on low SG level shall be OPERABLE at all times the SG is required for heat removal. These conditions include MODES 1, 2, and 3.
To avoid automatic actuation of the EFW pumps during normal heatup and cooldown transients, the low SG pressure Function can be bypassed at or below a secondary pressure of [750] psig. This secondary pressure can normally only be reached during MODE 3 operation.
The EFW System Initiation on loss of all RCPs Function shall be operable at  10% RTP. It is possible to bypass the Function below 10% RTP; however, for most cases, the Function is kept in service until the unit is placed on the Decay Heat Removal System. To prevent inadvertent actuation of the EFW pumps, it must be bypassed prior to stopping the last RCP.
Babcock & Wilcox STS                   B 3.3.11-12                                        Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES APPLICABILITY (continued)
The MFW, Main Steam Line Isolation, and EFW Vector Valve Control Functions shall be OPERABLE in MODES 1, 2, and 3 with SG pressure 750 psig because the SG inventory can be at a high energy level and contribute significantly to the peak pressure with a secondary side break.
Both the normal feedwater and the EFW must be able to be isolated on each SG to limit overcooling of the primary and mass and energy releases to the reactor building. Once the SG pressures have decreased below 750 psig, the Main Steam Line and MFW Isolation Functions can be bypassed to avoid actuation during normal unit cooldowns. The EFW Vector Valve Control logic will not perform any function when both SG pressures are low; thus, the logic can also be bypassed at the same point. In MODES 4, 5, and 6, the energy level is low and the secondary side feedwater flow rate is low or nonexistent. In MODES 4, 5, and 6, the primary system temperatures are too low to allow the SGs to effectively remove energy and EFIC instrumentation is not required to be OPERABLE.
ACTIONS            If a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or any of the transmitter, signal processing electronics, or EFIC channel cabinet modules are found inoperable, then all affected Functions provided by that channel must be declared inoperable and the unit must enter the Conditions for the particular protection Function affected.
A Note has been added to the ACTIONS indicating that a separate Condition entry is allowed for each Function. When the Required Channels in Table 3.3.11-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis) then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.
A.1 and A.2 Condition A applies to failures of a single EFW Initiation, Main Steam Line Isolation, or MFW Isolation instrumentation channel. This includes failure of a common instrumentation channel in any combination of the Functions.
With one channel inoperable in one or more EFW Initiation, Main Steam Line Isolation, or MFW Isolation Functions listed in Table 3.3.11-1, the channel(s) must be placed in bypass or trip within 1 hour. This Condition applies to failures that occur in a single channel, e.g., channel A, which when bypassed will remove initiate Functions within the channel from service. Since the RPS and EFIC channels are interlocked, only the corresponding channel in each system may be bypassed at any time.
This feature is ensured by an electrical interlock. If testing of another Babcock & Wilcox STS                 B 3.3.11-13                                         Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES ACTIONS (continued) channel in either the EFIC or RPS is required, the EFIC channel must be placed in trip to allow the other channel to be bypassed. With the channel in trip, the resultant logic is one-out-of-two. The Completion Time of 1 hour is adequate to perform Required Action A.1.
Required Action A.2 provides for placing the channel(s) in trip if the channel(s) is/are not restored to OPERABLE status within 72 hours [or in accordance with the Risk Informed Completion Time Program].
A single inoperable EFIC instrumentation channel affects at most one train of EFW, Main Steam Line Isolation, and MFW Isolation. Therefore, the 72 hour Completion Time was selected to be consistent with the allowed out of service time for the EFW, Main Steam Line Isolation, and MFW Isolation Functions.
B.1, B.2, and B.3 Condition B applies to a situation where two instrumentation channels for multiple protection functions of EFW Initiation, Main Steam Line Isolation, or MFW Isolation instrumentation are inoperable. For example, Condition B applies if channel A and B of the EFW Initiation Function are inoperable.
Condition B does not apply if one channel of different Functions is inoperable in the same protection channel. That condition is addressed by Condition A.
With two EFW Initiation, Main Steam Line Isolation, or MFW Isolation protection channels inoperable, one channel must be placed in bypass (Required Action B.1). Bypassing one of the remaining OPERABLE channels is not possible due to system interlocks. Therefore, the second channel must be tripped (Required Action B.2) to prevent a single failure from causing loss of the EFIC Function. The Completion Times of 1 hour are adequate to perform the Required Actions. [Alternatively, a Completion Time can be determined for Required Actions B.2 in accordance with the Risk Informed Completion Time Program.]
One of the channels must be returned to OPERABLE status (Required Action B.3) to minimize the time the system is permitted to operate in a configuration that is not capable of withstanding a single failure and still initiate EFW, Main Steam Line Isolation, and MFW Isolation. Restoring one channel changes system status to that of Condition A. A single Babcock & Wilcox STS                  B 3.3.11-14                                       Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES ACTIONS (continued) inoperable EFIC channel affects at most one train of EFW, Main Steam Line Isolation, and MFW Isolation. Therefore the 72 hour Completion Time was selected to be consistent with the allowed out of service time for the EFW, Main Steam Line Isolation, and MFW Isolation Functions.
[Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
C.1 The function of the EFW Vector Valve Control is to meet the single-failure criterion while being able to provide EFW on demand and isolate an SG when required. These conflicting requirements result in the necessity for two valves in series, in parallel with two valves in series, and a four channel valve command system. Refer to LCO 3.3.14, "Emergency Feedwater Initiation and Control (EFIC) Emergency Feedwater (EFW) -
Vector Valve Logic."
With one EFW Vector Valve Control channel inoperable, the system cannot meet the single-failure criterion and still meet the dual functional criteria described earlier. This condition is analogous to having one EFW train inoperable. Therefore, when one vector valve control channel is inoperable, the channel must be restored to OPERABLE status (Required Action C.1) within 72 hours, which is consistent with the Completion Time associated with the loss of one train of EFW. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
D.1, D.2.1, D.2.2, E.1, and F.1 If the Required Actions cannot be met within the required Completion Time or if more than two channels are inoperable in one or more Functions, the unit must be placed in a MODE or condition in which the requirement does not apply. This is done by placing the unit in a nonapplicable MODE for the particular Function. The nonapplicable MODE is to open the CRD trip breakers for Function 1.a, MODE 4 for Function 1.b, less than 10% RTP for Function 1.d, and SG pressure less than 750 psig for all other Functions. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
Babcock & Wilcox STS                 B 3.3.11-15                                         Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES SURVEILLANCE         A Note indicates that the SRs for each EFIC instrumentation Function REQUIREMENTS         are identified in the SRs column of Table 3.3.11-1. All Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION. The SG - Low Level Function is the only Function that was modeled in transient analysis, and thus is the only EFW Initiation Function subjected to response time testing. Response time testing is also required for Main Steam Line and MFW Isolation.
Individual EFIC subgroup relays must also be tested, one at a time, to verify the individual EFIC components will actuate when required. Some components cannot be tested at power since their actuation might lead to unit trip or equipment damage. These are specifically identified and must be tested when shut down. The various SRs account for individual functional differences and for test frequencies applicable specifically to the Functions listed in Table 3.3.11-1. The operational bypasses associated with each EFIC instrumentation channel are also subject to these SRs to ensure OPERABILITY of the EFIC instrumentation channel.
SR 3.3.11.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; therefore, it is key in verifying that the instrumentation continues to operate properly between each CHANNEL FUNCTIONAL TEST and CHANNEL CALIBRATION.
Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If the channels are normally off scale during times when surveillance is required, the CHANNEL CHECK will only verify that they are off scale in the same direction. Off scale low current loop channels are verified to be reading at the bottom of the range and not failed downscale.
[ The Frequency, about once every shift, is based on operating experience that demonstrates channel failure is rare. Since the probability of two random failures in redundant channels in any 12 hour period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels.
Babcock & Wilcox STS                    B 3.3.11-16                                            Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
The CHANNEL CHECK supplements less formal, but more frequent, checks of channel operability during normal operational use of the displays associated with the LCO required channels.
SR 3.3.11.2 A CHANNEL FUNCTIONAL TEST verifies the function of the required trip, interlock, and alarm functions of the channel. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay.
This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Setpoints for both trip and bypass removal functions must be found within the Allowable Value specified in the LCO. (Note that the Allowable Values for the bypass removal functions are specified in the Applicable MODES or Other Specified Condition column of Table 3.3.11-1 as limits on applicability for the trip Functions.) There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
[ The Frequency of 31 days is based on unit operating experience with regard to channel OPERABILITY and drift, which demonstrates that failure of more than one channel of a given function in any 31 day interval is a rare event.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                       B 3.3.11-17                                                      Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES SURVEILLANCE REQUIREMENTS (continued)
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.3.11.3 CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The test verifies the channel responds to a measured parameter within the necessary range and accuracy.
CHANNEL CALIBRATION leaves the channels adjusted to account for instrument drift to ensure that the instrument channel remains operational between successive tests. CHANNEL CALIBRATION shall find that measurement errors and bistable setpoint errors are within the assumptions of the unit specific setpoint analysis. CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint analysis. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
[ The Frequency is based on the assumption of an [18] month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                       B 3.3.11-18                                                      Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.11.4 This SR verifies individual channel actuation response times are less than or equal to the maximum value assumed in the accident analysis.
Response time testing acceptance criteria are included in "Unit Specific Response Time Acceptance Criteria" (Ref. 6).
Individual component response times are not modeled in the analysis.
The analysis models the overall or total elapsed time, from the point at which the parameter exceeds the actuation setpoint value at the sensor, to the point at which the end device is actuated.
[ EFIC RESPONSE TIME tests are conducted on an [18] month STAGGERED TEST BASIS. Testing of the final actuation devices, which make up the bulk of the EFIC RESPONSE TIME, is included in the testing of each channel. Therefore, staggered testing results in response time verification of these devices every [18] months. The [18] month test Frequency is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.
EFIC RESPONSE TIMES cannot be determined at power since equipment operation is required.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
REFERENCES           1. FSAR, Section [14.1].
: 2. 10 CFR 50.49.
: 3.    [Unit Name], [Unit Specific Setpoint Methodology].
Babcock & Wilcox STS                       B 3.3.11-19                                                      Rev. 5.0

EFIC Instrumentation B 3.3.11 BASES REFERENCES (continued)
: 4. FSAR, Chapter [7].
: 5. IEEE-279-1971, April 1972.
: 6. [Unit Specific Response Time Acceptance Criteria].
Babcock & Wilcox STS               B 3.3.11-20                                  Rev. 5.0

EFIC Manual Initiation B 3.3.12 B 3.3 INSTRUMENTATION B 3.3.12 Emergency Feedwater Initiation and Control (EFIC) Manual Initiation BASES BACKGROUND         The EFIC manual initiation capability provides the operator with the capability to actuate EFIC Functions from the control room in the absence of any other initiation condition. Manually actuated Functions include main feedwater (MFW) Isolation for once through steam generator (SG) A, MFW Isolation for SG B, Main Steam Line Isolation for SG A, Main Steam Line Isolation for SG B, and Emergency Feedwater (EFW)
Actuation. These Functions are provided in the event the operator determines that an EFIC Function is needed and does not automatically actuate. These are backup Functions to those performed automatically by EFIC.
The EFIC manual initiation circuitry satisfies the manual initiation and single-failure criterion requirements of IEEE-279-1971 (Ref. 1).
APPLICABLE         EFIC Functions credited in the safety analysis are automatic.
SAFETY             However, the manual initiation Functions are required by design ANALYSES           as backups to the automatic trip Functions and allow operators to actuate EFW, Main Steam Line Isolation, or MFW Isolation whenever these Functions are needed. Furthermore, the manual initiation of EFW Actuation, Main Steam Line Isolation, and MFW Isolation may be specified in unit operating procedures.
The EFIC manual initiation functions satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                All instrumentation performing an EFIC manual initiation Function shall be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
Two manual initiation switches per actuation channel (A and B) of each Function (A and B MFW Isolation, A and B Main Steam Line Isolation, and EFW Actuation) are required to be OPERABLE whenever the SGs are being relied on to remove heat. Each Function (MFW Isolation, Main Steam Line Isolation, and EFW Initiation) has two actuation or "trip" channels, channels A and B. Within each channel A actuation logic there are two manual trip switches. When one manual switch is depressed, a half trip occurs. When both manual switches are depressed, a full trip of channel A actuation occurs for that particular Function. Similarly, channel B actuation logic for each Function has two manual trip switches.
Both switches per actuation channel must be OPERABLE and must be Babcock & Wilcox STS                  B 3.3.12-1                                        Rev. 5.0

EFIC Manual Initiation B 3.3.12 BASES LCO (continued) depressed to get a full manual trip of that channel. The use of two manual trip switches for each channel of actuation logic allows for testing without actuating the end devices and also reduces the possibility of accidental manual actuation.
APPLICABILITY      The MFW and Main Steam Line Isolation manual initiation Functions shall be OPERABLE in MODES 1, 2, and 3 because SG inventory can be at a sufficiently high energy level to contribute significantly to the peak containment pressure during a secondary side break. In MODES 4, 5, and 6, the SG energy level is low and secondary side feedwater flow rate is low or nonexistent.
The EFW manual initiation Function shall be OPERABLE in MODES 1, 2, and 3 because the SGs are relied on for Reactor Coolant System heat removal. In MODES 4, 5, and 6, heat removal requirements are reduced and can be provided by the Decay Heat Removal System.
ACTIONS            A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each EFIC manual initiation Function.
A.1 With one or both manual initiation switches of one or more EFIC Function(s) inoperable in one channel, the channel for the associated EFIC Function(s) must be placed in the tripped condition within 72 hours
[or in accordance with the Risk Informed Completion Time Program].
With the channel in the tripped condition, the single-failure criterion is met and the operator can still initiate one actuation channel given a single failure in the other channel. Failure to perform Required Action A.1 could allow a single failure of another switch to prevent manual actuation of at least one of two trip channels. The Completion Time allotted to trip the channel allows the operator to take all the appropriate actions for the failed channel and still ensure that the risk involved in operating with the failed channel is acceptable.
B.1 With one or both manual initiation switches of one or more EFIC Function(s) inoperable in both actuation channels, one actuation channel for each Function must be restored to OPERABLE status within 1 hour [or in accordance with the Risk Informed Completion Time Program]. With the channel restored, the second channel must be placed in the tripped Babcock & Wilcox STS                  B 3.3.12-2                                          Rev. 5.0

EFIC Manual Initiation B 3.3.12 BASES ACTIONS (continued) condition within 72 hours (Required Action A.1). With the channel in the tripped condition, the single-failure criterion is met and the operator can still initiate one actuation channel given a single failure in the other channel. The Completion Time allotted to restore the channel allows the operator to take all the appropriate actions for the failed channel and still ensures that the risk involved in operating with the failed channel is acceptable.
C.1 and C.2 If Required Action A.1 or Required Action B.1 cannot be met within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE       SR 3.3.12.1 REQUIREMENTS This SR requires the performance of a CHANNEL FUNCTIONAL TEST to ensure that the channels can perform their intended functions. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. For MFW and Main Steam Line Isolation, the test need not include actuation of the end device. This is due to the risk of a unit transient caused by the closure of valves associated with MFW and Main Steam Line Isolation or actuating EFW during testing at power.
[ The Frequency of 31 days is based on operating experience that demonstrates the rarity of more than one channel failing within the same 31 day interval.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                   B 3.3.12-3                                         Rev. 5.0

EFIC Manual Initiation B 3.3.12 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. IEEE-279-1971, April 1972.
Babcock & Wilcox STS                      B 3.3.12-4                                                      Rev. 5.0

EFIC Logic B 3.3.13 B 3.3 INSTRUMENTATION B 3.3.13 Emergency Feedwater Initiation and Control (EFIC) Logic BASES BACKGROUND         Main Steam Line and Main Feedwater (MFW) Isolation The four emergency feedwater initiation and control (EFIC) channels sensing a steam generator (SG) low outlet pressure condition input their initiate commands to the trip logic modules. Figure [ ] , FSAR, Chapter [7] (Ref. 1), illustrates the Main Steam Line and MFW Isolation Logics. The trip logic modules are physically located in the "A" and "B" EFIC channel cabinets. Channel "A" actuation logic initiates when instrumentation channel "A" or "B" initiates and channel "C" or "D" initiates, which in simplified logic is:
                   "A" actuation = (A and C) or (A and D) or (B and C) or (B and D)
Channel "B" actuation logic initiates when instrumentation channel "A" or "C" initiates and channel "B" or "D" initiates, which in simplified logic is:
                   "B" actuation = (A and B) or (A and D) or (C and B) or (C and D)
Each of the four Functions (SG A Main Feedwater Isolation, SG B Main Feedwater Isolation, SG A Main Steam Line Isolation, and SG B Main Steam Line Isolation) has a channel "A" and a channel "B" of automatic actuation logic.
Both channels "A" and "B" of the SG A Main Feedwater Isolation automatic actuation logic send closure signals to the SG A main feedwater pump suction valve, the three SG A block valves, and the MFW pump discharge cross connect valve. In addition, the instrumentation trips MFW pump "A."
Both channels "A" and "B" of the SG A Main Steam Line Isolation automatic actuation logic send closure signals to both of the SG A Main Steam Isolation valves.
SG B MFW and Main Steam Line Isolation automatic actuation logics respond similarly for the SG B valves and MFW pump "B."
Emergency Feedwater (EFW) Actuation The four EFIC instrumentation channels for each of the parameters being sensed input their initiate commands to the trip logic modules. Figure [ ],
FSAR Chapter [7] (Ref. 1), illustrates the EFW initiation logic. These trip logic modules are physically located in the "A" and "B" EFIC channel cabinets.
Babcock & Wilcox STS                  B 3.3.13-1                                          Rev. 5.0

EFIC Logic B 3.3.13 BASES BACKGROUND (continued)
EFW Actuation functions are the same logic combinations as MFW and Main Steam Line Isolation. EFW initiation also occurs on high pressure injection (HPI) initiation. Both trains of HPI initiation are input into each EFW initiate logic channel.
EFIC automatically initiates the EFW System when any of the following conditions exist:
: a. All four reactor coolant pumps are tripped,
: b. Both MFW pumps are tripped and reactor power is > 20% RTP with the nuclear instrumentation Reactor Protection System not in shutdown bypass,
: c. Low level in either once through SG,
: d. Low pressure in either SG, or
: e. HPI Actuation on both A and B Engineered Safety Feature Actuation System channels.
Vector Valve Enable Logic The EFW module logic is responsible for sending open or close signals to the EFW control and isolation valves. Figure [ ] , FSAR, Chapter [7]
(Ref. 1), illustrates the vector valve logic. The vector module logic outputs are in a neutral state (neither commanding open nor close) until a signal is received from the Vector Valve Enable Logic. The Vector Valve Enable Logic monitors the channel A and B EFW Actuation logics. When an EFW Actuation occurs, the vector enable logic enables the vector logic to generate open or close signals to the EFW valves depending on the relative values of SG pressures.
APPLICABLE         Automatic isolation of MFW and main steam line was assumed in SAFETY             the safety analyses to mitigate the consequences of main steam line ANALYSES           or MFW line ruptures. The FSAR analyses for steam line breaks (SLBs) was generated before the development and installation of the safety grade EFIC System, which currently performs these automatic safety functions. The FSAR analysis, for example, assumes main steam line isolation through turbine stop valve closure based on an integrated control system signal. This same function is provided by the EFIC System by a safety grade signal that closes the Main Steam Line Isolation valves. The analyses are bounding, and the use of the EFIC System is consistent with the licensing position to take credit for safety grade systems to mitigate the consequences of an accident.
Babcock & Wilcox STS                   B 3.3.13-2                                          Rev. 5.0

EFIC Logic B 3.3.13 BASES APPLICABLE SAFETY ANALYSES (continued)
Similarly, vector valve control was not credited in the FSAR SLB analysis.
Operator action was credited with isolating EFW to the affected SG within the first 60 seconds. This function would be automatically performed by EFIC. Therefore, the FSAR analysis remains conservative relative to the inclusion of the vector valve logic.
Automatic initiation of EFW is credited in the loss of main feedwater analysis. The automatic actuation was based on the SG low level function of EFIC, although EFIC would initiate EFW based on the loss of both MFW pumps as well.
The EFIC logic satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                Two channels each of MFW and Main Steam Line Isolation, Vector Valve Enable, and EFW Actuation logics shall be OPERABLE. There are only two channels of automatic actuation logic per Function. Therefore, violation of this LCO could result in a complete loss of the automatic Function assuming a single failure of the other channel.
APPLICABILITY      The MFW and Main Steam Line Isolation automatic actuation logics shall be OPERABLE in MODES 1, 2, and 3 because SG inventory can be at a high energy level and can contribute significantly to the peak containment pressure during a secondary side line break. In MODES 4, 5, and 6, the energy level is low and the secondary side feedwater flow rate is low or nonexistent.
The EFW automatic actuation and vector enable logics shall be OPERABLE in MODES 1, 2, and 3 because the SGs are being used for heat removal from the primary system. During these MODES, the core power and heat removal requirements are the greatest, and if the normal source of feedwater is lost, EFW must be initiated rapidly to minimize the overheating of the primary system.
For portions of MODE 4 and for all of MODES 5 and 6, the primary system temperatures are too low to allow the SGs to effectively remove energy.
ACTIONS            If a channel is found inoperable, then all affected logic Functions provided by that channel must be declared inoperable and the LCO Condition entered for the particular protection function affected.
For this LCO, a Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each EFIC logic Function.
Babcock & Wilcox STS                  B 3.3.13-3                                       Rev. 5.0

EFIC Logic B 3.3.13 BASES ACTIONS (continued)
A.1 Condition A applies when one or more EFIC logic Functions in a single channel are inoperable (i.e., channel A could be inoperable for all four EFIC logic Functions and Condition A would still be applicable) with all Functions in the other channel OPERABLE. This Condition is equivalent to failure of one EFW, Main Steam Line Isolation, and MFW Isolation train.
With one automatic actuation logic channel of one or more EFIC Functions inoperable, the associated EFIC train must be restored to OPERABLE status. Since there are only two automatic actuation logic channels per EFIC Function, the condition of one channel inoperable is analogous to having one train of a two train Engineered Safety Feature (ESF) System inoperable. The system safety function can be accomplished; however, a single failure cannot be taken. Therefore, the failed channel(s) must be restored to OPERABLE status to re-establish the system's single-failure tolerance.
Condition A can be thought of as equivalent to failure of a single train of a two train safety system (e.g., the safety function can be accomplished, but a single failure cannot be taken). Thus, the Completion Time of 72 hours has been chosen to be consistent with Completion Times for restoring one inoperable ESF System train. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
The EFIC System has not been analyzed for failure of one train of one Function and the opposite train of the same Function. In this condition, the potential for system interactions that disable heat removal capability on EFW has not been evaluated. Consequently, any combination of failures in both channels A and B is not covered by Condition A and must be addressed by entry into LCO 3.0.3.
B.1 and B.2 If Required Action A.1 cannot be met within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging unit systems.
Babcock & Wilcox STS                  B 3.3.13-4                                       Rev. 5.0

EFIC Logic B 3.3.13 BASES SURVEILLANCE       SR 3.3.13.1 REQUIREMENTS This SR requires the performance of a CHANNEL FUNCTIONAL TEST to ensure that the channels can perform their intended functions. This test verifies MFW and Main Steam Line Isolation and EFW initiation automatic actuation logics are functional. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This test simulates the required inputs to the logic circuit and verifies successful operation of the automatic actuation logic. The test need not include actuation of the end device. This is due to the risk of a unit transient caused by the closure of valves associated with MFW and Main Steam Line Isolation or actuation of EFW during testing at power. [ The Frequency of 31 days is based on operating experience, which has demonstrated the rarity of more than one channel failing within the same 31 day interval.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Chapter [7].
Babcock & Wilcox STS                      B 3.3.13-5                                                      Rev. 5.0

EFIC - EFW - Vector Valve Logic B 3.3.14 B 3.3 INSTRUMENTATION B 3.3.14 Emergency Feedwater Initiation and Control (EFIC) - Emergency Feedwater (EFW) -
Vector Valve Logic BASES BACKGROUND          The function of the EFW vector valve logic is to determine whether EFW should not be fed to one or the other steam generator. This is to preclude the continued addition of EFW to a depressurized once through steam generator (SG) and, thus, minimize the overcooling effects of a steam leak. Each vector logic may isolate EFW to one SG or the other, never both.
There are four sets of vector valve logic; one in each channel of EFIC.
Each set of vector valve logic receives SG pressure information from bistables located in the input logic of the same EFIC channel. The pressure information received is:
: a. SG "A" pressure less than 600 psig,
: b. SG "B" pressure less than 600 psig,
: c. SG "A" pressure 125 psid greater than SG "B" pressure, and
: d. SG "B" pressure 125 psid greater than SG "A" pressure.
Each vector valve logic also receives a vector/control enable signal from both EFIC channel A and channel B when EFW is actuated.
The vector valve logic develops signals for open and close control of SG "A" and "B" EFW valves.
The vector valve logic outputs are in a neutral state with the valves fully open until enabled by the control/vector enable from the channel A or B trip logics. When enabled, the vector valve logic can issue close commands to the EFW control valves and open or close commands to the EFW isolation valves per the selected channel assignments.
The valve open/close commands are determined by the relative values of steam generator pressures as follows:
Babcock & Wilcox STS                  B 3.3.14-1                                        Rev. 5.0

EFIC - EFW - Vector Valve Logic B 3.3.14 BASES BACKGROUND (continued)
SG VALVES PRESSURE STATUS                                 "A"              "B" If SG "A" & SG "B" > 600 psig                  Open             Open If SG "A" > 600 psig & SG "B"                  Open            Close
                    < 600 psig If SG "A" < 600 psig & SG "B"                  Close            Open
                    > 600 psig If SG "A" & SG "B" < 600 psig AND                                         Open             Open SG "A" & SG "B" within 125 psid SG "A" 125 psid > SG "B"                       Open            Close SG "A" 125 psid > SG "A"                       Close            Open APPLICABLE         Automatic isolation of main feedwater (MFW) and main steam line SAFETY             was assumed in the safety analyses to mitigate the consequences ANALYSES           of main steam line or MFW line ruptures. The FSAR analysis for steam line breaks (SLBs) was generated before the development and installation of the safety grade EFIC System, which currently performs these automatic safety functions. The FSAR analysis, for example, assumes main steam line isolation through turbine stop valve closure based on an integrated control system signal. This same function is provided by the EFIC System by a safety grade signal that closes the main steam line isolation valves. The analyses are bounding, and the use of the EFIC System is consistent with the licensing position to take credit for safety grade systems to mitigate the consequences of an accident.
Similarly, vector logic valve control was not credited in the FSAR SLB analysis. Operator action was credited with isolating EFW to the affected SG within the first 60 seconds. This function would be automatically performed by EFIC. Therefore, the FSAR analysis remains conservative relative to the inclusion of the vector valve logic.
Babcock & Wilcox STS                  B 3.3.14-2                                       Rev. 5.0

EFIC - EFW - Vector Valve Logic B 3.3.14 BASES APPLICABLE SAFETY ANALYSES (continued)
EFW vector valve logic response time is included in the required response time for each EFW actuation initiation function instrumentation and is not specified separately.
The EFIC - EFW - vector valve logic satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                Four channels of the EFIC - EFW - vector valve logic module are required to be OPERABLE. The necessity for four channels is discussed in the BASES for ACTIONS. The 600 psig and 125 psid setpoints were chosen as discussed in Specification B 3.3.11, "EFIC System Instrumentation."
The feed only good generator verification study assumed a differential pressure vector value of 150 psid. The 125 psid setpoint conservatively assumes a 25 psi margin for instrument error. Failure to meet this LCO results in not being able to meet the single-failure criterion.
APPLICABILITY      EFIC - EFW - vector valve logic is required in MODES 1, 2, and 3 because the SGs are relied on in these MODES for required RCS heat removal. In MODES 4, 5, and 6, heat removal requirements are reduced and may be provided by the Decay Heat Removal System. Therefore, vector valve logic is not required to be OPERABLE in these MODES.
ACTIONS            A.1 The function of the EFIC-EFW control/isolation valves and the vector valve logic is to meet the single-failure criterion while maintaining the capability to:
: a. Provide EFW on demand and
: b. Isolate an SG when required.
These conflicting requirements result in the necessity for two valves in series, in parallel with two valves in series, and a four channel valve command system.
With one channel inoperable, the system cannot meet the single-failure criterion and still meet the dual functional criteria previously described.
Therefore, when one vector valve logic channel is inoperable, the channel must be restored to OPERABLE status within 72 hours [or in accordance with the Risk Informed Completion Time Program]. This is analogous to having one EFW train inoperable; wherein a 72 hour Completion Time is provided by the Required Actions of LCO 3.7.4, "EFW System." As such, the Completion Time of 72 hours is based on engineering judgement.
Babcock & Wilcox STS                   B 3.3.14-3                                        Rev. 5.0

EFIC - EFW - Vector Valve Logic B 3.3.14 BASES ACTIONS (continued)
B.1 and B.2 If Required Action A.1 cannot be met within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE       SR 3.3.14.1 REQUIREMENTS SR 3.3.14.1 is the performance of a CHANNEL FUNCTIONAL TEST.
This test demonstrates that the EFIC - EFW - vector valve logic performs its function as desired. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. [ The Frequency is based on operating experience that demonstrates the rarity of more than one channel failing within the same 31 day interval.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         None.
Babcock & Wilcox STS                      B 3.3.14-4                                                      Rev. 5.0

RB Purge Isolation - High Radiation B 3.3.15 B 3.3 INSTRUMENTATION B 3.3.15 Reactor Building (RB) Purge Isolation - High Radiation BASES BACKGROUND           The RB Purge Isolation - High Radiation Function closes the RB purge valves. This action isolates the RB atmosphere from the environment to minimize releases of radioactivity in the event an accident occurs. The high radiation signal indicates a failure of a barrier to the fuel radioactivity, and most likely a loss of coolant accident. The purge valves must begin to shut rapidly to ensure they reach a completely closed position prior to excessive pressures in the RB, against which the valves may not close.
The radiation monitoring system measures the activity in a representative sample of air drawn in succession through a particulate sampler, an iodine sampler, and a gas sampler. The LCO addresses only the gas sampler portion of this system. The sensitive volume of the gas sampler is shielded with lead and monitored by a Geiger-Mueller detector. The air sample is taken from the center of the purge exhaust duct through an isokinetic nozzle installed in the duct at a point selected for reduced turbulence.
If a gaseous activity flow rate of approximately 1E-2 &#xb5;Ci/sec (Kr-85) is exceeded, the monitor will alarm and initiate closure of the purge valves.
This activity flow rate is selected on the basis of 50,000 scfm flow rate in the purge exhaust and on the basis of a gas monitor setpoint equal to two times the expected background at the location of the monitor, which will provide fast detection of any release. The alarm setpoints for the particulate and iodine channels indicate that an alarm is obtained after the monitor samples a maximum permissible concentration level for 8 hours.
Therefore, a maximum of 1.3 mCi of Cs-137 or 67 &#xb5;Ci of DOSE EQUIVALENT I-131 will be released to the atmosphere during this period.
The closure of the purge valves ensures the RB remains as a barrier to fission product release. There is no bypass for this function. The closure of the purge valves provides an RB isolation assumed in the accident analysis.
Trip Setpoints and Allowable Values The trip setpoints are the nominal values at which the bistables are set.
Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION accuracy (i.e.,
                     +/- [rack calibration + comparator setting accuracy]).
Babcock & Wilcox STS                    B 3.3.15-1                                           Rev. 5.0

RB Purge Isolation - High Radiation B 3.3.15 BASES BACKGROUND (continued)
The trip setpoints used in the bistables are based on the analytical limits derived from the FSAR, Section [14.1] (Ref. 1). The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account to allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 2). Allowable Values specified in LCO 3.3.15 are conservatively adjusted with respect to the analytical limits. A detailed description of the methodology used to calculate the trip setpoints, including their explicit uncertainties, is provided in the "Unit Specific Setpoint Methodology" (Ref. 3). The actual nominal trip setpoint entered into the bistable is normally still more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a CHANNEL FUNCTIONAL TEST. One example of such a change in measurement error is drift during the surveillance interval. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
The Allowable Value in SR 3.3.15.3 is based on the methodology described in Reference 3, which incorporates all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each trip setpoint. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes.
These Allowable Values are established to prevent violation of the accident acceptance criteria during anticipated operational occurrences (AOOs).
Setpoints in accordance with the Allowable Value will ensure that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the unit is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed.
APPLICABLE         The analysis for the maximum hypothetical accident assumes the SAFETY             RB remains intact, with penetrations that are unnecessary for core ANALYSES           cooling isolated early in the event, within approximately [60] seconds.
The closure of the purge valves ensures the RB integrity assumed in the analysis is maintained. The isolation of the RB has not been analyzed mechanistically in the dose calculations, although its rapid isolation is assumed.
The RB Purge Isolation System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                   B 3.3.15-2                                           Rev. 5.0

RB Purge Isolation - High Radiation B 3.3.15 BASES LCO                  For sampling systems, OPERABILITY requires correct valve lineups, sample pump operation, filter motor operation, and detector OPERABILITY, when these sampling features are necessary to initiate a trip as assumed by the safety analysis or setpoint analysis.
Only the Allowable Values are specified for each RB Purge Isolation trip Function in the LCO. Nominal trip setpoints are specified in the unit specific setpoint calculations. The nominal setpoints are selected to ensure the setpoint measured by CHANNEL FUNCTIONAL TESTS does not exceed the Allowable Value if the bistable is performing as required.
Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable provided that operation and testing are consistent with the assumptions of the unit specific setpoint calculations. Each Allowable Value specified is more conservative than the analytical limit assumed in the safety analysis to account for instrument uncertainties associated with the trip function.
These uncertainties are defined in the "Unit Specific Setpoint Methodology" (Ref. 3) and the Offsite Dose Calculation Manual.
[ For this unit, the basis for the setpoint Allowable Value is as follows: ]
APPLICABILITY        The RB purge isolation - high radiation shall be OPERABLE in MODES 1, 2, 3, and 4. Outside of these MODES, the purge isolation must be OPERABLE whenever movement of [recently] irradiated fuel assemblies within the RB is taking place. These conditions are those under which the potential for fuel damage, and thus radiation release, is the greatest.
While in MODES 5 and 6, without fuel handling [involving handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [x] days)] in progress, the Purge Valve Isolation System does not need to be OPERABLE because the potential for a radioactive release is minimized and operator action is sufficient to ensure post accident offsite doses are maintained within the limits of 10 CFR 100. The need to use the purge valves in MODES 5 and 6 is in preparation for entry. This capability is required to minimize doses for personnel entering the building and is independent of the automatic isolation capability.
ACTIONS              A.1 With one channel inoperable in MODE 1, 2, 3, or 4, the RB purge valves must be placed and maintained in the closed position. This action accomplishes the safety function of the RB Purge Isolation - High Radiation Function. The 1 hour Completion Time is reasonable considering the time required to isolate the penetration and the relative importance of maintaining containment OPERABILITY during MODES 1, 2, 3, and 4.
Babcock & Wilcox STS                    B 3.3.15-3                                           Rev. 5.0

RB Purge Isolation - High Radiation B 3.3.15 BASES ACTIONS (continued)
B.1 and B.2 If Required Action A.1 cannot be met within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
C.1, C.2.1, and C.2.2 Condition C applies to failure of the high radiation purge function during movement of [recently] irradiated fuel assemblies within the RB.
With one channel inoperable during movement of [recently] irradiated fuel assemblies within the RB, the RB purge valves must be closed, or movement of [recently] irradiated fuel assemblies within the RB must be suspended. Required Action C.1 accomplishes the function of the high radiation channel. Required Action C.2.1 and Required Action C.2.2 place the unit in a configuration in which purge isolation on high radiation is not required. The Completion Time of "Immediately" is consistent with the urgency associated with the loss of RB isolation capability under conditions in which the fuel handling accidents [involving handling recently irradiated fuel] are possible and the high radiation function provides the only automatic actions to mitigate radiation release.
SURVEILLANCE       SR 3.3.15.1 REQUIREMENTS SR 3.3.15.1 is the performance of the CHANNEL CHECK for the RB purge isolation - high radiation instrumentation to ensure that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. Performance of the CHANNEL CHECK helps to ensure that the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared to similar unit instruments located throughout the unit. If the radiation monitor uses keep alive sources or check sources OPERABLE from the control room, the CHANNEL CHECK should also note the detector's response to these sources.
Babcock & Wilcox STS                 B 3.3.15-4                                         Rev. 5.0

RB Purge Isolation - High Radiation B 3.3.15 BASES SURVEILLANCE REQUIREMENTS (continued)
Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. [ The Frequency, about once every shift, is based on operating experience that demonstrates channel failure is rare. [At this unit, the following administrative controls and design features (e.g., downscale alarms) immediately alert operators to loss of function.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ---------------------------------------------------------------------------------------------- ] ]
SR 3.3.15.2 This SR requires the performance of a CHANNEL FUNCTIONAL TEST to ensure that the channels can perform their intended functions. This test verifies the capability of the instrumentation to provide the RB isolation. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
In MODES 1, 2, 3, and 4, the test does not include the actuation of the purge valves, as these valves are normally closed.
[ The justification of a 92 day Frequency, in view of the fact that there is only one channel, is Draft NUREG-1366 (Ref. 4).
Babcock & Wilcox STS                      B 3.3.15-5                                                      Rev. 5.0

RB Purge Isolation - High Radiation B 3.3.15 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.3.15.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations to ensure that the channel remains operational between successive tests. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
The CHANNEL CALIBRATION is a complete check of the instrumentation and detector. In MODES 1, 2, 3, and 4, the CHANNEL CALIBRATION does not include the actuation of the purge valves, since they are normally closed.
[ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                        B 3.3.15-6                                                      Rev. 5.0

RB Purge Isolation - High Radiation B 3.3.15 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Section [14.1].
: 2. 10 CFR 50.49.
: 3.    [Unit Specific Setpoint Methodology].
: 4. Draft NUREG-1366.
Babcock & Wilcox STS                      B 3.3.15-7                                                      Rev. 5.0

Control Room Isolation - High Radiation B 3.3.16 B 3.3 INSTRUMENTATION B 3.3.16 Control Room Isolation - High Radiation BASES BACKGROUND          The principal function of the Control Room Isolation - High Radiation is to provide an enclosed environment from which the unit can be operated following an uncontrolled release of radioactivity. The high radiation isolation function provides assurance that under the required conditions, an isolation signal will be given. The noble gas monitors located in the station vent stack provide isolation and shutdown of the normal Control Room Emergency Ventilation System (CREVS).
The control room isolation signal is provided by a single channel containing an iodine monitor with a scintillation detector and a gaseous monitor with a Geiger-Mueller detector. The iodine channel includes a particulate prefilter with the charcoal cartridge. If a radioactivity concentration above normal background level is detected or if sampling capability is lost, the monitor will initiate a shutdown of the normal duty supply fans and will place the ventilation dampers in their recirculation mode.
Trip Setpoints and Allowable Values The trip setpoints are the nominal value at which the bistables are set.
Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION accuracy (i.e., +/-
[rack calibration + comparator setting accuracy]).
The trip setpoints used in the bistables are based on the analytical limits derived from the FSAR, Section [14.1] (Ref. 1). The selection of these trip setpoints indicates that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, and instrument drift, Allowable Values specified in LCO 3.3.15 are conservatively adjusted with respect to the analytical limits. A detailed description of the methodology used to calculate the trip setpoints, including their explicit uncertainties, is provided in the "Unit Specific Setpoint Methodology" (Ref. 2). The actual nominal trip setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for changes in random measurement errors that are detectable by a CHANNEL FUNCTIONAL TEST. One example of a change in measurement error is drift during the surveillance interval. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
Babcock & Wilcox STS                    B 3.3.16-1                                          Rev. 5.0

Control Room Isolation - High Radiation B 3.3.16 BASES APPLICABLE           The CREVS is isolated when a reactor building high pressure Engineered SAFETY               Safety Feature Actuation System signal or a high radiation signal ANALYSES             is received. For the first 4 days following a loss of coolant accident, the CREVS is operated in the total recirculation mode. Four days after the start of the accident, the CREVS is started in the intake and recirculation mode and continues to operate in this mode for 30 days. This intake slightly pressurizes the control room. In both cases, the air flows through charcoal filters that are 95% efficient for elemental, particulate, and organic materials. The high radiation function only performs the initial isolation function to begin the recirculation mode of operation.
The Control Room Isolation - High Radiation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                  Only the Allowable Value is specified for each Control Room Isolation -
High Radiation trip Function in the LCO. Nominal trip setpoints are specified in the unit specific setpoint calculations. The nominal setpoints are selected to ensure the setpoint measured by the CHANNEL FUNCTIONAL TEST does not exceed the Allowable Value if the bistable is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable provided that operation and testing is consistent with the assumptions of the unit specific setpoint calculations. Each Allowable Value specified is more conservative than the analytical limit assumed in the safety analysis to account for instrument uncertainties appropriate to the trip function.
These uncertainties are defined in the "Unit Specific Setpoint Methodology" (Ref. 2).
[ At this unit, the basis for the Allowable Value is as follows: ]
APPLICABILITY        The control room isolation capability on high radiation shall be OPERABLE whenever there is a chance for a significant accidental release of radioactivity. This includes MODES 1, 2, 3, 4, [5, and 6] and all MODES and conditions during movement of [recently] irradiated fuel
[involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [x] days)]. If a radioactive release were to occur during any of these conditions, the control room would have to remain habitable to ensure reactor shutdown and cooling can be controlled from the main control room.
ACTIONS              A.1 Condition A applies to failure of the Control Room Isolation - High Radiation Function in MODE 1, 2, 3, or 4.
Babcock & Wilcox STS                    B 3.3.16-2                                          Rev. 5.0

Control Room Isolation - High Radiation B 3.3.16 BASES ACTIONS (continued)
With one channel of Control Room Isolation - High Radiation inoperable, the CREVS must be placed in a condition that does not require the isolation to occur. To ensure that the ventilation system has been placed in a state equivalent to that which occurs after the high radiation isolation has occurred, one OPERABLE train of the CREVS is placed in the emergency recirculation mode of operation. Reactor operation can continue indefinitely in this state. The 1 hour Completion Time is a sufficient amount of time in which to take the Required Action.
The Required Action is modified by a Note, which requires the CREVS be placed in the toxic gas protection mode if automatic transfer to the toxic gas protection mode is inoperable, since the pressurization mode would increase vulnerability to toxic gas releases.
B.1 and B.2 If the CREVS cannot be placed into recirculation mode while in MODE 1, 2, 3, or 4, actions must be taken to minimize the chances of an accident that could lead to radiation releases. The unit must be placed in at least MODE 3 within 6 hours, with a subsequent cooldown to MODE 5 within 36 hours. This places the reactor in a low energy state that allows greater time for operator action if habitation of the control room is precluded. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
C.1 and C.2 Required Action C.1 is the same as discussed earlier for Condition A, except for Completion Time. If the CREVS cannot be placed into recirculation mode during moving [recently] irradiated fuel assemblies, then Required Action C.2.1 and Required Action C.2.2 suspend actions that could lead to an accident that could release radioactivity resulting from a fuel handling accident.
Required Action C.2 places the core in a safe and stable configuration in which it is less likely to experience an accident that could result in a significant release of radioactivity. The reactor must be maintained in these conditions until the automatic isolation capability is returned to operation or when manual action places one train of the CREVS into the emergency recirculation mode. The Completion Time of "Immediately" for Required Action C.2.1 and Required Action C.2.2 is consistent with the urgency of the situation and accounts for the high radiation function, Babcock & Wilcox STS                   B 3.3.16-3                                        Rev. 5.0

Control Room Isolation - High Radiation B 3.3.16 BASES ACTIONS (continued) which provides the only automatic Control Room Isolation Function capable of responding to radiation release due to a fuel handling accident
[involving handling recently irradiated fuel]. The Completion Time does not preclude placing any fuel assembly into a safe position before ceasing any such movement.
Note that in certain circumstances, such as fuel handling [involving handling recently irradiated fuel] in the fuel building during power operation, both Condition A and Condition C may apply in the event of channel failure.
SURVEILLANCE       SR 3.3.16.1 REQUIREMENTS SR 3.3.16.1 is the performance of a CHANNEL CHECK for the Control Room Isolation - High Radiation actuation instrumentation to ensure that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious.
Performance of the CHANNEL CHECK helps ensure that the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared with similar unit instruments located throughout the unit. If the radiation monitor uses keep alive sources or check sources operated from the control room, the CHANNEL CHECK should also note the detector's response to these sources.
Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. [ The Frequency, about once every shift, is based on operating experience that demonstrates channel failure is rare. [At this unit, the following administrative controls and design features (e.g., downscale alarms) immediately alert operators to loss of function.]
Babcock & Wilcox STS                  B 3.3.16-4                                             Rev. 5.0

Control Room Isolation - High Radiation B 3.3.16 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.3.16.2 A Note defines a channel as being OPERABLE for up to 3 hours while bypassed for surveillance testing. The Note allows channel bypass for testing without defining it as inoperable, although during this time period it cannot actuate a control room isolation. This is based on the average time required to perform channel surveillance. It is not acceptable to routinely remove channels from service for more than 3 hours to perform required surveillance testing.
SR 3.3.16.2 is the performance of a CHANNEL FUNCTIONAL TEST to ensure that the channels can perform their intended functions. This test verifies the capability of the instrumentation to provide the automatic Control Room Isolation. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
[ The justification of a 92 day Frequency, in view of the fact that there is only one channel, is Draft NUREG-1366 (Ref. 3).
OR Babcock & Wilcox STS                        B 3.3.16-5                                                      Rev. 5.0

Control Room Isolation - High Radiation B 3.3.16 BASES SURVEILLANCE REQUIREMENTS (continued)
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.3.16.3 This SR requires the performance of a CHANNEL CALIBRATION with a setpoint Allowable Value of  [25] mR/hr to ensure that the instrument channel remains operational with the correct setpoint. This test is a complete check of the instrument loop and the transmitter.
CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations to ensure that the channel remains operational between successive tests. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.
[ The Frequency is based on the assumption of an [18] month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis and is consistent with the typical refueling cycle.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                        B 3.3.16-6                                                      Rev. 5.0

Control Room Isolation - High Radiation B 3.3.16 BASES REFERENCES         1. FSAR, Section [14.1].
: 2. [Unit Specific Setpoint Methodology].
: 3. Draft NUREG-1366.
Babcock & Wilcox STS               B 3.3.16-7                                      Rev. 5.0

PAM Instrumentation B 3.3.17 B 3.3 INSTRUMENTATION B 3.3.17 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND          The primary purpose of the PAM instrumentation is to display unit variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Events.
The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected unit parameters to monitor and to assess unit status and behavior following an accident.
The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed, and so that the need for and magnitude of further actions can be determined. These essential instruments are identified by [Unit Specific Documents] (Ref. 1) addressing the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by Supplement 1 to NUREG-0737 (Ref. 3).
The instrument channels required to be OPERABLE by this LCO equate to two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97 as Type A and Category I variables.
Type A variables are included in this LCO because they provide the primary information that permits the control room operator to take specific manually controlled actions that are required when no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Accidents (DBAs). Because the list of Type A variables widely differs between units, Table 3.3.17-1 in the accompanying LCO contains only those examples of Type A variables that may also be Category I.
Category I variables are the key variables deemed risk significant because they are needed to:
* Determine whether systems important to safety are performing their intended functions,
* Provide information to the operators that will enable them to determine the potential for causing a gross breach of the barriers to radioactivity release, and Babcock & Wilcox STS                   B 3.3.17-1                                        Rev. 5.0

PAM Instrumentation B 3.3.17 BASES BACKGROUND (continued)
* Provide information regarding the release of radioactive materials to allow for early indication of the need to initiate action necessary to protect the public and to estimate the magnitude of any impending threat.
These key variables are identified by unit specific Regulatory Guide 1.97 analysis (Ref. 1). This analysis identifies the unit specific Type A and Category I variables and provides justification for deviating from the NRC proposed list of Category I variables.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Table 3.3.17-1 provides a list of variables typical of those identified by a unit specific Regulatory Guide 1.97 analysis (Ref. 1). Table 3.3.17-1 in unit specific Technical Specifications shall list all Type A and Category I variables identified by the unit specific Regulatory Guide 1.97 analysis, as amended by the NRC's Safety Evaluation Report (SER).
The specific instrument Functions listed in Table 3.3.17-1 are discussed in the LCO Section APPLICABLE         The PAM instrumentation ensures the availability of information so SAFETY             that the control room operating staff can:
ANALYSES
* Perform the diagnosis specified in the emergency operating procedures. These variables are restricted to preplanned actions for the primary success path of DBAs (e.g., loss of coolant accident (LOCA)),
* Take the specified, preplanned, manually controlled actions, for which no automatic control is provided, which are required for safety systems to accomplish their safety functions,
* Determine whether systems important to safety are performing their intended functions,
* Determine the potential for causing a gross breach of the barriers to radioactivity release,
* Determine if a gross breach of a barrier has occurred, and
* Initiate action necessary to protect the public and estimate the magnitude of any impending threat.
Babcock & Wilcox STS                      B 3.3.17-2                                                      Rev. 5.0

PAM Instrumentation B 3.3.17 BASES APPLICABLE SAFETY ANALYSES (continued)
The unit specific Regulatory Guide 1.97 analysis documents the process that identifies Type A and Category I non-Type A variables.
PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Category I, non-type A, instrumentation must be retained in Technical Specifications because it is intended to assist operators in minimizing the consequences of accidents. Therefore, Category I, non-Type A variables are important for reducing public risk.
LCO                LCO 3.3.17 requires two OPERABLE channels for all but one Function to ensure no single failure prevents the operators from being presented with the information necessary to determine the status of the unit and to bring the unit to, and maintain it in, a safe condition following that accident.
Furthermore, provision of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information. [More than two channels may be required at some units if the Regulatory Guide 1.97 analysis determines that failure of one accident monitoring channel results in information ambiguity (i.e., the redundant displays disagree) that could lead operators to defeat or to fail to accomplish a required safety function.]
The exception to the two channel requirement is Penetration Flow Path Containment Isolation Valve position. In this case, the important information is the status of the containment penetrations. The LCO requires one position indicator for each active containment isolation valve.
This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve and prior knowledge of the passive valve or via system boundary status. If a normally active containment isolation valve is known to be closed and deactivated, position indication is not needed to determine status.
Therefore, the position indication for valves in this state is not required to be OPERABLE.
The following list is a discussion of the specified instrument Functions listed in Table 3.3.17-1. These discussions are intended as examples of what should be provided for each Function when the unit specific list is prepared.
: 1. Wide Range Neutron Flux Wide Range Neutron Flux indication is provided to verify reactor shutdown. [For this unit, the Wide Range Neutron Flux channels consist of the following:]
Babcock & Wilcox STS                  B 3.3.17-3                                          Rev. 5.0

PAM Instrumentation B 3.3.17 BASES LCO (continued) 2, 3. Reactor Coolant System (RCS) Hot and Cold Leg Temperature RCS Hot and Cold Leg Temperature instrumentation are Category I variables provided for verification of core cooling and long term surveillance. Reactor outlet temperature inputs to the RPS are provided by two fast response resistance elements and associated transmitters in each loop. The channels provide indication over a range of 32&deg;F to 700&deg;F.
: 4. RCS Pressure (Wide Range)
RCS Pressure (Wide Range) instrumentation is provided for verification of core cooling and RCS integrity long term surveillance.
Wide range RCS loop pressure is measured by pressure transmitters with a span of 0 psig to 3000 psig. The pressure transmitters are located outside the RB. Redundant monitoring capability is provided by two trains of instrumentation. Control room indications are provided through the inadequate core cooling monitor (ICCM) plasma display. The inadequate core cooling plasma display is the primary indication used by the operator during an accident. Therefore, the accident monitoring specification deals specifically with this portion of the instrument string.
In some units, RCS Pressure is a Type A variable because the operator uses this indication to monitor the cooldown of the RCS following a steam generator (SG) tube rupture or small break LOCA.
Operator actions to maintain a controlled cooldown, such as adjusting SG pressure or level, would use this indication. In addition, high pressure injection (HPI) flow is throttled based on RCS Pressure and subcooled margin. For some small break LOCAs, low pressure injection (LPI) may actuate with system pressure stabilizing above the shutoff head of the LPI pumps. If this condition exists, the operator is instructed to verify HPI flow and then terminate LPI flow prior to exceeding 30 minutes of LPI pump operation against a deadhead pressure. RCS Pressure, in conjunction with LPI flow, is also used to determine if a core flood line break has occurred.
: 5. Reactor Vessel Water Level Reactor Vessel Water Level instrumentation is provided for verification and long term surveillance of core cooling. The reactor vessel level monitoring system provides a direct measurement of the collapsed liquid level above the fuel alignment plate. The collapsed Babcock & Wilcox STS                  B 3.3.17-4                                        Rev. 5.0

PAM Instrumentation B 3.3.17 BASES LCO (continued) level represents the amount of liquid mass that is in the reactor vessel above the core. Measurement of the collapsed water level is selected because it is a direct indication of the water inventory.
The collapsed level is obtained over the same temperature and pressure range as the saturation measurements, thereby encompassing all operating and accident conditions where it must function. Also, it functions during the recovery interval. Therefore, it is designed to survive the high steam temperature that may occur during the preceding core recovery interval.
The level range extends from the top of the vessel down to the top of the fuel alignment plate. The response time is short enough to track the level during small break LOCA events. The resolution is sufficient to show the initial level drop, the key locations near the hot leg elevation, and the lowest levels just above the alignment plate.
This provides the operator with adequate indication to track the progression of the accident and to detect the consequences of its mitigating actions or the functionality of automatic equipment.
[ For this unit, the Reactor Vessel Water Level channels consist of the following: ]
: 6. Containment Sump Water Level (Wide Range)
Containment Sump Water Level (Wide Range) instrumentation is provided for verification and long term surveillance of RCS integrity.
[For this unit, the Containment Sump Water Level instrumentation consists of the following:]
: 7. Containment Pressure (Wide Range)
Containment Pressure (Wide Range) instrumentation is provided for verification of RCS and containment OPERABILITY. [For this unit, Containment Pressure instrumentation consists of the following:]
: 8. Penetration Flow Path Containment Isolation Valve Position Penetration Flow Path Containment Isolation Valve (CIV) Position is provided for verification of containment OPERABILITY.
CIV position is provided for verification of containment integrity. In the case of CIV position, the important information is the isolation status of the containment penetration. The LCO requires one Babcock & Wilcox STS                  B 3.3.17-5                                          Rev. 5.0

PAM Instrumentation B 3.3.17 BASES LCO (continued) channel of valve position indication in the control room to be OPERABLE for each active CIV in a containment penetration flow path, i.e., two total channels of CIV position indication for a penetration flow path with two active valves. For containment penetrations with only one active CIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE. This is sufficient to redundantly verify the isolation status of each isolable penetration via indicated status of the active valve, as applicable, and prior knowledge of passive valve or system boundary status. If a penetration flow path is isolated, position indication for the CIV(s) in the associated penetration flow path is not needed to determine status. Therefore, the position indication for valves in an isolated penetration flow path is not required to be OPERABLE. Each penetration is treated separately and each penetration flow path is considered a separate function. Therefore, separate Condition entry is allowed for each inoperable penetration flow path.
[ For this plant, the CIV position PAM instrumentation consists of the following: ]
: 9. Containment Area Radiation (High Range)
Containment Area Radiation (High Range) instrumentation is provided to monitor the potential for significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. [For this unit, the Containment Area Radiation instrumentation consists of the following:]
: 10. Pressurizer Level Pressurizer Level instrumentation is used to determine whether to terminate safety injection (SI), if still in progress, or to reinitiate SI if it has been stopped. Knowledge of pressurizer water level is also used to verify the unit conditions necessary to establish natural circulation in the RCS and to verify that the unit is maintained in a safe shutdown condition. [For this unit, the Pressurizer Level instrumentation consists of the following:]
Babcock & Wilcox STS                   B 3.3.17-6                                              Rev. 5.0

PAM Instrumentation B 3.3.17 BASES LCO (continued)
: 11. Steam Generator Water Level Steam Generator Water Level instrumentation is provided to monitor operation of decay heat removal via the SG. The indication of SG level is the extended startup range level instrumentation, covering a span of 6 inches to 394 inches above the lower tubesheet. The measured differential pressure is displayed in inches of water at 68&deg;F. Temperature compensation for this indication is performed manually by the operator. Redundant monitoring capability is provided by two trains of instrumentation. The uncompensated level signal is input to the unit computer, a control room indicator, and the Emergency Feedwater (EFW) Control System.
SG level indication is used by the operator to manually raise and control SG level to establish boiler condenser heat transfer. Operator action is initiated on a loss of subcooled margin. Feedwater flow is increased until the indicated extended startup range level reaches the boiler condenser setpoint.
: 12. Condensate Storage Tank (CST) Level CST Level instrumentation is provided to ensure a water supply for EFW. The CST provides the assured, safety grade water supply for the EFW System. The CST consists of two identical tanks connected by a common outlet header. Inventory is monitored by a 0 inch to 144 inch level indication for each tank. CST Level is displayed on a control room indicator, strip chart recorder, and unit computer. In addition, a control room annunciator alarms on low level.
CST Level is the primary indication used by the operator to identify loss of CST volume and replenish the CST or align suction to the EFW pumps from the hotwell.
: 13. Core Exit Temperature Core Exit Temperature is provided for verification and long term surveillance of core cooling. An evaluation was made of the minimum number of valid core exit thermocouples (CETs) necessary for inadequate core cooling detection. The evaluation determined the reduced complement of CETs necessary to detect initial core recovery and to trend the ensuing core heatup. The evaluations account for core nonuniformities and cold leg injection. Based on these evaluations, adequate or inadequate core cooling detection is ensured with two sets of five valid CETs.
Babcock & Wilcox STS                  B 3.3.17-7                                        Rev. 5.0

PAM Instrumentation B 3.3.17 BASES LCO (continued)
The subcooling margin monitor takes the average of the five highest CETs for each of the ICCM trains. Two channels ensure that a single failure will not disable the ability to determine the representative core exit temperature.
: 14. Emergency Feedwater Flow EFW Flow instrumentation is provided to monitor operation of decay heat removal via the SGs. The EFW Flow to each SG is determined from a differential pressure measurement calibrated to a span of 0 gpm to 1200 gpm. Redundant monitoring capability is provided by two independent trains of instrumentation for each SG. Each differential pressure transmitter provides an input to a control room indicator and the unit computer.
EFW Flow is the primary indication used by the operator to determine the need to throttle flow during an SLB accident to prevent the EFW pumps from operating in runout conditions. EFW Flow is also used by the operator to verify that the EFW System is delivering the correct flow to each SG. However, the primary indication used by the operator to ensure an adequate inventory is SG level.
RCS pressure is used by the operator to monitor the cooldown of the RCS following an SG tube rupture or small break LOCA. In addition, HPI flow is throttled based on RCS pressure and subcooled margin.
The indication is also used to identify an LPI pump operating at system pressures above its shutoff head. If this condition exists, the operator is instructed to verify this condition exists, to verify HPI flow, and to terminate LPI flow prior to exceeding 30 minutes of LPI pump operation against a deadhead pressure. RCS pressure, in conjunction with LPI flow, is also used to determine if a core flood line break has occurred.
APPLICABILITY       The PAM instrumentation LCO is applicable in MODES 1, 2, and 3.
These variables are related to the diagnosis and preplanned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1, 2, and 3. In MODES 4, 5, and 6, unit conditions are such that the likelihood of an event occurring that would require PAM instrumentation is low; therefore, the PAM instrumentation is not required to be OPERABLE in these MODES.
Babcock & Wilcox STS                    B 3.3.17-8                                          Rev. 5.0

PAM Instrumentation B 3.3.17 BASES ACTIONS            A Note is added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.17-1. The Completion Time(s) of the inoperable channels of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function. When the Required Channels in Table 3.3.17-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis) then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.
A.1 When one or more Functions have one required channel inoperable, the inoperable channel must be restored to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience.
This takes into account the remaining OPERABLE channel (or, in the case of a Function that has only one required channel, other non-Regulatory Guide 1.97 instrument channels to monitor the Function), the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.
B.1 Required Action B.1 specifies initiation of action described in Specification 5.6.5, that requires a written report to be submitted to the NRC. This report discusses the cause of the inoperability and identifies proposed restorative actions. This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability and given the likelihood of unit conditions that would require information provided by this instrumentation. The Completion Time of "Immediately" for Required Action B.1 ensures the requirements of Specification 5.6.5 are initiated.
C.1 When one or more Functions have two required channels inoperable (i.e.,
two channels inoperable in the same Function), one channel in the Function should be restored to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrumentation action operation and the availability of alternative means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance of qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable Babcock & Wilcox STS                 B 3.3.17-9                                          Rev. 5.0

PAM Instrumentation B 3.3.17 BASES ACTIONS (continued) channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.
D.1 Required Action D.1 directs entry into the appropriate Condition referenced in Table 3.3.17-1. The applicable Condition referenced in the Table is Function dependent. Each time an inoperable channel has not met the Required Action of Condition C and the associated Completion Time has expired, Condition D is entered for that channel and provides for transfer to the appropriate subsequent Condition.
E.1 If the Required Action and associated Completion Time of Condition C is not met and Table 3.3.17-1 directs entry into Condition E, the unit must be brought to a MODE in which the requirements of this LCO do not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
F.1 At this unit, alternative means of monitoring Containment Area Radiation have been developed and tested. These alternative means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allowed time.
If these alternative means are used, the Required Action is not to shut the unit down, but rather to follow the directions of Specification 5.6.5, in the Administrative Controls section of the Technical Specifications. The report provided to the NRC should discuss the alternative means used, describe the degree to which the alternative means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.
In the case of reactor vessel level, Reference 4 determined that the appropriate Required Action was not to shut the unit down, but rather to follow the directions of Specification 5.6.5.
[ At this unit, the alternative monitoring provisions consist of the following: ]
Babcock & Wilcox STS                    B 3.3.17-10                                         Rev. 5.0

PAM Instrumentation B 3.3.17 BASES SURVEILLANCE         As noted at the beginning of the SRs, the SRs apply to each PAM REQUIREMENTS         instrumentation Function in Table 3.3.17-1.
SR 3.3.17.1 Performance of the CHANNEL CHECK for each required instrumentation channel that is normally energized ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel with a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; therefore, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared with similar unit instruments located throughout the unit. If the radiation monitor uses keep alive sources or check sources OPERABLE from the control room, the CHANNEL CHECK should also note the detector's response to these sources.
Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If the channels are normally off scale during times when surveillance is required, the CHANNEL CHECK will only verify that they are off scale in the same direction. Offscale low current loop channels are verified to be reading at the bottom of the range and not failed downscale.
[ The 31 day Frequency is based on unit operating experience that demonstrates channel failure is rare.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                       B 3.3.17-11                                                      Rev. 5.0

PAM Instrumentation B 3.3.17 BASES SURVEILLANCE REQUIREMENTS (continued)
The CHANNEL CHECK supplements less formal but more frequent checks of channels during normal operational use of the displays associated with this LCO's required channels.
SR 3.3.17.2 A CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor. This test verifies the channel responds to measured parameters within the necessary range and accuracy.
A Note clarifies that the neutron detectors are not required to be tested as part of the CHANNEL CALIBRATION. There is no adjustment that can be made to the detectors. Furthermore, adjustment of the detectors is unnecessary because they are passive devices, with minimal drift. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration and the monthly axial channel calibration.
For the Containment Area Radiation instrumentation, a CHANNEL CALIBRATION may consist of an electronic calibration of the channel, not including the detector, for range decades above 10 R/hr, and a one point calibration check of the detector below 10 R/hr with a gamma source.
Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the resistance temperature detectors (RTD) sensors is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.
Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the Core Exit thermocouple sensors is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.
[ The Frequency is based on operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an
[18] month calibration interval in the determination of the magnitude of equipment drift.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                   B 3.3.17-12                                        Rev. 5.0

PAM Instrumentation B 3.3.17 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. [ Unit Specific Documents (e.g., FSAR, NRC Regulatory Guide 1.97 SER letter). ]
: 2. Regulatory Guide 1.97.
: 3. NUREG-0737, 1979.
: 4. 32-1177256-00, "Technical Basis for Reactor Vessel Level Indication System (RVLIS) Action Statement," April 10, 1990.
Babcock & Wilcox STS                     B 3.3.17-13                                                      Rev. 5.0

Remote Shutdown System B 3.3.18 B 3.3 INSTRUMENTATION B 3.3.18 Remote Shutdown System BASES BACKGROUND         The Remote Shutdown System provides the control room operator with sufficient instrumentation and controls to place and maintain the unit in a safe shutdown condition from locations other than the control room. This capability is necessary to protect against the possibility that the control room becomes inaccessible. A safe shutdown condition is defined as MODE 3. With the unit in MODE 3, the Emergency Feedwater (EFW)
System and the steam generator (SG) safety valves or the SG atmospheric dump valves can be used to remove core decay heat and meet all safety requirements. The long term supply of water for the EFW System and the ability to borate the Reactor Coolant System (RCS) from outside the control room allows extended operation in MODE 3.
In the event that the control room becomes inaccessible, the operators can establish control at the remote shutdown panel and place and maintain the unit in MODE 3. Not all controls and necessary transfer switches are located at the remote shutdown panel. Some controls and transfer switches will have to be operated locally at the switchgear, motor control panels, or other local stations. The unit automatically reaches MODE 3 following a unit shutdown and can be maintained safely in MODE 3 for an extended period of time.
The OPERABILITY of the Remote Shutdown System control and instrumentation Functions ensures that there is sufficient information available on selected unit parameters to place and maintain the unit in MODE 3 should the control room become inaccessible.
APPLICABLE         The Remote Shutdown System is required to provide equipment at SAFETY             appropriate locations outside the control room with a capability to ANALYSES           promptly shut down and maintain the unit in a safe condition in MODE 3.
The criteria governing the design and the specific system requirements of the Remote Shutdown System are located in 10 CFR 50, Appendix A, GDC 19 (Ref. 1).
The Remote Shutdown System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
LCO                The Remote Shutdown System LCO provides the requirements for the OPERABILITY of the instrumentation and controls necessary to place and maintain the unit in MODE 3 from a location other than the control room. The instrumentation and controls required are listed in Table B 3.3.18-1.
Babcock & Wilcox STS                 B 3.3.18-1                                          Rev. 5.0

Remote Shutdown System B 3.3.18 BASES LCO (continued)
The controls, instrumentation, and transfer switches are those required for:
* Core Reactivity Control (initial and long term),
* RCS Pressure Control,
* Decay Heat Removal via the EFW System and the SG safety valves or SG atmospheric dump valves,
* RCS Inventory Control via charging flow, and
* Safety support systems for the above Functions, including service water, component cooling water, and onsite power, including the diesel generators.
A Function of a Remote Shutdown System is OPERABLE if all instrument and control channels needed to support the Function are OPERABLE. In some cases, Table B 3.3.18-1 may indicate that the required information or control capability is available from several alternate sources. In these cases, the Function is OPERABLE as long as [one channel of any of] the alternate information or control sources are OPERABLE.
The Remote Shutdown System instruments and control circuits covered by this LCO do not need to be energized to be considered OPERABLE.
This LCO is intended to ensure the Remote Shutdown System instruments and control circuits will be OPERABLE if unit conditions require that the Remote Shutdown System be placed in operation.
APPLICABILITY      The Remote Shutdown System LCO is applicable in MODES 1, 2, and 3.
This is required so that the unit can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room.
This LCO is not applicable in MODE 4, 5, or 6. In these MODES, the unit is already subcritical and is in a condition of reduced RCS energy. Under these conditions, considerable time is available to restore necessary instrument and control Functions if control room instruments become unavailable.
ACTIONS            A Remote Shutdown System division is inoperable when each Function is not accomplished by at least one designated Remote Shutdown System channel that satisfies the OPERABILITY criteria for the channel's Function. These criteria are outlined in the LCO section of the Bases.
Babcock & Wilcox STS                 B 3.3.18-2                                         Rev. 5.0

Remote Shutdown System B 3.3.18 BASES ACTIONS (continued)
A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of the Specification may be entered independently for each Function. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
A.1 Condition A addresses the situation where one or more required Functions of the Remote Shutdown System are inoperable. This includes the control and transfer switches for any required Function.
The Required Action is to restore the required Function to OPERABLE status within 30 days. The Completion Time is based on operating experience and takes into account the remaining OPERABLE division and the low probability of an event that would require evacuation of the control room.
B.1 and B.2 If Required Action A.1 cannot be met within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE       [ SR 3.3.18.1 REQUIREMENTS Performance of the CHANNEL CHECK for each required instrumentation channel that is normally energized ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Babcock & Wilcox STS                 B 3.3.18-3                                        Rev. 5.0

Remote Shutdown System B 3.3.18 BASES SURVEILLANCE REQUIREMENTS (continued)
Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; therefore, it is key in verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability. If the channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. As specified in the Surveillance, a CHANNEL CHECK is only required for those channels that are normally energized. If the channels are normally off scale during times when surveillance is required, the CHANNEL CHECK will only verify that they are off scale in the same direction. Off scale low current loop channels are verified to be reading at the bottom of the range and not failed downscale.
[ The Frequency of 31 days is based on unit operating experience, which demonstrates that channel failure is rare.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ---------------------------------------------------------------------------------------------- ] ]
SR 3.3.18.2 SR 3.3.18.2 verifies each required Remote Shutdown System transfer switch and control circuit performs their intended function. This verification is performed from the remote shutdown panel and locally, as appropriate. Operation of the equipment from the remote shutdown panel is not necessary. The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes Babcock & Wilcox STS                        B 3.3.18-4                                                      Rev. 5.0

Remote Shutdown System B 3.3.18 BASES SURVEILLANCE REQUIREMENTS (continued) inaccessible, the unit can be placed and maintained in MODE 3 from the remote shutdown panel and the local control stations. [ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience demonstrates that remote shutdown control channels seldom fail to pass the Surveillance when performed at the
[18] month Frequency.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.3.18.3 CHANNEL CALIBRATION is a complete check of the instrument loop and sensor. The test verifies that the channel responds to measured parameters within the necessary range and accuracy.
A Note clarifies that the neutron detectors are not required to be tested as part of the CHANNEL CALIBRATION. There is no adjustment that can be made to the detectors. Furthermore, adjustment of the detectors is unnecessary because they are passive devices, with minimal drift. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration and the monthly axial channel calibration.
Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the resistance temperature detectors (RTD) sensors is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.
[ The Frequency is based on operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an
[18] month calibration interval in the determination of the magnitude of equipment drift.
Babcock & Wilcox STS                        B 3.3.18-5                                                      Rev. 5.0

Remote Shutdown System B 3.3.18 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 50, Appendix A, GDC 19.
Babcock & Wilcox STS                      B 3.3.18-6                                                      Rev. 5.0

Remote Shutdown System B 3.3.18 Table B 3.3.18-1 (page 1 of 1)
Remote Shutdown System Instrumentation and Controls
----------------------------------------------------------------------NOTE---------------------------------------------------------------------
This Table is for illustration purposes only. It does not attempt to encompass every Function used at every unit, but does contain the types of Functions commonly found.
FUNCTION/INSTRUMENT                                                                REQUIRED OR CONTROL PARAMETER                                                       NUMBER OF FUNCTIONS
: 1.       Reactivity Control
: a. Log Power Neutron Flux                                                                                 [1]
: b. Source Range Neutron Flux                                                                              [1]
: c. Reactor Trip Circuit Breaker Position                                                        [1 per trip breaker]
: d. Manual Reactor Trip                                                                                    [1]
: 2.       Reactor Coolant System (RCS) Pressure Control
: a. Pressurizer Pressure or RCS Wide Range                                                                 [1]
Pressure
: b. Pressurizer Power Operated Relief Valve                                                                [1]
(PORV) Control and Block Valve Control
: 3.       Decay Heat Removal via Steam Generators (SGs)
: a. Reactor Coolant Hot Leg Temperature                                                              [1 per loop]
: b. Reactor Coolant Cold Leg Temperature                                                             [1 per loop]
: c. Condensate Storage Tank Level                                                                          [1]
: d. SG Pressure                                                                                       [1 per SG]
: e. SG Level or Emergency Feedwater (EFW) Flow                                                        [1 per SG]
: f. EFW Controls                                                                                           [1]
: 4.       RCS Inventory Control
: a. Pressurizer Level                                                                                      [1]
: b. Reactor Coolant Injection Pump Controls                                                                [1]
-----------------------------------------------------------------REVIEWERS NOTE-------------------------------------------------------
For channels that fulfill GDC 19 requirements, the number of OPERABLE channels required depends on the unit licensing basis as described in the NRC unit specific Safety Evaluation Report (SER). Generally, two divisions are required OPERABLE. However, only one channel is required if the unit has justified such a design and the NRC's SER accepted the justification.
Babcock & Wilcox STS                                        B 3.3.18-7                                                                 Rev. 5.0

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits BASES BACKGROUND         These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within limits assumed in the safety analyses.
The safety analyses (Ref. 1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the normal steady state envelope. The limits placed on DNB related parameters ensure that these parameters will not be less conservative than were assumed in the analyses and thereby provide assurance that the minimum departure from nucleate boiling ratio (DNBR) will meet the required criteria for each of the transients analyzed.
The LCO for minimum RCS pressure is consistent with operation within the nominal operating envelope and is above that used as the initial pressure in the analyses. A pressure greater than the minimum specified will produce a higher minimum DNBR. A pressure lower than the minimum specified will cause the plant to approach the DNB limit.
The LCO for maximum RCS coolant hot leg temperature is consistent with full power operation within the nominal operating envelope and is lower than the initial hot leg temperature in the analyses. A hot leg temperature lower than that specified will produce a higher minimum DNBR. A temperature higher than that specified will cause the plant to approach the DNB limit.
The RCS flow rate is not expected to vary during operation with all pumps running. The LCO for the minimum RCS flow rate corresponds to that assumed for the DNBR analyses. A higher RCS flow rate will produce a higher DNBR. A lower RCS flow will cause the plant to approach the DNB limit.
APPLICABLE         The requirements of LCO 3.4.1 represent the initial conditions for DNB SAFETY             limited transients analyzed in the plant safety analyses (Ref. 1). The ANALYSES           safety analyses have shown that transients initiated from the limits of this LCO will meet the DNBR criterion of  [1.3]. This is the acceptance limit for the RCS DNBR parameters. Changes to the facility that could impact these parameters must be assessed for their impact on the DNBR criterion. The transients analyzed for include loss of coolant flow events and dropped or stuck control rod events. A key assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.2.1, "Regulating Rod Insertion Limits," LCO 3.2.3, "AXIAL POWER IMBALANCE OPERATING LIMITS," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."
Babcock & Wilcox STS                   B 3.4.1-1                                        Rev. 5.0

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABLE SAFETY ANALYSES (continued)
The core outlet pressure assumed in the safety analyses is 2135 psia.
The minimum pressure specified in LCO 3.4.1 is the limit value in the reactor coolant loop as measured at the hot leg pressure tap.
The safety analyses are performed with an assumed RCS coolant average temperature of 581&deg;F (579&deg;F plus 2&deg;F allowance for calculational uncertainty). The corresponding hot leg temperature of 604.6&deg;F is calculated by assuming an RCS core outlet pressure of 2135 psia and an RCS flow rate of 374,880 gpm. The maximum temperature specified is the limit value at the hot leg resistance temperature detector.
The safety analyses are performed with an assumed RCS flow rate of 374,880 gpm. The minimum flow rate specified in LCO 3.4.1 is the minimum mass flow rate.
Analyses have been performed to establish the pressure, temperature, and flow rate requirements for three pump and four pump operation. The flow limits for three pump operation are substantially lower than for four pump operation. To meet the DNBR criterion, a corresponding maximum power limit is required (see Bases for LCO 3.4.4, "RCS Loops - MODES 1 and 2").
The RCS DNB limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                This LCO specifies limits on the monitored process variables: RCS loop (hot leg) pressure, RCS hot leg temperature, and RCS total flow rate to ensure that the core operates within the limits assumed for the plant safety analyses. Operating within these limits will result in meeting DNBR criteria in the event of a DNB limited transient.
The pressure and temperature limits are to be applied to the loop with two reactor coolant pumps (RCPs) running for the three RCPs operating condition.
The LCO numerical values for pressure, temperature, and flow rate are given for the measurement location but have not been adjusted for instrument error. Plant specific limits of instrument error are established by the plant staff to meet the operational requirements of this LCO.
APPLICABILITY      In MODE 1, the limits on RCS pressure, RCS hot leg temperature, and RCS flow rate must be maintained during steady state with four pump or three pump operation in order to ensure that DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. In all other MODES the power level is low enough so that DNB is not a concern.
Babcock & Wilcox STS                   B 3.4.1-2                                        Rev. 5.0

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABILITY (continued)
The Note indicates the limit on RCS pressure may be exceeded during short term operational transients such as a THERMAL POWER ramp increase > 5% RTP per minute or a THERMAL POWER step increase
                   > 10% RTP. These conditions represent short term perturbations where actions to control pressure variations might be counterproductive. Also, since they represent transients initiated from power levels < 100% RTP, increased DNBR margin exists to offset the temporary pressure variations.
Another set of limits on DNBR related parameters is provided in Safety Limit (SL) 2.1.1, "Reactor Core SLs." Those limits are less restrictive than the limits of LCO 3.4.1, but violation of an SL merits a stricter, more severe Required Action. Should a violation of LCO 3.4.1 occur, the operator must check whether an SL may have been exceeded.
ACTIONS            A.1 Loop pressure and hot leg coolant temperature are controllable and measurable parameters. With one or both of these parameters not within the LCO limits, action must be taken to restore the parameters. RCS flow rate is not a controllable parameter and is not expected to vary during steady state four pump or three pump operation. However, if the flow rate is below the LCO limit, the parameter must be restored to within limits or power must be reduced as required in Required Action B.1, to restore DNBR margin and eliminate the potential for violation of the accident analysis bounds.
The 2 hour Completion Time for restoration of the parameters provides sufficient time to adjust plant parameters, determine the cause for the off normal condition, and restore the readings within limits. The Completion Time is based on plant operating experience.
B.1 If the Required Action A.1 is not met within the Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours. In MODE 2, the reduced power condition eliminates the potential for violation of the accident analysis bounds.
The 6 hour Completion Time is reasonable, based on operating experience, to reduce power in an orderly manner in conjunction with even control of steam generator heat removal.
Babcock & Wilcox STS                   B 3.4.1-3                                        Rev. 5.0

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE       SR 3.4.1.1 REQUIREMENTS Since Required Action A.1 allows a Completion Time of 2 hours to restore parameters that are not within limits, the Surveillance Frequency for loop (hot leg) pressure is sufficient to ensure that the pressure can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The RCS pressure value specified is dependent on the number of pumps in operation and has been adjusted to account for the pressure loss difference between the core exit and the measurement location. The value used in the plant safety analysis is 2135 psia. [ The 12 hour interval has been shown by operating practice to be sufficient to regularly assess potential degradation and to verify operation is within safety analysis assumptions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
A Note has been added to indicate the pressure limits are to be applied to the loop with two pumps in operation for the three pump operating condition.
SR 3.4.1.2 Since Required Action A.1 allows a Completion Time of 2 hours to restore parameters that are not within limits, the Surveillance Frequency for hot leg temperature is sufficient to ensure that the RCS coolant temperature can be restored to a normal operation, steady state condition following load changes and other expected transient operations. [ The 12 hour interval has been shown by operating practice to be sufficient to regularly assess potential degradation and to verify that operation is within safety analysis assumptions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                      B 3.4.1-4                                                       Rev. 5.0

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
A Note has been added to indicate the temperature limits are to be applied to the loop with two pumps in operation for the three pump operating condition.
SR 3.4.1.3 The RCS total flow rate Surveillance is performed using the installed flow instrumentation. [ The 12 hour interval has been shown by operating practice to be sufficient to regularly assess potential degradation and to verify that operation is within safety analysis assumptions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.4.1.4 Measurement of RCS total flow rate by performance of a precision calorimetric heat balance allows the installed RCS flow instrumentation to be calibrated and verifies that the actual RCS flow is greater than or equal to the minimum required RCS flow rate.
[ The Frequency of [18] months reflects the importance of verifying flow after a refueling outage when the core has been altered or RCS flow characteristics may have been modified, which may have caused change of flow.
Babcock & Wilcox STS                        B 3.4.1-5                                                       Rev. 5.0

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
The Surveillance is modified by a Note that indicates the SR does not need to be performed until stable thermal conditions are established at higher power levels. The Note is necessary to allow measurement of the flow rate at normal operating conditions at power in MODE 1. The Surveillance cannot be performed at low power or in MODE 2 or below because at low power the T across the core will be too small to provide valid results.
REFERENCES         1. FSAR, Chapter [15].
Babcock & Wilcox STS                      B 3.4.1-6                                                       Rev. 5.0

RCS Minimum Temperature for Criticality B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.2 RCS Minimum Temperature for Criticality BASES BACKGROUND         Establishing the value for the minimum temperature for reactor criticality is based upon considerations for:
: a. Operation within the existing instrumentation ranges and accuracies and
: b. Operation with reactor vessel above its minimum nil ductility reference temperature when the reactor is critical.
The reactor coolant moderator temperature coefficient used in core operating and accident analysis is typically defined for the normal operating temperature range (532&deg;F to 579&deg;F). The Reactor Protection System (RPS) receives inputs from the narrow range hot leg temperature detectors, which have a range of 520&deg;F to 620&deg;F. The integrated control system controls average temperature (Tavg) using inputs of the same range. Nominal Tavg for making the reactor critical is 532&deg;F. Safety and operating analyses for lower temperatures have not been made.
APPLICABLE         There are no accident analyses that dictate the minimum temperature SAFETY             for criticality, but all low power safety analyses assume initial ANALYSES           temperatures near the 525&deg;F limit (Ref. 1).
The RCS minimum temperature for criticality satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The purpose of the LCO is to prevent criticality outside the normal operating regime (532&deg;F to 579&deg;F) and to prevent operation in an unanalyzed condition.
The LCO limit of 525&deg;F has been selected to be within the instrument indicating range (520&deg;F to 620&deg;F). The limit is also set slightly below the lowest power range operating temperature (532&deg;F).
APPLICABILITY      The reactor has been designed and analyzed to be critical in MODES 1 and 2 only and in accordance with this Specification. Criticality is not permitted in any other MODE. Therefore, this LCO is applicable in MODE 1 and MODE 2 when keff  1.0.
Babcock & Wilcox STS                     B 3.4.2-1                                      Rev. 5.0

RCS Minimum Temperature for Criticality B 3.4.2 BASES ACTIONS            A.1 With Tavg below 525&deg;F, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 2 with Keff < 1.0 in 30 minutes. Rapid reactor shutdown can be readily and practically achieved in a 30 minute period. The Completion Time reflects the ability to perform this Action and maintain the plant within the analyzed range. If Tavg can be restored within the 30 minute time period, shutdown is not required.
SURVEILLANCE       SR 3.4.2.1 REQUIREMENTS RCS loop average temperature is required to be periodically verified at or above 525&deg;F. [ The SR Frequency of every 12 hours takes into account indications and alarms that are continuously available to the operator in the control room and is consistent with other routine Surveillances which are typically performed once per shift.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
In addition, operators are trained to be sensitive to RCS temperature during approach to criticality and will ensure that the minimum temperature for criticality is met as criticality is approached.
REFERENCES         1. FSAR, Chapter [15].
Babcock & Wilcox STS                      B 3.4.2-2                                                       Rev. 5.0

RCS P/T Limits B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.3 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND         All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.
The PTLR contains P/T limit curves for heatup, cooldown, and inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature (Ref. 1).
Each P/T limit curve defines an acceptable region for normal operation.
The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.
The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer, which has different design characteristics and operating functions.
10 CFR 50, Appendix G (Ref. 2), requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials.
Reference 2 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME), Boiler and Pressure Vessel Code, Section III, Appendix G (Ref. 3).
Linear elastic fracture mechanics (LEFM) methodology is used to determine the stresses and material toughness at locations within the RCPB. The LEFM methodology follows the guidance given by 10 CFR 50, Appendix G; ASME Code, Section III, Appendix G; and Regulatory Guide 1.99 (Ref. 4).
Material toughness properties of the ferritic materials of the reactor vessel are determined in accordance with the NRC Standard Review Plan (Ref. 5), ASTM E 185 (Ref. 6), and additional reactor vessel requirements. These properties are then evaluated in accordance with Reference 3.
Babcock & Wilcox STS                  B 3.4.3-1                                         Rev. 5.0

RCS P/T Limits B 3.4.3 BASES BACKGROUND (continued)
The actual shift in the nil ductility reference temperature (RTNDT) of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 6) and Appendix H of 10 CFR 50 (Ref. 7). The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Reference 3.
The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.
The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.
The calculation to generate the ISLH testing curve uses different safety factors (per Ref. 3) than the heatup and cooldown curves. The ISLH testing curve also extends to the RCS design pressure of 2500 psia.
The P/T limit curves and associated temperature rate of change limits are developed in conjunction with stress analyses for large numbers of operating cycles and provide conservative margins to nonductile failure.
Although created to provide limits for these specific normal operations, the curves also can be used to determine if an evaluation is necessary for an abnormal transient.
The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components.
The ASME Code, Section XI, Appendix E (Ref. 8) provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.
Babcock & Wilcox STS                  B 3.4.3-2                                          Rev. 5.0

RCS P/T Limits B 3.4.3 BASES APPLICABLE         The P/T limits are not derived from Design Basis Accident (DBA)
SAFETY             analyses. They are prescribed during normal operation to avoid ANALYSES           encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, an unanalyzed condition. Reference 1 establishes the methodology for determining the P/T limits. Since the P/T limits are not derived from any DBA analysis, there are no acceptance limits related to the P/T limits. Rather, the P/T limits are acceptance limits themselves since they preclude operation in an unanalyzed condition.
RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The two elements of this LCO are:
: a. The limit curves for heatup, cooldown, and ISLH testing and
: b. Limits on the rate of change of temperature.
The LCO limits apply to all components of the RCS, except the pressurizer. These limits define allowable operating regions and permit a large number of operating cycles while providing a wide margin to nonductile failure.
The limits for the rate of change of temperature control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and ISLH P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.
Violating the LCO limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follows:
: a. The severity of the departure from the allowable operating P/T regime or the severity of the rate of change of temperature,
: b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced), and
: c. The existences, sizes, and orientations of flaws in the vessel material.
Babcock & Wilcox STS                   B 3.4.3-3                                        Rev. 5.0

RCS P/T Limits B 3.4.3 BASES APPLICABILITY      The RCS P/T limits Specification provides a definition of acceptable operation for prevention of nonductile failure in accordance with 10 CFR 50, Appendix G (Ref. 2). Although the P/T limits were developed to provide guidance for operation during heatup or cooldown (MODES 3, 4, and 5) or ISLH testing, their applicability is at all times in keeping with the concern for nonductile failure. The limits do not apply to the pressurizer.
During MODES 1 and 2, other Technical Specifications provide limits for operation that can be more restrictive than or can supplement these P/T limits. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits," LCO 3.4.2, "RCS Minimum Temperature for Criticality," and Safety Limit (SL) 2.1, "SLs," also provide operational restrictions for pressure and temperature and maximum pressure. MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or descent.
ACTIONS            A.1 and A.2 Operation outside the P/T limits during MODE 1, 2, 3, or 4 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.
The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.
Besides restoring operation to within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components. The evaluation must be completed, documented, and approved in accordance with established plant procedures and administrative controls.
ASME Code, Section XI, Appendix E (Ref. 8) may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline. The evaluation must extend to all components of the RCPB.
The 72 hour Completion Time is reasonable to accomplish the evaluation.
The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed before continuing to operate.
Babcock & Wilcox STS                  B 3.4.3-4                                            Rev. 5.0

RCS P/T Limits B 3.4.3 BASES ACTIONS (continued)
Condition A is modified by a Note requiring Required Action A.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a lower MODE because: (a) the RCS remained in an unacceptable pressure and temperature region for an extended period of increased stress, or (b) a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. With reduced pressure and temperature conditions, the possibility of propagation of undetected flaws is decreased.
If the required restoration activity cannot be accomplished within 30 minutes, Required Action B.1 and Required Action B.2 must be implemented to reduce pressure and temperature.
If the required evaluation for continued operation cannot be accomplished within 72 hours, or the results are indeterminate or unfavorable, action must proceed to reduce pressure and temperature as specified in Required Actions B.1 and B.2. A favorable evaluation must be completed and documented before returning to operating pressure and temperature conditions. However, if the favorable evaluation is accomplished while reducing pressure and temperature conditions, a return to power operation may be considered without completing Required Action B.2.
Pressure and temperature are reduced by bringing the plant to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required MODE from full power conditions in an orderly manner and without challenging plant systems.
C.1 and C.2 Actions must be initiated immediately to correct operation outside of the P/T limits at times other than MODE 1, 2, 3, or 4, so that the RCPB is returned to a condition that has been verified acceptable by stress analysis.
Babcock & Wilcox STS                  B 3.4.3-5                                        Rev. 5.0

RCS P/T Limits B 3.4.3 BASES ACTIONS (continued)
The immediate Completion Time reflects the urgency of initiating action to restore the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished within this time in a controlled manner.
In addition to restoring operation to within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify that the RCPB integrity remains acceptable and must be completed prior to entry into MODE 4. Several methods may be used, including comparison with pre-analyzed transients in the stress analysis, or inspection of the components.
ASME Code, Section XI, Appendix E (Ref. 8), may also be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.
Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone, per Required Action C.1, is insufficient because higher than analyzed stresses may have occurred and may have affected RCPB integrity.
SURVEILLANCE         SR 3.4.3.1 REQUIREMENTS Verification that operation is within the PTLR limits is required when RCS pressure and temperature conditions are undergoing planned changes.
[ This Frequency of 30 minutes is considered reasonable in view of the control room indication available to monitor RCS status. Also, since temperature rate of change limits are specified in hourly increments, 30 minutes permits assessment and correction for minor deviations within a reasonable time.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                    B 3.4.3-6                                           Rev. 5.0

RCS P/T Limits B 3.4.3 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.
This SR is modified by a Note that requires this SR to be performed only during system heatup, cooldown, and ISLH testing.
REFERENCES         1. BAW-10046A, Rev. 1, July 1977.
: 2. 10 CFR 50, Appendix G.
: 3. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.
: 4. Regulatory Guide 1.99, Revision 2, May 1988.
: 5. NUREG-0800, Section 5.3.1, Rev. 1, July 1981.
: 6. ASTM E 185-82, July 1982.
: 7. 10 CFR 50, Appendix H.
: 8. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E.
Babcock & Wilcox STS                      B 3.4.3-7                                                       Rev. 5.0

RCS Loops - MODES 1 and 2 B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.4 RCS Loops - MODES 1 and 2 BASES BACKGROUND          The primary function of the RCS is removal of the heat generated in the fuel due to the fission process, and transfer of this heat, via the steam generators (SGs), to the secondary plant.
The secondary functions of the RCS include:
: a. Moderating the neutron energy level to the thermal state, to increase the probability of fission,
: b. Improving the neutron economy by acting as a reflector,
: c. Carrying the soluble neutron poison, boric acid,
: d. Providing a second barrier against fission product release to the environment, and
: e. Removing the heat generated in the fuel due to fission product decay following a unit shutdown.
The RCS configuration for heat transport uses two RCS loops. Each RCS loop contains an SG and two reactor coolant pumps (RCPs). An RCP is located in each of the two SG cold legs. The pump flow rate has been sized to provide core heat removal with appropriate margin to departure from nucleate boiling (DNB) during power operation and for anticipated transients originating from power operation. This Specification requires two RCS loops with either three or four pumps to be in operation. With three pumps in operation the reactor power level is restricted to [79.9]% RTP to preserve the core power to flow relationship, thus maintaining the margin to DNB. The intent of the Specification is to require core heat removal with forced flow during power operation.
Specifying the minimum number of pumps is an effective technique for designating the proper forced flow rate for heat transport, and specifying two loops provides for the needed amount of heat removal capability for the allowed power levels. Specifying two RCS loops also provides the minimum necessary paths (two SGs) for heat removal.
The Reactor Protection System (RPS) nuclear overpower trip setpoint is automatically reduced when one pump is taken out of service; manual resetting is not necessary.
Babcock & Wilcox STS                   B 3.4.4-1                                          Rev. 5.0

RCS Loops - MODES 1 and 2 B 3.4.4 BASES APPLICABLE         Safety analyses contain various assumptions for the Design Bases SAFETY             Accident (DBA) initial conditions including: RCS pressure, RCS ANALYSES           temperature, reactor power level, core parameters, and safety system setpoints. The important aspect for this LCO is the reactor coolant forced flow rate, which is represented by the number of pumps in service.
Both transient and steady state analyses have been performed to establish the effect of flow on DNB. The transient or accident analysis for the plant has been performed assuming either three or four pumps are in operation. The majority of the plant safety analysis is based on initial conditions at high core power or zero power. The accident analyses that are of most importance to RCP operation are the four pump coastdown, single pump locked rotor, and single pump (broken shaft or coastdown)
(Ref. 1).
Steady state DNB analysis has been performed for four, three, and two pump combinations. For four pump operation, the steady state DNB analysis, which generates the pressure and temperature SL (i.e., the departure from nucleate boiling ratio (DNBR) limit), assumes a maximum power level of [112]% RTP. This is the design overpower condition for four pump operation. The [112]% value is the accident analysis setpoint of the nuclear overpower (high flux) trip and is based on an analysis assumption that bounds possible instrumentation errors. The DNBR limit defines a locus of pressure and temperature points that result in a minimum DNBR greater than or equal to the critical heat flux correlation limit.
The three pump pressure temperature limit is tied to the steady state DNB analysis, which is evaluated each cycle. The flow used is the minimum allowed for three pump operation. The actual RCS flow rate will exceed the assumed flow rate. With three pumps operating, overpower protection is automatically provided by the power to flow ratio of the RPS nuclear overpower based on RCS flow and AXIAL POWER IMBALANCE setpoint. The maximum power level for three pump operation is
[79.9]% RTP and is based on the three pump flow as a fraction of the four pump flow at full power.
Although the Specification limits operation to a minimum of three pumps total, existing design analyses show that operation with one pump in each loop (two pumps total) is acceptable when core THERMAL POWER is restricted to be proportionate to the flow. However, continued power operation with two RCPs removed from service is not allowed by this Specification.
RCS Loops - MODES 1 and 2 satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                  B 3.4.4-2                                         Rev. 5.0

RCS Loops - MODES 1 and 2 B 3.4.4 BASES LCO                The purpose of this LCO is to require adequate forced flow for core heat removal. Flow is represented by the number of RCPs in operation in both RCS loops for removal of heat by the two SGs. To meet safety analysis acceptance criteria for DNB, four pumps are required at rated power; if only three pumps are available, power must be reduced.
APPLICABILITY      In MODES 1 and 2, the reactor is critical and has the potential to produce maximum THERMAL POWER. To ensure that the assumptions of the accident analyses remain valid, all RCS loops are required to be OPERABLE and in operation in these MODES to prevent DNB and core damage.
The decay heat production rate is much lower than the full power heat rate. As such, the forced circulation flow and heat sink requirements are reduced for lower, noncritical MODES as indicated by the LCOs for MODES 3, 4, and 5.
Operation in other MODES is covered by:
LCO 3.4.5,       "RCS Loops - MODE 3,"
LCO 3.4.6,       "RCS Loops - MODE 4,"
LCO 3.4.7,       "RCS Loops - MODE 5, Loops Filled,"
LCO 3.4.8,       "RCS Loops - MODE 5, Loops Not Filled,"
LCO 3.9.4,       "Decay Heat Removal (DHR) and Coolant Circulation -
High Water Level" (MODE 6); and LCO 3.9.5,       "Decay Heat Removal (DHR) and Coolant Circulation -
Low Water Level" (MODE 6).
ACTIONS            A.1 If the requirements of the LCO are not met, the Required Action is to reduce power and bring the plant to MODE 3. This lowers power level and thus reduces the core heat removal needs and minimizes the possibility of violating DNB limits.
The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging safety systems.
SURVEILLANCE       SR 3.4.4.1 REQUIREMENTS This SR requires verification of the required number of loops in operation.
Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal while maintaining the margin to DNB. [ The 12 hour interval has been shown by operating practice to be sufficient to regularly assess degradation and verify operation within safety analyses assumptions. In addition, control room indication and alarms will normally indicate loop status.
Babcock & Wilcox STS                   B 3.4.4-3                                       Rev. 5.0

RCS Loops - MODES 1 and 2 B 3.4.4 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Chapter [ ] .
Babcock & Wilcox STS                      B 3.4.4-4                                                       Rev. 5.0

RCS Loops - MODE 3 B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.5 RCS Loops - MODE 3 BASES BACKGROUND          The primary function of the reactor coolant in MODE 3 is removal of decay heat and transfer of this heat, via the steam generators (SGs), to the secondary plant fluid. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.
In MODE 3, reactor coolant pumps (RCPs) are used to provide forced circulation for heat removal during heatup and cooldown. The number of RCPs in operation will vary depending on operational needs, and the intent of this LCO is to provide forced flow from at least one RCP for core heat removal and transport. The flow provided by one RCP is adequate for heat removal and for boron mixing. However, two RCS loops are required to be OPERABLE to provide redundant paths for heat removal.
Reactor coolant natural circulation is not normally used; however, the natural circulation flow rate is sufficient for core cooling. If entry into natural circulation is required, the reactor coolant at the highest elevation of the hot leg must be maintained subcooled for single phase circulation.
When in natural circulation, it is preferable to remove heat using both SGs to avoid idle loop stagnation that might occur if only one SG were in service. One generator will provide adequate heat removal. Boron reduction in natural circulation is prohibited because mixing to obtain a homogeneous concentration in all portions of the RCS cannot be ensured.
APPLICABLE          No safety analyses are performed with initial conditions in MODE 3.
SAFETY ANALYSES            Failure to provide heat removal may result in challenges to a fission product barrier. The RCS loops are part of the primary success path that functions or actuates to prevent or mitigate a Design Basis Accident or transient that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.
RCS Loops - MODE 3 satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                 The purpose of this LCO is to require two loops to be available for heat removal thus providing redundancy. The LCO requires the two loops to be OPERABLE with the intent of requiring both SGs to be capable of transferring heat from the reactor coolant at a controlled rate. Forced reactor coolant flow is the required way to transport heat, although natural circulation flow provides adequate removal. A minimum of one running RCP meets the LCO requirement for one loop in operation.
Babcock & Wilcox STS                     B 3.4.5-1                                           Rev. 5.0

RCS Loops - MODE 3 B 3.4.5 BASES LCO (continued)
The Note permits a limited period of operation without RCPs. All RCPs may be removed from operation for  8 hours per 24 hour period for the transition to or from the Decay Heat Removal (DHR) System, and otherwise may be de-energized for  1 hour per 8 hour period. This means that natural circulation has been established. When in natural circulation, boron reduction with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1, is prohibited because an even concentration distribution throughout the RCS cannot be ensured. Core outlet temperature is to be maintained at least [10]&deg;F below the saturation temperature so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.
In MODES 3, 4, and 5, it is sometimes necessary to stop all RCP or DHR pump forced circulation (e.g., change operation from one DHR train to the other, to perform surveillance or startup testing, to perform the transition to and from DHR System cooling, or to avoid operation below the RCP minimum net positive suction head limit). The time period is acceptable because natural circulation is adequate for heat removal, or the reactor coolant temperature can be maintained subcooled and boron stratification affecting reactivity control is not expected.
An OPERABLE RCS loop consists of at least one OPERABLE RCP and an SG that is OPERABLE. An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.
APPLICABILITY      In MODE 3, the heat load is lower than at power; therefore, one RCS loop in operation is adequate for transport and heat removal. A second RCS loop is required to be OPERABLE but not in operation for redundant heat removal capability.
Operation in other MODES is covered by:
LCO 3.4.4,     "RCS Loops - MODES 1 and 2,"
LCO 3.4.6,     "RCS Loops - MODE 4,"
LCO 3.4.7,     "RCS Loops - MODE 5, Loops Filled,"
LCO 3.4.8,     "RCS Loops - MODE 5, Loops Not Filled,"
LCO 3.9.4,     "Decay Heat Removal (DHR) and Coolant Circulation -
High Water Level" (MODE 6), and LCO 3.9.5,     "Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level" (MODE 6).
Babcock & Wilcox STS                   B 3.4.5-2                                        Rev. 5.0

RCS Loops - MODE 3 B 3.4.5 BASES ACTIONS            A.1 If one RCS loop is inoperable, redundancy for forced flow heat removal is lost. The Required Action is restoration of the RCS loop to OPERABLE status within a Completion Time of 72 hours. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.] This time allowance is a justified period to be without the redundant nonoperating loop because a single loop in operation has a heat transfer capability greater than that needed to remove the decay heat produced in the reactor core.
B.1 If restoration of an RCS loop as required in A.1 is not possible within 72 hours, the unit must be brought to MODE 4. In MODE 4, the plant may be placed on the DHR System. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to achieve cooldown and depressurization from the existing plant conditions and without challenging plant systems.
C.1 and C.2 If two RCS loops are inoperable or a required RCS loop is not in operation, except as provided in the Note in the LCO section, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be immediately suspended. Action to restore one RCS loop to operation shall be immediately initiated and continued until one RCS loop is restored to OPERABLE status and to operation. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Time reflects the importance of maintaining operation for decay heat removal.
SURVEILLANCE       SR 3.4.5.1 REQUIREMENTS This SR requires verification that the required number of loops and pumps is in operation. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. [ The 12 hour interval has been shown by operating practice to be sufficient to regularly assess RCS loop status. In addition, control room indication and alarms will normally indicate loop status.
Babcock & Wilcox STS                   B 3.4.5-3                                       Rev. 5.0

RCS Loops - MODE 3 B 3.4.5 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.4.5.2 Verification that each required RCP is OPERABLE ensures that the single failure criterion is met and that an additional RCS loop can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power availability to each required pump. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability. [ The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation.
REFERENCES         None.
Babcock & Wilcox STS                      B 3.4.5-4                                                       Rev. 5.0

RCS Loops - MODE 4 B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.6 RCS Loops - MODE 4 BASES BACKGROUND          In MODE 4, the primary function of the reactor coolant is the removal of decay heat and transfer of this heat to the steam generators (SGs) or decay heat removal (DHR) heat exchangers. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.
In MODE 4, either reactor coolant pumps (RCPs) or DHR pumps can be used for coolant circulation. The number of pumps in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one RCP or one DHR pump for decay heat removal and transport. The flow provided by one RCP or one DHR pump is adequate for heat removal. The other intent of this LCO is to require that two paths (loops) be available to provide redundancy for heat removal.
APPLICABLE          No safety analyses are performed with initial condition in MODE 4.
SAFETY ANALYSES            RCS Loops - MODE 4 satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
LCO                 The purpose of this LCO is to require that two loops, RCS or DHR, be OPERABLE in MODE 4 and one of these loops be in operation. The LCO allows the two loops that are required to be OPERABLE to consist of any combination of RCS or DHR System loops. Any one loop in operation provides enough flow to remove the decay heat from the core with forced circulation. The second loop that is required to be OPERABLE provides redundant paths for heat removal.
The Note permits a limited period of operation without RCPs. All RCPs may be removed from operation for  8 hours per 24 hour period for the transition to or from the DHR System and otherwise may be de-energized for  1 hour per 8 hour period. This means that natural circulation has been established using the SGs. The Note prohibits boron dilution with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1 is maintained when forced flow is stopped because an even concentration distribution cannot be ensured. Core outlet temperature is to be maintained at least 10&deg;F below saturation temperature so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.
The Note also permits the DHR pumps to be stopped for  1 hour per 8 hour period. When the DHR pumps are stopped, no alternate heat removal path exists, unless the RCS and SGs have been placed in service in forced or natural circulation. The response of the RCS without Babcock & Wilcox STS                    B 3.4.6-1                                        Rev. 5.0

RCS Loops - MODE 4 B 3.4.6 BASES LCO (continued) the DHR System depends on the core decay heat load and the length of time that the DHR pumps are stopped. As decay heat diminishes, the effects on RCS temperature and pressure diminish. Without cooling by DHR, higher heat loads will cause the reactor coolant temperature and pressure to increase at a rate proportional to the decay heat load.
Because pressure can increase, the applicable system pressure limits (pressure and temperature (P/T) or low temperature overpressure protection (LTOP) limits) must be observed and forced DHR flow or heat removal via the SGs must be re-established prior to reaching the pressure limit. The circumstances for stopping both DHR trains are to be limited to situations where:
: a. Pressure and pressure and temperature increases can be maintained well within the allowable pressure (P/T and LTOP) and 10&deg;F subcooling limits or
: b. An alternate heat removal path through the SG is in operation.
An OPERABLE RCS loop consists of at least one OPERABLE RCP and an SG that is OPERABLE.
Similarly for the DHR System, an OPERABLE DHR loop is comprised of the OPERABLE DHR pump(s) capable of providing forced flow to the DHR heat exchanger(s). DHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. Management of gas voids is important to DHR System OPERABILITY.
APPLICABILITY      In MODE 4, this LCO applies because it is possible to remove core decay heat and to provide proper boron mixing with either the RCS loops and SGs or the DHR System.
Operation in other MODES is covered by:
LCO 3.4.4,       "RCS Loops - MODES 1 and 2,"
LCO 3.4.5,       "RCS Loops - MODE 3,"
LCO 3.4.7,       "RCS Loops - MODE 5, Loops Filled,"
LCO 3.4.8,       "RCS Loops - MODE 5, Loops Not Filled,"
LCO 3.9.4,       "Decay Heat Removal (DHR) and Coolant Circulation -
High Water Level" (MODE 6), and LCO 3.9.5,       "Decay Heat Removal (DHR) and Coolant Circulation -
Low Water Level" (MODE 6).
Babcock & Wilcox STS                   B 3.4.6-2                                       Rev. 5.0

RCS Loops - MODE 4 B 3.4.6 BASES ACTIONS            A.1 If only one required RCS loop or DHR loop is OPERABLE and in operation, redundancy for heat removal is lost. Action must be initiated to restore a second loop to OPERABLE status.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 1). In MODE 4 the steam generators are available for heat removal via natural circulation. In MODE 4, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action A.1 is modified by a second Note. Note 2 states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate.
LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
B.1 and B.2 If two required RCS or DHR loops are inoperable or a required loop is not in operation, except during conditions permitted by the Note in the LCO section, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RCS or DHR loop to OPERABLE status and operation must be initiated. The required margin to criticality must not be reduced in this type of operation.
Suspending the introduction of coolant, into the RCS, with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 Babcock & Wilcox STS                   B 3.4.6-3                                        Rev. 5.0

RCS Loops - MODE 4 B 3.4.6 BASES ACTIONS (continued) is required to ensure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.
The immediate Completion Times reflect the importance of maintaining operation for decay heat removal. The action to restore must continue until one loop is restored to operation.
SURVEILLANCE       SR 3.4.6.1 REQUIREMENTS This Surveillance requires verification of the required DHR or RCS loop in operation to ensure forced flow is providing decay heat removal.
Verification includes flow rate, temperature, or pump status monitoring.
[ The 12 hour interval has been shown by operating practice to be sufficient to regularly assess RCS loop status.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
In addition, control room indication and alarms will normally indicate loop status.
SR 3.4.6.2 Verification that each required pump is OPERABLE ensures that an additional RCS or DHR loop can be placed in operation if needed to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to each required pump. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability. [ The Frequency of 7 days is considered reasonable in view of other administrative controls and has been shown to be acceptable by operating experience.
OR Babcock & Wilcox STS                      B 3.4.6-4                                                       Rev. 5.0

RCS Loops - MODE 4 B 3.4.6 BASES SURVEILLANCE REQUIREMENTS (continued)
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation.
SR 3.4.6.3 DHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required DHR loop(s) and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of DHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The DHR System is OPERABLE when it is sufficiently filled with water.
Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump),
the Surveillance is not met. If the accumulated gas is eliminated or brought within the acceptance criteria limits during performance of the Surveillance, the Surveillance is met and past system OPERABILITY is evaluated under the Corrective Action Program. If it is determined by subsequent evaluation that the DHR System is not rendered inoperable Babcock & Wilcox STS                      B 3.4.6-5                                                       Rev. 5.0

RCS Loops - MODE 4 B 3.4.6 BASES SURVEILLANCE REQUIREMENTS (continued) by the accumulated gas (i.e., the system is sufficiently filled with water),
the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
DHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.
Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
This SR is modified by a Note that states the SR is not required to be performed until 12 hours after entering MODE 4. In a rapid shutdown, there may be insufficient time to verify all susceptible locations prior to entering MODE 4.
[ The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the DHR System piping and the procedural controls governing system operation.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                      B 3.4.6-6                                                       Rev. 5.0

RCS Loops - MODE 5, Loops Filled B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.7 RCS Loops - MODE 5, Loops Filled BASES BACKGROUND          In MODE 5 with RCS loops filled, the primary function of the reactor coolant is the removal of decay heat and transfer of this heat either to the steam generator (SG) secondary side coolant or the component cooling water via the decay heat removal (DHR) heat exchangers. While the principal means for decay heat removal is via the DHR System, the SGs are specified as a backup means for redundancy. Although the SGs cannot remove heat unless steaming occurs (which is not possible in MODE 5), they are available as a temporary heat sink and can be used by allowing the RCS to heat up into the temperature region of MODE 4 where steaming can be effective for heat removal. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.
In MODE 5 with RCS loops filled, DHR loops are the principal means for heat removal. The number of loops in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one DHR loop for decay heat removal and transport. The flow provided by one DHR loop is adequate for decay heat removal. The other intent of this LCO is to require that a second path be available to provide redundancy for heat removal.
The LCO provides for either SG heat removal or DHR System heat removal. In this MODE, reactor coolant pump (RCP) operation may be restricted because of net positive suction head (NPSH) limitations, and the SG will not be able to provide steam for the turbine driven feed pumps. However, to ensure that the SGs can be used as a heat sink, a motor driven feedwater pump is needed, because it is independent of steam. Condensate pumps, startup pumps, or the motor driven auxiliary feedwater pump can be used. If RCPs are available, the steam generator level need not be adjusted. If RCPs are not available, the water level must be adjusted for natural circulation. The high entry point in the generator should be accessible from the feedwater pumps so that natural circulation can be stimulated. The SGs are primarily a backup to the DHR pumps, which are used for forced flow. By requiring the SGs to be a backup heat removal path, the option to increase RCS pressure and temperature for heat removal in MODE 4 is provided.
APPLICABLE          No safety analyses are performed with initial conditions in MODE 5.
SAFETY ANALYSES            RCS Loops - MODE 5 (Loops Filled) satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                    B 3.4.7-1                                         Rev. 5.0

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES LCO                The purpose of this LCO is to require that at least one of the DHR loops be OPERABLE and in operation with an additional DHR loop OPERABLE or both SGs with secondary side water level  [50]%. One DHR loop provides sufficient forced circulation to perform the safety functions of the reactor coolant under these conditions. The second DHR loop is normally maintained as a backup to the operating DHR loop to provide redundancy for decay heat removal. However, if the standby DHR loop is not OPERABLE, a sufficient alternate method of providing redundant heat removal paths is to provide both SGs with their secondary side water levels  [50]%. Should the operating DHR loop fail, the SGs could be used to remove the decay heat.
Note 1 permits the DHR pumps to be removed from operation for up to 1 hour per 8 hour period. The circumstances for stopping both DHR trains are to be limited to situations where: (a) Pressure and temperature increases can be maintained well within the allowable pressure (P/T and low temperature overpressure protection) and 10&deg;F subcooling limits or (b) Alternate heat paths through the SGs are in operation.
The Note prohibits boron dilution with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1 is maintained when DHR forced flow is stopped because an even concentration distribution cannot be ensured. Core outlet temperature is to be maintained at least 10&deg;F below saturation temperature so that no vapor bubble would form and possibly cause a natural circulation flow obstruction. In this MODE, the generators are used as a backup for decay heat removal and, to ensure their availability, the RCS loop flow path is to be maintained with subcooled liquid.
In MODE 5, it is sometimes necessary to stop all RCP or DHR pump forced circulation. This is permitted to change operation from one DHR train to the other, perform surveillance or startup testing, perform the transition to and from the DHR System, or to avoid operation below the RCP minimum NPSH limit. The time period is acceptable because natural circulation is acceptable for heat removal, the reactor coolant temperature can be maintained subcooled, and boron stratification affecting reactivity control is not expected.
Note 2 allows one DHR loop to be inoperable for a period of up to 2 hours provided that the other loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when such testing is safe and possible.
Note 3 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting DHR loops to not be in operation when at least one RCP is in operation. This Note provides for the transition to MODE 4 where an RCP is permitted to be in operation and replaces the RCS circulation function provided by the DHR loops.
Babcock & Wilcox STS                   B 3.4.7-2                                        Rev. 5.0

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES LCO (continued)
An OPERABLE DHR loop is composed of an OPERABLE DHR pump and an OPERABLE DHR heat exchanger.
DHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. A SG can perform as a heat sink when it has an adequate water level and is OPERABLE. Management of gas voids is important to DHR System OPERABILITY.
APPLICABILITY      In MODE 5 with loops filled, forced circulation is provided by this LCO to remove decay heat from the core and to provide proper boron mixing.
One loop of DHR provides sufficient circulation for these purposes.
Operation in other MODES is covered by:
LCO 3.4.4,      "RCS Loops - MODES 1 and 2,"
LCO 3.4.5,      "RCS Loops - MODE 3,"
LCO 3.4.6,      "RCS Loops - MODE 4,"
LCO 3.4.8,      "RCS Loops - MODE 5, Loops Not Filled,"
LCO 3.9.4,      "Decay Heat Removal (DHR) and Coolant Circulation - High Water Level" (MODE 6), and LCO 3.9.5,      "Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level" (MODE 6).
ACTIONS            A.1, A.2, B.1, and B.2 If one DHR loop is OPERABLE and any required SG has secondary side water level < [50]% or one required DHR loop inoperable, redundancy for heat removal is lost. Action must be initiated to restore a second DHR loop to OPERABLE status or initiate action to restore the secondary side water level in the SGs, and action must be taken immediately. Either Required Action will restore redundant decay heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
C.1 and C.2 If no required DHR loop is in operation, except as provided in Note 1, or no required DHR loop is OPERABLE, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore a DHR loop to OPERABLE status and operation must be initiated.
The required margin to criticality must not be reduced in this type of operation. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of Babcock & Wilcox STS                   B 3.4.7-3                                        Rev. 5.0

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES ACTIONS (continued)
LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.
The immediate Completion Time reflects the importance of maintaining operation for decay heat removal.
SURVEILLANCE       SR 3.4.7.1 REQUIREMENTS This SR requires verification that the required DHR loop is in operation.
Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. [ The 12 hour Frequency has been shown by operating practice to be sufficient to regularly assess degradation.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
In addition, control room indication and alarms will normally indicate loop status.
SR 3.4.7.2 Verifying the SGs are OPERABLE by ensuring their secondary side water levels are  [50]% ensures that redundant heat removal paths are available if the second DHR loop is not OPERABLE. If both DHR loops are OPERABLE, this Surveillance is not needed. [ The 12 hour Frequency has been shown by operating practice to be sufficient to regularly assess degradation and verify operation within safety analyses assumptions.
OR Babcock & Wilcox STS                      B 3.4.7-4                                                       Rev. 5.0

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES SURVEILLANCE REQUIREMENTS (continued)
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.4.7.3 Verification that each required DHR pump is OPERABLE ensures that redundant paths for heat removal are available. The requirement also ensures that the additional loop can be placed in operation if needed to maintain decay heat removal and reactor coolant circulation. If the secondary side water level is  [50]% in both SGs, this Surveillance is not needed. Verification is performed by verifying proper breaker alignment and power available to each required pump. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability. [ The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation.
Babcock & Wilcox STS                      B 3.4.7-5                                                       Rev. 5.0

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.4.7.4 DHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required DHR loop(s) and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of DHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The DHR System is OPERABLE when it is sufficiently filled with water.
Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump),
the Surveillance is not met. If the accumulated gas is eliminated or brought within the acceptance criteria limits during performance of the Surveillance, the Surveillance is met and past system OPERABILITY is evaluated under the Corrective Action Program. If it is determined by subsequent evaluation that the DHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water),
the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
DHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.
Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the Babcock & Wilcox STS                   B 3.4.7-6                                         Rev. 5.0

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES SURVEILLANCE REQUIREMENTS (continued) maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
[ The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the DHR System piping and the procedural controls governing system operation.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         None.
Babcock & Wilcox STS                      B 3.4.7-7                                                       Rev. 5.0

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.8 RCS Loops - MODE 5, Loops Not Filled BASES BACKGROUND          In MODE 5 with loops not filled, the primary function of the reactor coolant is the removal of decay heat and transfer of this heat to the decay heat removal (DHR) heat exchangers. The steam generators (SGs) are not available as a heat sink when the loops are not filled. The secondary function of the reactor coolant is to act as a carrier for the soluble neutron poison, boric acid.
Loops are not filled when the reactor coolant water level is within the horizontal portion of the hot leg as might be the case for refueling or maintenance on the reactor coolant pumps or SGs. GL 88-17 (Ref. 1) expresses concerns for loss of decay heat removal for this operating condition. With water at this low level, the margin above the decay heat suction piping connection to the hot leg is small. The possibility of loss of level or inlet vortexing exists and if it were to occur, the operating DHR pump could become air bound and fail resulting in a loss of forced flow for heat removal. As a consequence the water in the core will heat up and could boil with the possibility of core uncovering due to boil off. Because the containment hatch may be open at this time, a pathway to the outside for fission product release exists if core damage were to occur.
In MODE 5 with loops not filled, only DHR pumps can be used for coolant circulation. The number of pumps in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one DHR pump for decay heat removal and transport, to require that two paths be available to provide redundancy for heat removal.
APPLICABLE          No safety analyses are performed with initial conditions in MODE 5 with SAFETY              loops not filled. The flow provided by one DHR pump is adequate for ANALYSES            heat removal and for boron mixing.
RCS Loops - MODE 5 (Loops Not Filled) satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
LCO                 The purpose of this LCO is to require that a minimum of two DHR loops be OPERABLE and that one of these loops be in operation. An OPERABLE loop is one that has the capability of transferring heat from the reactor coolant at a controlled rate. Heat cannot be removed via the DHR system unless forced flow is used. A minimum of one running decay heat removal pump meets the LCO requirement for one loop in operation. An additional DHR loop is required to be OPERABLE to provide redundancy for heat removal.
Babcock & Wilcox STS                    B 3.4.8-1                                          Rev. 5.0

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES LCO (continued)
Note 1 permits the DHR pumps to be removed from operation for 15 minutes when switching from one train to the other. The circumstances for stopping both DHR pumps are to be limited to situations where the outage time is short [and temperature is maintained
[160]&deg;F]. The Note prohibits boron dilution with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1 is maintained or draining operations when DHR forced flow is stopped.
Note 2 allows one DHR loop to be inoperable for a period of 2 hours provided that the other loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when these tests are safe and possible.
An OPERABLE DHR loop is composed of an OPERABLE DHR pump capable of providing forced flow to an OPERABLE DHR heat exchanger.
DHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. Management of gas voids is important to DHR System OPERABILITY.
APPLICABILITY      In MODE 5 with loops not filled, this LCO requires core heat removal and coolant circulation by the DHR System.
Operation in other MODES is covered by:
LCO 3.4.4,     "RCS Loops - MODES 1 and 2,"
LCO 3.4.5,     "RCS Loops - MODE 3,"
LCO 3.4.6,     "RCS Loops - MODE 4,"
LCO 3.4.7,     "RCS Loops - MODE 5, Loops Filled,"
LCO 3.9.4,     "Decay Heat Removal (DHR) and Coolant Circulation - High Water Level" (MODE 6), and LCO 3.9.5,     "Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level" (MODE 6).
ACTIONS            A.1 If one required DHR loop is inoperable, redundancy for heat removal is lost. Required Action A.1 is to immediately initiate activities to restore a second loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
Babcock & Wilcox STS                  B 3.4.8-2                                          Rev. 5.0

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES ACTIONS (continued)
B.1 and B.2 If no required loop is OPERABLE or the required loop is not in operation, except as provided by Note 1 in the LCO, the Required Action requires immediate suspension of all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 and requires initiation of action to immediately restore one DHR loop to OPERABLE status and operation.
The Required Action for restoration does not apply to the condition of both loops not in operation when the exception Note in the LCO is in force. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.
The immediate Completion Time reflects the importance of maintaining operations for decay heat removal. The action to restore must continue until one loop is restored.
SURVEILLANCE       SR 3.4.8.1 REQUIREMENTS This Surveillance requires verification that the required loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal.
[ The 12 hour interval has been shown by operating practice to be sufficient to regularly assess degradation and verify operation within safety analyses assumptions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.4.8-3                                                       Rev. 5.0

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.4.8.2 Verification that each required pump is OPERABLE ensures that redundancy for heat removal is provided. The requirement also ensures that an additional loop can be placed in operation if needed to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to each required pump. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability. [ The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation.
SR 3.4.8.3 DHR System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the DHR loops and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of DHR System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become Babcock & Wilcox STS                      B 3.4.8-4                                                       Rev. 5.0

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES SURVEILLANCE REQUIREMENTS (continued) sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The DHR System is OPERABLE when it is sufficiently filled with water.
Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump),
the Surveillance is not met. If the accumulated gas is eliminated or brought within the acceptance criteria limits during performance of the Surveillance, the Surveillance is met and past system OPERABILITY is evaluated under the Corrective Action Program. If it is determined by subsequent evaluation that the DHR System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water),
the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
DHR System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations.
Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
[ The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the DHR System piping and the procedural controls governing system operation.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
Babcock & Wilcox STS                   B 3.4.8-5                                         Rev. 5.0

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. Generic Letter 88-17, October 17, 1988.
Babcock & Wilcox STS                      B 3.4.8-6                                                       Rev. 5.0

Pressurizer B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.9 Pressurizer BASES BACKGROUND          The pressurizer provides a point in the RCS where liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primary system pressure during steady state operation and limiting the pressure changes caused by reactor coolant thermal expansion and contraction during normal load transients.
The pressure control components addressed by this LCO include the pressurizer water level, the required heaters, and their controls and emergency power supplies. Pressurizer safety valves and pressurizer power operated relief valves (PORVs) are addressed by LCO 3.4.10, "Pressurizer Safety Valves," and LCO 3.4.11, "Pressurizer Power Operated Relief Valve (PORV)," respectively.
The maximum water level limit has been established to ensure that a liquid to vapor interface exists to permit RCS pressure control during normal operation and proper pressure response for anticipated design basis transients. The water level limit thus serves two purposes:
: a. Pressure control during normal operation maintains subcooled reactor coolant in the loops and thus is in the preferred state for heat transport and
: b. By restricting the level to a maximum, expected transient reactor coolant volume increases (pressurizer insurge) will not cause excessive level changes that could result in degraded ability for pressure control.
The maximum water level limit permits pressure control equipment to function as designed. The limit preserves the steam space during normal operation, thus both sprays and heaters can operate to maintain the design operating pressure. The level limit also prevents filling the pressurizer (water solid) for anticipated design basis transients, thus ensuring that pressure relief devices (PORVs or code safety valves) can control pressure by steam relief rather than water relief. If the level limits were exceeded prior to a transient that creates a large pressurizer insurge volume leading to water relief, the maximum RCS pressure might exceed the design Safety Limit (SL) of 2750 psig or damage may occur to the PORVs or pressurizer code safety valves.
Babcock & Wilcox STS                   B 3.4.9-1                                          Rev. 5.0

Pressurizer B 3.4.9 BASES BACKGROUND (continued)
The pressurizer heaters are used to maintain a pressure in the RCS so reactor coolant in the loops is subcooled and thus in the preferred state for heat transport to the steam generators (SGs). This function must be maintained with a loss of offsite power. Consequently, the emphasis of this LCO is to ensure that the essential power supplies and the associated heaters are adequate to maintain pressure for RCS loop subcooling with an extended loss of offsite power.
A minimum required available capacity of [126] kW ensures that the RCS pressure can be maintained. Unless adequate heater capacity is available, reactor coolant subcooling cannot be maintained indefinitely.
Inability to control the system pressure and maintain subcooling under conditions of natural circulation flow in the primary system could lead to loss of single phase natural circulation and decreased capability to remove core decay heat.
APPLICABLE         In MODES 1 and 2, the LCO requirement for a steam bubble is reflected SAFETY             implicitly in the accident analyses. No safety analyses are performed in ANALYSES           lower MODES. All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer. In making this assumption, the analyses neglect the small fraction of noncondensible gases normally present.
Safety analyses presented in the FSAR do not take credit for pressurizer heater operation; however, an implicit initial condition assumption of the safety analyses is that the RCS is operating at normal pressure.
The maximum level limit is of prime interest for the loss of main feedwater (LOMFW) event. Conservative safety analyses assumptions for this event indicate that it produces the largest increase of pressurizer level caused by a moderate frequency event. Thus this event has been selected to establish the pressurizer water level limit. Assuming proper response action by emergency systems, the level limit prevents water relief through the pressurizer safety valves. Since prevention of water relief is a goal for abnormal transient operation, rather than an SL, the value for pressurizer level is nominal and is not adjusted for instrument error.
Evaluations performed for the design basis large break loss of coolant accident (LOCA), which assumed a higher maximum level than assumed for the LOMFW event, have been made. The higher pressurizer level assumed for the LOCA is the basis for the volume of reactor coolant released to the containment. The containment analysis performed using the mass and energy release demonstrated that the maximum resulting containment pressure was within design limits.
Babcock & Wilcox STS                    B 3.4.9-2                                       Rev. 5.0

Pressurizer B 3.4.9 BASES APPLICABLE SAFETY ANALYSES (continued)
The requirement for emergency power supplies is based on NUREG-0737 (Ref. 1). The intent is to allow maintaining the reactor coolant in a subcooled condition with natural circulation at hot, high pressure conditions for an undefined, but extended, time period after a loss of offsite power. While loss of offsite power is an initial condition or coincident event assumed in many accident analyses, maintaining hot, high pressure conditions over an extended time period is not evaluated as part of FSAR accident analyses.
The maximum pressurizer water level limit satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Although the heaters are not specifically used in accident analysis, the need to maintain subcooling in the long term during loss of offsite power, as indicated in NUREG-0737 (Ref. 1), is the reason for providing an LCO.
LCO                The LCO requirement for the pressurizer to be OPERABLE with a water level  [290] inches ensures that a steam bubble exists. Limiting the maximum operating water level preserves the steam space for pressure control. The LCO has been established to ensure the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure transients.
Requiring the presence of a steam bubble is also consistent with analytical assumptions.
The LCO requires a minimum of [126] kW of pressurizer heaters OPERABLE [and capable of being powered from an emergency power supply]. As such, the LCO addresses both the heaters and the power supplies. The minimum heater capacity required is sufficient to maintain the system near normal operating pressure when accounting for heat losses through the pressurizer insulation. By maintaining the pressure near the operating conditions, a wide margin to subcooling can be obtained in the loops. The exact design value of [126] kW is derived from the use of nine heaters rated at 14 kW each. The amount needed to maintain pressure is dependent on the insulation losses, which can vary due to tightness of fit and condition.
APPLICABILITY      The need for pressure control is most pertinent when core heat can cause the greatest effect on RCS temperature, resulting in the greatest effect on pressurizer level and RCS pressure control. Thus Applicability has been designated for MODES 1 and 2. The Applicability is also provided for MODE 3 and, for pressurizer water level, for MODE 4 with RCS temperature  [275]&deg;F. The purpose is to prevent solid water RCS operation during heatup and cooldown to avoid rapid pressure rises caused by normal operational perturbations, such as reactor coolant Babcock & Wilcox STS                  B 3.4.9-3                                          Rev. 5.0

Pressurizer B 3.4.9 BASES APPLICABILITY (continued) pump startup. The temperature of [275]&deg;F has been designated as the cutoff for applicability because LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System," provides a requirement for pressurizer level below [275]&deg;F. The LCO does not apply to MODE 5 with loops filled because LCO 3.4.12 applies. The LCO does not apply to MODES 5 and 6 with partial loop operation.
In MODES 1, 2, and 3, there is the need to maintain the availability of pressurizer heaters capable of being powered from an emergency power supply. In the event of a loss of offsite power, the initial conditions of these MODES give the greatest demand for maintaining the RCS in a hot pressurized condition with loop subcooling for an extended period. The Applicability is modified by a Note stating that the OPERABILITY requirements on pressurizer heaters do not apply in MODE 4. For MODE 4, 5, or 6, it is not necessary to control pressure (by heaters) to ensure loop subcooling for heat transfer when the Decay Heat Removal System is in service, and therefore the LCO is not applicable.
ACTIONS            A.1 With pressurizer water level in excess of the maximum limit, action must be taken to restore pressurizer operation to within the bounds assumed in the analysis. This is done by restoring the pressurizer water level to within the limit. The 1 hour Completion Time is considered to be a reasonable time for draining excess liquid.
B.1 and B.2 If the water level cannot be restored, reducing core power constrains heat input effects that drive pressurizer insurge that could result from an anticipated transient. By shutting down the reactor and reducing reactor coolant temperature to at least MODE 3, the potential thermal energy of the reactor coolant mass for LOCA mass and energy releases is reduced.
Six hours is a reasonable time based upon operating experience to reach MODE 3 from full power without challenging plant systems and operators.
Further pressure and temperature reduction to MODE 4 with RCS temperature  [275]&deg;F places the plant into a MODE where the LCO is not applicable. The [24] hour Completion Time to reach the nonapplicable MODE is reasonable based upon operating experience.
Babcock & Wilcox STS                  B 3.4.9-4                                           Rev. 5.0

Pressurizer B 3.4.9 BASES ACTIONS (continued)
C.1 If the [emergency] power supplies to the heaters are not capable of providing [126] kW, or the pressurizer heaters are inoperable, restoration is required in 72 hours [or in accordance with the Risk Informed Completion Time Program]. The Completion Time of 72 hours is reasonable considering the anticipation that a demand caused by loss of offsite power will not occur in this period. Pressure control may be maintained during this time using normal station powered heaters.
D.1 and D.2 If pressurizer heater capability cannot be restored within the allowed Completion Time of Required Action C.1, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 4 within the following 6 hours. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. Similarly, the Completion Time of 12 hours to reach MODE 4 is reasonable based on operating experience to achieve power reduction from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.4.9.1 REQUIREMENTS This SR requires that during steady state operation, pressurizer water level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The Surveillance is performed by observing the indicated level. [ The 12 hour interval has been shown by operating practice to be sufficient to regularly assess the level for any deviation and verify that operation is within safety analyses assumptions. Alarms are also available for early detection of abnormal level indications.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.4.9-5                                                       Rev. 5.0

Pressurizer B 3.4.9 BASES SURVEILLANCE REQUIREMENTS (continued)
[ SR 3.4.9.2 The SR requires the power supplies are capable of producing the minimum power and the associated pressurizer heaters are verified to be at their design rating. (This may be done by testing the power supply output and by performing an electrical check on heater element continuity and resistance.) [ The Frequency of ((18] months] is considered adequate to detect heater degradation and has been shown by operating experience to be acceptable.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ---------------------------------------------------------------------------------------------- ] ]
[ SR 3.4.9.3 This SR is not applicable if the heaters are permanently powered by 1E power supplies.
This Surveillance demonstrates that the heaters can be manually transferred to, and energized by, emergency power supplies. [ The Frequency of [18] months is based on a typical fuel cycle and is consistent with similar verifications of emergency power.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ---------------------------------------------------------------------------------------------- ] ]
Babcock & Wilcox STS                        B 3.4.9-6                                                       Rev. 5.0

Pressurizer B 3.4.9 BASES REFERENCES         1. NUREG-0737, November 1980.
Babcock & Wilcox STS           B 3.4.9-7            Rev. 5.0

Pressurizer Safety Valves B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.10 Pressurizer Safety Valves BASES BACKGROUND           The purpose of the two spring loaded pressurizer safety valves is to provide RCS overpressure protection. Operating in conjunction with the Reactor Protection System (RPS), two valves are used to ensure that the Safety Limit (SL) of 2750 psig is not exceeded for analyzed transients during operation in MODES 1 and 2. Two safety valves are used for MODE 3 and portions of MODE 4. For the remainder of MODE 4, MODE 5, and MODE 6 with the reactor head on, overpressure protection is provided by operating procedures and LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System."
The self actuated pressurizer safety valves are designed in accordance with the requirements set forth in the ASME Boiler and Pressure Vessel Code, Section III (Ref. 1). The required lift pressure is 2500 psig +/- 1%.
The safety valves discharge steam from the pressurizer to a quench tank located in the containment. The discharge flow is indicated by an increase in temperature downstream of the safety valves and by an increase in the quench tank temperature and level.
The upper and lower pressure limits are based on the +/- 1% tolerance requirement for lifting pressures above 1000 psig. The lift setting is for the ambient conditions associated with MODES 1, 2, and 3. This requires either that the valves be set hot or that a correlation between hot and cold settings be established.
The pressurizer safety valves are part of the primary success path and mitigate the effects of postulated accidents. OPERABILITY of the safety valves ensures that the RCS pressure will be limited to 110% of design pressure. The consequences of exceeding the ASME pressure limit could include damage to RCS components, increased leakage, or a requirement to perform additional stress analyses prior to resumption of reactor operation.
APPLICABLE           All accident analyses in the FSAR that require safety valve actuation SAFETY               assume operation of both pressurizer safety valves to limit increasing ANALYSES             reactor coolant pressure. The overpressure protection analysis (Ref. 1) is also based on operation of both safety valves and assumes that the valves open at the high range of the setting (2500 psig system design pressure plus 1%). These valves must accommodate pressurizer Babcock & Wilcox STS                   B 3.4.10-1                                        Rev. 5.0

Pressurizer Safety Valves B 3.4.10 BASES APPLICABLE SAFETY ANALYSES (continued) insurges that could occur during a startup, rod withdrawal, ejected rod, loss of main feedwater, or main feedwater line break accident. The startup accident establishes the minimum safety valve capacity. The startup accident is assumed to occur at < 15% power. Single failure of a safety valve is neither assumed in the accident analysis nor required to be addressed by the ASME Code. Compliance with this Specification is required to ensure that the accident analysis and design basis calculations remain valid.
Pressurizer safety valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The two pressurizer safety valves are set to open at the RCS design pressure (2500 psig) and within the ASME specified tolerance to avoid exceeding the maximum RCS design pressure SL, to maintain accident analysis assumptions and to comply with ASME Code requirements. The upper and lower pressure tolerance limits are based on the +/- 1%
tolerance requirements (Ref. 1) for lifting pressures above 1000 psig.
The limit protected by this Specification is the reactor coolant pressure boundary (RCPB) SL of 110% of design pressure. Inoperability of one or both valves could result in exceeding the SL if a transient were to occur.
The consequences of exceeding the ASME pressure limit could include damage to one or more RCS components, increased leakage, or additional stress analysis being required prior to resumption of reactor operation.
APPLICABILITY      In MODES 1, 2, and 3, and portions of MODE 4 above the LTOP cut in temperature, OPERABILITY of two valves is required because the combined capacity is required to keep reactor coolant pressure below 110% of its design value during certain accidents. MODE 3 and portions of MODE 4 are conservatively included, although the listed accidents may not require both safety valves for protection.
The LCO is not applicable in MODE 4 when any RCS cold leg temperature is  [283]&deg;F and MODE 5 because LTOP protection is provided. Overpressure protection is not required in MODE 6 with the reactor vessel head detensioned.
The Note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design Babcock & Wilcox STS                 B 3.4.10-2                                         Rev. 5.0

Pressurizer Safety Valves B 3.4.10 BASES LCO (continued) condition. Only one valve at a time will be removed from service for testing. The [36] hour exception is based on an 18 hour outage time for each of the two valves. The 18 hour period is derived from operating experience that hot testing can be performed in this timeframe.
ACTIONS            A.1 With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS overpressure protection system. An inoperable safety valve coincident with an RCS overpressure event could challenge the integrity of the RCPB.
B.1 and B.2 If the Required Action cannot be met within the required Completion Time or if both pressurizer safety valves are inoperable, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 with any RCS cold leg temperature  [283]&deg;F within 12 hours. The 6 hours allowed is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. Similarly, the [24] hours allowed is reasonable, based on operating experience, to reach MODE 4 without challenging plant systems. With any RCS cold leg temperature at or below [283]&deg;F, overpressure protection is provided by LTOP. The change from MODE 1, 2, or 3 to MODE 4 reduces the RCS energy (core power and pressure), lowers the potential for large pressurizer insurges, and thereby removes the need for overpressure protection by two pressurizer safety valves.
SURVEILLANCE       SR 3.4.10.1 REQUIREMENTS SRs are specified in the INSERVICE TESTING PROGRAM. Pressurizer safety valves are to be tested in accordance with the requirements of the ASME Code (Ref. 1), which provides the activities and the Frequency necessary to satisfy the SRs. No additional requirements are specified.
The pressurizer safety valve setpoint is +/- [3]% for OPERABILITY; however, the valves are reset to +/- 1% during the Surveillance to allow for drift.
REFERENCES         1. ASME Code for Operation and Maintenance of Nuclear Power Plants.
Babcock & Wilcox STS                  B 3.4.10-3                                       Rev. 5.0

Pressurizer PORV B 3.4.11 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.11 Pressurizer Power Operated Relief Valve (PORV)
BASES BACKGROUND           The pressurizer is equipped with three devices for pressure relief functions: two American Society of Mechanical Engineers (ASME) pressurizer safety valves that are safety grade components and one PORV that is not a safety grade device. The PORV is an electromatic pilot operated valve that is automatically opened at a specific set pressure when the pressurizer pressure increases and is automatically closed on decreasing pressure. The PORV may also be manually operated using controls installed in the control room.
An electric motor operated, normally open, block valve is installed between the pressurizer and the PORV. The function of the block valve is to isolate the PORV. Block valve closure is accomplished manually using controls in the control room and may be used to isolate a leaking PORV to permit continued power operation. Most importantly, the block valve is to be used to isolate a stuck open PORV to isolate the resulting small break loss of coolant accident (LOCA). Closure terminates the RCS depressurization and coolant inventory loss.
The PORV, its block valve, and their controls are powered from normal power supplies but are also capable of being powered from emergency supplies. Power supplies for the PORV are separate from those for the block valve. Power supply requirements are defined in NUREG-0737, Paragraph III, G.1 (Ref. 1).
The PORV setpoint is above the high pressure reactor trip setpoint and below the opening setpoint for the pressurizer safety valve as required by IE Bulletin 79-05B (Ref. 2). The purpose of the relationship of these setpoints is to limit the number of transient pressure increase challenges that might open the PORV, which, if opened, could fail in the open position. A pressure increase transient would cause a reactor trip, reducing core energy, and for many expected transients, prevent the pressure increase from reaching the PORV setpoint. The PORV setpoint thus limits the frequency of challenges from transients and limits the possibility of a small break LOCA from a failed open PORV.
Placing the setpoint below the pressurizer safety valve opening setpoint reduces the frequency of challenges to the safety valves, which, unlike the PORV, cannot be isolated if they were to fail open. The PORV setpoint is therefore important for limiting the possibility of a small break LOCA.
Babcock & Wilcox STS                    B 3.4.11-1                                          Rev. 5.0

Pressurizer PORV B 3.4.11 BASES BACKGROUND (continued)
The primary purpose of this LCO is to ensure that the PORV and the block valve are operating correctly so the potential for a small break LOCA through the PORV pathway is minimized, or if a small break LOCA were to occur through a failed open PORV, the block valve could be manually operated to isolate the path.
The PORV may be manually operated to depressurize the RCS as deemed necessary by the operator in response to normal or abnormal transients. The PORV may be used for depressurization when the pressurizer spray is not available; a condition that would be encountered during loss of offsite power. Steam generator tube rupture (SGTR) is one event that may require use of the PORV if the sprays are unavailable.
The PORV may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater.
The PORV functions as an automatic overpressure device and limits challenges to the safety valves. Although the PORV acts as an overpressure device for operational purposes, safety analyses [do not take credit for PORV actuation, but] do take credit for the safety valves.
The PORV also provides low temperature overpressure protection (LTOP) during heatup and cooldown. LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System," addresses this function.
APPLICABLE         The PORV small break LOCA break size is bounded by the spectrum SAFETY             of piping breaks analyzed for plant licensing. Because the PORV small ANALYSES           break LOCA is located at the top of the pressurizer, the RCS response characteristics are different from RCS loop piping breaks; analyses have been performed to investigate these characteristics.
The possibility of a small break LOCA through the PORV is reduced when the PORV flow path is OPERABLE and the PORV opening setpoint is established to be reasonably remote from expected transient challenges.
The possibility is minimized if the flow path is isolated.
The PORV opening setpoint has been established in accordance with Reference 2. It has been set so expected RCS pressure increases from anticipated transients will not challenge the PORV, minimizing the possibility of a small break LOCA through the PORV.
Overpressure protection is provided by safety valves, and analyses do not take credit for the PORV opening for accident mitigation.
Babcock & Wilcox STS                  B 3.4.11-2                                       Rev. 5.0

Pressurizer PORV B 3.4.11 BASES APPLICABLE SAFETY ANALYSES (continued)
Operational analyses that support the emergency operating procedures utilize the PORV to depressurize the RCS for mitigation of SGTR when the pressurizer spray system is unavailable (loss of offsite power). FSAR safety analyses for SGTR have been performed assuming that offsite power is available and thus pressurizer sprays (or the PORV) are available.
The PORV and its block valve satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
LCO                The LCO requires the PORV and its associated block valve to be OPERABLE. The block valve is required to be OPERABLE so it may be used to isolate the flow path if the PORV is not OPERABLE. If the block valve is not OPERABLE, the PORV may be used for temporary isolation.
APPLICABILITY      In MODES 1, 2, and 3, the PORV and its block valve are required to be OPERABLE to limit the potential for a small break LOCA through the flow path. A likely cause for PORV LOCA is a result of pressure increase transients that cause the PORV to open. Imbalances in the energy output of the core and heat removal by the secondary system can cause the RCS pressure to increase to the PORV opening setpoint. Pressure increase transients can occur any time the steam generators are used for heat removal. The most rapid increases will occur at higher operating power and pressure conditions of MODES 1 and 2.
Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is high. Therefore, the applicability is pertinent to MODES 1, 2, and 3. The LCO is not applicable in MODE 4 when both pressure and core energy are decreased and the pressure surges become much less significant. The PORV setpoint is reduced for LTOP in MODES 4, 5, and 6 with the reactor vessel head in place. LCO 3.4.12 addresses the PORV requirements in these MODES.
ACTIONS            A.1 and A.2 With the PORV inoperable, the PORV must be restored or the flow path isolated within 1 hour. The block valve should be closed and power must be removed from the block valve to reduce the potential for inadvertent PORV opening and depressurization.
Babcock & Wilcox STS                  B 3.4.11-3                                      Rev. 5.0

Pressurizer PORV B 3.4.11 BASES ACTIONS (continued)
B.1 and B.2 If the block valve is inoperable, it must be restored to OPERABLE status within 1 hour. The prime importance for the capability to close the block valve is to isolate a stuck open PORV. Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour, the Required Action is to close the block valve and remove power within 1 hour rendering the PORV isolated. The 1 hour Completion Times are consistent with an allowance of some time for correcting minor problems, restoring the valve to operation, and establishing correct valve positions and restricting the time without adequate protection against RCS depressurization.
C.1 and C.2 If the Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The 6 hours allowed is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. Similarly, the 12 hours allowed is reasonable, based on operating experience, to reach MODE 4 from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.4.11.1 REQUIREMENTS Block valve cycling verifies that it can be closed if needed. [ The basis for the Frequency of 92 days is the ASME Code (Ref. 3).
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.4.11-4                                                      Rev. 5.0

Pressurizer PORV B 3.4.11 BASES SURVEILLANCE REQUIREMENTS (continued)
Block valve cycling, as stated in the Note, is not required to be performed when it is closed for isolation; cycling could increase the hazard of an existing degraded flow path.
SR 3.4.11.2 PORV cycling demonstrates its function. [ The Frequency of 18 months is based on a typical refueling cycle and industry accepted practice.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.4.11.3 This Surveillance is not required for plants with permanent 1E power supplies to the valves.
This SR demonstrates that emergency power can be provided and is performed by transferring power from the normal supply to the emergency supply and cycling the valves. [ The Frequency of 18 months is based on a typical refueling cycle and industry accepted practice.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.4.11-5                                                      Rev. 5.0

Pressurizer PORV B 3.4.11 BASES REFERENCES         1. NUREG-0737, Paragraph III, G.1, November 1980.
: 2. NRC IE Bulletin 79-05B, April 21, 1979.
: 3. ASME Code for Operation and Maintenance of Nuclear Power Plants.
Babcock & Wilcox STS             B 3.4.11-6                                  Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.12 Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND         -----------------------------------REVIEWERS NOTE-----------------------------------
For plants for which the NRC has approved LTOP setpoints based on non-10 CFR 50, Appendix G, methodology, as allowed in NRC Generic Letter 88-11, the following Bases must be revised accordingly.
The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) requirements of 10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting RCPB component for providing such protection. LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the allowable combinations for operational pressure and temperature during cooldown, shutdown, and heatup to keep from violating the Reference 1 limits.
The reactor vessel material is less tough at reduced temperatures than at normal operating temperature. Also, as vessel neutron irradiation accumulates, the material becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure must be maintained low when temperature is low and must be increased only as temperature is increased.
Operational maneuvering during cooldown, heatup, or any anticipated operational occurrence must be controlled to not violate LCO 3.4.3.
Exceeding these limits could lead to brittle fracture of the reactor vessel.
LCO 3.4.3 presents requirements for administrative control of RCS pressure and temperature to prevent exceeding the P/T limits.
This LCO provides RCS overpressure protection in the applicable MODES by ensuring an adequate pressure relief capacity and a minimum coolant addition capability. The pressure relief capacity requires either the power operated relief valve (PORV) lift setpoint to be reduced and pressurizer coolant level at or below a maximum limit or the RCS depressurized and with an RCS vent of sufficient size to handle the limiting transient during LTOP.
The LTOP approach to protecting the vessel by limiting coolant addition capability allows a maximum of [one] makeup pump, and requires deactivating HPI, and isolating the core flood tanks (CFTs).
Babcock & Wilcox STS                      B 3.4.12-1                                                      Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES BACKGROUND (continued)
Should more than [one] HPI pump inject on an HPI actuation, the pressurizer level and PORV or another RCS vent cannot prevent overpressurizing the RCS. Even with only one HPI pump OPERABLE, the vent cannot prevent RCS overpressurization.
The pressurizer level limit provides a compressible vapor space or cushion (either steam or nitrogen) that can accommodate a coolant insurge and prevent a rapid pressure increase, allowing the operator time to stop the increase. The PORV, with reduced lift setting, or the RCS vent is the overpressure protection device that acts as backup to the operator in terminating an increasing pressure event.
With HPI deactivated, the ability to provide RCS coolant addition is restricted. To balance the possible need for coolant addition, the LCO does not require the Makeup System to be deactivated. Due to the lower pressures associated with the LTOP MODES and the expected decay heat levels, the Makeup System can provide flow with the OPERABLE makeup pump through the makeup control valve.
PORV Requirements As designed for the LTOP System, each PORV is signaled to open if the RCS pressure approaches a limit set in the LTOP actuation circuit. The LTOP actuation circuit monitors RCS pressure and determines when an overpressure condition is approached. When the monitored pressure meets or exceeds the setting, the PORV is signaled to open. Maintaining the setpoint within the limits of the LCO ensures the Reference 1 limits will be met in any event analyzed for LTOP.
When a PORV is opened in an increasing pressure transient, the release of coolant causes the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.
RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at ambient containment pressure in an RCS overpressure transient, if the relieving requirements of the maximum credible LTOP transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow of the limiting LTOP transient and maintaining pressure below P/T limits. The required vent capacity may be provided by one or more vent paths.
Babcock & Wilcox STS                 B 3.4.12-2                                         Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES BACKGROUND (continued)
For an RCS vent to meet the flow capacity, it requires removing a pressurizer safety valve, locking the PORV in the open position and disabling its block valve in the open position, or similarly establishing a vent by opening an RCS vent valve. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.
APPLICABLE         Safety analyses (Ref. 3) demonstrate that the reactor vessel can be SAFETY             adequately protected against overpressurization transients during ANALYSES           shutdown. In MODES 1, 2, and 3, and in MODE 4 with RCS temperature exceeding [283]&deg;F, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At nominally [283]&deg;F and below, overpressure prevention falls to an OPERABLE PORV and a restricted coolant level in the pressurizer or to a depressurized RCS and a sufficient size RCS vent. Each of these means has a limited overpressure relief capability.
The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as vessel material toughness decreases due to neutron embrittlement. Each time the P/T limit curves are revised, the LTOP System will be re-evaluated to ensure that its functional requirements can still be met with the PORV and pressurizer level method or the depressurized and vented RCS condition.
Transients that are capable of overpressurizing the RCS have been identified and evaluated. These transients relate to either mass input or heat input: actuating the HPI System, discharging the CFTs, energizing the pressurizer heaters, failing the makeup control valve open, losing decay heat removal, starting a reactor coolant pump (RCP) with a large temperature mismatch between the primary and secondary coolant systems, and adding nitrogen to the pressurizer.
HPI actuation and CFT discharge are the transients that result in exceeding P/T limits within < 10 minutes, in which time no operator action is assumed to take place. In the rest, operator action after that time precludes overpressurization. The analyses demonstrate that the time allowed for operator action is adequate, or the events are self limiting and do not exceed P/T limits.
The following are required during the LTOP MODES to ensure that transients do not occur, which either of the LTOP overpressure protection means cannot handle:
: a. Deactivating all but [one] makeup pump,
: b. Deactivating HPI, and Babcock & Wilcox STS                  B 3.4.12-3                                         Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)
: c. Immobilizing CFT discharge isolation valves in their closed positions.
The Reference 3 analyses demonstrate the PORV can maintain RCS pressure below limits when only one makeup pump is actuated.
Consequently, the LCO allows only [one] makeup pump to be OPERABLE in the LTOP MODES.
Since the PORV cannot do this for one HPI pump and the RCS vent cannot do this for even one pump, the LCO also requires the HPI actuation circuits deactivated and the CFTs isolated.
The isolated CFTs must have their discharge valves closed and the valve power breakers fixed in their open positions. The analyses show the effect of CFT discharge is over a narrower RCS temperature range (175&deg;F and below) than that of the LCO ([283]&deg;F and below).
Fracture mechanics analyses established the temperature of LTOP Applicability at [283]&deg;F. Above this temperature, the pressurizer safety valves provide the reactor vessel pressure protection. The vessel materials were assumed to have a neutron irradiation accumulation equal to 21 effective full power years (EFPYs) of operation.
This LCO will deactivate the HPI actuation when the RCS temperature is
[283]&deg;F. The consequences of a small break LOCA in LTOP MODE 4 conform to 10 CFR 50.46 and 10 CFR 50, Appendix K (Refs. 4 and 5),
requirements by having a maximum of [one] makeup pump OPERABLE.
Reference 3 contains the acceptance limits that satisfy the LTOP requirements. Any change to the RCS must be evaluated against these analyses to determine the impact of the change on the LTOP acceptance limits.
PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORV is set to open at  [555] psig. The setpoint is derived by modeling the performance of the LTOP System, assuming the limiting allowed LTOP transient of uncontrolled HPI actuation of one pump.
These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoint at or below the derived limit ensures the Reference 1 limits will be met.
Babcock & Wilcox STS                  B 3.4.12-4                                      Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)
The PORV setpoint will be re-evaluated for compliance when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to embrittlement induced by neutron irradiation. Revised P/T limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.3 discuss these examinations.
The PORV is considered an active component. Therefore, its failure represents the worst case LTOP single active failure.
Pressurizer Level Performance Analyses of operator response time show that the pressurizer level must be maintained  [220] inches to provide the 10 minute action time for correcting transients.
The pressurizer level limit will also be re-evaluated for compliance each time P/T limit curves are revised based on the results of the vessel material surveillance.
RCS Vent Performance With the RCS depressurized, analyses show a vent of [0.75] square inches is capable of mitigating the transient resulting from full opening of the makeup control valve while the makeup pump is providing RCS makeup. The capacity of a vent this size is greater than the flow resulting from this credible transient at 100 psig back pressure, which is less than the maximum RCS pressure on the P/T limit curve in LCO 3.4.3.
The RCS vent size will also be re-evaluated for compliance each time P/T limit curves are revised based on the results of the vessel material surveillance.
The vent is passive and is not subject to active failure.
The LTOP System satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The LCO requires an LTOP System OPERABLE with a limited coolant input capability and a pressure relief capability. To limit coolant input, the LCO requires a maximum of [one] makeup pump OPERABLE, the HPI deactivated, and the CFT discharge isolation valves closed and immobilized. For pressure relief, it requires either the pressurizer coolant at or below a maximum level and the PORV OPERABLE with a lift setting at the LTOP limit or the RCS depressurized and a vent established.
Babcock & Wilcox STS                  B 3.4.12-5                                         Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES LCO (continued)
The LCO is modified by two Notes. Note 1 allows [two makeup pumps] to be made capable of injecting for  1 hour during pump swap operations.
One hour provides sufficient time to safely complete the actual transfer and to complete the administrative controls and surveillance requirements associated with the swap. The intent is to minimize the actual time that more than [one] makeup pump is physically capable of injection. Note 2 states that CFT isolation is only required when the CFT pressure is more than or equal to the maximum RCS pressure for the existing RCS temperature, as allowed in LCO 3.4.3. This Note permits the CFT discharge valve surveillance performed only under these pressure and temperature conditions.
The pressurizer is OPERABLE with a coolant level  [220] inches.
The PORV is OPERABLE when its block valve is open, its lift setpoint is set at  [555] psig and testing has proven its ability to open at that setpoint, and motive power is available to the two valves and their control circuits.
For the depressurized RCS, an RCS vent is OPERABLE when open with an area of at least [0.75] square inches.
APPLICABILITY      This LCO is applicable in MODE 4 when any RCS cold leg temperature is
[283]&deg;F, in MODE 5, and in MODE 6 when the reactor vessel head is on. The Applicability temperature of [283]&deg;F is established by fracture mechanics analyses. The pressurizer safety valves provide overpressure protection to meet LCO 3.4.3 P/T limits above [283]&deg;F. With the vessel head off, overpressurization is not possible.
LCO 3.4.3 provides the operational P/T limits for all MODES.
LCO 3.4.10, "Pressurizer Safety Valves," requires the pressurizer safety valves OPERABLE to provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above [283]&deg;F.
ACTIONS            A.1 and B.1 With two or more makeup pumps capable of injecting into the RCS or if the HPI is activated, immediate actions are required to render the other pump(s) inoperable or to deactivate HPI. Emphasis is on immediate deactivation because inadvertent injection with [one] or more HPI pump OPERABLE is the event of greatest significance, since it causes the greatest pressure increase in the shortest time. Also, the vent cannot mitigate overpressurization from the injection of even one HPI pump.
The immediate Completion Times reflect the urgency of quickly proceeding with the Required Actions.
Babcock & Wilcox STS                 B 3.4.12-6                                          Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES ACTIONS (continued)
C.1, D.1, and D.2 An unisolated CFT requires isolation within 1 hour only when the CFT pressure is at or more than the maximum RCS pressure for the existing temperature allowed in LCO 3.4.3.
If isolation is needed and cannot be accomplished in 1 hour, Required Action D.1 and Required Action D.2 provide two options, either of which must be performed in 12 hours. By increasing the RCS temperature to
                   > 175&deg;F, the CFT pressure of 600 psig cannot exceed the LTOP limits if both tanks are fully injected. Depressurizing the CFTs below the LTOP limit of [555] psig also prevents exceeding the LTOP limits in the same event.
The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that a limiting LTOP event is not likely in the allowed times.
E.1, F.1, and F.2 With the pressurizer level more than [220] inches, the time for operator action in a pressure increasing event is reduced. The postulated event most affected in the LTOP MODES is failure of the makeup control valve, which fills the pressurizer relatively rapidly. Restoration is required within 1 hour.
If restoration within 1 hour in either case cannot be accomplished, Required Actions F.1 and F.2 must be performed within 12 hours to close the makeup control valve and its isolation valve. These Required Actions limit the makeup capability, which is not required with a high pressurizer level, and permit cooldown and depressurization to continue. Heatup must be stopped because heat addition decreases the reactor coolant density and increases the pressurizer level.
The Completion Times again are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that a limiting LTOP transient is not likely in the allowed times.
Babcock & Wilcox STS                   B 3.4.12-7                                        Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES ACTIONS (continued)
G.1, H.1, and H.2 With the PORV inoperable, overpressure relieving capability is lost, and restoration of the PORV within 1 hour is required. If that cannot be accomplished, the ability of the Makeup System to add water must be limited within the next 12 hours.
If restoration cannot be completed within 1 hour, Required Action H.1 and Required Action H.2 must be performed to limit RCS water addition capability. Makeup is not deactivated to maintain the RCS coolant level.
Required Action H.1 and Required Action H.2 require reducing the makeup tank level to 70 inches and deactivating the low low makeup tank level interlock to the borated water storage tank. This makes the available makeup water volume insufficient to exceed the LTOP limit by a makeup control valve full opening.
These Completion Times also consider these activities can be accomplished in these time periods. A limiting LTOP event is not likely in those times.
Some PORV testing or maintenance can only be performed at plant shutdown. Such activity is permitted if Required Action H.1 and Required Action H.2 are taken to compensate for PORV unavailability.
I.1 With the pressurizer level above [220] inches and the PORV inoperable or the LTOP System inoperable for any reason other than cited in Condition A through H, Required Action I.1 requires the RCS depressurized and vented within 12 hours from the time either Condition started.
One or more vents may be used. A vent size of  [0.75] square inches is specified. This vent size assumes 100 psig backpressure. Because makeup may be required, the vent size accommodates inadvertent full makeup system operation. Such a vent keeps the pressure from full flow of [one] makeup pump with a wide open makeup control valve within the LCO limit.
The PORV has a larger area and may be used for venting by opening and locking it open.
Babcock & Wilcox STS                  B 3.4.12-8                                      Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES ACTIONS (continued)
This size RCS vent or the PORVs a vent cannot maintain RCS pressure below LTOP limits if the HPI and CFT systems are inadvertently actuated.
Therefore, verification of the deactivation of two HPI pumps, HPI injection, and the CFTs must accompany the depressurizing and venting. Since these systems are required deactivated by the LCO, SR 3.4.12.1, SR 3.4.12.2, and SR 3.4.12.3 require verification of their deactivated status every 12 hours.
The Completion Time is based on operating experience that this activity can be accomplished in this time period and on engineering evaluations indicating that a limiting LTOP transient is not likely in this time.
SURVEILLANCE         SR 3.4.12.1, SR 3.4.12.2, and SR 3.4.12.3 REQUIREMENTS Verifications must be performed that only [one] makeup pump is capable of injecting into the RCS, the HPI is deactivated, and the CFT discharge isolation valves are closed and immobilized. These Surveillances ensure the minimum coolant input capability will not create an RCS overpressure condition to challenge the LTOP System.
[ The 12 hour intervals are shown by operating practice to be sufficient to regularly assess conditions for potential degradation and verify operation within the safety analysis.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.4.12.4 Verification of the pressurizer level at  [220] inches by observing control room or other indications ensures a cushion of sufficient size is available to reduce the rate of pressure increase from potential transients.
Babcock & Wilcox STS                        B 3.4.12-9                                                      Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued)
The 30 minute Surveillance Frequency during heatup and cooldown must be performed for the LCO Applicability period when temperature changes can cause pressurizer level variations. This Frequency may be discontinued when the ends of these conditions are satisfied, as defined in plant procedures. [ Thereafter, the Surveillance is required at 12 hour intervals. ]
[ These Frequencies are shown by operating practice sufficient to regularly assess indications of potential degradation and verify operation within the safety analysis.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.4.12.5 Verification that the PORV block valve is open ensures a flow path to the PORV.
[ The 12 hour interval has been shown by operating practice sufficient to regularly assess conditions for potential degradation and verify operation is within the safety analysis.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                       B 3.4.12-10                                                      Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.4.12.6 The RCS vent of at least [0.75] square inches must be verified open for relief protection only if the vent is being used to satisfy the requirements of this LCO. [ For a vent valve not locked open, the Frequency is every 12 hours. Valves that are sealed or secured in the open position are considered "locked" in this context. For other vent path(s) (e.g., a vent valve that is locked, sealed, or secured in position, a removed pressurizer safety valve, or open manway), the required Frequency is every 31 days.
Again, the Frequency intervals consider operating practice to determine adequacy to regularly assess conditions for potential degradation and verify operation within the safety analysis.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
The passive vent path arrangement must only be open to be OPERABLE.
SR 3.4.12.7 A CHANNEL FUNCTIONAL TEST is required within [12] hours after decreasing RCS temperature to  [283]&deg;F and periodically thereafter to ensure the setpoint is proper for using the PORV for LTOP. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay.
This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. PORV actuation is not needed, as it could depressurize the RCS.
Babcock & Wilcox STS                     B 3.4.12-11                                                      Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued)
The [12] hour Frequency considers the unlikelihood of a low temperature overpressure event during the time. [ The 31 day Frequency is based on industry accepted practice and is acceptable by experience with equipment reliability.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.4.12.8 The CHANNEL CALIBRATION for the LTOP setpoint ensures that the PORV will be actuated at the appropriate RCS pressure by verifying the accuracy of the instrument string. The calibration can only be performed in shutdown.
[ The 18 month Frequency considers a typical refueling cycle and industry accepted practice.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                       B 3.4.12-12                                                      Rev. 5.0

Low Temperature Overpressure Protection (LTOP) System B 3.4.12 BASES REFERENCES         1. 10 CFR 50, Appendix G.
: 2. Generic Letter 88-11.
: 3. FSAR, Section 15.
: 4. 10 CFR 50.46.
: 5. 10 CFR 50, Appendix K.
Babcock & Wilcox STS             B 3.4.12-13                                  Rev. 5.0

RCS Operational LEAKAGE B 3.4.13 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.13 RCS Operational LEAKAGE BASES BACKGROUND         Components that contain or transport the coolant to or from the reactor core make up the RCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.
During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.
10 CFR 50, Appendix A, GDC 30 (Ref. 1), requires means for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting Leakage Detection Systems.
The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur detrimental to the safety of the facility and the public.
A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS leakage detection.
This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analysis radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA). However, the ability to monitor leakage provides advance warning to permit plant shutdown before a LOCA occurs. This advantage has been shown by "leak before break" studies.
Babcock & Wilcox STS                  B 3.4.13-1                                        Rev. 5.0

RCS Operational LEAKAGE B 3.4.13 BASES APPLICABLE         Except for primary to secondary LEAKAGE, the safety analyses do not SAFETY             address operational LEAKAGE. However, other operational LEAKAGE ANALYSES           is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGE from all steam generators (SGs) is [1 gallon per minute] or increases to [1 gallon per minute] as a result of accident induced conditions. The LCO requirement to limit primary to secondary LEAKAGE through any one SG to less than or equal to 150 gallons per day is significantly less than the conditions assumed in the safety analysis.
Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a steam line break (SLB) accident. To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR). The leakage contaminates the secondary fluid.
The FSAR (Ref. 3) analysis for SGTR assumes the contaminated secondary fluid is only briefly released via safety valves and the majority is steamed to the condenser. The [1 gpm] primary to secondary LEAKAGE safety analysis assumption is relatively inconsequential.
The SLB is more limiting for site radiation releases. The safety analysis for the SLB accident assumes the entire [1 gpm] primary to secondary LEAKAGE is through the affected generator as an initial condition. The dose consequences resulting from the SLB accident are well within the limits defined in 10 CFR 100.
RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                RCS operational LEAKAGE shall be limited to:
: a. Pressure Boundary LEAKAGE Pressure boundary LEAKAGE is prohibited as the leak itself could cause further RCPB deterioration, resulting in higher LEAKAGE.
: b. Unidentified LEAKAGE One gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period. Separating the sources of leakage (i.e., leakage from an identified source versus leakage from an unidentified source) is necessary for prompt identification of potentially adverse conditions, assessment of the safety significance, and corrective action.
Babcock & Wilcox STS                  B 3.4.13-2                                       Rev. 5.0

RCS Operational LEAKAGE B 3.4.13 BASES LCO (continued)
: c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of unidentified LEAKAGE and is well within the capability of the RCS makeup system. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include controlled reactor coolant pump (RCP) seal leakoff (a normal function not considered LEAKAGE).
: d. Primary to Secondary LEAKAGE Through Any One SG The limit of 150 gallons per day per SG is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines (Ref. 4). The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, "The RCS operational primary to secondary leakage through any one SG shall be limited to 150 gallons per day." The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational leakage rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.
APPLICABILITY      In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.
In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.
LCO 3.4.14, "RCS Pressure Isolation Valve (PIV) Leakage," measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leaktight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.
Babcock & Wilcox STS                  B 3.4.13-3                                      Rev. 5.0

RCS Operational LEAKAGE B 3.4.13 BASES ACTIONS            A.1 If pressure boundary LEAKAGE exists, the affected component, pipe, or vessel must be isolated from the RCS by a closed manual valve, closed and de-activated automatic valve, blind flange, or check valve within 4 hours. While in this condition, structural integrity of the system should be considered because the structural integrity of the part of the system within the isolation boundary must be maintained under all licensing basis conditions, including consideration of the potential for further degradation of the isolated location. Normal LEAKAGE past the isolation device is acceptable as it will limit RCS LEAKAGE and is included in identified or unidentified LEAKAGE. This action is necessary to prevent further deterioration of the RCPB.
B.1 If unidentified LEAKAGE or identified LEAKAGE are in excess of the LCO limits, the LEAKAGE must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.
C.1 and C.2 If primary to secondary LEAKAGE is not within limit, or any of the Required Actions and associated Completion Times cannot be met, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. The reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.
This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.
The Completion Times allowed are reasonable, based on operating experience, to reach the required conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the pressure stresses acting on the RCPB are much lower and further deterioration is much less likely.
Babcock & Wilcox STS                  B 3.4.13-4                                        Rev. 5.0

RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE         SR 3.4.13.1 REQUIREMENTS Verifying RCS LEAKAGE within the LCO limits ensures that the integrity of the RCPB is maintained. Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory balance.
The RCS water inventory balance must be performed with the reactor at steady state operating conditions (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, [and RCP seal injection and return flows]). The Surveillance is modified by two Notes.
Note 1 states that this SR is not required to be performed until 12 hours after establishing steady state operation. The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established.
Steady state operation is required to perform a proper water inventory balance since calculations during maneuvering are not useful. For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP pump seal injection and return flows.
An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level.
These leakage detection systems are specified in LCO 3.4.15, "RCS Leakage Detection Instrumentation."
Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 150 gallons per day cannot be measured accurately by an RCS water inventory balance.
[ The 72 hour Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                    B 3.4.13-5                                        Rev. 5.0

RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE REQUIREMENTS (continued)
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.4.13.2 This SR verifies that primary to secondary LEAKAGE is less than or equal to 150 gallons per day through any one SG. Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCO 3.4.17, "Steam Generator Tube Integrity," should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference 5. The operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.
The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours after establishment of steady state operation. For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.
[ The Surveillance Frequency of 72 hours is a reasonable interval to trend primary to secondary LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                        B 3.4.13-6                                                      Rev. 5.0

RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE REQUIREMENTS (continued)
The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Ref. 5).
REFERENCES         1. 10 CFR 50, Appendix A, GDC 30.
: 2. Regulatory Guide 1.45, May 1973.
: 3. FSAR, Chapter [15].
: 4. NEI 97-06, "Steam Generator Program Guidelines."
: 5. EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."
Babcock & Wilcox STS                 B 3.4.13-7                                    Rev. 5.0

RCS PIV Leakage B 3.4.14 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage BASES BACKGROUND         10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, and 3), define RCS PIVs as any two normally closed valves in series within the RCS pressure boundary that separate the high pressure RCS from an attached low pressure system. During their lives, these valves can produce varying amounts of reactor coolant leakage through either normal operational wear or mechanical deterioration. The RCS PIV Leakage LCO allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety.
The PIV leakage limit applies to each individual valve. Leakage through both series PIVs in a line must be included as part of the identified LEAKAGE, governed by LCO 3.4.13, "RCS Operational LEAKAGE." This is true during operation only when the loss of RCS mass through two series valves is determined by a water inventory balance (SR 3.4.13.1).
A known component of the identified LEAKAGE before operation begins is the least of the two individual leakage rates determined for leaking series PIVs during the required surveillance testing; leakage measured through one PIV in a line is not RCS operational LEAKAGE if the other is leaktight.
Although this specification provides a limit on allowable PIV leakage rate, its main purpose is to prevent overpressure failure of the low pressure portions of connecting systems. The leakage limit is an indication that the PIVs between the RCS and the connecting systems are degraded or degrading. PIV leakage could lead to overpressure of the low pressure piping or components. Failure consequences could be a loss of coolant accident (LOCA) outside of containment, an unanalyzed accident that could degrade the ability for low pressure injection.
The basis for this LCO is the 1975 NRC "Reactor Safety Study" (Ref. 4) that identified potential intersystem LOCAs as a significant contributor to the risk of core melt.
A subsequent study (Ref. 5) evaluated various PIV configurations to determine the probability of intersystem LOCAs.
PIVs are provided to isolate the RCS from the following typically connected systems:
: a. Decay Heat Removal (DHR) System,
: b. Emergency Core Cooling System (ECCS), and Babcock & Wilcox STS                  B 3.4.14-1                                        Rev. 5.0

RCS PIV Leakage B 3.4.14 BASES BACKGROUND (continued)
: c. Makeup and Purification System.
The PIVs are listed in [FSAR section] Reference 6.
Violation of this LCO could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.
APPLICABLE         Reference 4 identified potential intersystem LOCAs as a significant SAFETY             contributor to the risk of core melt. The dominant accident sequence in ANALYSES           the intersystem LOCA category is the failure of the low pressure portion of the DHR System outside of containment. The accident is the result of a postulated failure of the PIVs, which are part of the reactor coolant pressure boundary (RCPB), and the subsequent pressurization of the DHR System downstream of the PIVs from the RCS. Because the low pressure portion of the DHR System is typically designed for 600 psig, overpressurization failure of the DHR low pressure line would result in a LOCA outside containment and subsequent risk of core melt.
Reference 5 evaluated various PIV configurations, leakage testing of the valves, and operational changes to determine the effect on the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce the probability of an intersystem LOCA.
RCS PIV leakage satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                RCS PIV leakage is identified LEAKAGE into closed systems connected to the RCS. Isolation valve leakage is usually on the order of drops per minute. Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken.
The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with a maximum limit of 5 gpm. The previous criterion of 1 gpm for all valve sizes imposed an unjustified penalty on the larger valves without providing information on potential valve degradation and resulted in higher personnel radiation exposures. A study concluded a leakage rate limit based on valve size was superior to a single allowable value.
Reference 7 permits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure of the connected system during RCS operation (the maximum pressure differential) in those types of valves in which the higher service pressure Babcock & Wilcox STS                   B 3.4.14-2                                       Rev. 5.0

RCS PIV Leakage B 3.4.14 BASES LCO (continued) will tend to diminish the overall leakage channel opening. In such cases, the observed rate may be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one half power.
APPLICABILITY      In MODES 1, 2, 3, and 4, this LCO applies because the PIV leakage potential is greatest when the RCS is pressurized. In MODE 4, valves in the DHR flow path are not required to meet the requirements of this LCO when in, or during the transition to or from, the DHR mode of operation.
In MODES 5 and 6, leakage limits are not provided because the lower reactor coolant pressure results in a reduced potential for leakage and for a LOCA outside the containment.
ACTIONS            The ACTIONS are modified by two Notes. Note 1 is added to provide clarification that each flow path allows separate entry into a Condition.
This is allowed based upon the functional independence of the flow path.
Note 2 requires an evaluation of affected systems if a PIV is inoperable.
The leakage may have affected system operability, or isolation of a leaking flow path with an alternate valve may have degraded the ability of the interconnected system to perform its safety function.
A.1 and A.2 The flow path must be isolated by two valves. Required Actions A.1 and A.2 are modified by a Note that the valves used for isolation must meet the same leakage requirements as the PIVs and must be on the RCS pressure boundary [or the high pressure portion of the system].
Required Action A.1 requires that the isolation with one valve must be performed within 4 hours. Four hours provides time to reduce leakage in excess of the allowable limit and to isolate the affected system if leakage cannot be reduced. The 4 hours allows the actions and restricts the operation with leaking isolation valves.
[ Required Action A.2 specifies that the double isolation barrier of two valves be restored by closing some other valve qualified for isolation or restoring one leaking PIV. [The 72 hour time after exceeding the limit considers the time required to complete the Action and the low probability of a second valve failing during this time period.
or Babcock & Wilcox STS                   B 3.4.14-3                                       Rev. 5.0

RCS PIV Leakage B 3.4.14 BASES ACTIONS (continued)
The 72 hour time after exceeding the limit allows for the restoration of the leaking PIV to OPERABLE status. This timeframe considers the time required to complete this Action and the low probability of a second valve failing during this period. ]
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Two options are provided for Required Action A.2. The second option (72 hour restoration) is appropriate if isolation of a second valve would place the unit in an unanalyzed condition.
B.1 and B.2 If leakage cannot be reduced, [the system isolated,] or other Required Actions accomplished, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. This Required Action may reduce the leakage and also reduces the potential for a LOCA outside the containment. The allowed Completion Times are reasonable based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
C.1 The inoperability of the DHR autoclosure interlock renders the DHR suction isolation valves incapable of isolating in response to a high pressure condition and preventing inadvertent opening of the valves at RCS pressures in excess of the DHR systems design pressure. If the DHR autoclosure interlock is inoperable, operation may continue as long as the DHR suction penetration is closed by at least one closed manual or deactivated automatic valve within 4 hours. This action accomplishes the purpose of the autoclosure function.
SURVEILLANCE       SR 3.4.14.1 REQUIREMENTS Performance of leakage testing on each RCS PIV or isolation valve used to satisfy Required Action A.1 or A.2 is required to verify that leakage is below the specified limit and to identify each leaking valve. The leakage limit of 0.5 gpm per inch of nominal valve diameter up to 5 gpm maximum applies to each valve. Leakage testing requires a stable pressure condition.
Babcock & Wilcox STS                      B 3.4.14-4                                                      Rev. 5.0

RCS PIV Leakage B 3.4.14 BASES SURVEILLANCE REQUIREMENTS (continued)
For the two PIVs in series, the leakage requirement applies to each valve individually and not to the combined leakage across both valves. If the PIVs are not individually leakage tested, one valve may have failed completely and not detected if the other valve in series meets the leakage requirement. In this situation, the protection provided by redundant valves would be lost.
Testing is to be performed every 9 months, but may be extended, if the plant does not go into MODE 5 for at least 7 days.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
If the testing is within the scope of the licensee's INSERVICE TESTING PROGRAM, the Frequency "In accordance with the INSERVICE TESTING PROGRAM" should be used. Otherwise, the periodic Frequency of [18] months or the reference to the Surveillance Frequency Control Program should be used.
[ The [18 month] Frequency is consistent with 10 CFR 50.55a(g) (Ref. 8) as contained in the INSERVICE TESTING PROGRAM, is within frequency allowed by the American Society of Mechanical Engineers (ASME) Code (Ref. 7), and is based on the need to perform such surveillances under conditions that apply during an outage and the potential for an unplanned transient if the Surveillance were performed with the plant at power.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
[ In addition, testing must be performed once after the valve has been opened by flow or exercised to ensure tight reseating. PIVs disturbed in the performance of this Surveillance should also be tested unless documentation shows that an infinite testing loop cannot practically be avoided. Testing must be performed within 24 hours after the valve has been reseated. Within 24 hours is a reasonable and practical time limit for performing this test after opening or reseating a valve. ]
Babcock & Wilcox STS                        B 3.4.14-5                                                      Rev. 5.0

RCS PIV Leakage B 3.4.14 BASES SURVEILLANCE REQUIREMENTS (continued)
The leakage limit is to be met at the RCS pressure associated with MODES 1 and 2. This permits leakage testing at high differential pressures with stable conditions not possible in the MODES with lower pressures.
Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stable conditions to allow for performance of this Surveillance. The Note that allows this provision is complimentary to the Frequency of prior to entry into MODE 2 whenever the unit has been in MODE 5 for 7 days or more, if leakage testing has not been performed in the previous 9 months. In addition, this Surveillance is not required to be performed on the DHR System when the DHR System is aligned to the RCS in the decay heat removal mode of operation. PIVs contained in the DHR flow path must be leakage rate tested after DHR is secured and stable unit conditions and the necessary differential pressures are established.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
The "24 hour..." Frequency of performance for Surveillance Requirement 3.4.14.1 is not required for B&W Owner's Group plants licensed prior to 1980. These plants were licensed prior to the NRC establishing formal Technical Specification controls for pressure isolation valves. Subsequently, these earlier plants had their licenses modified by NRC Order to require certain PIV testing Frequencies (excluding the "24 hour..." Frequency) be included in that plant's Technical Specifications. Based upon the information available to the Staff at the time, the content of those Orders was considered acceptable. Since 1980, the NRC Staff has determined an additional PIV leakage rate determination is required within 24 hours following actuation of the valve and flow through the valve. This is necessary in order to ensure the PIV's ability to support the integrity of the reactor coolant pressure boundary.
The Revised Standard Technical Specifications include the "24 hours..."
Frequency to reflect current NRC Staff position on the need to include this test requirement within Technical Specifications.
[ SR 3.4.14.2 and SR 3.4.14.3 Verifying that the DHR autoclosure interlocks are OPERABLE ensures that RCS pressure will not pressurize the DHR system beyond 125% of its design pressure of [600] psig. The interlock setpoint that prevents the valves from being opened is set so the actual RCS pressure must be
                     < [425] psig to open the valves. This setpoint ensures the DHR design pressure will not be exceeded and the DHR relief valves will not lift. [ The 18 month Frequency is based on the need to perform this Surveillance Babcock & Wilcox STS                        B 3.4.14-6                                                      Rev. 5.0

RCS PIV Leakage B 3.4.14 BASES SURVEILLANCE REQUIREMENTS (continued) under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance was performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
These SRs are modified by Notes allowing the DHR autoclosure function to be disabled when using the DHR System suction relief valve for cold overpressure protection in accordance with LCO 3.4.12. ]
REFERENCES         1. 10 CFR 50.2.
: 2. 10 CFR 55a(c).
: 3. 10 CFR 50, Appendix A, Section V, GDC 55.
: 4. NUREG-75/014, Appendix V, October 1975.
: 5. NUREG-0677, NRC, May 1980.
: 6.    [Document containing list of PIVs.]
: 7. ASME Code for Operation and Maintenance of Nuclear Power Plants.
: 8. 10 CFR 50.55a(g).
Babcock & Wilcox STS                      B 3.4.14-7                                                      Rev. 5.0

RCS Leakage Detection Instrumentation B 3.4.15 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.15 RCS Leakage Detection Instrumentation BASES BACKGROUND         GDC 30 of Appendix A to 10 CFR 50 (Ref. 1) requires means for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE. Regulatory Guide 1.45, Revision 0, (Ref. 2) describes acceptable methods for selecting leakage detection systems.
Leakage detection systems must have the capability to detect significant reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE. [In addition to meeting the OPERABILITY requirements, the monitors are typically set to provide the most sensitive response without causing an excessive number of spurious alarms.]
The containment sump used to collect unidentified LEAKAGE is instrumented to alarm for increases above the normal flow rates.
The reactor coolant contains radioactivity that, when released to the containment, may be detected by radiation monitoring instrumentation.
Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS LEAKAGE.
Other indications may be used to detect an increase in unidentified LEAKAGE; however, they are not required to be OPERABLE by this LCO. An increase in humidity of the containment atmosphere would indicate release of water vapor to the containment. Dew point temperature measurements can thus be used to monitor humidity levels of the containment atmosphere as an indicator of potential RCS LEAKAGE.
Since the humidity level is influenced by several factors, a quantitative evaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid flow into or from the containment sump [and condensate flow from air coolers]. Humidity level monitoring is considered most useful as an indirect alarm or indication to alert the operator to a potential problem.
Humidity monitors are not required for this LCO.
Air temperature and pressure monitoring methods may also be used to infer unidentified LEAKAGE to the containment. Containment temperature and pressure fluctuate slightly during plant operation, but a rise above the normally indicated range of values may indicate RCS Babcock & Wilcox STS                  B 3.4.15-1                                         Rev. 5.0

RCS Leakage Detection Instrumentation B 3.4.15 BASES BACKGROUND (continued)
LEAKAGE into the containment. The relevance of temperature and pressure measurements is affected by containment free volume and, for temperature, detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment.
Temperature and pressure monitors are not required by this LCO.
The above mentioned LEAKAGE detection methods or systems differ in sensitivity and response time. [Some of these systems could serve as early alarm systems signaling the operators that closer examination of other detection systems is necessary to determine the extent of any corrective action that may be required.]
APPLICABLE         The need to evaluate the severity of an alarm or an indication is important SAFETY             to the operators, and the ability to compare and verify with indications ANALYSES           from other systems is necessary.
The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area are necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leak occur detrimental to the safety of the unit and the public.
RCS leakage detection instrumentation satisfies Criterion 1 of 10 CFR 50.36(c)(2)(ii).
LCO                This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide confidence that small amounts of unidentified LEAKAGE are detected in time to allow actions to place the plant in a safe condition when RCS LEAKAGE indicates possible RCPB degradation.
The LCO requires two instruments to be OPERABLE.
The containment sump is used to collect unidentified LEAKAGE. [The containment sump consists of the normal sump and the emergency sump. The LCO requirements apply to the total amount of unidentified LEAKAGE collected in [the][both] sump[s].] The monitor on the containment sump detects [level or flow rate or the operating frequency of a pump] and is instrumented to detect when there is [leakage of] [an increase above the normal value by] 1 gpm. The identification of [an increase in] unidentified LEAKAGE will be delayed by the time required for the unidentified LEAKAGE to travel to the containment sump and it Babcock & Wilcox STS                  B 3.4.15-2                                        Rev. 5.0

RCS Leakage Detection Instrumentation B 3.4.15 BASES LCO (continued) may take longer than one hour to detect a 1 gpm increase in unidentified LEAKAGE, depending on the origin and magnitude of the LEAKAGE.
This sensitivity is acceptable for containment sump monitor OPERABILITY.
The reactor coolant contains radioactivity that, when released to the containment, can be detected by the gaseous or particulate containment atmosphere radioactivity monitor. Only one of the two detectors is required to be OPERABLE. Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS LEAKAGE, but have recognized limitations. Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. If there are few fuel element cladding defects and low levels of activation products, it may not be possible for the gaseous or particulate containment atmosphere radioactivity monitors to detect a 1 gpm increase within 1 hour during normal operation. However, the gaseous or particulate containment atmosphere radioactivity monitor is OPERABLE when it is capable of detecting a 1 gpm increase in unidentified LEAKAGE within 1 hour given an RCS activity equivalent to that assumed in the design calculations for the monitors (Reference 3).
The LCO requirements are satisfied when monitors of diverse measurement means are available. Thus, the containment sump monitor, in combination with a particulate or gaseous radioactivity monitor, provides an acceptable minimum.
APPLICABILITY      Because of elevated RCS temperature and pressure in MODES 1, 2, 3, and 4, RCS leakage detection instrumentation is required to be OPERABLE.
In MODE 5 or 6, the temperature is  200&deg;F and pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation is much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.
ACTIONS            A.1 and A.2 With the containment sump monitor inoperable, no other form of sampling can provide the equivalent information.
Babcock & Wilcox STS                  B 3.4.15-3                                         Rev. 5.0

RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS (continued)
However, the containment atmosphere activity monitor will provide indications of changes in leakage. Together with the containment atmosphere radioactivity monitor, the periodic surveillance for RCS inventory balance, SR 3.4.13.1, water inventory balance, must be performed at an increased frequency of 24 hours to provide information that is adequate to detect leakage. A Note is added allowing that SR 3.4.13.1 is not required to be performed until 12 hours after establishing steady state operation (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and [RCP seal injection and return flows]). The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established.
Restoration of the sump monitor to OPERABLE status is required to regain the function in a Completion Time of 30 days after the monitor's failure. This time is acceptable considering the frequency and adequacy of the RCS water inventory balance required by Required Action A.1.
B.1.1, B.1.2, and B.2 With required gaseous or particulate containment atmosphere radioactivity monitoring instrumentation channels inoperable, alternative action is required. Either grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with SR 3.4.13.1, must be performed to provide alternate periodic information. With a sample obtained and analyzed or a water inventory balance performed every 24 hours, the reactor may be operated for up to 30 days to allow restoration of at least one of the radioactivity monitors.
The 24 hour interval provides periodic information that is adequate to detect leakage. A Note is added allowing that SR 3.4.13.1 is not required to be performed until 12 hours after establishing steady state operation (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and [RCP seal injection and return flows]). The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established. The 30 day Completion Time recognizes at least one other form of leak detection is available.
Babcock & Wilcox STS                 B 3.4.15-4                                        Rev. 5.0

RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS (continued)
C.1 and C.2 With the containment sump monitor inoperable, the only means of detecting LEAKAGE is the required containment atmosphere radiation monitor. A Note clarifies that this Condition is only applicable when the only OPERABLE monitor is the required containment atmosphere gaseous radiation monitor. In addition, this configuration does not provide the required diverse means of leakage detection. Indirect methods of monitoring RCS leakage must be implemented. Grab samples of the containment atmosphere must be taken and analyzed to provide alternate periodic information. The 12 hour interval is sufficient to detect increasing RCS leakage. The Required Action provides 7 days to restore another RCS leakage monitor to OPERABLE status to regain the intended leakage detection diversity. The 7 day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period.
D.1 and D.2 If a Required Action of Condition A, B or C cannot be met within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 4). In MODE 4 the RCS pressure is lower and the risk of significant RCS leakage is reduced. In MODE 4, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action D.2 is modified by a second Note. Note 2 states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate.
LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
Babcock & Wilcox STS                  B 3.4.15-5                                        Rev. 5.0

RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS (continued)
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
E.1 With both required monitors inoperable, no automatic means of monitoring leakage are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.
SURVEILLANCE       SR 3.4.15.1 REQUIREMENTS SR 3.4.15.1 requires the performance of a CHANNEL CHECK of the required containment atmosphere radioactivity monitor. The check gives reasonable confidence that each channel is operating properly. [ The Frequency of 12 hours is based on instrument reliability and is reasonable for detecting off normal conditions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.4.15.2 SR 3.4.15.2 requires the performance of a CHANNEL FUNCTIONAL TEST of the required containment atmosphere radioactivity monitor. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string. [ The Frequency of 92 days Babcock & Wilcox STS                      B 3.4.15-6                                                      Rev. 5.0

RCS Leakage Detection Instrumentation B 3.4.15 BASES SURVEILLANCE REQUIREMENTS (continued) considers instrument reliability, and operating experience has shown it proper for detecting degradation.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.4.15.3 and SR 3.4.15.4 These SRs require the performance of a CHANNEL CALIBRATION for each of the required RCS leakage detection instrumentation channels.
The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. [ The Frequency of [18] months is a typical refueling cycle and considers channel reliability. Again, operating experience has proven this Frequency is acceptable.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.4.15-7                                                      Rev. 5.0

RCS Leakage Detection Instrumentation B 3.4.15 BASES REFERENCES         1. 10 CFR 50, Appendix A, Section IV, GDC 30.
: 2. Regulatory Guide 1.45, Revision 0, "Reactor Coolant Pressure Boundary Leakage Detection Systems," May 1973.
: 3. FSAR, Section [ ] .
: 4. BAW-2441-A, Revision 2, Risk Informed Justification for LCO, End State Changes, September 2006.
Babcock & Wilcox STS             B 3.4.15-8                                      Rev. 5.0

RCS Specific Activity B 3.4.16 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.16 RCS Specific Activity BASES BACKGROUND          The maximum dose that an individual at the exclusion area boundary can receive for 2 hours following an accident, or at the low population zone outer boundary for the radiological release duration, is specified in
[10 CFR 100.11][10 CFR 50.67] (Ref. 1). Doses to control room operators must be limited per GDC 19. The limits on specific activity ensure that the offsite and control room doses are appropriately limited during analyzed transients and accidents.
The RCS specific activity LCO limits the allowable concentration level of radionuclides in the reactor coolant. The LCO limits are established to minimize the dose consequences in the event of a steam line break (SLB) or steam generator tube rupture (SGTR) accident.
The LCO contains specific activity limits for both DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and control room doses meet the appropriate acceptance criteria in the Standard Review Plan (SRP)
(Ref. 2).
APPLICABLE          The LCO limits on the specific activity of the reactor coolant ensure that SAFETY              the resulting offsite and control room doses meet the appropriate SRP ANALYSES            acceptance criteria following a SLB or SGTR accident. The safety analyses (Refs. 3 and 4) assume the specific activity of the reactor coolant is at the LCO limits, and an existing reactor coolant steam generator (SG) tube leakage rate of [1 gpm] exists. The safety analyses assume the specific activity of the secondary coolant is at its limit of
[0.1] Ci/gm DOSE EQUIVALENT I-131 from LCO 3.7.17, "Secondary Specific Activity."
The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specific activity. Reference to these analyses is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.
The safety analyses consider two cases of reactor coolant iodine specific activity. One case assumes specific activity at [1.0] Ci/gm DOSE EQUIVALENT I-131 with a concurrent large iodine spike that increases the rate of release of iodine from the fuel rods containing cladding defects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factor of 335), respectively. The second case assumes the initial reactor coolant iodine activity at [60.0] Ci/gm DOSE EQUIVALENT Babcock & Wilcox STS                       B 3.4.16-1                                     Rev. 5.0

RCS Specific Activity B 3.4.16 BASES APPLICABLE SAFETY ANALYSES (continued)
I-131 due to an iodine spike caused by a reactor or an RCS transient prior to the accident. In both cases, the noble gas specific activity is assumed to be [280] Ci/gm DOSE EQUIVALENT XE-133.
The SGTR analysis assumes a rise in pressure in the ruptured SG causes radioactively contaminated steam to discharge to the atmosphere through the atmospheric dump valves or the main steam safety valves.
The atmospheric discharge stops when the turbine bypass to the condenser removes the excess energy to rapidly reduce the RCS pressure and close the valves. The unaffected SG removes core decay heat by venting steam until the cooldown ends and the Decay Heat Removal (DHR) System is placed in service.
The SLB radiological analysis assumes that offsite power is lost at the same time as the pipe break occurs outside containment. The affected SG blows down completely and steam is vented directly to the atmosphere. The unaffected SG removes core decay heat by venting steam to the atmosphere until the cooldown ends and the DHR System is placed in service.
Operation with iodine specific activity levels greater than the LCO limit is permissible, if the activity levels do not exceed [60.0] Ci/gm for more than 48 hours.
The limits on RCS specific activity are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices.
RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The iodine specific activity in the reactor coolant is limited to [1.0] Ci/gm DOSE EQUIVALENT I-131, and the noble gas specific activity in the reactor coolant is limited to [280] Ci/gm DOSE EQUIVALENT XE-133.
The limits on specific activity ensure that offsite and control room doses will meet the appropriate SRP acceptance criteria (Ref. 2).
The SLB and SGTR accident analyses (Refs. 3 and 4) show that the calculated doses are within acceptable limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of a SLB or SGTR, lead to doses that exceed the SRP acceptance criteria (Ref. 2).
Babcock & Wilcox STS                     B 3.4.16-2                                        Rev. 5.0

RCS Specific Activity B 3.4.16 BASES APPLICABILITY      In MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133 is necessary to limit the potential consequences of a SLB or SGTR to within the SRP acceptance criteria (Ref. 2).
In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS and steam generators are depressurized, and primary to secondary leakage is minimal. Therefore, the monitoring of RCS specific activity is not required.
ACTIONS            A.1 and A.2 With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of 4 hours must be taken to demonstrate that the specific activity is < [60.0] Ci/gm. The Completion Time of 4 hours is required to obtain and analyze a sample. Sampling is continued every 4 hours to provide a trend.
The DOSE EQUIVALENT I-131 must be restored to within limit within 48 hours. The Completion Time of 48 hours is acceptable since it is expected that, if there were an iodine spike, the normal coolant iodine concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.
A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODE(S), relying on Required Actions A.1 and A.2 while the DOSE EQUIVALENT I-131 LCO limit is not met. This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, power operation.
B.1 With the DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENT XE-133 must be restored to within limit within 48 hours.
The allowed Completion Time of 48 hours is acceptable since it is expected that, if there were a noble gas spike, the normal coolant noble gas concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.
Babcock & Wilcox STS                      B 3.4.16-3                                       Rev. 5.0

RCS Specific Activity B 3.4.16 BASES ACTIONS (continued)
A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODES(S), relying on Required Action B.1 while the DOSE EQUIVALENT XE-133 LCO limit is not met.
This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, power operation.
C.1 and C.2 If the Required Action and associated Completion Time of Condition A or B is not met, or if the DOSE EQUIVALENT I-131 is > [60.0] Ci/gm, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.4.16.1 REQUIREMENTS SR 3.4.16.1 requires performing a gamma isotopic analysis as a measure of the noble gas specific activity of the reactor coolant. This measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in the noble gas specific activity.
Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. [The 7 day Frequency considers the low probability of a gross fuel failure during this time.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                          B 3.4.16-4                                                  Rev. 5.0

RCS Specific Activity B 3.4.16 BASES SURVEILLANCE REQUIREMENTS (continued)
Due to the inherent difficulty in detecting Kr-85 in a reactor coolant sample due to masking from radioisotopes with similar decay energies, such as F-18 and I-134, it is acceptable to include the minimum detectable activity for Kr-85 in the SR 3.4.16.1 calculation. If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE-133 is not detected, it should be assumed to be present at the minimum detectable activity.
A Note modifies the SR to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the SR. This allows the Surveillance to be performed in those MODES, prior to entering MODE 1.
SR 3.4.16.2 This Surveillance is performed to ensure iodine specific activity remains within the LCO limit during normal operation and following fast power changes when iodine spiking is more apt to occur. [The 14 day Frequency is adequate to trend changes in the iodine activity level, considering noble gas activity is monitored every 7 days.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
The Frequency, between 2 and 6 hours after a power change > 15% RTP within a 1 hour period, is established because the iodine levels peak during this time following iodine spike initiation; samples at other times would provide inaccurate results.
The Note modifies this SR to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the SR. This allows the Surveillance to be performed in those MODES, prior to entering MODE 1.
Babcock & Wilcox STS                          B 3.4.16-5                                                  Rev. 5.0

RCS Specific Activity B 3.4.16 BASES REFERENCES          ------------------------------- Reviewers Note -------------------------------------------
The first listed References 1 and 2 are for plants that are licensed to 10 CFR 100.11. The second set of References are for plants that are licensed to 10 CFR 50.67.
[ 1. 10 CFR 100.11.
: 2. Standard Review Plan (SRP) Section 15.1.5 Appendix A (SLB) and Section 15.6.3 (SGTR).
: 1. 10 CFR 50.67.
: 2. Standard Review Plan (SRP) Section 15.0.1 "Radiological Consequence Analyses Using Alternative Source Terms." ]
: 3. FSAR, Section [15.1.5].
: 4. FSAR, Section [15.6.3].
Babcock & Wilcox STS                       B 3.4.16-6                                                      Rev. 5.0

SG Tube Integrity B 3.4.17 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.17 Steam Generator (SG) Tube Integrity BASES BACKGROUND         Steam generator (SG) tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers.
The SG tubes have a number of important safety functions. Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary systems pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.4, "RCS Loops - MODES 1 and 2," LCO 3.4.5, "RCS Loops - MODE 3," LCO 3.4.6, "RCS Loops - MODE 4," and LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled."
SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements.
Steam generator tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively.
The SG performance criteria are used to manage SG tube degradation.
Specification 5.5.8, "Steam Generator (SG) Program," requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 5.5.8, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 5.5.8. Meeting the SG performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions.
The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Ref. 1).
Babcock & Wilcox STS                 B 3.4.17-1                                       Rev. 5.0

SG Tube Integrity B 3.4.17 BASES APPLICABLE         The steam generator tube rupture (SGTR) accident is the limiting design SAFETY             basis event for SG tubes and avoiding an SGTR is the basis for this ANALYSES           Specification. The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate equal to the operational LEAKAGE rate limits in LCO 3.4.13, "RCS Operational LEAKAGE," plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumes the contaminated secondary fluid is only briefly released to the atmosphere via safety valves and the majority is discharged to the main condenser.
The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture.) In these analyses, the steam discharge to the atmosphere is based on the total primary to secondary LEAKAGE from all SGs of [1 gallon per minute] or is assumed to increase to [1 gallon per minute] as a result of accident induced conditions. For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUIVALENT I-131 is assumed to be equal to the LCO 3.4.16, "RCS Specific Activity," limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Ref. 2), 10 CFR 100 (Ref. 3) or the NRC approved licensing basis (e.g., a small fraction of these limits).
Steam generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The LCO requires that SG tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the plugging [or repair] criteria be plugged [or repaired] in accordance with the Steam Generator Program.
During an SG inspection, any inspected tube that satisfies the Steam Generator Program plugging [or repair] criteria is [repaired or] removed from service by plugging. If a tube was determined to satisfy the plugging
[or repair] criteria but was not plugged [or repaired], the tube may still have tube integrity.
In the context of this Specification, a SG tube is defined as the entire length of the tube, including the tube wall [and any repairs made to it],
between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.
A SG tube has tube integrity when it satisfies the SG performance criteria.
The SG performance criteria are defined in Specification 5.5.8, "Steam Generator Program," and describe acceptable SG tube performance.
The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria.
Babcock & Wilcox STS                   B 3.4.17-2                                        Rev. 5.0

SG Tube Integrity B 3.4.17 BASES LCO (continued)
There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.
The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as, "The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis.
The division between primary and secondary classifications will be based on detailed analysis and/or testing.
Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included in the design specification.
This includes safety factors and applicable design basis loads based on ASME Code, Section III, Subsection NB (Ref. 4) and Draft Regulatory Guide 1.121 (Ref. 5).
The accident induced leakage performance criterion ensures that the primary to secondary LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The accident analysis assumes that accident induced leakage does not exceed [1 gpm per SG, except for specific types of degradation at specific locations where the NRC has approved greater accident induced leakage.] The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.
Babcock & Wilcox STS                  B 3.4.17-3                                         Rev. 5.0

SG Tube Integrity B 3.4.17 BASES LCO (continued)
The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in LCO 3.4.13, "RCS Operational LEAKAGE," and limits primary to secondary LEAKAGE through any one SG to 150 gallons per day. This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative.
APPLICABILITY      Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced in MODE 1, 2, 3, or 4.
RCS conditions are far less challenging in MODES 5 and 6 than during MODES 1, 2, 3, and 4. In MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.
ACTIONS            The ACTIONS are modified by a Note clarifying that the Conditions may be entered independently for each SG tube. This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube. Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.
A.1 and A.2 Condition A applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube plugging [or repair]
criteria but were not plugged [or repaired] in accordance with the Steam Generator Program as required by SR 3.4.17.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG plugging [or repair] criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged [or repaired] has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the Babcock & Wilcox STS                   B 3.4.17-4                                       Rev. 5.0

SG Tube Integrity B 3.4.17 BASES ACTIONS (continued) estimated growth of the degradation prior to the next SG tube inspection.
If it is determined that tube integrity is not being maintained, Condition B applies.
A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity.
If the evaluation determines that the affected tube(s) have tube integrity, Required Action A.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tubes. However, the affected tube(s) must be plugged [or repaired] prior to entering MODE 4 following the next refueling outage or SG inspection. This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.
B.1 and B.2 If the Required Actions and associated Completion Times of Condition A are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.4.17.1 REQUIREMENTS During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices.
During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring assessment determines the "as found" condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.
The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube plugging [or repair] criteria. Inspection scope (i.e.,
Babcock & Wilcox STS                  B 3.4.17-5                                        Rev. 5.0

SG Tube Integrity B 3.4.17 BASES SURVEILLANCE REQUIREMENTS (continued) which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation. Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations.
The Steam Generator Program defines the Frequency of SR 3.4.17.1.
The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Ref. 6). The Steam Generator Program uses information on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 5.5.8 contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections. If crack indications are found in any SG tube, the maximum inspection interval for all affected and potentially affected SGs is restricted by Specification 5.5.8 until subsequent inspections support extending the inspection interval.
SR 3.4.17.2 During an SG inspection, any inspected tube that satisfies the Steam Generator Program plugging [or repair] criteria is [repaired or] removed from service by plugging. The tube plugging [or repair] criteria delineated in Specification 5.5.8 are intended to ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube plugging [or repair] criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s).
Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.
[Steam generator tube repairs are only performed using approved repair methods as described in the Steam Generator Program.]
The Frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the plugging [or repair] criteria are plugged [or repaired] prior to subjecting the SG tubes to significant primary to secondary pressure differential.
Babcock & Wilcox STS                  B 3.4.17-6                                          Rev. 5.0

SG Tube Integrity B 3.4.17 BASES REFERENCES         1. NEI 97-06, "Steam Generator Program Guidelines."
: 2. 10 CFR 50 Appendix A, GDC 19.
: 3. 10 CFR 100.
: 4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.
: 5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.
: 6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines."
Babcock & Wilcox STS               B 3.4.17-7                                    Rev. 5.0

CFTs B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
B 3.5.1 Core Flood Tanks (CFTs)
BASES BACKGROUND          The function of the ECCS CFTs is to supply water to the reactor vessel during the blowdown phase of a loss of coolant accident (LOCA), to provide inventory to help accomplish the refill phase that follows thereafter, and to provide Reactor Coolant System (RCS) makeup for a small break LOCA. Two CFTs are provided for these functions.
The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.
In the refill phase of a LOCA, which follows immediately, reactor coolant inventory has vacated the core through steam flashing and ejection through the break. The core is essentially in adiabatic heatup. The balance of inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer so as to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of safety injection water.
The CFTs are pressure vessels partially filled with borated water and pressurized with nitrogen gas. The CFTs are passive components, since no operator or control actions are required for them to perform their function. Internal tank pressure is sufficient to discharge the contents of the CFTs to the RCS if RCS pressure decreases below the CFT pressure. Each CFT is piped separately into the reactor vessel downcomer. The CFT injection lines are also utilized by the Low Pressure Injection (LPI) System. Each CFT is isolated from the RCS by a motor operated isolation valve and two check valves in series.
The motor operated isolation valves are normally open, with power removed from the valve motor to prevent inadvertent closure prior to or during an accident.
The CFTs thus form a passive system for injection directly into the reactor vessel. Except for the core flood line break LOCA, a unique accident that also disables a portion of the injection system, both tanks are assumed to operate in the safety analyses for Design Basis Events. Because injection is directly into the reactor vessel downcomer, and because it is a passive system not subject to the single active failure criterion, all fluid injection is credited for core cooling.
Babcock & Wilcox STS                    B 3.5.1-1                                         Rev. 5.0

CFTs B 3.5.1 BASES BACKGROUND (continued)
The CFT gas/water volumes, gas pressure, and outlet pipe size are selected to provide core cooling for a large break LOCA prior to the injection of coolant by the LPI System.
APPLICABLE         The CFTs are taken credit for in both the large and small break LOCA SAFETY             analyses at full power (Ref. 1). These Design Basis Accident (DBA)
ANALYSES           analyses establish the acceptance limits for the CFTs. Reference to the analyses for these DBAs is used to assess changes in the CFTs as they relate to the acceptance limits. In performing the LOCA calculations, conservative assumptions are made concerning the availability of emergency injection flow. The assumption of the loss of offsite power is required by regulations. In the early stages of a LOCA with the loss of offsite power, the CFTs provide the sole source of makeup water to the RCS.
This is because the LPI pumps and high pressure injection (HPI) pumps cannot deliver flow until the emergency diesel generators (EDGs) start, come to rated speed, and go through their timed loading sequence.
The limiting large break LOCA is a double ended guillotine cold leg break at the discharge of the reactor coolant pump.
During this event, the CFTs discharge to the RCS as soon as RCS pressure decreases below CFT pressure. As a conservative estimate, no credit is taken for HPI for large break LOCAs. LPI is not assumed to occur until 35 seconds after the RCS pressure decreases to the ESFAS actuation pressure. No operator action is assumed during the blowdown stage of a large break LOCA.
The small break LOCA analysis also assumes a time delay after ESFAS actuation before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated by the CFTs, with pumped flow then providing continued cooling. As break size decreases, the CFTs and HPI pumps both play a part in terminating the rise in clad temperature. As break size continues to decrease, the role of the CFTs continues to decrease until the tanks are not required and the HPI pumps become responsible for terminating the temperature increase.
This LCO helps to ensure that the following acceptance criteria for the ECCS established by 10 CFR 50.46 (Ref. 2) will be met following a LOCA:
: a. Maximum fuel element cladding temperature of 2200&deg;F, Babcock & Wilcox STS                   B 3.5.1-2                                      Rev. 5.0

CFTs B 3.5.1 BASES APPLICABLE SAFETY ANALYSES (continued)
: b. Maximum cladding oxidation of  0.17 times the total cladding thickness before oxidation,
: c. Maximum hydrogen generation from a zirconium water reaction of 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react, and
: d. Core maintained in a coolable geometry.
Since the CFTs discharge during the blowdown phase of a LOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.
The limits for operation with a CFT that is inoperable for any reason other than the boron concentration not being within limits minimize the time that the plant is exposed to a LOCA event occurring along with failure of a CFT, which might result in unacceptable peak cladding temperatures. If a closed isolation valve cannot be opened, or the proper water volume or nitrogen cover pressure cannot be restored, the full capability of one CFT is not available and prompt action is required to place the reactor in a MODE in which this capability is not required.
In addition to LOCA analyses, the CFTs have been assumed to operate to provide borated water for reactivity control for severe overcooling events such as a large steam line break (SLB).
The CFTs are part of the primary success path that functions or actuates to mitigate a DBA that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.
The minimum volume requirement for the CFTs ensures that both CFTs can provide adequate inventory to reflood the core and downcomer following a LOCA. The downcomer then remains flooded until the HPI and LPI systems start to deliver flow.
The maximum volume limit is based upon the need to maintain adequate gas volume to ensure proper injection, ensure the ability of the CFTs to fully discharge, and limit the maximum amount of boron inventory in the CFTs. Values of [7555] gallons and [8005] gallons are specified. These values allow for instrument inaccuracies. Values of other parameters are treated similarly.
The minimum nitrogen cover pressure requirement of [525] psig ensures that the contained gas volume will generate discharge flow rates during injection that are consistent with those assumed in the safety analysis.
Babcock & Wilcox STS                   B 3.5.1-3                                        Rev. 5.0

CFTs B 3.5.1 BASES APPLICABLE SAFETY ANALYSES (continued)
The maximum nitrogen cover pressure limit of [625] psig ensures that the amount of CFT inventory that is discharged while the RCS depressurizes, and is therefore lost through the break, will not be larger than that predicted by the safety analysis. The maximum allowable boron concentration of [3500] ppm in the CFTs ensures that the sump pH will be maintained between 7.0 and 11.0 following a LOCA.
The minimum boron requirement of [2270] ppm is selected to ensure that the reactor will remain subcritical during the reflood stage of a large break LOCA. During a large break LOCA, all control rod assemblies are assumed not to insert into the core, and the initial reactor shutdown is accomplished by void formation during blowdown. Sufficient boron concentration must be maintained in the CFTs to prevent a return to criticality during reflood.
The CFT isolation valves are not single failure proof; therefore, whenever these valves are open, power shall be removed from them. This precaution ensures that both CFTs are available during an accident. With power supplied to the valves, a single active failure could result in a valve closure, which would render one CFT unavailable for injection. Both CFTs are required to function in the event of a large break LOCA.
The CFTs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The LCO establishes the minimum conditions required to ensure that the CFTs are available to accomplish their core cooling safety function following a LOCA. Both CFTs are required to function in the event of a large break LOCA. If the entire contents of both tanks are not injected during the blowdown phase of a large break LOCA, the ECCS acceptance criteria of 10 CFR 50.46 (Ref. 2) could be violated. For a CFT to be considered OPERABLE, the isolation valve must be fully open, power removed above [2000] psig, and the limits established in the SR for contained volume, boron concentration, and nitrogen cover pressure must be met.
APPLICABILITY      In MODES 1 and 2, and in MODE 3 with RCS pressure > 750 psig, the CFT OPERABILITY requirements are based on full power operation.
Although cooling requirements may decrease as power decreases, the CFTs are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.
This LCO is only applicable at pressures  750 psig. Below 750 psig, the rate of RCS blowdown is such that the safety injection pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref. 2) limit of 2200&deg;F.
Babcock & Wilcox STS                    B 3.5.1-4                                        Rev. 5.0

CFTs B 3.5.1 BASES APPLICABILITY (continued)
In MODE 3 with RCS pressure  750 psig, and in MODES 4, 5, and 6, the CFT motor operated isolation valves are closed to isolate the CFTs from the RCS. This allows RCS cooldown and depressurization without discharging the CFTs into the RCS or requiring depressurization of the CFTs.
ACTIONS            A.1 If the boron concentration of one CFT is not within limits, it must be returned to within the limits within 72 hours. In this condition, ability to maintain subcriticality may be reduced, but the effects of reduced boron concentration on core subcriticality during reflood are minor. Boiling of the ECCS water in the core during reflood concentrates the boron in the saturated liquid that remains in the core. In addition, the volume of the CFT is still available for injection. Since the boron requirements are based on the average boron concentration of the total volume of two CFTs, the consequences are less severe than they would be if the contents of a CFT were not available for injection. Thus, 72 hours is allowed to return the boron concentration to within limits.
B.1 If one CFT is inoperable for a reason other than boron concentration, the CFT must be returned to OPERABLE status within 1 hour. In this condition it cannot be assumed that the CFT will perform its required function during a LOCA. Due to the severity of the consequences should a LOCA occur in these conditions, the 1 hour Completion Time to open the valve, remove power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to return the inoperable CFT to OPERABLE status. The Completion Time minimizes the time the plant is potentially exposed to a LOCA in these conditions.
C.1 and C.2 If the CFT cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and RCS pressure reduced to  750 psig within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Babcock & Wilcox STS                  B 3.5.1-5                                           Rev. 5.0

CFTs B 3.5.1 BASES ACTIONS (continued)
D.1 If more than one CFT is inoperable, the unit is in a condition outside the accident analysis; therefore, LCO 3.0.3 must be entered immediately.
SURVEILLANCE       SR 3.5.1.1 REQUIREMENTS Verification that each CFT isolation valve is fully open, as indicated in the control room, ensures that the CFTs are available for injection and ensures timely discovery if a valve should be less than fully open. If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power removed, a closed valve could result in accident analysis assumptions not being met. [ A 12 hour Frequency is considered reasonable in view of administrative controls that ensure that a mispositioned isolation valve is unlikely.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.5.1.2 and SR 3.5.1.3 Verification of each CFT's nitrogen cover pressure and the borated water volume is sufficient to ensure adequate injection during a LOCA. [ Due to the static design of the CFTs, a 12 hour Frequency usually allows the operator to identify changes before the limits are reached. Operating experience has shown that this Frequency is appropriate for early detection and correction of off normal trends.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                      B 3.5.1-6                                                       Rev. 5.0

CFTs B 3.5.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.5.1.4 Surveillance is reasonable to verify that the CFT boron concentration is within the required limits, because the static design of the CFT limits the ways in which the concentration can be changed. [ The Frequency is adequate to identify changes that could occur from mechanisms such as stratification or inleakage.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Sampling within 6 hours after an 80 gallon volume increase will identify whether inleakage from the RCS has caused a reduction in boron concentration to below the required limit. It is not necessary to verify boron concentration if the added water inventory is from the borated water storage tank (BWST), because the water contained in the BWST is within CFT boron concentration requirements. This is consistent with the recommendations of NUREG-1366 (Ref. 3).
SR 3.5.1.5 Verification that power is removed from each CFT isolation valve operator
[when the RCS pressure is  [2000] psig ensures that an active failure could not result in the undetected closure of a CFT motor operated isolation valve coincident with a LOCA. If this closure were to occur and Babcock & Wilcox STS                      B 3.5.1-7                                                       Rev. 5.0

CFTs B 3.5.1 BASES SURVEILLANCE REQUIREMENTS (continued) the postulated LOCA is a rupture of the redundant CFT inlet piping, CFT capability would be rendered inoperable. The rupture would render the tank with the open valve inoperable, and a closed valve on the other CFT would likewise render it inoperable. This would cause a loss of function for the CFTs. [ Since power is removed under administrative control, the 31 day Frequency will provide adequate assurance that the power is removed.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note that allows power to be supplied to the motor operated isolation valves when RCS pressure is < [2000] psig, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during plant startups or shutdowns.
REFERENCES         1. FSAR, Section [6.3].
: 2. 10 CFR 50.46.
: 3. Draft NUREG-1366, February 1990.
Babcock & Wilcox STS                      B 3.5.1-8                                                       Rev. 5.0

ECCS - Operating B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
B 3.5.2 ECCS - Operating BASES BACKGROUND         The function of the ECCS is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:
: a. Loss of coolant accident (LOCA),
: b. Rod ejection accident (REA),
: c. Steam generator tube rupture (SGTR), and
: d. Steam line break (SLB).
There are two phases of ECCS operation: injection and recirculation. In the injection phase, all injection is initially added to the Reactor Coolant System (RCS) via the cold legs and to the reactor vessel. After the borated water storage tank (BWST) has been depleted, the ECCS recirculation phase is entered as the ECCS suction is transferred to the containment sump.
Two redundant, 100% capacity trains are provided. In MODES 1, 2, and 3, each train consists of high pressure injection (HPI) and low pressure injection (LPI) subsystems. In MODES 1, 2, and 3, both trains must be OPERABLE. This ensures that 100% of the core cooling requirements can be provided even in the event of a single active failure.
A suction header supplies water from the BWST or the containment sump to the ECCS pumps. Separate piping supplies each train. HPI discharges into each of the four RCS cold legs between the reactor coolant pump and the reactor vessel. LPI discharges into each of the two core flood nozzles on the reactor vessel that discharge into the vessel downcomer area. Control valves are set to balance the HPI flow to the RCS. This flow balance directs sufficient flow to the core to meet the analysis assumptions following a small break LOCA in one of the RCS cold legs near an HPI nozzle.
The HPI pumps are capable of discharging to the RCS at an RCS pressure above the opening setpoint of the pressurizer safety valves.
The LPI pumps are capable of discharging to the RCS at an RCS pressure of approximately 200 psia. When the BWST has been nearly emptied, the suction for the LPI pumps is manually transferred to the containment sump. The HPI pumps cannot take suction directly from the sump. If HPI is still needed, a cross connect from the discharge side of Babcock & Wilcox STS                  B 3.5.2-1                                          Rev. 5.0

ECCS - Operating B 3.5.2 BASES BACKGROUND (continued) the LPI pump to the suction of the HPI pumps would be opened. This is known as "piggy backing" HPI to LPI and enables continued HPI to the RCS, if needed, after the BWST is emptied.
In the long term cooling period, flow paths in the LPI System are established to preclude the possibility of boric acid in the core region reaching an unacceptably high concentration. One flow path is from the hot leg through the decay heat suction line from the hot leg and then in a reverse direction through the containment sump outlet line into the sump.
The other flow path is through the pressurizer auxiliary spray line from one LPI train into the pressurizer and through the hot leg into the top region of the core.
The HPI subsystem also functions to supply borated water to the reactor core following increased heat removal events, such as large SLBs.
During low temperature conditions in the RCS, limitations are placed on the maximum number of ECCS pumps that may be OPERABLE. Refer to the Bases for LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System," for the basis of these requirements.
During a large break LOCA, RCS pressure will decrease to < 200 psia in
                   < 20 seconds. The ECCS is actuated upon receipt of an Engineered Safety Feature Actuation System (ESFAS) signal. The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately (in the programmed sequence). If offsite power is not available, the Engineered Safety Feature (ESF) buses shed normal operating loads and are connected to the diesel generators. Safeguard loads are then actuated in the programmed time sequence. The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required before pumped flow is available to the core following a LOCA.
The active ECCS components, along with the passive core flood tanks (CFTs), the BWST, and the containment sump, are covered in LCO 3.5.1, "Core Flood Tanks (CFTs)," LCO 3.5.4, "Borated Water Storage Tank (BWST)," and LCO 3.6.8, "Containment Sump," and provide the cooling water necessary to meet 10 CFR 50.46 (Ref. 1).
APPLICABLE         The LCO helps to ensure that the following acceptance criteria for the SAFETY             ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a ANALYSES           LOCA:
: a. Maximum fuel element cladding temperature is  2200&deg;F, Babcock & Wilcox STS                  B 3.5.2-2                                         Rev. 5.0

ECCS - Operating B 3.5.2 BASES APPLICABLE SAFETY ANALYSES (continued)
: b. Maximum cladding oxidation is  0.17 times the total cladding thickness before oxidation,
: c. Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react,
: d. Core is maintained in a coolable geometry, and
: e. Adequate long term core cooling capability is maintained.
The LCO also helps ensure that containment temperature limits are met.
Both HPI and LPI subsystems are assumed to be OPERABLE in the large break LOCA analysis at full power (Ref. 2). This analysis establishes a minimum required flow for the HPI and LPI pumps, as well as the minimum required response time for their actuation. The HPI pump is credited in the small break LOCA analysis. This analysis establishes the flow and discharge head requirements at the design point for the HPI pump. The SGTR and SLB analyses also credit the HPI pump but are not limiting in their design.
The large break LOCA event with a loss of offsite power and a single failure (disabling one ECCS train) establishes the OPERABILITY requirements for the ECCS. During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment. The nuclear reaction is terminated either by moderator voiding during large breaks or CONTROL ROD assembly insertion for small breaks. Following depressurization, emergency cooling water is injected into the reactor vessel core flood nozzles, then flows into the downcomer, fills the lower plenum, and refloods the core.
The LCO ensures that an ECCS train will deliver sufficient water to match decay heat boiloff rates soon enough to minimize core uncovery for a large break LOCA. It also ensures that the HPI pump will deliver sufficient water for a small break LOCA and provide sufficient boron to maintain the core subcritical.
In the LOCA analyses, HPI and LPI are not credited until 35 seconds after actuation of the ESFAS signal. This is based on a loss of offsite power and the associated time delays in startup and loading of the emergency Babcock & Wilcox STS                  B 3.5.2-3                                         Rev. 5.0

ECCS - Operating B 3.5.2 BASES APPLICABLE SAFETY ANALYSES (continued) diesel generator (EDG). Further, LPI flow is not credited until RCS pressure drops below the pump's shutoff head. For a large break LOCA, HPI is not credited at all.
The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that at least one is available, assuming a single failure in the other train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.
In MODES 1, 2, and 3, an ECCS train consists of an HPI subsystem and an LPI subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST upon an ESFAS signal and manually transferring suction to the containment sump.
During an event requiring ECCS actuation, a flow path is provided to ensure an abundant supply of water from the BWST to the RCS via the HPI and LPI pumps and their respective discharge flow paths to each of the four cold leg injection nozzles and the reactor vessel. In the long term, this flow path may be manually transferred to take its supply from the containment sump and to supply its flow to the RCS via two paths, as described in the Background section. Management of gas voids is important to ECCS OPERABILITY.
The flow path for each train must maintain its designed independence to ensure that no single failure can disable both ECCS trains.
As indicated in the Note, operation in MODE 3 with ECCS trains de-activated pursuant to LCO 3.4.12 is necessary for plants with an LTOP System arming temperature at or near the MODE 3 boundary temperature of [350]&deg;F. LCO 3.4.12 requires that certain components be de-activated at and below the LTOP System arming temperature. When this temperature is at or near the MODE 3 boundary temperature, time is needed to restore the systems to OPERABLE status.
APPLICABILITY      In MODES 1, 2, and 3, the ECCS train OPERABILITY requirements for the limiting Design Basis Accident, a large break LOCA, are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. The HPI pump performance Babcock & Wilcox STS                   B 3.5.2-4                                       Rev. 5.0

ECCS - Operating B 3.5.2 BASES APPLICABILITY (continued) is based on the small break LOCA, which establishes the pump performance curve and is less dependent on power. The HPI pump performance requirements are based on a small break LOCA. MODES 2 and 3 requirements are bounded by the MODE 1 analysis.
In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops -
MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level."
ACTIONS            A.1 With one LPI subsystem inoperable, action must be taken to restore it to OPERABLE status within 7 days [or in accordance with the Risk Informed Completion Time Program]. In this condition, the remaining OPERABLE ECCS train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure to the remaining LPI subsystem could result in loss of ECCS function. The [7] day Completion Time is reasonable to perform corrective maintenance on the inoperable LPI subsystem. The [7] day Completion Time is based on the findings of the deterministic and probabilistic analysis in Reference 3.
Reference 3 concluded that extending the Completion Time to [7] days for an inoperable LPI subsystem proves plant operational flexibility while simultaneously reducing overall plant risk. This is because the risks incurred by having the LPI subsystem unavailable for a longer time at power will be substantially offset by the benefits associated with avoiding unnecessary plant transitions and by reducing risk during plant shutdown operations.
B.1 With one or more trains operable and at least 100% of the injection flow equivalent to a single OPERABLE ECCS train available, components inoperable for reasons other than Condition A must be returned to OPERABLE status within 72 hours [or in accordance with the Risk Informed Completion Time Program]. The 72 hour Completion Time is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.
An ECCS train is inoperable if it is not capable of delivering the design flow to the RCS.
Babcock & Wilcox STS                   B 3.5.2-5                                         Rev. 5.0

ECCS - Operating B 3.5.2 BASES ACTIONS (continued)
The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. This allows increased flexibility in plant operations under circumstances when components in opposite trains are inoperable.
An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref. 4) has shown the risk of having one full ECCS train inoperable to be sufficiently low to justify continued operation for 72 hours.
With one or more components inoperable such that 100% of the flow equivalent to a single OPERABLE ECCS train is not available, the facility is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be immediately entered.
C.1 and C.2 If the inoperable components cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and at least MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1 Condition A is applicable with one or more trains inoperable. The allowed Completion Time is based on the assumption that at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train is available.
With less than 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the facility is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.
Babcock & Wilcox STS                   B 3.5.2-6                                         Rev. 5.0

ECCS - Operating B 3.5.2 BASES SURVEILLANCE       SR 3.5.2.1 REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained. Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removal of power or by key locking the control in the correct position ensures that the valves cannot change position as the result of an active failure. These valves are of the type described in Reference 5, which can disable the function of both ECCS trains and invalidate the accident analyses. [ The 12 hour Frequency is considered reasonable in view of other administrative controls that will ensure the unlikelihood of a mispositioned valve.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.5.2.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. [ The 31 day Frequency is appropriate because the valves are operated under administrative control, and an inoperable valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                      B 3.5.2-7                                                       Rev. 5.0

ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
SR 3.5.2.3 ECCS piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the ECCS and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of ECCS locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The ECCS is OPERABLE when it is sufficiently filled with water.
Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump),
the Surveillance is not met. If the accumulated gas is eliminated or brought within the acceptance criteria limits during performance of the Surveillance, the Surveillance is met and past system OPERABILITY is evaluated under the Corrective Action Program. If it is determined by Babcock & Wilcox STS                      B 3.5.2-8                                                       Rev. 5.0

ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued) subsequent evaluation that the ECCS is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
ECCS locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety.
For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location.
Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
[ The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the ECCS piping and the existence of procedural controls governing system operation.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.5.2.4 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the ASME Code (Ref. 6). This type of testing may be accomplished by measuring the pump's developed head at only Babcock & Wilcox STS                      B 3.5.2-9                                                       Rev. 5.0

ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued) one point of the pump's characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the plant accident analysis. SRs are specified in the INSERVICE TESTING PROGRAM of the ASME Code. The ASME Code provides the activities and Frequencies necessary to satisfy the requirements.
SR 3.5.2.5 and SR 3.5.2.6 These SRs demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated ESFAS signal and that each ECCS pump starts on receipt of an actual or simulated ESFAS signal.
This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. [ The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
The actuation logic is tested as part of the ESFAS testing, and equipment performance is monitored as part of the INSERVICE TESTING PROGRAM.
SR 3.5.2.7 This Surveillance ensures that these valves are in the proper position to prevent the HPI pump from exceeding its runout limit. [ This 18 month Frequency is based on the same reasons as those stated for SR 3.5.2.5 and SR 3.5.2.6.
Babcock & Wilcox STS                      B 3.5.2-10                                                      Rev. 5.0

ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.5.2.8 This Surveillance ensures that the flow controllers for the LPI throttle valves will automatically control the LPI train flow rate in the desired range and prevent LPI pump runout as RCS pressure decreases after a LOCA. [ The 18 month Frequency is justified by the same reasons as those stated for SR 3.5.2.5 and SR 3.5.2.6.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 50.46.
: 2. FSAR, Section [6.3].
: 3. BAW-2295-A, Revision 1, Justification for Extension of Allowed Outage Time for Low Pressure Injection and Reactor Building Spray System.
: 4. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components,"
December 1, 1975.
Babcock & Wilcox STS                      B 3.5.2-11                                                      Rev. 5.0

ECCS - Operating B 3.5.2 BASES REFERENCES (continued)
: 5. IE Information Notice 87-01, "RHR Valve Misalignment Causes Degradation of ECCS in PWRs," January 6, 1987.
: 6. ASME Code for Operation and Maintenance of Nuclear Power Plants.
Babcock & Wilcox STS               B 3.5.2-12                                  Rev. 5.0

ECCS - Shutdown B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
B 3.5.3 ECCS - Shutdown BASES BACKGROUND          The Background section for Bases B 3.5.2, "ECCS - Operating," is applicable to these Bases, with the following modifications.
In MODE 4, the required ECCS train consists of two separate subsystems: high pressure injection (HPI) and low pressure injection (LPI), each consisting of two redundant, 100% capacity trains.
The ECCS flow paths consist of piping, valves, heat exchangers, and pumps, such that water from the borated water storage tank (BWST) and the containment sump can be injected into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2.
APPLICABLE          The Applicable Safety Analyses section of Bases 3.5.2 is applicable to SAFETY              these Bases.
ANALYSES Due to the stable conditions associated with operation in MODE 4 and the reduced probability of occurrence of a Design Basis Accident (DBA), the ECCS operational requirements are reduced. Included in these reductions is that certain automatic Engineered Safety Feature Actuation System (ESFAS) actuation is not available. In this MODE sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.
Only one ECCS train is required for MODE 4. This requirement dictates that single failures are not considered during this MODE. The ECCS train
                    - shutdown satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                 In MODE 4, one of the two independent (and redundant) ECCS trains is required to ensure sufficient ECCS flow is available to the core following a DBA.
In MODE 4, an ECCS train consists of an HPI subsystem and an LPI subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST and transferring suction to the containment sump.
During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the BWST to the RCS, via the ECCS pumps and their respective supply headers, to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to supply its flow to the RCS hot and cold legs. Management of gas voids is important to ECCS OPERABILITY.
Babcock & Wilcox STS                   B 3.5.3-1                                        Rev. 5.0

ECCS - Shutdown B 3.5.3 BASES LCO (continued)
This LCO is modified by two Notes. The first allows a DHR train to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the DHR mode during MODE 4. The second Note states that HPI actuation may be deactivated in accordance with LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System." Operator action is then required to initiate HPI. In the event of a loss of coolant accident (LOCA) requiring HPI actuation, the time required for operator action has been shown by analysis to be acceptable.
APPLICABILITY      In MODES 1, 2, and 3, the OPERABILITY requirements for the ECCS are covered by LCO 3.5.2.
In MODE 4 with the RCS temperature below 280&deg;F, one OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity condition of the reactor and the limited core cooling requirements.
In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops -
MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "DHR and Coolant Circulation - High Water Level," and LCO 3.9.5, "DHR and Coolant Circulation - Low Water Level."
ACTIONS            A Note prohibits the application of LCO 3.0.4.b to inoperable ECCS DHR loops when entering MODE 4 from MODE 5. There is an increased risk associated with entering MODE 4 from MODE 5 with DHR inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
Babcock & Wilcox STS                  B 3.5.3-2                                          Rev. 5.0

ECCS - Shutdown B 3.5.3 BASES ACTIONS (continued)
A.1 If no LPI subsystem train is OPERABLE, the unit is not prepared to respond to a LOCA or to continue cooldown using the LPI pumps and decay heat exchangers. The Completion Time of immediately, which would initiate action to restore at least one ECCS LPI subsystem to OPERABLE status, ensures that prompt action is taken to restore the required cooling capacity. Normally, in MODE 4, reactor decay heat must be removed by an LPI train operating with suction from the RCS. If no LPI train is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generator(s). The alternate means of heat removal must continue until the inoperable ECCS LPI subsystem can be restored to operation so that continuation of decay heat removal (DHR) is provided.
With both DHR pumps and heat exchangers inoperable, it would be unwise to require the plant to go to MODE 5, where the only available heat removal system is the LPI trains operating in the DHR mode.
Therefore, the appropriate action is to initiate measures to restore one ECCS LPI subsystem and to continue the actions until the subsystem is restored to OPERABLE status.
B.1 If no ECCS HPI subsystem is OPERABLE, due to the inoperability of the HPI pump or flow path from the BWST, the plant is not prepared to provide high pressure response to Design Basis Events requiring ESFAS.
The 1 hour Completion Time to restore at least one ECCS HPI subsystem to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the plant in MODE 5, where an ECCS train is not required.
C.1 When the Required Action of Condition B cannot be completed within the required Completion Time, a controlled shutdown should be initiated. The allowed Completion Time of 24 hours is reasonable, based on operating experience, to reach MODE 5 from full power conditions in an orderly manner and without challenging plant systems.
Babcock & Wilcox STS                  B 3.5.3-3                                           Rev. 5.0

ECCS - Shutdown B 3.5.3 BASES SURVEILLANCE       SR 3.5.3.1 REQUIREMENTS The applicable Surveillance descriptions from Bases 3.5.2 apply.
REFERENCES         The applicable references from Bases 3.5.2 apply.
Babcock & Wilcox STS                B 3.5.3-4                                       Rev. 5.0

BWST B 3.5.4 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
B 3.5.4 Borated Water Storage Tank (BWST)
BASES BACKGROUND          The BWST supports the ECCS and the Containment Spray System by providing a source of borated water for ECCS and containment spray pump operation. In addition, the BWST supplies borated water to the refueling pool for refueling operations.
The BWST supplies two ECCS trains, each by a separate, redundant supply header. Each header also supplies one train of the Containment Spray System. A normally open, motor operated isolation valve is provided in each header to allow the operator to isolate the BWST from the ECCS after the ECCS pump suction has been transferred to the containment sump following depletion of the BWST during a loss of coolant accident (LOCA). Use of a single BWST to supply both ECCS trains is acceptable because the BWST is a passive component, and passive failures are not assumed in the analysis of Design Basis Events (DBEs) to occur coincidentally with the Design Basis Accident (DBA).
The ECCS and containment spray pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at shutoff head conditions.
This LCO ensures that:
: a. The BWST contains sufficient borated water to support the ECCS during the injection phase,
: b. Sufficient water volume exists in the containment sump to support continued operation of the ECCS and containment spray pumps at the time of transfer to the recirculation mode of cooling, and
: c. The reactor remains subcritical following a LOCA.
Insufficient water inventory in the BWST could result in insufficient cooling capacity of the ECCS when the transfer to the recirculation mode occurs.
Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following a LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside containment.
Babcock & Wilcox STS                   B 3.5.4-1                                        Rev. 5.0

BWST B 3.5.4 BASES APPLICABLE         During accident conditions, the BWST provides a source of borated SAFETY             water to the high pressure injection (HPI), low pressure injection (LPI),
ANALYSES           and containment spray pumps. As such, it provides containment cooling and depressurization, core cooling, and replacement inventory and is a source of negative reactivity for reactor shutdown. The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of Specifications B 3.5.2, "ECCS - Operating," and B 3.6.6, "Containment Spray and Cooling Systems." These analyses are used to assess changes to the BWST in order to evaluate their effects in relation to the acceptance limits.
The limits on volume of [ 415,200 gallons and  449,000 gallons] are based on several factors. Sufficient deliverable volume must be available to provide at least 20 minutes of full flow of all ECCS pumps prior to the transfer to the containment sump for recirculation. Twenty minutes gives the operator adequate time to prepare for switchover to containment sump recirculation.
A second factor that affects the minimum required BWST volume is the ability to support continued ECCS pump operation after the manual transfer to recirculation occurs. When ECCS pump suction is transferred to the sump, there must be sufficient water in the sump to ensure adequate net positive suction head (NPSH) for the LPI and containment spray pumps. This NPSH calculation is described in the FSAR (Ref. 1),
and the amount of water that enters the sump from the BWST and other sources is one of the input assumptions. Since the BWST is the main source that contributes to the amount of water in the sump following a LOCA, the calculation does not take credit for more than the minimum volume of usable water from the BWST.
The third factor is that the volume of water in the BWST must be within a range that will ensure the solution in the sump following a LOCA is within a specified pH range that will minimize the evolution of iodine and the effect of chloride and caustic stress corrosion cracking on the mechanical systems and components.
The volume range ensures that refueling requirements are met and that the capacity of the BWST is not exceeded. Note that the volume limits refer to total, rather than usable, volume required to be in the BWST; a certain amount of water is unusable because of tank discharge line location or other physical characteristics.
The [2270] ppm limit for minimum boron concentration was established to ensure that, following a LOCA, with a minimum BWST level, the reactor will remain subcritical in the cold condition following mixing of the BWST and Reactor Coolant System (RCS) water volumes. Large break LOCAs assume that all control rods remain withdrawn from the core.
Babcock & Wilcox STS                   B 3.5.4-2                                         Rev. 5.0

BWST B 3.5.4 BASES APPLICABLE SAFETY ANALYSES (continued)
The minimum and maximum concentration limits both ensure that the solution in the sump following a LOCA is within a specified pH range that will minimize the evolution of iodine and the effect of chloride and caustic stress corrosion cracking on the mechanical systems and components.
The [2450] ppm maximum limit for boron concentration in the BWST is also based on the potential for boron precipitation in the core during the long term cooling period following a LOCA. For a cold leg break, the core dissipates heat by pool nucleate boiling. Because of this boiling phenomenon in the core, the boric acid concentration will increase in this region. If allowed to proceed in this manner, a point may be reached where boron precipitation will occur in the core. Post LOCA emergency procedures direct the operator to establish dilution flow paths in the LPI System to prevent this condition by establishing a forced flow path through the core regardless of break location. These procedures are based on the minimum time in which precipitation could occur, assuming that maximum boron concentrations exist in the borated water sources used for injection following a LOCA.
Boron concentrations in the BWST in excess of the limit could result in precipitation earlier than assumed in the analysis.
The 40&deg;F lower limit on the temperature of the solution in the BWST was established to ensure that the solution will not freeze. This temperature also helps prevent boron precipitation and ensures that water injection in the reactor vessel will not be colder than the lowest temperature assumed in reactor vessel stress analysis. The [100]&deg;F upper limit on the temperature of the BWST contents is consistent with the maximum injection water temperature assumed in the LOCA analysis.
The numerical values of the parameters stated in the SR are actual values and do not include allowance for instrument errors.
The BWST satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The BWST exists to ensure that an adequate supply of borated water is available to cool and depressurize the containment in the event of a DBA; to cool and cover the core in the event of a LOCA, thereby ensuring the reactor remains subcritical following a DBA; and to ensure an adequate level exists in the containment sump to support ECCS and containment spray pump operation in the recirculation MODE. To be considered OPERABLE, the BWST must meet the limits for water volume, boron concentration, and temperature established in the SRs.
Babcock & Wilcox STS                   B 3.5.4-3                                        Rev. 5.0

BWST B 3.5.4 BASES APPLICABILITY      In MODES 1, 2, 3, and 4, the BWST OPERABILITY requirements are dictated by the ECCS and Containment Spray System OPERABILITY requirements. Since both the ECCS and Containment Spray System must be OPERABLE in MODES 1, 2, 3, and 4, the BWST must be OPERABLE to support their operation.
Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops -
MODE 5, Loops Not Filled," respectively. MODE 6 core cooling requirements are addressed by LCO 3.9.4, "DHR and Coolant Circulation
                   - High Water Level," and LCO 3.9.5, "DHR and Coolant Circulation - Low Water Level."
ACTIONS            A.1 With the BWST boron concentration not within limits, the condition must be corrected within 8 hours. In this condition, neither the ECCS nor the Reactor Building Spray System can perform its design functions.
Therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the plant in a MODE in which overall plant risk is minimized. The 8 hour limit to restore the boron concentration to within limits was developed considering the time required to change boron concentration and assuming that the contents of the tank are still available for injection.
B.1 and B.2 If the BWST boron concentration is not restored to within limits within the associated Completion Time, the plant must be brought to MODE 3 within 6 hours and MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. Reference 2 demonstrated that it is acceptable to remain in MODE 4 in this condition because the boron concentration limit is based on MODE 1 events and there is additional SHUTDOWN MARGIN available for events initiated in MODE 4.
Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the Babcock & Wilcox STS                  B 3.5.4-4                                        Rev. 5.0

BWST B 3.5.4 BASES ACTIONS (continued) results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
C.1 With BWST water temperature not within limits, it must be returned to within limits within 8 hours. If the temperature is not within limits, the ECCS and containment spray systems may not be able to perform their respective design functions; therefore, prompt action must be taken to restore the tank to OPERABLE status. The allowed Completion Time of 8 hours to restore the BWST water temperature to within limits was developed considering the time required to change water temperature and that the contents of the tank are still available for injection.
D.1 With the BWST inoperable for reasons other than Condition A or C (e.g.,
water volume), levels must be restored to within required limits within 1 hour. In this condition, neither the ECCS nor the Containment Spray System can perform its design functions. Therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the plant in a MODE in which the BWST is not required. The allowed Completion Time of 1 hour to restore the BWST to OPERABLE status is based on this condition simultaneously affecting multiple redundant trains.
E.1 and E.2 If the BWST cannot be restored to OPERABLE status within the associated Completion Times of Condition C or D, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Babcock & Wilcox STS                   B 3.5.4-5                                          Rev. 5.0

BWST B 3.5.4 BASES SURVEILLANCE       SR 3.5.4.1 REQUIREMENTS Verification that the BWST water temperature is within the specified temperature band ensures that the boron will not precipitate; the fluid will not freeze; the fluid temperature entering the reactor vessel will not be colder than assumed in the reactor vessel stress analysis; and the fluid temperature entering the reactor vessel will not be hotter than assumed in the LOCA analysis. [ The 24 hour Frequency is sufficient to identify a temperature change that would approach either temperature limit and has been shown to be acceptable through operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
The SR is modified by a Note that requires the Surveillance to be performed only when ambient air temperatures are outside the operating temperature limits of the BWST. With ambient temperatures within this band, the BWST temperature should not exceed the limits.
SR 3.5.4.2 Verification that the BWST contained volume is within the required range ensures that a sufficient initial supply is available for injection and to support continued ECCS pump operation on recirculation. [ Since the BWST volume is normally stable and provided with a low level alarm, a 7 day Frequency has been shown to be appropriate through operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                      B 3.5.4-6                                                       Rev. 5.0

BWST B 3.5.4 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.5.4.3 Verification that the boron concentration of the BWST fluid is within the required band ensures that the reactor will remain subcritical following a LOCA. [ Since the BWST volume is normally stable, a 7 day sampling Frequency is appropriate and has been shown to be acceptable through operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Section [6.1].
: 2. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                      B 3.5.4-7                                                       Rev. 5.0

Containment B 3.6.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment BASES BACKGROUND          The containment consists of the concrete reactor building (RB), its steel liner, and the penetrations through this structure. The structure is designed to contain radioactive material that may be released from the reactor core following a design basis loss of coolant accident (LOCA).
Additionally, this structure provides shielding from the fission products that may be present in the containment atmosphere following accident conditions.
The containment is a reinforced concrete structure with a cylindrical wall, a flat foundation mat, and a shallow dome roof. For containments with ungrouted tendons, the cylinder wall is prestressed with a post tensioning system in the vertical and horizontal directions, and the dome roof is prestressed using a three way post tensioning system. The inside surface of the containment is lined with a carbon steel liner to ensure a high degree of leak tightness during operating and accident conditions.
The concrete RB is required for structural integrity of the containment under Design Basis Accident (DBA) conditions. The steel liner and its penetrations establish the leakage limiting boundary of the containment.
Maintaining the containment OPERABLE limits the leakage of fission product radioactivity from the containment to the environment. SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, Appendix J, Option
[A][B] (Ref. 1), as modified by approved exemptions.
The isolation devices for the penetrations in the containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:
: a. All penetrations required to be closed during accident conditions are either:
: 1. Capable of being closed by an OPERABLE automatic containment isolation system or
: 2. Closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.3, "Containment Isolation Valves,"
: b. Each air lock is OPERABLE, except as provided in LCO 3.6.2, "Containment Air Locks,"
Babcock & Wilcox STS                    B 3.6.1-1                                        Rev. 5.0

Containment B 3.6.1 BASES BACKGROUND (continued)
: c. All equipment hatches are closed, and
[ d. The pressurized sealing mechanism associated with each penetration, except as provided in LCO 3.6.[ ] , is OPERABLE. ]
APPLICABLE         The safety design basis for the containment is that the containment must SAFETY             withstand the pressures and temperatures of the limiting DBA without ANALYSES           exceeding the design leakage rate.
The DBAs that result in a challenge to containment OPERABILITY from high pressures and temperatures are a LOCA, a steam line break, and a rod ejection accident (REA) (Ref. 2). In addition, release of significant fission product radioactivity within containment can occur from a LOCA or REA. In the DBA analyses, it is assumed that the containment is OPERABLE such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of [0.25]% of containment air weight per day (Ref. 3). This leakage rate, used in the evaluation of offsite doses resulting from accidents, is defined in 10 CFR 50, Appendix J, Option [A][B] (Ref. 1), as La: the maximum allowable leakage rate at the calculated maximum peak containment pressure (Pa) resulting from the limiting design basis LOCA.
The allowable leakage rate represented by La forms the basis for the acceptance criteria imposed on all containment leakage rate testing. La is assumed to be [0.25]% per day in the safety analysis at Pa = [53.9] psig (Ref. 3).
Satisfactory leakage rate test results are a requirement for the establishment of containment OPERABILITY.
The containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                Containment OPERABILITY is maintained by limiting leakage to  1.0 La, except prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test. At this time the applicable leakage limits must be met.
Compliance with this LCO will ensure a containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.
Babcock & Wilcox STS                   B 3.6.1-2                                        Rev. 5.0

Containment B 3.6.1 BASES LCO (continued)
Individual leakage rates specified for the containment air lock (LCO 3.6.2)
[and purge valves with resilient seals (LCO 3.6.3)] are not specifically part of the acceptance criteria of 10 CFR 50, Appendix J. Therefore, leakage rates exceeding these individual limits only result in the containment being inoperable when the leakage results in exceeding the overall acceptance criteria of 1.0 La.
APPLICABILITY      In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, containment is not required to be OPERABLE in MODE 5 to prevent leakage of radioactive material from containment. The requirements for containment during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
ACTIONS            A.1 In the event containment is inoperable, containment must be restored to OPERABLE status within 1 hour. The 1 hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining containment during MODES 1, 2, 3, and 4. This time period also ensures the probability of an accident (requiring containment OPERABILITY) occurring during periods when containment is inoperable is minimal.
B.1 and B.2 If containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Babcock & Wilcox STS                  B 3.6.1-3                                        Rev. 5.0

Containment B 3.6.1 BASES SURVEILLANCE         SR 3.6.1.1 REQUIREMENTS Maintaining the containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Containment Leakage Rate Testing Program. The containment concrete visual examinations may be performed during either power operation, e.g., performed concurrently with other containment inspection-related activities such as tendon testing, or during a maintenance or refueling outage. The visual examinations of the steel liner plate inside containment are performed during maintenance or refueling outages since this is the only time the liner plate is fully accessible.
Failure to meet air lock and purge valve with resilient seal leakage limits specified in LCO 3.6.2 and LCO 3.6.3 does not invalidate the acceptability of these overall leakage determinations unless their contribution to overall Type A, B, and C leakage causes that to exceed limits. As left leakage prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test is required to be < 0.6 La for combined Type B and C leakage, and [< 0.75 La for Option A] [ 0.75 La for Option B] for overall Type A leakage. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of  1.0 La. At  1.0 La the offsite dose consequences are bounded by the assumptions of the safety analysis. SR Frequencies are as required by the Containment Leakage Rate Testing Program. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.
SR Frequencies are as required by the Containment Leakage Rate Testing Program. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Regulatory Guide 1.163 and NEI 94-01 include acceptance criteria for as-left and as-found Type A leakage rates and combined Type B and C leakage rates, which may be reflected in the Bases.
[ SR 3.6.1.2 For ungrouted, post tensioned tendons, this SR ensures that the structural integrity of the containment will be maintained in accordance with the provisions of the Containment Tendon Surveillance Program.
Testing and Frequency are in accordance with the ASME Code, Section XI, Subsection IWL (Ref. 4), and applicable addenda as required by 10 CFR 50.55a. ]
Babcock & Wilcox STS                        B 3.6.1-4                                                       Rev. 5.0

Containment B 3.6.1 BASES REFERENCES         1. 10 CFR 50, Appendix J, Option [A][B].
: 2. FSAR, Sections [14.1 and 14.2].
: 3. FSAR, Section [5.6].
: 4. ASME Code, Section XI, Subsection IWL.
Babcock & Wilcox STS              B 3.6.1-5                     Rev. 5.0

Containment Air Locks B 3.6.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.2 Containment Air Locks BASES BACKGROUND          Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation.
Each air lock is nominally a right circular cylinder, 10 ft in diameter, with a door at each end. The doors are interlocked to prevent simultaneous opening. During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary. Each air lock door has been designed and is tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. As such, closure of a single door supports containment OPERABILITY. Each of the doors contains double gasketed seals and local leakage rate testing capability to ensure pressure integrity. To effect a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in containment internal pressure results in increased sealing force on each door).
Each personnel air lock door is provided with limit switches that provide control room indication of door position. Additionally, control room indication is provided to alert the operator whenever an air lock door interlock mechanism is defeated.
The containment air locks form part of the containment pressure boundary. As such, air lock integrity and leak tightness is essential for maintaining the containment leakage rate within limit in the event of a DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analysis.
APPLICABLE          The DBAs that result in a release of radioactive material within SAFETY              containment are a loss of coolant accident (LOCA), a steam line break, ANALYSES            and a rod ejection accident (Ref. 2). In the analysis of each of these accidents, it is assumed that containment is OPERABLE such that release of fission products to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of [0.25]% of containment air weight per day (Ref. 3). This leakage rate is defined in 10 CFR 50, Appendix J, Option A (Ref. 1), as La: the maximum allowable containment leakage rate at the calculated maximum peak containment pressure (Pa) following a design basis LOCA. This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air lock. La is [0.25]% per day and Pa is [53.9] psig, resulting from the limiting design basis LOCA.
Babcock & Wilcox STS                   B 3.6.2-1                                          Rev. 5.0

Containment Air Locks B 3.6.2 BASES APPLICABLE SAFETY ANALYSES (continued)
The containment air locks satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                Each containment air lock forms part of the containment pressure boundary. As a part of the containment pressure boundary, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.
Each air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of containment does not exist when containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into or exit from containment.
APPLICABILITY      In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment air locks are not required in MODE 5 to prevent leakage of radioactive material from containment. The requirements for the containment air locks during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
ACTIONS            The ACTIONS are modified by a Note that allows entry and exit to perform repairs on the affected air lock component. If the outer door is inoperable, then it may be easily accessed for most repairs. It is preferred that the air lock be accessed from inside primary containment by entering through the other OPERABLE air lock. However, if this not practicable, or if repairs on either door must be performed from the barrel side of the door then it is permissible to enter the air lock through the OPERABLE door, which means there is a short time during which the containment boundary is not intact (during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit the OPERABLE door must be immediately closed. If ALARA conditions permit, entry and exit should be via an OPERABLE air lock.
Babcock & Wilcox STS                   B 3.6.2-2                                         Rev. 5.0

Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each air lock. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable air lock. Complying with the Required Actions may allow for continued operation, and a subsequent inoperable air lock is governed by subsequent Condition entry and application of associated Required Actions.
In the event the air lock leakage results in exceeding the overall containment leakage rate, Note 3 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1, "Containment."
A.1, A.2, and A.3 With one air lock door inoperable in one or more containment air locks, the OPERABLE door must be verified closed (Required Action A.1) in each affected containment air lock.
This ensures that a leak tight containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour. This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires containment be restored to OPERABLE status within 1 hour.
In addition, the affected air lock penetration must be isolated by locking closed the remaining OPERABLE air lock door within the 24 hour Completion Time. The 24 hour Completion Time is considered reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed.
Required Action A.3 verifies that an air lock with an inoperable door has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
Babcock & Wilcox STS                   B 3.6.2-3                                        Rev. 5.0

Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
The Required Actions have been modified by two Notes. Note 1 clarifies that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable.
With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls if both air locks have an inoperable door. This 7 day restriction begins when the second air lock is discovered inoperable. Containment entry may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS-required activities) if the containment was entered, using the inoperable air lock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time that the OPERABLE door is expected to be open.
B.1, B.2, and B.3 With an air lock interlock mechanism inoperable in one or more air locks, the Required Actions and associated Completion Times are consistent with those specified in Condition A.
The Required Actions have been modified by two Notes. Note 1 clarifies that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable.
With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from the containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock).
Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
Babcock & Wilcox STS                   B 3.6.2-4                                         Rev. 5.0

Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
C.1, C.2, and C.3 With one or more air locks inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be immediately initiated to evaluate previous combined leakage rates using current air lock test results. An evaluation is acceptable since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour (per LCO 3.6.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.
Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed. This action must be completed within the 1 hour Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour.
Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour Completion Time [or in accordance with the Risk Informed Completion Time Program]. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status assuming that at least one door is maintained closed in each affected air lock.
D.1 and D.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 4). The release of stored energy to the Reactor Building in the event of an accident in MODE 4 is substantially less than the energy release assumed due to an accident at power. Therefore, the challenge to containment air locks is substantially reduced. Because of the reduction in Reactor Coolant System (RCS) pressure and temperature in MODE 4, the likelihood of an event is also reduced. In addition, there are more Babcock & Wilcox STS                   B 3.6.2-5                                          Rev. 5.0

Containment Air Locks B 3.6.2 BASES ACTIONS (continued) accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5.
However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action D.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and containment OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is required by the Containment Leakage Rate Testing Program.
The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable, since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR requiring the results to be evaluated against the acceptance criteria which is applicable to SR 3.6.1.1. This ensures that air lock leakage is properly accounted for in determining the combined Type B and C containment leakage rate.
Babcock & Wilcox STS                  B 3.6.2-6                                          Rev. 5.0

Containment Air Locks B 3.6.2 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.6.2.2 The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident containment pressure, closure of either door will support containment OPERABILITY. Thus, the door interlock feature supports containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous opening of the inner and outer doors will not inadvertently occur. [ Due to the purely mechanical nature of this interlock, and given that the interlock mechanism is not normally challenged when the containment air lock door is used for entry and exit (procedures require strict adherence to single door opening), this test is only required to be performed every 24 months. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage, and the potential for loss of containment OPERABILITY if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed at the 24 month Frequency. The 24 month Frequency is based on engineering judgment and is considered adequate given that the interlock is not challenged during the use of the airlock.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 50, Appendix J, Option [A][B].
: 2. FSAR, Sections [14.1 and 14.2].
: 3. FSAR, Section [5.6].
: 4. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                      B 3.6.2-7                                                       Rev. 5.0

Containment Isolation Valves B 3.6.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASES BACKGROUND           The containment isolation valves form part of the containment pressure boundary and provide a means for fluid penetrations not serving accident consequence limiting systems to be provided with two isolation barriers that are closed on an automatic isolation signal. These isolation devices consist of either passive devices or active (automatic) devices. Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Check valves, or other automatic valves designed to close following an accident without operator action, are considered active devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system. These barriers (typically containment isolation valves) make up the Containment Isolation System.
Containment isolation occurs upon receipt of a high containment pressure or diverse containment isolation signal. The containment isolation signal closes automatic containment isolation valves in fluid penetrations not required for operation of engineered safeguard systems to prevent leakage of radioactive material. Upon actuation of high pressure injection, automatic containment valves also isolate systems not required for containment or Reactor Coolant System (RCS) heat removal. Other penetrations are isolated by the use of valves in the closed position or blind flanges. As a result, the containment isolation valves (and blind flanges) help ensure that the containment atmosphere will be isolated in the event of a release of radioactive material to containment atmosphere from the RCS following a Design Basis Accident (DBA).
OPERABILITY of the containment isolation valves (and blind flanges) supports containment OPERABILITY during accident conditions.
The OPERABILITY requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed in the safety analysis. Therefore, the OPERABILITY requirements provide assurance that the containment function assumed in the safety analysis will be maintained.
The Reactor Building Purge System is part of the Reactor Building Ventilation System. The Purge System was designed for intermittent operation, providing a means of removing airborne radioactivity caused by minor leakage from the RCS prior to personnel entry into containment.
The Containment Purge System consists of one [48] inch line for exhaust Babcock & Wilcox STS                    B 3.6.3-1                                        Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES BACKGROUND (continued) and one [48] inch line for supply, with supply and exhaust fans capable of purging the containment atmosphere at a rate of approximately [50,000]
ft3/min. This flow rate is sufficient to reduce the airborne radioactivity level within containment to levels defined in 10 CFR 20 (Ref. 1) for a 40 hour workweek within 2 hours of purge initiation during reactor operation. The containment purge supply and exhaust lines each contain two isolation valves that receive an isolation signal on a unit vent high radiation condition.
Failure of the purge valves to close following a design basis event would cause a significant increase in the radioactive release because of the large containment leakage path introduced by these [48] inch purge lines.
Failure of the purge valves to close would result in leakage considerably in excess of the containment design leakage rate of [0.25]% of containment air weight per day (La) (Ref. 2). Because of their large size, the [48] inch purge valves in some units are not qualified for automatic closure from their open position under DBA conditions. Therefore, the
[48] inch purge valves are maintained sealed closed (SR 3.6.3.1) in MODES 1, 2, 3, and 4 to ensure the containment boundary is maintained.
The [8 inch] containment minipurge valves operate to:
: a. Reduce the concentration of noble gases within containment prior to and during personnel access and
: b. Equalize internal and external pressures.
Since the minipurge valves are designed to meet the requirements for automatic containment isolation valves, these valves may be opened as needed in MODES 1, 2, 3, and 4.
APPLICABLE         The containment isolation valve LCO was derived from the assumptions SAFETY             related to minimizing the loss of reactor coolant inventory and ANALYSES           establishing containment boundary during major accidents. As part of the containment boundary, containment isolation valve OPERABILITY supports leak tightness of the containment. Therefore, the safety analysis of any event requiring isolation of containment is applicable to this LCO.
The DBAs that result in a release of radioactive material within containment are a loss of coolant accident (LOCA), a main steam line break, and a rod ejection accident (Ref. 3). In the analysis for each of these accidents, it is assumed that containment isolation valves are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment Babcock & Wilcox STS                  B 3.6.3-2                                          Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES APPLICABLE SAFETY ANALYSES (continued) through containment isolation valves (including containment purge valves) are minimized. The safety analysis assumes that the [48] inch purge valves are closed at event initiation.
The DBA analysis assumes that, within 60 seconds after the accident, isolation of the containment is complete and leakage terminated except for the design leakage rate, La. The containment isolation total response time of 60 seconds includes signal delay, diesel generator startup (for loss of offsite power), and containment isolation valve stroke times.
The single-failure criterion required to be imposed in the conduct of unit safety analyses was considered in the original design of the containment purge valves. Two valves in a series on each purge line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred. The inboard and outboard isolation valves on each line are provided with diverse power sources, motor operated and pneumatically operated spring closed, respectively. This arrangement was designed to preclude common mode failures from disabling both valves on a purge line.
The purge valves may be unable to close in the environment following a LOCA. Therefore, each of the purge valves is required to remain sealed closed during MODES 1, 2, 3, and 4. In this case, the single-failure criterion remains applicable to the containment purge valves because of failure in the control circuit associated with each valve. Again, the purge system valve design prevents a single failure from compromising the containment boundary as long as the system is operated in accordance with the subject LCO.
The containment isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                Containment isolation valves form a part of the containment boundary.
The containment isolation valve safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during a DBA.
The automatic power operated isolation valves are required to have isolation times within limits and to actuate on an automatic isolation signal. The [48] inch purge valves must be maintained sealed closed [or have blocks installed to prevent full opening]. [Blocked purge valves also actuate on an automatic signal.] The valves covered by this LCO are listed along with their associated stroke times in the FSAR (Ref. 4).
Babcock & Wilcox STS                   B 3.6.3-3                                        Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES LCO (continued)
The normally closed isolation valves are considered OPERABLE when manual valves are closed, check valves have flow through the valve secured, blind flanges are in place, and closed systems are intact. These passive isolation valves/devices are those listed in Reference 5.
Purge valves with resilient seals must meet additional leakage rate requirements. The other containment isolation valve leakage rates are addressed by LCO 3.6.1, "Containment," as Type C testing.
This LCO provides assurance that the containment isolation valves and purge valves will perform their designated safety functions to minimize the loss of reactor coolant inventory and establish the containment boundary during accidents.
APPLICABILITY      In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment isolation valves are not required to be OPERABLE in MODE 5. The requirements for containment isolation valves during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
ACTIONS            The ACTIONS are modified by a Note allowing penetration flow paths, except for [48] inch purge valve penetration flow paths, to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated. Due to the size of the containment purge line penetration and the fact that those penetrations exhaust directly from the containment atmosphere to the environment, the penetration flow paths containing these valves may not be opened under administrative controls. A single purge valve in a penetration flow path may be opened to effect repairs to an inoperable valve, as allowed by SR 3.6.3.1.
A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable , since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation valves are governed by subsequent Condition entry and application of associated Required Actions.
Babcock & Wilcox STS                  B 3.6.3-4                                        Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued)
The ACTIONS are further modified by a third Note, which ensures appropriate remedial actions are taken, if necessary, if the affected systems are rendered inoperable by an inoperable containment isolation valve.
In the event isolation valve leakage results in exceeding the overall containment leakage rate, Note 4 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1.
                   --------------------------------- REVIEWER'S NOTE -----------------------------------
The bracketed phrase "following isolation" in the Completion Times for Required Actions A.3, B.2, and E.2 is only applicable to plants that have adopted a Risk Informed Completion Time Program.
A.1, A.2, and A.3
                   -----------------------------------REVIEWER'S NOTE-----------------------------------
Adoption of the 7 day Completion time for Required Action A.1 requires licensees to make the following commitments:
: 1.    [LICENSEE] commits to implementing a methodology for assessing the effect on large early release frequency (LERF) and incremental conditional large early release probability (ICLERP) when utilizing the extended CIV Completion Times in the program for managing risk in accordance with 10 CFR 50.65(a)(4).
: 2.    [LICENSEE] commits to the guidance of NUMARC 93-01, "Industry Guideline for monitoring the effectiveness of maintenance at nuclear power plants," Revision [4F], Section 11, which provides guidance and details on the assessment and management of risk during maintenance.
Condition A has been modified by a Note indicating this Condition is only applicable to those penetration flow paths with two [or more] containment isolation valves. The Note also states that the Condition is not applicable to containment isolation valves in the main steam lines and [any specific penetrations identified by the plant-specific risk analysis as having high risk significance for an interfacing systems loss of coolant accident (ISLOCA), as described in Reference 6]. For penetration flow paths with only one containment isolation valve and a closed system, Condition E provides appropriate actions.
Babcock & Wilcox STS                      B 3.6.3-5                                                       Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued)
In the event one containment isolation valve in one or more penetration flow paths is inoperable, [except for purge valve leakage not within limit],
the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic containment isolation valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration isolated in accordance with Required Action A.2, the device used to isolate the penetration should be the closest available one to containment. Required Action A.2 must be completed within the 7 day Completion Time [or in accordance with the Risk Informed Completion Time Program]. The specified time period is based on an analysis of plant risk (Ref. 6).
Required Action A.1 requires a determination that the OPERABLE containment isolation valve in the affected penetration is not inoperable due to a common cause failure. If the inoperable containment isolation valve and the OPERABLE containment isolation valve in the penetration share a similar design in a feature that is related to the valve inoperability, a situation-specific verification of the OPERABLE containment isolation valve (e.g., inspection, partial stroke, functionality test, or engineering evaluation) must be performed with 4 hours.
For affected penetration flow paths that cannot be restored to OPERABLE status within the 7 day Completion Time and that have been isolated in accordance with Required Action A.2, the affected penetration flow paths must be verified to be isolated on a periodic basis. This periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days [following isolation]
for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.
Babcock & Wilcox STS                   B 3.6.3-6                                          Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued)
Required Action A.3 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows the devices to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.
B.1 and B.2 Condition B has been modified by a Note indicating this Condition is only applicable to those penetration flow paths with two [or more] containment isolation valves that are containment isolation valves in the main steam lines or are [any specific penetrations identified by the plant-specific risk analysis as having high risk significance for an interfacing systems loss of coolant accident (ISLOCA), as described in Reference 6].
In the event one containment isolation valve in one or more penetration flow paths is inoperable, [except for purge valve leakage not within limit,]
the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic containment isolation valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For a penetration isolated in accordance with Required Action B.1, the device used to isolate the penetration should be the closest available one to containment. Required Action B.1 must be completed within the 4 hour Completion Time [or in accordance with the Risk Informed Completion Time Program]. The specified time period is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.
For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour Completion Time and that have been isolated in accordance with Required Action B.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident and no longer Babcock & Wilcox STS                   B 3.6.3-7                                         Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) capable of being automatically isolated will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days [following isolation] for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.
Required Action B.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows the devices to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.
C.1 In the event one containment isolation valve in two or more penetration flow paths are inoperable, all but one of the affected containment isolation valves must be isolated within 4 hours. The 7 day Completion Time in Condition A is only applicable to a single inoperable containment isolation valve in one penetration. Therefore, all but one penetration must be isolated using a closed and de-activated automatic valve, a closed manual valve, or a blind flange within the 4 hour Completion Time.
When the affected penetration is isolated in accordance with Required Action C.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.3 or B.2, which remain in effect.
This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an Babcock & Wilcox STS                   B 3.6.3-8                                        Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative controls and the probability of their misalignment is low.
Condition C is modified by a Note indicating this Condition is only applicable to penetration flow paths with two [or more] containment isolation valves. Conditions A, B, and C of this LCO address the condition of one containment isolation valve inoperable in this type of penetration flow path.
D.1 With two [or more] containment isolation valves in one or more penetration flow paths inoperable, [except for purge valve leakage not within limit,] the affected penetration flow path must be isolated within 1 hour. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1. In the event the affected penetration is isolated in accordance with Required Action D.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.3 or B.2, which remains in effect.
This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative controls and the probability of their misalignment is low.
Condition D is modified by a Note indicating this Condition is only applicable to penetration flow paths with two [or more] containment isolation valves. Conditions A, B, and C of this LCO address the condition of one containment isolation valve inoperable in this type of penetration flow path.
E.1 and E.2 With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers Babcock & Wilcox STS                   B 3.6.3-9                                         Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. Required Action E.1 must be completed within the 72 hour Completion Time [or in accordance with the Risk Informed Completion Time Program]. The specified time period is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4. In the event the affected penetration is isolated in accordance with Required Action E.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This periodic verification is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days [following isolation]
for verifying that each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative controls and the probability of their misalignment is low.
Condition E is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. The closed system must meet the requirements of Reference 7. This Note is necessary since this Condition is written to specifically address those penetration flow paths in a closed system.
Required Action E.2 is modified by two Notes. Note 1 applies to valves and blind flanges located in high radiation areas and allows these devices to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices, once verified to be in the proper position, is small.
[ F.1, F.2, and F.3 In the event one or more containment purge valves in one or more penetration flow paths are not within the purge valve leakage limits, purge valve leakage must be restored to within limits or the affected penetration flow path must be isolated. The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single Babcock & Wilcox STS                      B 3.6.3-10                                       Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) active failure. Isolation barriers that meet this criterion are a [closed and de-activated automatic valve, closed manual valve, and blind flange]. A purge valve with resilient seals utilized to satisfy Required Action F.1 must have been demonstrated to meet the leakage requirements of SR 3.6.3.6. The specified Completion Time is reasonable, considering that one containment purge valve remains closed so that a gross breach of containment does not exist.
In accordance with Required Action F.2, this penetration flow path must be verified to be isolated on a periodic basis. The periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or valve manipulation.
Rather, it involves verification that those isolation devices outside containment and potentially capable of being mispositioned are in the correct position. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.
For the containment purge valve with resilient seal that is isolated in accordance with Required Action F.1, SR 3.6.3.6 must be performed at least once every [ ] days. This provides assurance that degradation of the resilient seal is detected and confirms that the leakage rate of the containment purge valve does not increase during the time the penetration is isolated. The normal Frequency for SR 3.6.3.6, 184 days, is based on an NRC initiative, Generic Issue B-20 (Ref. 9). Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more often. Therefore, a Frequency of once per [ ] days was chosen and has been shown acceptable based on operating experience.
Required Action F.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. ]
Babcock & Wilcox STS                  B 3.6.3-11                                          Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued)
G.1 and G.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 10). The release of stored energy to the Reactor Building in the event of an accident in MODE 4 is substantially less than the energy release assumed due to an accident at power. Therefore, the challenge to containment isolation valves is substantially reduced. Because of the reduction in RCS pressure and temperature in MODE 4, the likelihood of an event is also reduced. In addition, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state. Required Action G.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate.
LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       [ SR 3.6.3.1 REQUIREMENTS Each [48] inch containment purge valve is required to be periodically verified sealed closed. This Surveillance is designed to ensure that a gross breach of containment is not caused by an inadvertent or spurious opening of a containment purge valve. Detailed analysis of the purge valves failed to conclusively demonstrate their ability to close during a LOCA in time to limit offsite doses. Therefore, these valves are required to be in the sealed closed position during MODES 1, 2, 3, and 4. A containment purge valve that is sealed closed must have motive power to Babcock & Wilcox STS                 B 3.6.3-12                                         Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued) the valve operator removed. This can be accomplished by de-energizing the source of electric power or by removing the air supply to the valve operator. In this application, the term "sealed" has no connotation of leak tightness. [ The Frequency is a result of an NRC initiative, Generic Issue B-24 (Ref. 8), related to containment purge valve use during unit operations.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
In the event purge valve leakage requires entry into Condition F, the Surveillance permits opening one purge valve in a penetration flow path to perform repairs. ]
SR 3.6.3.2 This SR ensures that the minipurge valves are closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of limits. The SR is not required to be met when the minipurge valves are open for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open. The minipurge valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. [ The 31 day Frequency is consistent with other containment isolation valve requirements discussed in SR 3.6.3.3.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                      B 3.6.3-13                                                      Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.3.3 This SR requires verification that each containment isolation manual valve and blind flange located outside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the containment boundary is within design limits. This SR does not require any testing or valve manipulation.
Rather, it involves verification that those containment isolation valves outside containment and capable of being mispositioned are in the correct position. [ Since verification of valve position for containment isolation valves outside containment is relatively easy, the 31 day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
The SR specifies that containment isolation valves open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.
The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted Babcock & Wilcox STS                      B 3.6.3-14                                                      Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued) during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in the proper position, is low.
SR 3.6.3.4 This SR requires verification that each containment isolation manual valve and blind flange that is located inside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the containment boundary is within design limits. For containment isolation valves inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate, since these containment isolation valves are operated under administrative controls and the probability of their misalignment is low. The SR specifies that containment isolation valves open under administrative controls are not required to meet the SR during the time they are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.
The Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in their proper position, is small.
SR 3.6.3.5 Verifying that the isolation time of each automatic power operated containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analyses.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
If the testing is within the scope of the licensee's INSERVICE TESTING PROGRAM, the Frequency "In accordance with the INSERVICE TESTING PROGRAM" should be used. Otherwise, the periodic Frequency of [92] days or the reference to the Surveillance Frequency Control Program should be used.
Babcock & Wilcox STS                      B 3.6.3-15                                                      Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)
[ The Frequency of this SR is in accordance with [the INSERVICE TESTING PROGRAM] [92 days.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.] ]
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.3.6 For containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, Option
[A][B] is required to ensure OPERABILITY. Operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types. [ Based on this observation and the importance of maintaining this penetration leak tight (due to the direct path between containment and the environment), a Frequency of once per 184 days was established as part of the NRC resolution of Generic Issue B-20, "Containment Leakage Due to Seal Deterioration" (Ref. 9).
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Additionally, this SR must be performed within 92 days after opening the valve. The 92 day Frequency was chosen recognizing that cycling the valve could introduce additional seal degradation (greater than that occurring to a valve that has not been opened). Thus, decreasing the interval is a prudent measure after a valve has been opened.
Babcock & Wilcox STS                      B 3.6.3-16                                                      Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.6.3.7 Automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures that each automatic containment isolation valve will actuate to its isolation position on a containment isolation signal. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls.
[ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass this Surveillance when performed at the
[18] month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.3.8
                   -----------------------------------REVIEWERS NOTE-----------------------------------
This SR is only required for those units with resilient seal purge valves allowed to be open during [MODE 1, 2, 3, or 4] and having blocking devices on the valves that are not permanently installed.
Verifying that each [48] inch containment purge valve is blocked to restrict opening to  [50%] is required to ensure that the valves can close under DBA conditions within the times assumed in the analyses of References 3 and 4. If a LOCA occurs, the purge valves must close to maintain containment leakage within the values assumed in the accident analysis.
At other times when purge valves are required to be capable of closing Babcock & Wilcox STS                      B 3.6.3-17                                                      Rev. 5.0

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)
(e.g., during movement of [recently] irradiated fuel assemblies),
pressurization concerns are not present, thus the purge valves can be fully open. [ The [18] month Frequency is appropriate because the blocking devices are typically removed only during a refueling outage.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 20.
: 2. FSAR, Section [5.6].
: 3. FSAR, Sections [14.1 and 14.2].
: 4. FSAR, Section [5.3].
: 5. FSAR, Section [5.3].
: 6. BAW-2461-A, Risk-Informed Justification for Containment Isolation Valve Allowed Outage Time Change.
: 7. Standard Review Plan 6.2.4.
: 8. Generic Issue B-24.
: 9. Generic Issue B-20.
: 10. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                      B 3.6.3-18                                                      Rev. 5.0

Containment Pressure B 3.6.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.4 Containment Pressure BASES BACKGROUND          The containment pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) or steam line break (SLB). These limits also prevent the containment pressure from exceeding the containment design negative pressure differential with respect to the outside atmosphere in the event of inadvertent actuation of the Containment Spray System.
Containment pressure is a process variable that is monitored and controlled. The containment pressure limits are derived from the input conditions used in the containment functional analyses and the containment structure external pressure analysis. Should operation occur outside these limits coincident with a Design Basis Accident (DBA), post accident containment pressures could exceed calculated values.
APPLICABLE          Containment internal pressure is an initial condition used in the DBA SAFETY              analyses to establish the maximum peak containment internal pressure.
ANALYSES            The limiting DBAs considered, relative to containment pressure, are the LOCA and SLB, which are analyzed using computer pressure transients.
The worst-case LOCA generates larger mass and energy release than the worst-case SLB. Thus, the LOCA event bounds the SLB event from the containment peak pressure standpoint (Ref. 1).
The initial pressure condition used in the containment analysis was
[17.7] psia ([3.0] psig). This resulted in a maximum peak pressure from a LOCA of [53.9] psig. The LCO limit of [3.0] psig ensures that, in the event of an accident, the design pressure of [55] psig for containment is not exceeded. In addition, the building was designed for an internal pressure equal to [3] psig above external pressure during a tornado. The containment was also designed for an internal pressure equal to [2.5] psig below external pressure, to withstand the resultant pressure drop from an accidental actuation of the Containment Spray System. The LCO limit of
[-2.0] psig ensures that operation within the design limit of [-2.5] psig is maintained (Ref. 2).
For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the cooling effectiveness of the Emergency Core Cooling Systems during the core reflood phase of a LOCA analysis increases with increasing containment backpressure. Therefore, for the reflood phase, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the containment pressure response in accordance with 10 CFR 50, Appendix K (Ref. 2).
Babcock & Wilcox STS                    B 3.6.4-1                                         Rev. 5.0

Containment Pressure B 3.6.4 BASES BACKGROUND (continued)
Containment pressure satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                Maintaining containment pressure less than or equal to the LCO upper pressure limit ensures that, in the event of a DBA, the resultant peak containment accident pressure will remain below the containment design pressure. Maintaining containment pressure greater than or equal to the LCO lower pressure limit ensures that the containment will not exceed the design negative differential pressure following the inadvertent actuation of the Containment Spray System.
APPLICABILITY      In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. Since maintaining containment pressure within design basis limits is essential to ensure initial conditions assumed in the accident analysis are maintained, the LCO is applicable in MODES 1, 2, 3, and 4.
In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment pressure within the limits of the LCO is not required in MODES 5 and 6.
ACTIONS            A.1 When containment pressure is not within the limits of the LCO, containment pressure must be restored to within these limits within 1 hour. The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, "Containment," which requires that containment be restored to OPERABLE status within 1 hour.
B.1 and B.2 If containment pressure cannot be restored within limits within the required Completion Time, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 3). The release of stored energy to the Reactor Building in the event of an accident in MODE 4 is substantially less than the energy release assumed due to an accident at power. Therefore, the challenge to the containment systems due to an increase in containment pressure is Babcock & Wilcox STS                   B 3.6.4-2                                       Rev. 5.0

Containment Pressure B 3.6.4 BASES ACTIONS (continued) substantially reduced. Because of the reduction in Reactor Coolant System (RCS) pressure and temperature in MODE 4, the likelihood of an event is also reduced. In addition, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.6.4.1 REQUIREMENTS Verifying that containment pressure is within limits ensures that operation remains within the limits assumed in the containment analysis. [ The 12 hour Frequency of this SR was developed after taking into consideration operating experience related to trending of containment pressure variations during the applicable MODES. Furthermore, the 12 hour Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal containment pressure condition.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                  B 3.6.4-3                                          Rev. 5.0

Containment Pressure B 3.6.4 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Section [14.2].
: 2. 10 CFR 50, Appendix K.
: 3. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                      B 3.6.4-4                                                       Rev. 5.0

Containment Air Temperature B 3.6.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.5 Containment Air Temperature BASES BACKGROUND          The containment structure serves to contain radioactive material, which may be released from the reactor core following a Design Basis Accident (DBA). The containment average air temperature is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) or steam line break (SLB).
The containment average air temperature limit is derived from the input conditions used in the containment functional analyses and the containment structure external pressure analysis. This LCO ensures that initial conditions assumed in the analysis of a DBA are not violated during unit operations. The total amount of energy to be removed from the Containment Cooling System during post accident conditions is dependent upon the energy released to the containment due to the event as well as the initial containment temperature and pressure. The higher the initial temperature, the higher the resultant peak containment pressure and temperature. Exceeding containment design pressure may result in leakage greater than that assumed in the accident analysis.
Operation with containment temperature in excess of the LCO limit violates an initial condition assumed in the accident analysis.
APPLICABLE          Containment average air temperature is an initial condition used in the SAFETY              DBA analyses. Average air temperature is also used to establish the ANALYSES            containment environmental qualification operating envelope. The limit for containment average air temperature ensures that operation is maintained within the assumptions used in the DBA analysis for containment.
Several accidents (primarily LOCA and SLB) result in a marked increase in containment temperature and pressure due to energy release within the containment. Of these, the LOCA results in the greatest sustained increase in containment temperature. By maintaining containment air temperature at less than the initial temperature assumed in the LOCA analysis, the reactor building design condition will not be exceeded.
The LOCA that was identified as presenting the greatest challenge to containment OPERABILITY was a cold leg Reactor Coolant System break, of specified size, at a reactor coolant pump suction.
Containment average air temperature satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                    B 3.6.5-1                                      Rev. 5.0

Containment Air Temperature B 3.6.5 BASES LCO                During a DBA, with an initial containment average air temperature less than or equal to the LCO temperature limit, the resultant accident temperature profile assures that the containment structural temperature is maintained below its design temperature and that required safety related equipment will continue to perform its function.
APPLICABILITY      In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment average air temperature within the limit is not required in MODE 5 or 6.
ACTIONS            A.1 When containment average air temperature is not within the limit of the LCO, it must be restored within 8 hours. This Required Action is necessary to return operation to within the bounds of the containment analysis. The 8 hour Completion Time is acceptable considering the sensitivity of the analysis to variations in this parameter and provides sufficient time to correct minor problems.
B.1 and B.2 If the containment average air temperature cannot be restored to within its limit within the required Completion Time, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 1). The release of stored energy to the Reactor Building in the event of an accident in MODE 4 is substantially less than the energy release assumed due to an accident at power. Therefore, the challenge to the containment systems due to an increase in containment temperature is substantially reduced. Because of the reduction in Reactor Coolant System (RCS) pressure and temperature in MODE 4, the likelihood of an event is also reduced. In addition, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Babcock & Wilcox STS                    B 3.6.5-2                                       Rev. 5.0

Containment Air Temperature B 3.6.5 BASES ACTIONS (continued)
Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.6.5.1 REQUIREMENTS Verifying that containment average air temperature is within the LCO limit ensures that containment operation remains within the limit assumed for the containment analyses. In order to determine the containment average air temperature, an arithmetic average is calculated, using measurements taken at locations within the containment selected to provide a representative sample of the overall containment atmosphere.
[ The 24 hour Frequency of this SR is considered acceptable based on observed slow rates of temperature increase within containment as a result of environmental heat sources (due to the large volume of containment). Furthermore, the 24 hour Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal containment temperature condition.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.6.5-3                                                       Rev. 5.0

Containment Air Temperature B 3.6.5 BASES REFERENCES         1. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS             B 3.6.5-4                                       Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.6 Containment Spray and Cooling Systems BASES BACKGROUND          The Containment Spray and Containment Cooling systems provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure and the iodine removal capability of the spray reduces the release of fission product radioactivity from containment to the environment, in the event of a Design Basis Accident (DBA), to within limits. The Containment Spray and Containment Cooling systems are designed to meet the requirements of 10 CFR 50, Appendix A, GDC 38, "Containment Heat Removal," GDC 39, "Inspection of Containment Heat Removal Systems," GDC 40, "Testing of Containment Heat Removal Systems," GDC 41, "Containment Atmosphere Cleanup," GDC 42, "Inspection of Containment Atmosphere Cleanup Systems," and GDC 43, "Testing of Containment Atmosphere Cleanup Systems" (Ref. 1), or other documents that were appropriate at the time of licensing (identified on a unit specific basis).
The Containment Cooling System and Containment Spray System are Engineered Safety Feature (ESF) systems. They are designed to ensure that the heat removal capability required during the post accident period can be attained. The Containment Spray System and Containment Cooling System provide redundant containment heat removal operation.
The Containment Spray System and Containment Cooling System provide redundant methods to limit and maintain post accident conditions to less than the containment design values.
Containment Spray System The Containment Spray System consists of two separate trains of equal capacity, each capable of meeting the design basis. Each train includes a containment spray pump, spray headers, nozzles, valves, and piping.
Each train is powered from a separate ESF bus. The borated water storage tank (BWST) supplies borated water to the Containment Spray System during the injection phase of operation. In the recirculation mode of operation, Containment Spray System pump suction is manually transferred from the BWST to the containment sump.
The Containment Spray System provides a spray of relatively cold borated water mixed with sodium hydroxide from the spray additive tank into the upper regions of containment to reduce the containment pressure and temperature and to reduce the concentration of fission products in the containment atmosphere during a DBA. In the recirculation mode of operation, heat is removed from the containment sump water by the Babcock & Wilcox STS                   B 3.6.6-1                                       Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES BACKGROUND (continued) decay heat removal coolers. Each train of the Containment Spray System provides adequate spray coverage to meet the system design requirements for containment heat removal.
The Containment Spray System is actuated automatically by a containment High-High pressure signal coincident with a containment high pressure signal and a low pressure injection signal. An automatic actuation opens the Containment Spray System pump discharge valves and starts the two Containment Spray System pumps. [A manual actuation of the Containment Spray System requires the operator to actuate two separate switches on the main control board to begin the same sequence.]
Containment Cooling System The Containment Cooling System consists of three containment cooling trains connected to a common duct suction header with four vertical return air ducts. Each cooling train is equipped with demisters, cooling coils, and an axial flow fan driven by a two speed water cooled electric motor. Each unit connection (two per unit) to the common header is provided with a backpressure damper for isolation purposes.
During normal operation, two containment cooling trains are required to operate. The third unit is on standby and isolated from the operating units by means of the backpressure dampers. The swing unit is equipped with a transfer switch. It can be manually placed to either the "A" or "B" power train to operate in case one of the operating units fails. Upon receipt of an emergency signal, the two operating cooling fans running at high speed will automatically stop. The two cooling unit fans connected to the ESF buses will automatically restart and run at low speed, provided normal or emergency power is available.
In post accident operation following an actuation signal, the Containment Cooling System fans are designed to start automatically in slow speed if they are not already running. If they are running at high (normal) speed, the fans automatically stop and restart in slow speed. The fans are operated at the lower speed during accident conditions to prevent motor overload from the higher density atmosphere.
APPLICABLE         The Containment Spray System and Containment Cooling System limit SAFETY             the temperature and pressure that could be experienced following a ANALYSES           DBA. The limiting DBAs considered are the loss of coolant accident (LOCA) and the steam line break. The postulated DBAs are analyzed, with regard to containment ESF systems, assuming the loss of one ESF Babcock & Wilcox STS                  B 3.6.6-2                                        Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES APPLICABLE SAFETY ANLALYSES (continued) bus. This is the worst-case single active failure, resulting in one train of the Containment Spray System and one train of the Containment Cooling System being inoperable.
The analysis and evaluation show that, under the worst-case scenario, the highest peak containment pressure is [53.9] psig (experienced during a LOCA). The analysis shows that the peak containment temperature is
[276]&deg;F (experienced during a LOCA). Both results are less than the design values. (See the Bases for LCO 3.6.4, "Containment Pressure,"
and LCO 3.6.5, "Containment Air Temperature," for a detailed discussion.) The analyses and evaluations assume a power level of
[2568] MWt, one containment spray train and one containment cooling train operating, and initial (pre-accident) conditions of [130]&deg;F and
[17.7] psia. The analyses also assume a response time delayed initiation to provide conservative peak calculated containment pressure and temperature responses.
The effect of an inadvertent containment spray actuation has been analyzed. An inadvertent spray actuation results in a [2.5] psig containment pressure drop and is associated with the sudden cooling effect in the interior of the leak tight containment. Additional discussion is provided in the Bases for LCO 3.6.4.
The modeled Containment Spray System actuation from the containment analyses is based on a response time associated with exceeding the containment pressure High-High setpoint coincident with a high pressure injection signal to achieve full flow through the containment spray nozzles. The Containment Spray System total response time of
[56] seconds includes diesel generator (DG) startup (for loss of offsite power), block loading of equipment, containment spray pump startup, and spray line filling (Ref. 2).
Containment cooling train performance for post accident conditions is given in Reference 3. The result of the analysis is that each train can provide 33% of the required peak cooling capacity during the post accident condition. The train post accident cooling capacity under varying containment ambient conditions, required to perform the accident analyses, is also shown in Reference 4.
The modeled Containment Cooling System actuation from the containment analysis is based on a response time associated with exceeding the containment pressure high setpoint to achieve full Containment Cooling System air and safety grade cooling water flow.
The Containment Cooling System total response time of [25] seconds includes signal delay, DG startup (for loss of offsite power), and service water pump startup times (Ref. 3).
Babcock & Wilcox STS                   B 3.6.6-3                                         Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES APPLICABLE SAFETY ANALYSES (continued)
The Containment Spray System and the Containment Cooling System satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                During a DBA, a minimum of one containment cooling train and one containment spray train are required to maintain the containment peak pressure and temperature below the design limits. Additionally, one containment spray train is required to remove iodine from the containment atmosphere and maintain concentrations below those assumed in the safety analysis. To ensure that these requirements are met, two containment spray trains and two containment cooling units must be OPERABLE. Therefore, in the event of an accident, the minimum requirements are met, assuming the worst-case single active failure occurs.
Each Containment Spray System typically includes a spray pump, spray headers, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST upon an Engineered Safety Features Actuation System signal and manually transferring suction to the containment sump. Management of gas voids is important to Containment Spray System OPERABILITY.
Each Containment Cooling System typically includes demisters, cooling coils, dampers, an axial flow fan driven by a two speed water cooled electrical motor, instruments, and controls to ensure an OPERABLE flow path.
APPLICABILITY      In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature, requiring the operation of the containment spray trains and containment cooling trains.
In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the Containment Spray System and the Containment Cooling System are not required to be OPERABLE in MODES 5 and 6.
ACTIONS            A.1 With one containment spray train inoperable, action must be taken to restore it to OPERABLE status within [7] days [or in accordance with the Risk Informed Completion Time Program]. In this condition, the remaining OPERABLE containment spray train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure to the remaining containment spray train could result in loss of spray function. The [7] day Completion Time is reasonable to perform corrective maintenance on the inoperable containment spray Babcock & Wilcox STS                   B 3.6.6-4                                      Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES ACTIONS (continued) train. The [7] day Completion Time is based on the findings of the deterministic and probabilistic analysis in Reference 5. Reference 5 concluded that extending the Completion Time to [7] days for an inoperable containment spray train proves plant operational flexibility while simultaneously reducing overall plant risk. This is because the risks incurred by having the containment spray train unavailable for a longer time at power will be substantially offset by the benefits associated with avoiding unnecessary plant transitions and by reducing risk during plant shutdown operations.
B.1 and B.2 If the inoperable containment spray train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 60 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 6). The release of stored energy to the Reactor Building in the event of an accident in MODE 4 is substantially less than the energy release assumed due to an accident at power. Therefore, the challenge to the containment systems is substantially reduced. Because of the reduction in Reactor Coolant System (RCS) pressure and temperature in MODE 4, the likelihood of an event is also reduced. In addition, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5.
However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
Babcock & Wilcox STS                  B 3.6.6-5                                          Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES ACTIONS (continued)
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
The extended interval to reach MODE 4 allows additional time to attempt restoration of the containment spray train and is reasonable when considering the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.
C.1 With one of the required containment cooling trains inoperable, the inoperable containment cooling train must be restored to OPERABLE status within 7 days [or in accordance with the Risk Informed Completion Time Program]. The components in this degraded condition provide iodine removal capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 7 day Completion Time was developed taking into account the redundant heat removal capabilities afforded by combinations of the Containment Spray System and Containment Cooling System and the low probability of a DBA occurring during this period.
D.1 and D.2 With one containment spray and one [required] containment cooling train inoperable, one of the required containment cooling trains must be restored to OPERABLE status within 72 hours [or in accordance with the Risk Informed Completion Time Program]. The components in this degraded condition provide iodine removal capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 72 hour Completion Time was developed taking into account the redundant heat removal capabilities afforded by combinations of the Containment Spray System and Containment Cooling System, the iodine removal function of the Containment Spray System, and the low probability of a DBA occurring during this period.
E.1 With two of the required containment cooling trains inoperable, one of the required containment cooling trains must be restored to OPERABLE status within 72 hours [or in accordance with the Risk Informed Completion Time Program]. The components in this degraded condition (both spray trains are OPERABLE or else Condition G is entered) provide iodine removal capabilities and are capable of providing at least 100% of Babcock & Wilcox STS                  B 3.6.6-6                                         Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES ACTIONS (continued) the heat removal needs after an accident. The 72 hour Completion Time was developed taking into account the redundant heat removal capabilities afforded by combinations of the Containment Spray System and Containment Cooling System and the low probability of a DBA occurring during this period.
F.1 and F.2 If the Required Actions and associated Completion Times of Condition C, D, or E of this LCO are not met, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 6). The release of stored energy to the Reactor Building in the event of an accident in MODE 4 is substantially less than the energy release assumed due to an accident at power. Therefore, the challenge to the containment systems is substantially reduced. Because of the reduction in RCS pressure and temperature in MODE 4, the likelihood of an event is also reduced. In addition, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action F.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Babcock & Wilcox STS                  B 3.6.6-7                                          Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES ACTIONS (continued)
G.1 With two containment spray trains or any combination of three or more containment spray and containment cooling trains inoperable, the unit is in a condition outside the accident analysis. Therefore, LCO 3.0.3 must be entered immediately.
SURVEILLANCE       SR 3.6.6.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the containment spray flow path provides assurance that the proper flow paths will exist for Containment Spray System operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation. Rather, it involves verification that those valves outside containment and capable of potentially being mispositioned are in the correct position. [ The 31 day Frequency is appropriate because the valves are operated under administrative control, and an inoperable valve position would only affect a single train. The Frequency has been shown to be acceptable through operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
Babcock & Wilcox STS                      B 3.6.6-8                                                       Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.6.6.2 Operating each [required] containment cooling train fan unit for 15 minutes ensures that all trains are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. [ The 31 day Frequency was developed considering the known reliability of the fan units and controls, the two train redundancy available, and the low probability of a significant degradation of the containment cooling trains occurring between surveillances and has been shown to be acceptable through operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.6.3 Verifying that each [required] containment cooling train provides an essential raw water cooling flow rate of  [1780] gpm to each cooling unit provides assurance that the design flow rate assumed in the safety analyses will be achieved (Ref. 1). [ The Frequency was developed considering the known reliability of the Cooling Water System, the two train redundancy available, and the low probability of a significant degradation of flow occurring between surveillances.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                      B 3.6.6-9                                                       Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.6.4 Containment Spray System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required containment spray trains and may also prevent water hammer and pump cavitation.
Selection of Containment Spray System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration.
Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The Containment Spray System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If the accumulated gas is eliminated or brought within the acceptance criteria limits during performance of the Surveillance, the Surveillance is met and past system OPERABILITY is evaluated under the Corrective Action Program. If it is determined by subsequent evaluation that the Containment Spray System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
Accumulated gas should be eliminated or brought within the acceptance criteria limits.
Babcock & Wilcox STS                      B 3.6.6-10                                                      Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued)
Containment Spray System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
[ The 31 day Frequency takes into consideration the gradual nature of gas accumulation in the Containment Spray System piping and the procedural controls governing system operation.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.6.5 Verifying that each containment spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the cycle. Flow and differential pressure are normal tests of centrifugal pump performance required by the ASME Code (Ref. 7). Since the Containment Spray System pumps cannot be tested with flow through the spray headers, they are tested on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall Babcock & Wilcox STS                      B 3.6.6-11                                                      Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued) performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
SR 3.6.6.6 and SR 3.6.6.7 These SRs require verification that each automatic containment spray valve actuates to its correct position and that each containment spray pump starts upon receipt of an actual or simulated actuation signal. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. [ The [18] month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillances when performed at the [18] month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.6.8 This SR requires verification that each [required] containment cooling train actuates upon receipt of an actual or simulated actuation signal.
[ The [18] month Frequency is based on engineering judgment and has been shown to be acceptable through operating experience. See SR 3.6.6.6 and SR 3.6.6.7, above, for further discussion of the basis for the [18] month Frequency.
OR Babcock & Wilcox STS                      B 3.6.6-12                                                      Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued)
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.6.9 With the containment spray header isolated and drained of any solution, low pressure air or smoke can be blown through test connections.
Performance of this Surveillance demonstrates that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during an accident is not degraded. [ Due to the passive nature of the design of the nozzles, a test at [the first refueling and at]
10 year intervals is considered adequate to detect obstruction of the spray nozzles.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 50, Appendix A, GDC 38, GDC 39, GDC 40, GDC 41, GDC 42, and GDC 43.
: 2. FSAR, Section [14.1].
: 3. FSAR, Section [6.3].
: 4. FSAR, Section [14.2].
Babcock & Wilcox STS                      B 3.6.6-13                                                      Rev. 5.0

Containment Spray and Cooling Systems B 3.6.6 BASES REFERENCES (continued)
: 5. BAW-2295-A, Revision 1, Justification for Extension of Allowed Outage Time for Low Pressure Injection and Reactor Building Spray Systems.
: 6. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
: 7. ASME Code for Operation and Maintenance of Nuclear Power Plants.
Babcock & Wilcox STS             B 3.6.6-14                                       Rev. 5.0

Spray Additive System B 3.6.7 B 3.6 CONTAINMENT SYSTEMS B 3.6.7 Spray Additive System BASES BACKGROUND           The Spray Additive System is a subsystem of the Containment Spray System that assists in reducing the iodine fission product inventory in the containment atmosphere resulting from a Design Basis Accident (DBA).
The Containment Spray System and Spray Additive System perform no function during normal operations. In the event of an accident such as a loss of coolant accident (LOCA), however, the Spray Additive System will be automatically actuated upon a high containment pressure signal by the Engineered Safety Features Actuation System.
Radioiodine in its various forms is the fission product of primary concern in the evaluation of a DBA. It is absorbed by the spray from the containment atmosphere. To enhance the iodine absorption capacity of the spray, the spray solution is adjusted to an alkaline pH that promotes iodine hydrolysis, in which iodine is converted to nonvolatile forms.
Sodium hydroxide (NaOH), because of its stability when exposed to radiation and elevated temperature, is the preferred spray additive.
The spray additive tank is designed and located to permit gravity draining into the Containment Spray System. Both Containment Spray System pumps initially take suction from the borated water storage tank (BWST) via two independent flow paths. The spray additive tank has a common header that splits and feeds each of the Containment Spray System suction lines. The system is designed to inject at a rate commensurate with the draining rate of the BWST so that all borated water injected is mixed with NaOH.
The flow rate is proportioned to provide a spray solution with a pH between [7.2 and 11.0] (Ref. 1). This range of alkalinity was established not only to aid in removal of airborne iodine, but also to minimize the corrosion of mechanical system components that would occur if the acidic borated water were not buffered. The pH range also considers the environmental qualification of equipment in containment that may be subjected to the spray.
APPLICABLE           The containment Spray Additive System is essential to the effective SAFETY               removal of airborne iodine within containment following a DBA.
ANALYSES Following the assumed release of radioactive materials into containment, the containment is assumed to leak at its design value following the accident. The analysis assumes that most of the containment volume is covered by the spray.
Babcock & Wilcox STS                     B 3.6.7-1                                        Rev. 5.0

Spray Additive System B 3.6.7 BASES APPLICABLE SAFETY ANALYSES (continued)
The DBA response time assumed for the Spray Additive System is the same as for the Containment Spray System and is discussed in the Bases for LCO 3.6.6, "Containment Spray and Cooling Systems."
The DBA analyses assume that one train of the Containment Spray System/Spray Additive System is inoperable and that the entire spray additive tank volume is added to the remaining Containment Spray System flow path.
In the evaluation of the worst-case LOCA, the safety analysis assumed that an alkaline containment spray effectively reduced the airborne iodine.
Each Containment Spray System suction line is equipped with its own gravity feed from the spray additive tank. Therefore, in the event of a single failure within the Spray Additive System (i.e., suction valve failure),
NaOH will still be mixed with the borated water, establishing the alkalinity essential to effective iodine removal.
The Spray Additive System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The Spray Additive System is necessary to reduce the release of radioactive material to the environment in the event of a DBA. To be considered OPERABLE, the volume and concentration of the spray additive solution must be sufficient to provide NaOH injection into the spray flow until the Containment Spray System suction path is switched from the BWST to the containment sump and to raise the average spray solution pH to a level conducive to iodine removal. The average spray solution pH is between [7.2 and 11.0]. This pH range maximizes the effectiveness of the iodine removal mechanism without introducing conditions that may induce caustic stress corrosion cracking of mechanical system components. In addition, it is essential that valves in the Spray Additive System flow paths are properly positioned and that automatic valves are capable of activating to their correct positions.
APPLICABILITY      In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment requiring the operation of the Spray Additive System. The Spray Additive System assists in reducing the iodine fission product inventory prior to release to the environment.
In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Thus, the Spray Additive System is not required to be OPERABLE in MODES 5 and 6.
Babcock & Wilcox STS                   B 3.6.7-2                                        Rev. 5.0

Spray Additive System B 3.6.7 BASES ACTIONS            A.1 With the containment Spray Additive System inoperable, the system must be restored to OPERABLE status within 72 hours. The pH adjustment of the Containment Spray System for corrosion protection and iodine removal enhancement is reduced in this Condition. The Containment Spray System would still be available and would remove some iodine from the containment atmosphere in the event of a DBA. The 72 hour Completion Time takes into account the redundant flow path capabilities and the low probability of the worst-case DBA occurring during this period.
B.1 and B.2 If the Spray Additive System cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 84 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 5 allows additional time for restoration of the Spray Additive System and is reasonable when considering that the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.
SURVEILLANCE       SR 3.6.7.1 REQUIREMENTS Verifying the correct alignment of spray additive manual, power operated, and automatic valves in the spray additive flow path provides assurance that the system is able to provide additive to the Containment Spray System in the event of a DBA. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing.
This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation. Rather, it involves verification that those valves outside containment capable of potentially being mispositioned are in the correct position. [ The 31 day Frequency is appropriate because the valves are operated under administrative control. The Frequency has been shown to be acceptable through operating experience.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                   B 3.6.7-3                                          Rev. 5.0

Spray Additive System B 3.6.7 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.7.2 To provide effective iodine removal, the containment spray must be an alkaline solution. Since the BWST contents are normally acidic, the volume of the spray additive tank must provide a sufficient volume of spray additive to adjust pH for all water injected. This SR is performed to verify the availability of sufficient NaOH solution in the Spray Additive System. [ The 184 day Frequency is based on the low probability of an undetected change in tank volume occurring during the SR interval (the tank is isolated during normal unit operations). Tank level is also indicated and alarmed in the control room, such that there is a high confidence that a substantial change in level would be detected.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.7.3 This SR provides verification of the NaOH concentration in the spray additive tank and is sufficient to ensure that the spray solution being injected into containment is at the correct pH level. The concentration of NaOH in the spray additive tank must be determined by chemical analysis. [ The 184 day Frequency is sufficient to ensure that the concentration level of NaOH in the spray additive tank remains within the established limits. This is based on the low likelihood of an uncontrolled change in concentration (the tank is normally isolated) and the probability that any substantial variance in tank volume will be detected.
Babcock & Wilcox STS                      B 3.6.7-4                                                       Rev. 5.0

Spray Additive System B 3.6.7 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.7.4 This SR provides verification that each automatic valve in the Spray Additive System flow path actuates to its correct position. The SR excludes automatic valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to valves that are locked, sealed, or otherwise secured in the actuated position since the affected valves were verified to be in the actuated position prior to being locked, sealed, or otherwise secured. Placing an automatic valve in a locked, sealed, or otherwise secured position requires an assessment of the OPERABILITY of the system or any supported systems, including whether it is necessary for the valve to be repositioned to the non-actuated position to support the accident analysis. Restoration of an automatic valve to the non-actuated position requires verification that the SR has been met within its required Frequency. [ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the [18] month Frequency.
Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                      B 3.6.7-5                                                       Rev. 5.0

Spray Additive System B 3.6.7 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.6.7.5 To ensure that the correct pH level is established in the borated water solution provided by the Containment Spray System, the flow [rate] in the Spray Additive System is verified. This SR provides assurance that the correct amount of NaOH will be metered into the flow path upon Containment Spray System initiation. [ Due to the passive nature of the spray additive flow controls, the 5 year Frequency is sufficient to identify component degradation that may affect flow [rate].
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
References         1. FSAR, Section [6.2].
Babcock & Wilcox STS                      B 3.6.7-6                                                       Rev. 5.0

Containment Sump B 3.6.8 B 3.6 CONTAINMENT SYSTEMS B 3.6.8 Containment Sump BASES BACKGROUND          ----------------------------------- REVIEWER'S NOTE ---------------------------------
Some plant designs have more than one containment sump. LCO 3.6.8 provides the option of specifying one or two containment sumps. The Bases specify when to discuss differences between one or more sump designs by providing bracketed information. However, for clarity, all references to the containment sump are not provided with plural bracketed alternatives. Licensees adopting this Bases section for plants with two or more containment sumps should make the appropriate changes to the Bases to reflect the plant design.
The containment sump provides a borated water source to support recirculation of coolant from the containment sump for residual heat removal, emergency core cooling, containment cooling, and [containment atmosphere cleanup] during accident conditions.
The containment sump supplies both trains of the Emergency Core Cooling System (ECCS) and the Containment Spray System (CSS) during any accident that requires recirculation of coolant from the containment sump. The recirculation mode is initiated when the pump suction is transferred to the containment sump on low Borated Water Storage Tank (BWST) level, which ensures the containment sump has enough water to supply the net positive suction head to the ECCS and CSS pumps. [The use of a single containment sump to supply both trains of the ECCS and CSS is acceptable since the containment sump is a passive component, and passive failures are not required to be assumed to occur coincident with Design Basis Events.][Describe the design of plants with two or more containment sumps.]
The containment sump contains strainers to limit the quantity of the debris materials from entering the sump suction piping. Debris accumulation on the strainers can lead to undesirable hydraulic effects including air ingestion through vortexing or deaeration, and reduced net positive suction head (NPSH) at pump suction piping.
Babcock & Wilcox STS                            B 3.6.8-1                                                  Rev. 5.0

Containment Sump B 3.6.8 BASES BACKGROUND (continued)
While the majority of debris accumulates on the strainers, some fraction penetrates the strainers and is transported to downstream components in the ECCS, CSS, and the Reactor Coolant System (RCS). Debris that penetrates the strainer can result in wear to the downstream components, blockages, or reduced heat transfer across the fuel cladding. Excessive debris in the containment sump water source could result in insufficient recirculation of coolant during the accident, or insufficient heat removal from the core during the accident.
APPLICABLE         During all accidents that require recirculation, the containment sump SAFETY             provides a source of borated water to the ECCS and CSS ANALYSIS           pumps. As such, it supports residual heat removal, emergency core cooling, containment cooling, and [containment atmosphere cleanup]
during an accident. It also provides a source of negative reactivity (Ref. 1). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of B 3.5.2, "ECCS - Operating," B 3.5.3, "ECCS -
Shutdown," and B 3.6.6, "Containment Spray and Cooling Systems."
FSAR Section X.XX (Ref. 2) describes evaluations that confirm long-term core cooling is assured following any accident that requires recirculation from the containment sump.
The containment sump satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                ----------------------------- REVIEWER'S NOTE --------------------------------------
The containment sump description should include all design features credited in the containment debris analysis.
[The][Two] containment sump is required to ensure a source of borated water to support ECCS and CSS OPERABILITY. A containment sump consists of the containment drainage flow paths, [design features upstream of the containment sump that are credited in the containment debris analysis,] the containment sump strainers, the pump suction trash racks, and the inlet to the ECCS and CSS piping. An OPERABLE containment sump has no structural damage or abnormal corrosion that could prevent recirculation of coolant and will not be restricted by containment accident generated and transported debris.
Babcock & Wilcox STS                           B 3.6.8-2                                                  Rev. 5.0

Containment Sump B 3.6.8 BASES LCO (continued)
Containment accident generated and transported debris consists of the following:
: a. Accident generated debris sources - Insulation, coatings, and other materials which are damaged by the high-energy line break (HELB) and transported to the containment sump. This includes materials within the HELB zone of influence and other materials (e.g.,
unqualified coatings) that fail due to the post-accident containment environment following the accident;
: b. Latent debris sources - Pre-existing dirt, dust, paint chips, fines or shards of insulation, and other materials inside containment that do not have to be damaged by the HELB to be transported to the containment sump; and
: c. Chemical product debris sources - Aluminum, zinc, carbon steel, copper, and non-metallic materials such as paints, thermal insulation, and concrete that are susceptible to chemical reactions within the post-accident containment environment leading to corrosion products that are generated within the containment sump pool or are generated within containment and transported to the containment sump.
Containment debris limits are defined in FSAR Section X.XX (Ref. 2).
APPLICABILITY      In MODES 1, 2, 3, and 4, containment sump OPERABILITY requirements are dictated by the ECCS and CSS OPERABILITY requirements. Since both the ECCS and the CSS must be OPERABLE in MODES 1, 2, 3, and 4, the containment sump must also be OPERABLE to support their operation.
In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the containment sump is not required to be OPERABLE in MODES 5 or 6.
Babcock & Wilcox STS                       B 3.6.8-3                                    Rev. 5.0

Containment Sump B 3.6.8 BASES ACTIONS            A.1, A.2, and A.3 Condition A is applicable when there is a condition which results in containment accident generated and transported debris exceeding the analyzed limits. Containment debris limits are defined in FSAR Section X.XX (Ref. 2).
Immediate action must be initiated to mitigate the condition. Examples of mitigating actions are:
* Removing the debris source from containment or preventing the debris from being transported to the containment sump;
* Evaluating the debris source against the assumptions in the analysis;
* Deferring maintenance that would affect availability of the affected systems and other LOCA mitigating equipment;
* Deferring maintenance that would affect availability of primary defense-in-depth systems, such as containment coolers;
* Briefing operators on LOCA debris management actions; or
* Applying an alternative method to establish new limits.
While in this condition, the RCS water inventory balance, SR 3.4.13.1, must be performed at an increased Frequency of once per 24 hours. An unexpected increase in RCS leakage could be indicative of an increased potential for an RCS pipe break, which could result in debris being generated and transported to the containment sump. The more frequent monitoring allows operators to act in a timely fashion to minimize the potential for an RCS pipe break while the containment sump is inoperable.
[For the purposes of applying LCO 3.0.6 and the Safety Function Determination Program while in Condition A, the [two] containment sumps are considered a single support system for all ECCS and CSS trains because containment accident generated and transported debris issues that would render one sump inoperable would render all of the sumps inoperable.]
The inoperable containment sump must be restored to OPERABLE status in 90 days. A 90-day Completion Time is reasonable for emergent conditions that involve debris in excess of the analyzed limits that could be generated and transported to the containment sump under accident conditions. The likelihood of an initiating event in the 90-day Completion Babcock & Wilcox STS                      B 3.6.8-4                                    Rev. 5.0

Containment Sump B 3.6.8 BASES ACTIONS (continued)
Time is very small and there is margin in the associated analyses. The mitigating actions of Required Action A.1 provide additional assurance that the effects of debris in excess of the analyzed limits will be mitigated during the Completion Time.
B.1
                   -------------------------------------- Reviewer's Note ------------------------------------
The Required Action B.1 Completion Time should be the same as the LCO 3.6.6 Completion Time for a single inoperable CSS train.
When the containment sump is inoperable for reasons other than Condition A, such as blockage, structural damage, or abnormal corrosion that could prevent recirculation of coolant, it must be restored to OPERABLE status within [72 hours]. The [72 hour] Completion Time takes into account the reasonable time for repairs, and low probability of an accident that requires the containment sump occurring during this period. [Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
Required Action B.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.5.2, "ECCS - Operating," and LCO 3.5.3, "ECCS - Shutdown," should be entered if an inoperable containment sump results in an inoperable ECCS train. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.6.6, "Containment Spray and Cooling Systems," should be entered if an inoperable containment sump results in an inoperable CSS train. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.
C.1 and C.2 If the containment sump cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Babcock & Wilcox STS                           B 3.6.8-5                                                  Rev. 5.0

Containment Sump B 3.6.8 BASES SURVEILLANCE       SR 3.6.8.1 REQUIREMENTS Periodic inspections are performed to verify the containment sump does not show current or potential debris blockage, structural damage, or abnormal corrosion to ensure the operability and structural integrity of the containment sump (Ref. 1).
[The 18 month Frequency is based on the need to perform this Surveillance during a refueling outage, because of the need to enter containment. This Frequency is sufficient to detect any indication of structural damage, abnormal corrosion, or debris blockage of the containment sump.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   -------------------------------------------------------------------------------------------------]
REFERENCES         1. FSAR, Chapter [6] and Chapter [15].
: 2. FSAR, Section [X.XX], [Sump Debris Evaluation].
Babcock & Wilcox STS                           B 3.6.8-6                                                  Rev. 5.0

MSSVs B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)
BASES BACKGROUND          The primary purpose of the MSSVs is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available.
Nine MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in the FSAR, Section [5.2] (Ref. 1). The MSSV rated capacity passes the full steam flow at 112% RTP with the valves full open. This meets the requirements of the ASME Code, Section III (Ref. 2). The MSSV design includes staggered setpoints, according to Table 3.7.1-1 in the accompanying LCO, so that only the needed number of valves will actuate. Staggered setpoints reduce the potential for valve chattering because of insufficient steam pressure to fully open all valves following a turbine reactor trip.
APPLICABLE          The design basis of the MSSVs comes from Reference 2 and its purpose SAFETY              is to limit secondary system pressure to  110% of design pressure when ANALYSES            passing 100% of design steam flow. This design basis is sufficient to cope with any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis.
The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are those characterized as decreased heat removal events, and are presented in the FSAR, Section [15.2] (Ref. 3). Of these, the full power turbine trip coincident with a loss of condenser heat sink is the limiting AOO. For this event, the Condenser Circulating Water System is lost and, therefore, the Turbine Bypass Valves are not available to relieve Main Steam System pressure. Similarly, MSSV relief capacity is utilized in the FSAR for mitigation of the following events:
: a. Loss of main feedwater,
: b. Steam line break,
: c. Steam generator tube rupture, and
: d. Excessive heat removal due to feedwater system malfunction.
The MSSVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                    B 3.7.1-1                                        Rev. 5.0

MSSVs B 3.7.1 BASES LCO                The MSSVs setpoints are established to prevent overpressurization as discussed in the Applicable Safety Analysis section of these Bases. The LCO requires all MSSVs to be OPERABLE to ensure compliance with the ASME Code following DBAs initiated at full power. Operation with less than a full complement of MSSVs requires limitations on unit THERMAL POWER and adjustment of the Reactor Protection System (RPS) trip setpoints. This effectively limits the Main Steam System steam flow while the MSSV relieving capacity is reduced due to valve inoperability. To be OPERABLE, lift setpoints must remain within limits, according to Table 3.7.1-1 in the accompanying LCO.
The OPERABILITY of the MSSVs is defined as the ability to open within the setpoint tolerances, relieve steam generator overpressure, and reseat when pressure has been reduced.
The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the INSERVICE TESTING PROGRAM.
The lift settings, according to Table 3.7.1-1 in the accompanying LCO, correspond to ambient conditions of the valve at nominal operating temperature and pressure.
This LCO provides assurance that the MSSVs will perform the design safety function to mitigate the consequences of accidents that could result in a challenge to the RCPB.
APPLICABILITY      In MODE 1 above [18]% RTP, the number of MSSVs per steam generator required to be OPERABLE must be within the acceptable region, according to Figure 3.7.1-1 in the accompanying LCO. Below [18]% RTP in MODES 1, 2, and 3, only two MSSVs are required OPERABLE per steam generator.
In MODES 4 and 5, there is no credible transient requiring the MSSVs.
The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.
ACTIONS            The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each MSSV.
Babcock & Wilcox STS                   B 3.7.1-2                                      Rev. 5.0

MSSVs B 3.7.1 BASES ACTIONS (continued)
A.1 and A.2 An alternative to restoring the inoperable MSSV(s) to OPERABLE status is to reduce power so that the available MSSV relieving capacity meets ASME Code requirements for the power level. Operation may continue, provided the ALLOWABLE THERMAL POWER and RPS nuclear overpower trip setpoint are reduced by the application of the following formulas:
RP = [ Y / Z] x 100%
and SP = [ Y / Z ] x W where:
W    =     Nuclear overpower trip setpoint for four pump operation as specified in LCO 3.3.1, "Reactor Protection System (RPS),"
Y    =     Total OPERABLE MSSV relieving capacity per steam generator based on a summation of individual OPERABLE MSSV relief capacities per steam generator [lb/hour],
Z    =     Required relieving capacity per steam generator of
[6,585,600] lb/hour, RP =       Reduced power requirement (not to exceed RTP), and SP =       Nuclear overpower trip setpoint (not to exceed W).
These equations are graphically represented in Figure 3.7.1-1, in the accompanying LCO. Operation is restricted to the area below and to the right of line BCDE.
The operator should limit the maximum steady state power level to some value slightly below this setpoint to avoid an inadvertent overpower trip.
The 4 hour Completion Time for Required Action A.1 is a reasonable time period to reduce power level and is based on the low probability of an event occurring during this period that would require activation of the MSSVs. An additional 32 hours is allowed in Required Action A.2 to Babcock & Wilcox STS                   B 3.7.1-3                                       Rev. 5.0

MSSVs B 3.7.1 BASES ACTIONS (continued) reduce the setpoints. The Completion Time of 36 hours for Required Action A.2 is based on a reasonable time to correct the MSSV inoperability, the time required to perform the power reduction, operating experience in resetting all channels of a protective function, and on the low probability of the occurrence of a transient that could result in steam generator overpressure during this period.
B.1 and B.2 With one or more MSSVs inoperable, a verification by administrative means that at least [two] required MSSVs per steam generator are OPERABLE, with each valve from a different lift setting range, is performed.
If the MSSVs cannot be restored to OPERABLE status in the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE       SR 3.7.1.1 REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the INSERVICE TESTING PROGRAM. The ASME Code (Ref. 4) requires that safety and relief valve tests be performed in accordance with ANSI/ASME OM-1-1987 (Ref. 5). According to Reference 5, the following tests are required for MSSVs:
: a. Visual examination,
: b. Seat tightness determination,
: c. Setpoint pressure determination (lift setting),
: d. Compliance with owner's seat tightness criteria, and
: e. Verification of the balancing device integrity device on balanced valves.
Babcock & Wilcox STS                   B 3.7.1-4                                         Rev. 5.0

MSSVs B 3.7.1 BASES SURVEILLANCE REQUIREMENTS (continued)
The ANSI/ASME Standard requires the testing of all valves every 5 years, with a minimum of 20% of the valves tested every 24 months.
Reference 4 provides the activities and frequencies necessary to satisfy the requirements. Table 3.7.1-1 allows a +/- [3]% setpoint tolerance for OPERABILITY; however, the valves are reset to +/- 1% during the Surveillance to allow for drift.
This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.
REFERENCES         1. FSAR, Section [5.2].
: 2. ASME, Boiler and Pressure Vessel Code, Section III, Article NC-7000, Class 2 Components.
: 3. FSAR, Section [15.2].
: 4. ASME Code for Operation and Maintenance of Nuclear Power Plants.
: 5. ANSI/ASME OM-1-1987.
Babcock & Wilcox STS                   B 3.7.1-5                                         Rev. 5.0

MSIVs B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Main Steam Isolation Valves (MSIVs)
BASES BACKGROUND          The MSIVs isolate steam flow from the secondary side of the steam generators following a high energy line break (HELB). MSIV closure terminates flow from the unaffected (intact) steam generator.
One MSIV is located in each main steam line outside of, but close to, containment. The MSIVs are downstream from the main steam safety valves (MSSVs) and emergency feedwater pump turbine's steam supply to prevent their being isolated from the steam generators by MSIV closure. Closing the MSIVs isolates each steam generator from the other, and isolates the turbine, Turbine Bypass System, and other auxiliary steam supplies from the steam generators.
The MSIVs close on a Steam and Feedwater Rupture Control System signal generated by either low steam generator pressure or steam generator to feedwater differential pressure. The MSIVs fail closed on loss of control or actuation power. The MSIVs may also be actuated manually.
A description of the MSIVs is found in the FSAR, Section [10.3] (Ref. 1).
APPLICABLE          The design basis of the MSIVs is established by the containment analysis SAFETY              for the large steam line break (SLB) inside containment, as discussed in ANALYSES            the FSAR, Section [6.2] (Ref. 2). It is also influenced by the accident analysis of the SLB events presented in the FSAR, Section [15.4]
(Ref. 3). The design precludes the blowdown of more than one steam generator, assuming a single active component failure (i.e., the failure of one MSIV to close on demand).
The limiting case for the containment analysis is the SLB inside containment with a loss of offsite power following turbine trip and failure of the MSIV on the affected steam generator to close. At 100% RTP, the steam generator inventory and temperature are at their maximum, maximizing the mass and energy release to the containment.
Due to reverse flow, failure of the MSIV to close contributes to the total release of the additional mass and energy in the steam headers downstream of the other MSIV. Other failures considered are the failure of a main feedwater isolation valve to close, and failure of an emergency diesel generator (EDG) to start.
Babcock & Wilcox STS                   B 3.7.2-1                                        Rev. 5.0

MSIVs B 3.7.2 BASES APPLICABLE SAFETY ANALYSES (continued)
The accident analysis compares several different SLB events against different acceptance criteria. The large SLB outside containment upstream of the MSIV is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB inside containment at full power is the limiting case for a post trip return to power. The analysis includes scenarios with offsite power available and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System (RCS) cooldown. With a loss of offsite power, the response of mitigating systems, such as the High Pressure Injection (HPI) System pumps, is delayed. Significant single failures considered include failure of an MSIV to close, failure of an EDG, and failure of an HPI pump.
The MSIVs serve only a safety function and remain open during power operation. These valves operate under the following situations:
: a. An HELB, an SLB, or main feedwater line breaks (FWLBs), inside containment. In order to maximize the mass and energy release into the containment, the analysis assumes the MSIV in the affected steam generator remains open. For this scenario, steam is discharged into containment from both steam generators until closure of the MSIV in the intact steam generator occurs. After MSIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIV in the intact loop.
: b. An SLB outside of containment and upstream from the MSIVs is not a containment pressurization concern. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition. Closure of the MSIVs isolates the break and limits the blowdown to a single steam generator.
: c. A break downstream of the MSIVs will be isolated by the closure of the MSIVs. Events such as increased steam flow through the turbine or the steam bypass valves will also terminate on closing the MSIVs.
: d. Following a steam generator tube rupture, closure of the MSIVs isolates the ruptured steam generator from the intact steam generator. In addition to minimizing radiological releases, this enables the operator to maintain the pressure of the steam generator with the ruptured tube below the MSIVs' setpoints, a necessary step toward isolating flow through the rupture.
Babcock & Wilcox STS                   B 3.7.2-2                                        Rev. 5.0

MSIVs B 3.7.2 BASES APPLICABLE SAFETY ANALYSES (continued)
: e. The MSIVs are also utilized during other events such as an FWLB.
The MSIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                This LCO requires that the MSIV in both steam lines be OPERABLE. The MSIVs are considered OPERABLE when the isolation times are within limits and they close on an isolation actuation signal.
This LCO provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 100 limits (Ref. 4).
APPLICABILITY      The MSIVs must be OPERABLE in MODE 1 and in MODES 2 and 3 with any MSIVs open, when there is significant mass and energy in the RCS and steam generator; therefore, the MSIVs must be OPERABLE or closed. When the MSIVs are closed, they are already performing the safety function.
In MODE 4, the steam generator energy is low. Therefore, the MSIVs are not required to be OPERABLE.
In MODES 5 and 6, the steam generators do not contain much energy because their temperature is below the boiling point of water; therefore, the MSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.
ACTIONS            A.1 With one MSIV inoperable in MODE 1, action must be taken to restore the component to OPERABLE status within [8] hours [or in accordance with the Risk Informed Completion Time Program]. Some repairs can be made to the MSIV with the unit hot. The [8] hour Completion Time is reasonable, considering the probability of an accident that would require actuation of the MSIVs occurring during this time interval. The turbine stop valves are available to provide the required isolation for the postulated accidents.
The [8] hour Completion Time is greater than that normally allowed for containment isolation valves because the MSIVs are valves that isolate a closed system penetrating containment. These valves differ from other containment isolation valves in that the closed system provides an additional means for containment isolation.
Babcock & Wilcox STS                  B 3.7.2-3                                        Rev. 5.0

MSIVs B 3.7.2 BASES ACTIONS (continued)
B.1 If the MSIV cannot be restored to OPERABLE status in accordance with Required Action A.1, the unit must be placed in MODE 2 and the inoperable MSIV closed within the next 6 hours. The Completion Times are reasonable, based on operating experience, to reach MODE 2.
C.1 and C.2 Condition C is modified by a Note indicating that separate Condition entry is allowed for each MSIV.
Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the inoperable MSIVs may either be restored to OPERABLE status or closed.
When closed, the MSIVs are already in the position required by the assumptions in the safety analysis.
The [8] hour Completion Time is consistent with that allowed in Condition A.
Inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of MSIV status indications available in the control room, and other administrative controls, to ensure these valves are in the closed position.
D.1 and D.2 If the MSIV cannot be restored to OPERABLE status or closed in the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems.
Babcock & Wilcox STS                  B 3.7.2-4                                       Rev. 5.0

MSIVs B 3.7.2 BASES SURVEILLANCE       SR 3.7.2.1 REQUIREMENTS This SR verifies that the closure time of each MSIV is within the limit given in Reference 5 and is within that assumed in the accident and containment analyses. This SR also verifies the valve closure time is in accordance with the INSERVICE TESTING PROGRAM. This SR is normally performed upon returning the unit to operation following a refueling outage, because the MSIVs should not be tested at power since even a part stroke exercise increases the risk of a valve closure with the unit generating power. As the MSIVs are not to be tested at power, they are exempt from the ASME Code (Ref. 6) requirements during operation in MODES 1 and 2.
The Frequency for this SR is in accordance with the INSERVICE TESTING PROGRAM.
This test is conducted in MODE 3, with the unit at operating temperature and pressure. This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows delaying testing until MODE 3 in order to establish conditions consistent with those under which the acceptance criterion was generated.
SR 3.7.2.2 This SR verifies that each MSIV can close on an actual or simulated actuation signal. This Surveillance is normally performed upon returning the plant to operation following a refueling outage. [ The Frequency of MSIV testing is every [18] months. The [18] month Frequency for testing is based on the refueling cycle. Operating experience has shown that these components usually pass the Surveillance when performed at the
[18] month Frequency. Therefore, this Frequency is acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.7.2-5                                                       Rev. 5.0

MSIVs B 3.7.2 BASES REFERENCES         1. FSAR, Section [10.3].
: 2. FSAR, Section [6.2].
: 3. FSAR, Section [15.4].
: 4. 10 CFR 100.11.
: 5. [Technical Requirements Manual.]
: 6. ASME Code for Operation and Maintenance of Nuclear Power Plants.
Babcock & Wilcox STS              B 3.7.2-6                                  Rev. 5.0

[MFSVs, MFCVs, and Associated SFCVs]
B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 [ Main Feedwater Stop Valves (MFSVs), Main Feedwater Control Valves (MFCVs), and Associated Startup Feedwater Control Valves (SFCVs) ]
BASES BACKGROUND            The main feedwater isolation valves (MFIVs) for each steam generator consist of the MFSVs, MFCVs, and the SFCVs. The MFIVs isolate main feedwater (MFW) flow to the secondary side of the steam generators following a high energy line break (HELB). Closure of the MFIVs terminates flow to both steam generators, terminating the event for feedwater line breaks (FWLBs) occurring upstream of the MFIVs. The consequences of events occurring in the main steam lines or in the feedwater lines downstream of the MFIVs will be mitigated by their closure. Closing the MFIVs and associated bypass valves effectively terminates the addition of feedwater to an affected steam generator, limiting the mass and energy release for steam line breaks (SLBs) or FWLBs inside containment and reducing the cooldown effects for SLBs.
The MFIVs close on receipt of a Steam and Feedwater Rupture Control System (SFRCS) signal generated by either low steam generator pressure or steam generator/feedwater differential pressure. The MFIVs can also be closed manually.
[ The MFIVs and associated bypass valves close on receipt for a safety injection - low Tavg coincident with reactor trip or steam generator water level - high high signal. They may also be actuated manually. In addition to the MFIVs and associated bypass valves, a check valve inside containment is available to isolate the feedwater line penetrating containment and to ensure that the consequences of events do not exceed the capacity of the containment heat removal systems. ]
A description of the MFIVs is found in the FSAR, Section [10.4.7] (Ref. 1).
APPLICABLE            The design basis of the MFIVs is established by the analysis for the large SAFETY                SLB. It is also influenced by the accident analysis for the large FWLB.
ANALYSES              Closure of the MFIVs may also be relied on to terminate a steam break for core response analysis and excess feedwater event upon the receipt of a steam generator water level - high signal.
Failure of an MFIV to close following an SLB, FWLB, or excess feedwater event, can result in additional mass and energy being delivered to the steam generators, contributing to cooldown. This failure also results in additional mass and energy releases following an SLB or FWLB event.
The MFIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                     B 3.7.3-1                                         Rev. 5.0

[MFSVs, MFCVs, and Associated SFCVs]
B 3.7.3 BASES LCO                  This LCO ensures that the MFIVs will isolate MFW flow to the steam generators following a FWLB or a main steam line break. These valves will also isolate the nonsafety related portions from the safety related portions of the system.
[Two] [MFSVs], [MFCVs], [or associated SFCVs] are required to be OPERABLE. The MFIVs are considered OPERABLE when the isolation times are within limits and they close on an isolation actuation signal.
Failure to meet the LCO requirements can result in additional mass and energy being released to containment following an SLB or FWLB inside containment. If the SFRCS on high steam generator level is relied on to terminate an excess feedwater flow event, failure to meet the LCO may result in the introduction of water into the main steam lines.
APPLICABILITY        The [MFSVs], [MFCVs], [or associated SFCVs] must be OPERABLE whenever there is significant mass and energy in the RCS and steam generators. This ensures that in the event of an HELB, a single failure cannot result in the blowdown of more than one steam generator.
In MODES 1, 2, and 3, the [MFSVs], [MFCVs], [or associated SFCVs] are required to be OPERABLE in order to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment. When the valves are closed, they are already performing their safety function.
In MODES 4, 5, and 6, steam generator energy is low. Therefore, the
[MFSVs], [MFCVs], [or associated SFCVs] are not required for isolation of potential high energy secondary system pipe breaks in these MODES.
ACTIONS              The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each valve.
A.1 and A.2 With one [MFSV] in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within [8 or 72] hours. When these valves are closed or isolated, they are performing their required safety function.
[ For units with only one MFIV per feedwater line: The [8] hour Completion Time is reasonable to close the MFIV or its associated bypass valve which includes performing a controlled unit shutdown to MODE 2. The Completion Time is reasonable, based on operating experience, to reach MODE 2 from full power conditions with the MFIVs closed, in an orderly manner and without challenging unit systems. ]
Babcock & Wilcox STS                     B 3.7.3-2                                        Rev. 5.0

[MFSVs, MFCVs, and Associated SFCVs]
B 3.7.3 BASES ACTIONS (continued)
The [72] hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The [72] hour Completion Time is reasonable, based on operating experience.
Inoperable [MFSVs] that are closed or isolated, must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.
B.1 and B.2 With one [MFCV] in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within [8 or 72] hours. When these valves are closed or isolated, they are performing their required safety function.
[ For units with only one MFIV per feedwater line: The [8] hour Completion Time is reasonable, based on operating experience, to close the MFIV or its associated bypass valve. ]
The [72] hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths.
Inoperable [MFCVs] that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.
C.1 and C.2 With one [SFCV] in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within [8 or 72] hours. When these valves are closed or isolated, they are performing their required safety function.
Babcock & Wilcox STS                    B 3.7.3-3                                        Rev. 5.0

[MFSVs, MFCVs, and Associated SFCVs]
B 3.7.3 BASES ACTIONS (continued)
[ For units with only one MFIV per feedwater line: The [8] hour Completion Time is reasonable, based on operating experience, to close the MFIV or its associated bypass valve. ]
The [72] hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths.
Inoperable SFCVs that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated.
D.1 With two inoperable valves in the same flow path there may be no redundant system to operate automatically and perform the required safety function. Although the containment can be isolated with the failure to two valves in parallel in the same flow path, the double failure can be an indication of a common mode failure in the valves of this flow path and as such is treated the same as a loss of the isolation capability of this flow path. Under these conditions, affected valves in each flow path must be restored to OPERABLE status, or the affected flow path isolated within 8 hours. The 8 hour Completion Time is reasonable, based on operating experience, to close the MFIV or otherwise isolate the affected flow path.
E.1 and E.2 If the [MFSVs], [MFCVs], and [associated SFCVs] cannot be restored to OPERABLE status, or closed, or isolated within the associated Completion Time, the unit must be in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
Babcock & Wilcox STS                   B 3.7.3-4                                         Rev. 5.0

[MFSVs, MFCVs, and Associated SFCVs]
B 3.7.3 BASES SURVEILLANCE       SR 3.7.3.1 REQUIREMENTS This SR verifies that the closure time of each [MFSV], [MFCV], and
[associated SFCV] is within the limit given in Reference 2 and is within that assumed in the accident and containment analyses. This SR also verifies the valve closure time is in accordance with the INSERVICE TESTING PROGRAM. This SR is normally performed upon returning the unit to operation following a refueling outage. The [MFSV], [MFCV], and
[associated SFCV] should not be tested at power since even a part stroke exercise increases the risk of a valve closure with the unit generating power. This is consistent with the ASME Code (Ref. 3) requirements during operation in MODES 1 and 2.
This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR.
The Frequency for this SR is in accordance with the INSERVICE TESTING PROGRAM.
SR 3.7.3.2 This SR verifies that each [MFSV, MFCV, and associated SFCV] can close on an actual or simulated actuation signal. This Surveillance is normally performed upon returning the plant to operation following a refueling outage.
[ The Frequency for this SR is every [18] months. The [18] month Frequency for testing is based on the refueling cycle. Operating experience has shown that these components usually pass the Surveillance when performed at the [18] month Frequency. Therefore, this Frequency is acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.7.3-5                                                       Rev. 5.0

[MFSVs, MFCVs, and Associated SFCVs]
B 3.7.3 BASES REFERENCES         1. FSAR, Section [10.4.7].
: 2. [Technical Requirements Manual.]
: 3. ASME Code for Operation and Maintenance of Nuclear Power Plants.
Babcock & Wilcox STS              B 3.7.3-6                                  Rev. 5.0

AVVs B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Atmospheric Vent Valves (AVVs)
BASES BACKGROUND           The AVVs provide a method for cooling the unit to decay heat removal (DHR) entry conditions, should the preferred heat sink via the Turbine Bypass System to the condenser not be available, as discussed in the FSAR, Section [10.3] (Ref. 1). This is done in conjunction with the Emergency Feedwater System, providing cooling water from the condensate storage tank (CST). The AVVs may also be required to meet the design cooldown rate during a normal cooldown when steam pressure drops too low for maintenance of a vacuum in the condenser to permit use of the Turbine Bypass System.
[ The AVVs are provided with upstream block valves to permit their being tested at power, and to provide an alternate means of isolation. ]
The AVVs are equipped with pneumatic controllers to permit control of the cooldown rate.
[ The AVVs are provided with a pressurized gas supply of bottled nitrogen that, on loss of pressure in the normal instrument air supply, automatically supplies nitrogen to operate the AVVs. The nitrogen supply is sized to provide sufficient pressurized gas to operate the AVVs for the time required for Reactor Coolant System (RCS) cooldown to DHR entry conditions. ]
A description of the AVVs is found in Reference 1.
APPLICABLE           The design basis of the AVVs is established by the capability to cool the SAFETY               unit to MODE 3. The design rate of [75]&deg;F per hour is applicable for both ANALYSES             steam generators, each with one AVV. This rate is adequate to cool the unit to DHR entry conditions with only one AVV and one steam generator utilizing the cooling water supply available in the CST.
In the accident analysis presented in Reference 1, the AVVs are assumed to be used by the operator to cool down the unit to MODE 3 for accidents accompanied by a loss of offsite power. Prior to operator actions to cool down the unit, the AVVs and the main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator's pressure and temperature below the design value.
This is about 30 minutes following initiation of an event; however, this may be less for a steam generator tube rupture (SGTR) event. Some initiating events falling into this category are a main steam line break upstream of the main steam isolation valves, a feedwater line break, and an SGTR event (although the AVVs on the affected steam generator may still be available following an SGTR event).
Babcock & Wilcox STS                     B 3.7.4-1                                         Rev. 5.0

AVVs B 3.7.4 BASES APPLICABLE SAFETY ANALYSES (continued)
For the recovery from an SGTR event, the operator is also required to perform a limited cooldown to establish adequate subcooling as a necessary step to terminate the primary to secondary break flow into the ruptured steam generator. The time required to terminate the primary to secondary break flow for an SGTR is more critical than the time required to cool down to DHR conditions for this event, and also for other accidents. Thus, the SGTR is the limiting event for the AVVs. The number of AVVs required to be OPERABLE to satisfy the SGTR accident analysis requirements depends upon the consideration of any single failure assumptions regarding the failure of one AVV to open on demand.
[ The design must accommodate the single failure of one AVV to open on demand, thus each steam generator must have at least one AVV. The AVVs are equipped with manual block valves in the event an AVV spuriously fails open, or fails to close during use. ]
The AVVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                  [Two] AVVs [lines per steam generator] are required to be OPERABLE.
Failure to meet the LCO can result in the inability to cool the unit to DHR entry conditions following an event in which the condenser is unavailable for use with the Steam Bypass System.
An AVV is considered OPERABLE when it is capable of providing a controlled relief of the main steam flow, and is capable of fully opening and closing on demand.
APPLICABILITY        In MODES 1, 2, and 3, and in MODE 4, when steam generator is being relied upon for heat removal, the AVVs are required to be OPERABLE.
In MODES 5 and 6, an SGTR is not a credible event.
ACTIONS              A.1 With one AVV [line] inoperable, action must be taken to restore the inoperable AVV to OPERABLE status. The 7 day Completion Time allows for redundant capability afforded by the remaining OPERABLE AVV and a nonsafety grade backup in the Steam Bypass System and MSSVs. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
Babcock & Wilcox STS                     B 3.7.4-2                                         Rev. 5.0

AVVs B 3.7.4 BASES ACTIONS (continued)
[ B.1 With more than one AVV [line] inoperable, action must be taken to restore
[all but one] AVV [lines] to OPERABLE status. As the block valve can be closed to isolate an AVV, some repairs may be possible with the unit at power. The 24 hour Completion Time is reasonable to repair inoperable AVV [lines], based on the availability of the Steam Bypass System and MSSVs, and the low probability of an event occurring during this period that would require the AVV [lines]. ]
C.1 and C.2 If the AVV [lines] cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within [24] hours, without reliance upon the steam generator for heat removal. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE         SR 3.7.4.1 REQUIREMENTS To perform a controlled cooldown of the RCS, the AVVs must be able to be opened either remotely or locally and throttled through their full range.
This SR ensures that the AVVs are tested through a full control cycle at least once per fuel cycle. Performance of inservice testing or use of an AVV during a unit cooldown may satisfy this requirement. [ Operating experience has shown that these components usually pass the Surveillance when performed at the [18] month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                        B 3.7.4-3                                                       Rev. 5.0

AVVs B 3.7.4 BASES SURVEILLANCE REQUIREMENTS (continued)
[ SR 3.7.4.2 The function of the block valve is to isolate a failed open AVV. Cycling the block valve closed and open demonstrates its ability to perform this function. Performance of inservice testing or use of the block valve during unit cooldown may satisfy this requirement. [ Operating experience has shown that these components usually pass the Surveillance when performed at the [18] month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ---------------------------------------------------------------------------------------------- ] ]
REFERENCES           1. FSAR, Section [10.3].
Babcock & Wilcox STS                        B 3.7.4-4                                                       Rev. 5.0

EFW System B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Emergency Feedwater (EFW) System BASES BACKGROUND         The EFW System automatically supplies feedwater to the steam generators to remove decay heat from the Reactor Coolant System (RCS) upon the loss of normal feedwater supply. The EFW pumps take suction through separate and independent suction lines from the condensate storage tank (CST) (LCO 3.7.6, "Condensate Storage Tank (CST)"), and pump to the steam generator secondary side through the EFW nozzles. The steam generators function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam safety valves (MSSVs) (LCO 3.7.1, "Main Steam Safety Valves (MSSVs)"), or atmospheric vent valves (AVVs) (LCO 3.7.4, "Atmospheric Vent Valves (AVVs)"). If the main condenser is available, steam may be released via the Turbine Bypass System and recirculated to the CST.
[The following system description is provided as an example. Actual system description should be provided by the specific unit. The EFW System consists of two turbine driven EFW pumps, each of which provides a nominal 100% capacity, and one nonsafety grade motor driven EFW pump. The steam turbine driven EFW pumps receive steam from either of the two main steam headers, upstream of the main steam isolation valves (MSIVs). The EFW System supplies a common header capable of feeding either or both steam generators. The 100% capacity is sufficient to remove decay heat and cool the unit to decay heat removal (DHR) entry conditions. The EFW System normally receives a supply of water from the CST. A safety grade source of water is also supplied by the Service Water System (SWS). Automatic valves on the supply piping open on low pressure in the supply piping to transfer the water supply from the CST to the SWS. A third source of water can be supplied by manually aligning the fire protection header to the EFW pump suction.]
Thus, the requirements for diversity in motive power sources for the EFW System are met.
The EFW System is capable of supplying feedwater to the steam generators during normal unit startup, shutdown, and hot standby conditions.
The EFW System is designed to supply sufficient water to cool the unit to DHR entry conditions with steam being released through the ADVs or condenser.
The EFW actuates automatically on low steam generator level, low steam generator pressure, or loss of four reactor coolant pumps.
Babcock & Wilcox STS                   B 3.7.5-1                                      Rev. 5.0

EFW System B 3.7.5 BASES BACKGROUND (continued)
The EFW System is discussed in the FSAR, Sections [9.2.7] and [9.2.8]
(Refs. 1 and 2, respectively).
APPLICABLE           The EFW System mitigates the consequences of any event with a loss of SAFETY               normal feedwater.
ANALYSES The design basis of the EFW System is to supply water to the steam generator to remove decay heat and other residual heat by delivering at least the minimum required flow rate to the steam generators at pressures corresponding to the lowest steam generator safety valve set pressure plus 3%.
In addition, the EFW System must supply enough makeup water to replace steam generator secondary inventory being lost as steam as the unit cools to MODE 4 conditions. Sufficient EFW flow must also be available to account for flow losses such as pump recirculation and line breaks.
The limiting Design Basis Accidents (DBAs) and transients for the EFW System are as follows:
: a. Feedwater line break (FWLB) and
: b. Loss of main feedwater.
In addition, the minimum available EFW flow and system characteristics are serious considerations in the analysis of a small break loss of coolant accident.
[ The EFW System design is such that it can perform its function following a loss of the turbine driven main feedwater pumps or an FWLB, combined with a loss of normal or reserve electric power. ]
The EFW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                  This LCO provides assurance that the EFW System will perform its design safety function to mitigate the consequences of accidents that could result in overpressurization of the reactor coolant pressure boundary. [Three] independent EFW pumps, in two diverse trains are required to be OPERABLE to ensure the availability of residual heat removal capability for all events accompanied by a loss of offsite power and a single failure. [This is accomplished by powering two pumps by steam driven turbines supplied with steam from a source not isolated by the closure of the MSIVs, and one pump from a power source that, in the event of loss of offsite power, is supplied by the emergency diesel generator.]
Babcock & Wilcox STS                    B 3.7.5-2                                        Rev. 5.0

EFW System B 3.7.5 BASES LCO (continued)
The EFW System is considered to be OPERABLE when the components and flow paths required to provide EFW flow to the steam generators are OPERABLE. This requires that the [two] turbine driven EFW pump(s) be OPERABLE with redundant steam supplies from each of the main steam lines upstream of the MSIVs and capable of supplying EFW flow to either of the two steam generators. The [nonsafety grade] motor driven EFW pump(s) and [the] associated flow path(s) to the EFW System [are] also required to be OPERABLE. The piping, valves, instrumentation, and controls in the required flow paths shall also be OPERABLE. The primary and secondary sources of water to the EFW System are required to be OPERABLE. The associated flow paths from the EFW System primary and secondary sources of water to all EFW pumps also are required to be OPERABLE.
The LCO is modified by a Note indicating that one EFW train, which includes a motor driven EFW pump, is required in MODE 4. This is because of reduced heat removal requirement, the short duration of MODE 4 in which feedwater is required, and the insufficient steam supply available in MODE 4 to power the turbine driven EFW pump.
APPLICABILITY      In MODES 1, 2, and 3, the EFW System is required to be OPERABLE and to function in the event that the main feedwater is lost. In addition, the EFW System is required to supply enough makeup water to replace the steam generator secondary inventory lost as the unit cools to MODE 4 conditions.
In MODE 4, with RCS temperature above [212]&deg;F, the EFW System may be used for heat removal via the steam generators. In MODE 4, the steam generators are used for heat removal until the DHR System is in operation.
In MODES 5 and 6, the steam generators are not used for DHR and the EFW System is not required.
ACTIONS            A Note prohibits the application of LCO 3.0.4.b to an inoperable EFW train when entering MODE 1. There is an increased risk associated with entering MODE 1 with EFW inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
Babcock & Wilcox STS                   B 3.7.5-3                                       Rev. 5.0

EFW System B 3.7.5 BASES ACTIONS (continued)
[ A.1 With the turbine driven EFW pump inoperable due to one inoperable steam supply, or if a turbine driven pump is inoperable for any reason while in MODE 3 immediately following refueling, action must be taken to restore the inoperable equipment to an OPERABLE status within 7 days
[or in accordance with the Risk Informed Completion Time Program]. The 7 day Completion Time is reasonable, based on the following reasons:
: a. For the inoperability of a turbine driven EFW pump due to one inoperable steam supply, the 7 day Completion Time is reasonable since there is a redundant steam supply line for the turbine driven pump and the turbine driven train is still capable of performing its specified function for most postulated events.
: b. For the inoperability of a turbine driven EFW pump while in MODE 3 immediately subsequent to a refueling, the 7 day Completion Time is reasonable due to the minimal decay heat levels in this situation.
: c. For both the inoperability of a turbine driven pump due to one inoperable steam supply and an inoperable turbine driven EFW pump while in MODE 3 immediately following refueling, the 7 day Completion Time is reasonable due to the availability of redundant OPERABLE EFW pumps, and due to the low probability of an event requiring the use of the inoperable turbine driven EFW pump.
Condition A is modified by a Note which limits the applicability of the Condition for an inoperable turbine driven EFW pump in MODE 3 to when the unit has not entered MODE 2 following a refueling. Condition A allows one EFW train to be inoperable for 7 days vice the 72 hour Completion Time in Condition B. This longer Completion Time is based on the reduced decay heat following refueling and prior to the reactor being critical. ]
B.1 When one of the required EFW trains (pump or flow path) is inoperable in MODE 1, 2, or 3 [for reasons other than Condition A], action must be taken to restore the train to OPERABLE status within 72 hours [or in accordance with the Risk Informed Completion Time Program]. This Condition includes the loss of two steam supply lines to one of the turbine driven EFW pumps. The 72 hour Completion Time is reasonable, based on the redundant capabilities afforded by the EFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.
Babcock & Wilcox STS                   B 3.7.5-4                                        Rev. 5.0

EFW System B 3.7.5 BASES ACTIONS (continued)
C.1 and C.2 With the required motor driven EFW train (pump or flow path) inoperable and one of the turbine driven EFW trains inoperable due to one inoperable steam supply, action must be taken to restore the affected equipment to OPERABLE status within [24] [48] hours. Assuming no single active failures when in this condition, the accident (a feed line break (FLB) or main steamline break (MSLB)) could result in the loss of the remaining steam supply to the inoperable turbine driven EFW pump due to the faulted steam generator (SG). In this condition, the EFW system may no longer be able to meet the required flow to the SGs assumed in the safety analysis, [either due to the analysis requiring flow from two EFW pumps or due to the remaining EFW pump having to feed a faulted SG].
                     ------------------------------------REVIEWERS NOTE----------------------------------
Licensees should adopt the appropriate Completion Time based on their plant design. The 24 hour Completion Time is applicable to plants that can no longer meet the safety analysis requirement of 100% EFW flow to the SG(s) assuming no single active failure and a FLB or MSLB resulting in the loss of the remaining steam supply to the inoperable turbine driven EFW pump. The 48 hour Completion Time is applicable to plants that can still meet the safety analysis requirement of 100% EFW flow to the SG(s) assuming no single active failure and a FLB or MSLB resulting in the loss of the remaining steam supply to the turbine driven EFW pump.
[ The 24 hour Completion Time is reasonable based on the remaining OPERABLE steam supply to the affected turbine driven EFW pump, the availability of the remaining OPERABLE turbine driven EFW pump, and the low probability of an event occurring that would require the inoperable steam supply to be available for the affected turbine driven EFW pump. ]
[ The 48 hour Completion Time is reasonable based on the fact that the remaining turbine driven EFW train is capable of providing 100% of the EFW flow requirements, and the low probability of an event occurring that would challenge the EFW System. ]
D.1 and D.2 When Required Action A.1, [B.1, C.1, or C.2] cannot be completed within the required Completion Time, [or when two EFW trains are inoperable in MODE 1, 2, or 3, for reasons other than Condition C] the unit must be Babcock & Wilcox STS                        B 3.7.5-5                                                       Rev. 5.0

EFW System B 3.7.5 BASES ACTIONS (continued) placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 4 within [18] hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
[ In MODE 4, with two EFW trains inoperable, operation is allowed to continue because only one motor driven EFW train is required in accordance with the Note that modifies the LCO. Although not required, the unit may continue to cool down and initiate DHR. ]
E.1 Required Action E.1 is modified by a Note indicating that all required MODE changes are suspended until at least one EFW train is restored to OPERABLE status.
With [all] EFW trains inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety grade equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore at least one EFW train to OPERABLE status.
LCO 3.0.3 is not applicable, as it could force the units into a less safe condition.
F.1 In MODE 4, either the steam generator loops or the DHR loops can be used to provide heat removal, which is addressed in LCO 3.4.6, "RCS Loops - MODE 4." With one EFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status.
SURVEILLANCE        SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the EFW water and steam supply flow paths provides assurance that the proper flow paths exist for EFW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since those valves are verified to be in the correct position prior Babcock & Wilcox STS                   B 3.7.5-6                                          Rev. 5.0

EFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS (continued) to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.
[ The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.7.5.2 Verifying that each EFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that EFW pump performance has not degraded during the cycle. Flow and differential head are normal tests of pump performance required by the ASME Code (Ref. 3). Because it is undesirable to introduce cold EFW into the steam generators while they are operating, this test is performed on recirculation flow.
This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. Performance of inservice testing as discussed in the ASME Code (Ref. 3) and the INSERVICE TESTING PEROGRAM, satisfies this requirement.
This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test.
Babcock & Wilcox STS                        B 3.7.5-7                                                       Rev. 5.0

EFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.7.5.3 This SR verifies that EFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates a Steam and Feedwater Rupture Control System (SFRCS) signal by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. [ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The
[18] month Frequency is also acceptable based on operating experience and design reliability of the equipment.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note that states the SR is not required to be met in MODE 4. In MODE 4, the required EFW train is already aligned and operating. This SR is modified by [a] [two] Note[s]. [Note 1 indicates that the SR be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test.] [The] Note [2] states that the SR is not required to be met in MODE 4. [In MODE 4, the required pump is already operating and the autostart function is not required.] [In MODE 4, the heat removal requirements would be less providing more time for operator action to manually start the required EFW pump.]
SR 3.7.5.4 This SR verifies that the turbine driven EFW pumps start in the event of any accident or transient that generates an SFRCS signal by demonstrating that each turbine driven EFW pump starts automatically on Babcock & Wilcox STS                      B 3.7.5-8                                                       Rev. 5.0

EFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS (continued) an actual or simulated actuation signal. These pumps are not required in MODE 4. [ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by [a] [two] Note[s]. [Note 1 indicates that the SR be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test.]
[The] Note [2] states that the SR is not required to be met in MODE 4. [In MODE 4, the required pump is already operating and the autostart function is not required.] [In MODE 4, the heat removal requirements would be less providing more time for operator action to manually start the required EFW pump.]
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Some plants may not routinely use the EFW for heat removal in MODE 4.
The second justification is provided for plants that use a startup feedwater pump rather than EFW for startup and shutdown.
SR 3.7.5.5 This SR ensures that the EFW System is properly aligned by verifying the flow paths to each steam generator prior to entering MODE 2 after more than 30 days in any combination of MODE 5 or 6, or defueled.
OPERABILITY of EFW flow paths must be demonstrated before sufficient core heat is generated that would require the operation of the EFW System during a subsequent shutdown. The Frequency is reasonable, based on engineering judgment, in view of other administrative controls to ensure that the flow paths are OPERABLE. To further ensure EFW Babcock & Wilcox STS                      B 3.7.5-9                                                       Rev. 5.0

EFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS (continued)
System alignment, flow path OPERABILITY is verified, following extended outages to determine no misalignment of valves has occurred. This SR ensures that the flow path from the CST to the steam generator is properly aligned. (This SR is not required by those units that use EFW for normal startup and shutdown.)
[ SR 3.7.5.6 and SR 3.7.5.7 For this facility, the CHANNEL FUNCTIONAL TEST and CHANNEL CALIBRATION for the EFW pump suction pressure interlocks are as follows:
A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. ]
REFERENCES           1. FSAR, Section [9.2.7].
: 2. FSAR, Section [9.2.8].
: 3. ASME Code for Operation and Maintenance of Nuclear Power Plants.
Babcock & Wilcox STS                      B 3.7.5-10                                     Rev. 5.0

CST B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Condensate Storage Tank (CST)
BASES BACKGROUND          The CST provides a safety grade source of water to the steam generators for removing decay and sensible heat from the Reactor Coolant System (RCS). The CST provides a passive flow of water, by gravity, to the Emergency Feedwater (EFW) System (LCO 3.7.5, "Emergency Feedwater (EFW) System"). The steam produced is released to the atmosphere by the main steam safety valves (MSSVs) or the atmospheric vent valves.
When the main steam isolation valves are open, the preferred means of heat removal is to discharge to the condenser by the nonsafety grade path of the turbine bypass valves. The condensed steam is returned to the CST by the condensate pump. This has the advantage of conserving condensate while minimizing releases to the environment.
Because the CST is a principal component in removing residual heat from the RCS, it is designed to withstand earthquakes and other natural phenomena, as well as missiles that might be generated by natural phenomena. The CST is designed to Seismic Category I to ensure availability of the feedwater supply. Feedwater is also available from an alternate source(s).
A description of the CST is found in the FSAR, Section [9.2.60] (Ref. 1).
APPLICABLE          The CST provides cooling water to remove decay heat and cool down SAFETY              the unit following all events in the accident analysis, as discussed in ANALYSES            the FSAR, Chapters [6] and [15] (Refs. 2 and 3, respectively). For anticipated operational occurrences and accidents that do not affect the OPERABILITY of the steam generators, the analysis assumption is generally 30 minutes at MODE 3, steaming through the MSSVs, followed by a cooldown to decay heat removal (DHR) entry conditions at the design cooldown rate.
The limiting event for the condensate volume is the large feedwater line break coincident with a loss of offsite power. Single failures that also affect this event include the following:
: a. Failure of the diesel generator powering the motor driven EFW pump to the unaffected steam generator (requiring additional steam to drive the remaining EFW pump turbine) and
: b. Failure of the steam driven EFW pump (requiring a longer time for cooldown using only one motor driven EFW pump).
Babcock & Wilcox STS                    B 3.7.6-1                                        Rev. 5.0

CST B 3.7.6 BASES APPLICABLE SAFETY ANALYSES (continued)
These are not usually the limiting failures in terms of consequences for these events.
The CST satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
LCO                To satisfy accident analysis assumptions, the [two] CSTs must contain sufficient cooling water to remove decay heat for 13 hours following a reactor trip from 102% RTP and then to cool down the RCS to DHR System entry conditions, assuming a coincident loss of offsite power and most adverse single failure. While so doing, the CSTs must retain sufficient water to ensure adequate net positive suction head for the EFW pump(s) during the cooldown, to account for any losses from the steam driven EFW pump turbine, as well as losses incurred before isolating EFW to a broken line.
The level required is equivalent to a usable volume of [250,000] gallons, which is based on holding the unit in MODE 3 for 13 hours, followed by a cooldown to DHR System entry conditions.
The OPERABILITY of the CST is determined by maintaining the tank level at or above the minimum required level.
APPLICABILITY      In MODES 1, 2, 3, and in MODE 4, when steam generator is being relied upon for heat removal, the CST is required to be OPERABLE.
In MODES 5 and 6, the CST is not required because the EFW System is not required.
ACTIONS            A.1 and A.2 As an alternative to unit shutdown, the OPERABILITY of the backup water supply should be verified within 4 hours and once every 12 hours thereafter. The OPERABILITY of the backup feedwater supply must include verification, by administrative means, of the OPERABILITY of flow paths from the backup supply to the EFW pumps and availability of the required volume of water in the backup supply. The CST must be restored to OPERABLE status within 7 days because the backup supply may be performing this function in addition to its normal functions. The 4 hour Completion Time is reasonable, based on operating experience, to verify the OPERABILITY of the backup water supply. Additionally, verifying the backup water supply every 12 hours is adequate to ensure the backup water supply continues to be available. The 7 day Completion Time is reasonable, based on an OPERABLE backup water supply being available, and the low probability of an event occurring during this time period, requiring the use of the water from the CST(s).
Babcock & Wilcox STS                  B 3.7.6-2                                        Rev. 5.0

CST B 3.7.6 BASES ACTIONS (continued)
B.1 and B.2 If the CST cannot be restored to OPERABLE status in the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply, with the DHR System in operation. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4, without reliance on steam generators for heat removal, within
[24] hours. This allows an additional 6 hours for the DHR System to be placed in service after entering MODE 4.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE       SR 3.7.6.1 REQUIREMENTS This SR verifies that the CST(s) contains the required volume of cooling water. [ The 12 hour Frequency is based on operating experience and the need for operator awareness of unit evolutions that may affect the CST inventory between checks. The 12 hour Frequency is considered adequate in view of other indications in the control room, including alarms, to alert the operator to abnormal deviations in CST levels.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Section [9.2.6].
: 2. FSAR, Chapter [6].
: 3. FSAR, Chapter [15].
Babcock & Wilcox STS                      B 3.7.6-3                                                       Rev. 5.0

CCW System B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Component Cooling Water (CCW) System BASES BACKGROUND         The CCW System provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, the CCW System also provides this function for various nonessential components, as well as the spent fuel pool. The CCW System serves as a barrier to the release of radioactive byproducts between potentially radioactive systems and the Service Water System, and thus to the environment.
A typical CCW System is arranged as two independent full capacity cooling loops, and has isolatable nonsafety related components. Each safety related train includes a full capacity pump, surge tank, heat exchanger, piping, valves, and instrumentation. Each safety related train is powered from a separate bus. A surge tank in the system provides sufficient net positive suction head for each pump and isolation of nonessential components on a low tank level signal. The pump in each train is automatically started on receipt of a safety feature actuation signal, and all nonessential components are isolated.
Additional information on the design and operation of the CCW System, along with a list of the components served, is presented in the FSAR, Section [9.2.2] (Ref. 1). The principal safety related function of the CCW System is the removal of decay heat from the reactor via the [decay heat removal (DHR) heat exchanger]. This may utilize the DHR System during a normal or post accident cooldown and shutdown, or during the recirculation phase following a loss of coolant accident.
APPLICABLE         The design basis of the CCW System is to provide cooling water to the SAFETY             Emergency Core Cooling System and emergency diesel generators ANALYSES           (EDGs) during DBA conditions. The CCW System also supplies cooling water to EDGs during a loss of offsite power.
The CCW System is designed to perform its function with a single failure of any active component assuming a loss of offsite power.
The CCW System also functions to cool the unit from [DHR] entry conditions (Tcold < [350]&deg;F) to MODE 5 (Tcold < [200]&deg;F) during normal and post accident operations. The time required to cool from [350]&deg;F to
[200]&deg;F is a function of the number of CCW and [DHR] trains operating.
One CCW train is sufficient to remove decay heat during subsequent operations with Tcold < [200]&deg;F.
The CCW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                  B 3.7.7-1                                          Rev. 5.0

CCW System B 3.7.7 BASES LCO                The CCW trains are independent of each other to the degree that each has separate controls and power supplies and the operation of one train does not depend on the other. In the event of a DBA, one train of CCW is required to provide the minimum heat removal capability assumed in the safety analysis for systems to which it supplies cooling water. To ensure this is met, two CCW trains must be OPERABLE. At least one CCW train will operate assuming the worst case single active failure occurs coincident with loss of offsite power.
A CCW train is considered OPERABLE when:
: a. It has an OPERABLE pump and associated surge tank and
: b. The associated piping, valves, heat exchanger, and instrumentation and controls required to perform the safety related function are OPERABLE.
The isolation of CCW from other components or systems not required for safety may render these components or systems inoperable, but does not affect the OPERABILITY of the CCW System.
APPLICABILITY      In MODES 1, 2, 3, and 4, the CCW System is a normally operating system that must be prepared to perform its post accident safety functions, primarily Reactor Coolant System heat removal, by cooling the DHR heat exchanger.
Although the LCO for the CCW System is not applicable in MODES 5 and 6, the capability of the CCW System to perform its necessary related support functions may be required for OPERABILITY of supported systems.
ACTIONS            A.1 Required Action A.1 is modified by a Note indicating that the applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources - Operating,"
and LCO 3.4.6, "RCS Loops - MODE 4," should be entered if an inoperable CCW train results in an inoperable EDG or DHR loop. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.
If one CCW train is inoperable, action must be taken to restore OPERABLE status within 72 hours [or in accordance with the Risk Informed Completion Time Program]. In this Condition, the remaining OPERABLE CCW train is adequate to perform the heat removal function.
The 72 hour Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this period.
Babcock & Wilcox STS                  B 3.7.7-2                                         Rev. 5.0

CCW System B 3.7.7 BASES ACTIONS (continued)
B.1 and B.2 If the CCW train cannot be restored to OPERABLE status in the associated Completion Time, the unit must be placed in a MODE in which overall plant risk is minimized. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref 2). The stored energy in the Reactor Coolant System (RCS) that must be removed by the CCW System in the event of an accident in MODE 4 is substantially less than the energy assumed due to an accident at power.
Therefore, the heat loads on the CCW System are substantially reduced.
Because of the reduction in RCS pressure and temperature in MODE 4, the likelihood of an event is also reduced. In addition, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5.
However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE       SR 3.7.7.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the CCW flow to individual components may render those components inoperable, but does not affect the OPERABILITY of the CCW System.
Verifying the correct alignment for manual, power operated, and automatic valves in the CCW flow path provides assurance that the proper flow paths exist for CCW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since Babcock & Wilcox STS                   B 3.7.7-3                                         Rev. 5.0

CCW System B 3.7.7 BASES SURVEILLANCE REQUIREMENTS (continued) they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves which cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in their correct position.
[ The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.7.7.2 This SR verifies proper automatic operation of the CCW valves on an actual or simulated actuation signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. [ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the [18] month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                        B 3.7.7-4                                                       Rev. 5.0

CCW System B 3.7.7 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.7.7.3 This SR verifies proper automatic operation of the CCW pumps on an actual or simulated actuation signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. [ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the [18] month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Section [9.2.2].
: 2. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                      B 3.7.7-5                                                       Rev. 5.0

SWS B 3.7.8 B 3.7 PLANT SYSTEMS B 3.7.8 Service Water System (SWS)
BASES BACKGROUND          The SWS provides a heat sink for the removal of process and operating heat from safety related components during a transient or Design Basis Accident (DBA) or transient. During normal operation and normal shutdown, the SWS also provides this function for various safety related and nonsafety related components. The safety related position is covered by this LCO.
An SWS consists of two separate, 100% capacity safety related cooling water trains. Each train consists of a 100% capacity pump, one component cooling water (CCW) heat exchanger, piping, valving, and instrumentation. The pumps and valves are remote manually aligned, except in the unlikely event of a loss of coolant accident (LOCA). The pumps are automatically started upon receipt of a safety feature actuation signal, and all essential valves are aligned to their post accident positions.
The SWS also provides cooling directly to the Control Room Emergency Ventilation System water cooled condensing unit, the Emergency Core Cooling System (ECCS) pump room coolers, containment air cooler, and turbine driven cooling water systems. The system provides cooling and is also a source of water to the ECCS pump and the emergency feedwater pumps, and can provide a source of makeup water to the cooling tower.
Additional information about the design and operation of the SWS, along with a list of the components served, is presented in the FSAR, Section [9.2.1] (Ref. 1). The principal safety related function of the SWS is the removal of decay heat from the reactor via the [CCW System].
APPLICABLE          The design basis of the SWS is for one SWS train, in conjunction with the SAFETY              CCW System and a 100% capacity containment cooling system, ANALYSES            (containment spray, containment air coolers, or a combination) to remove core decay heat following a design basis LOCA, as discussed in the FSAR, Section [6.2] (Ref. 2). This provides for a gradual reduction in the temperature of this fluid, as it is supplied to the Reactor Coolant System (RCS) by the safety injection pumps.
The SWS is designed to perform its function with a single failure of any active component, assuming loss of offsite power.
The SWS, in conjunction with the CCW System, also cools the unit from Decay Heat Removal (DHR) System, as discussed in the FSAR, Section [6.3], (Ref. 3) entry conditions to MODE 5 during normal and post accident operation. The time required for this evolution is a function of the number of CCW and DHR System trains that are operating. One Babcock & Wilcox STS                    B 3.7.8-1                                        Rev. 5.0

SWS B 3.7.8 BASES APPLICABLE SAFETY ANALYSES (continued)
SWS train is sufficient to remove decay heat during subsequent operations in MODES 5 and 6. This assumes a maximum SWS temperature of [85]&deg;F occurring simultaneously with maximum heat loads on the system.
The SWS is also required when needed to support CCW in the removal of heat from the emergency diesel generators (EDGs) or reactor auxiliaries.
The SWS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                Two SWS trains are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming the worst case single active failure occurs coincident with the loss of offsite power.
An SWS train is considered OPERABLE when:
: a. It has an OPERABLE pump and
: b. The associated piping, valves, heat exchanger, and instrumentation and controls required to perform the safety related function are OPERABLE.
APPLICABILITY      In MODES 1, 2, 3, and 4, the SWS is a normally operating system that is required to support the OPERABILITY of the equipment serviced by the SWS and required to be OPERABLE in these MODES.
Although the LCO for the SWS is not applicable in MODES 5 and 6, the capability of the SWS to perform its necessary related support functions may be required for OPERABILITY of supported systems.
ACTIONS            A.1 If one SWS train is inoperable, action must be taken to restore OPERABLE status within 72 hours [or in accordance with the Risk Informed Completion Time Program]. In this Condition, the remaining OPERABLE SWS train is adequate to perform the heat removal function.
However, the overall reliability is reduced because a single failure in the OPERABLE SWS train could result in loss of SWS function. Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources -
Operating," should be entered if an inoperable SWS train results in an inoperable EDG. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4,"
Babcock & Wilcox STS                  B 3.7.8-2                                        Rev. 5.0

SWS B 3.7.8 BASES ACTIONS (continued) should be entered if an inoperable SWS train results in an inoperable DHR train. The 72 hour Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this period.
B.1 and B.2 If the SWS train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which overall plant risk is minimized. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 4). The stored energy in the RCS that must be removed by the SWS in the event of an accident in MODE 4 is substantially less than the energy assumed due to an accident at power. Therefore, the heat loads on the SWS are substantially reduced. Because of the reduction in RCS pressure and temperature in MODE 4, the likelihood of an event is also reduced. In addition, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
Babcock & Wilcox STS                   B 3.7.8-3                                         Rev. 5.0

SWS B 3.7.8 BASES SURVEILLANCE       SR 3.7.8.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the SWS flow path provides assurance that the proper flow paths exist for SWS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves.
[ The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note indicating that the isolation of the SWS components or systems may render those components inoperable but does not affect the OPERABILITY of the SWS.
SR 3.7.8.2 The SR verifies proper automatic operation of the SWS valves. The SWS is a normally operating system that cannot be fully actuated as part of the normal testing. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. [ The
[18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the
[18] month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.
Babcock & Wilcox STS                      B 3.7.8-4                                                       Rev. 5.0

SWS B 3.7.8 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.7.8.3 The SR verifies proper automatic operation of the SWS pumps on an actual or simulated actuation signal. The SWS is a normally operating system that cannot be fully actuated as part of normal testing during normal operation. [ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at an [18] month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.7.8-5                                                       Rev. 5.0

SWS B 3.7.8 BASES REFERENCES         1. FSAR, Section [9.2.1].
: 2. FSAR, Section [6.2].
: 3. FSAR, Section [6.3].
: 4. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS              B 3.7.8-6                                      Rev. 5.0

UHS B 3.7.9 B 3.7 PLANT SYSTEMS B 3.7.9 Ultimate Heat Sink (UHS)
BASES BACKGROUND           The UHS provides a heat sink for process and operating heat from safety related components during a transient or accident as well as during normal operation. This is done utilizing the Service Water System (SWS).
The UHS has been defined as that complex of water sources, including necessary retaining structures (e.g., a pond with its dam, or a river with its dam), and the canals or conduits connecting the sources with, but not including, the cooling water system intake structures, as discussed in the FSAR, Section [9.2.5] (Ref. 1). If cooling towers or portions thereof are required to accomplish the UHS safety functions, they should meet the same requirements as the sink. The two principal functions of the UHS are the dissipation of residual heat after a reactor shutdown, and dissipation of residual heat after an accident.
A variety of complexes is used to meet the requirements for a UHS. A lake or an ocean may qualify as a single source. If the complex includes a water source contained by a structure, it is likely that a second source will be required.
The basic performance requirements are that a 30 day supply of water be available, and that the design basis temperatures of safety related equipment not be exceeded. Basins of cooling towers generally include less than a 30 day supply of water, typically 7 days or less. A 30 day supply would be dependent on another source(s) and a makeup system(s) for replenishing the source in the cooling tower basin. For smaller basin sources, which may be as small as a 1 day supply, the systems for replenishing the basin and the backup source(s) become of sufficient importance that the makeup system itself may be required to meet the same design criteria as an Engineered Safety Feature (e.g.,
single failure considerations and multiple makeup water sources may be required).
Additional information on the design and operation of the system, along with a list of components served, can be found in Reference 1.
APPLICABLE           The UHS is the sink for heat removal from the reactor core following all SAFETY               accidents and anticipated operational occurrences in which the unit is ANALYSES             cooled down and placed on [decay heat removal]. Its maximum post accident heat load occurs approximately 20 minutes after a design basis loss of coolant accident (LOCA). Near this time, the unit switches from injection to recirculation and the containment cooling systems are required to remove the core decay heat.
Babcock & Wilcox STS                     B 3.7.9-1                                        Rev. 5.0

UHS B 3.7.9 BASES APPLICABLE SAFETY ANALYSES (continued)
The operating limits are based on conservative heat transfer analyses for the worst case LOCA. Reference 1 provides the details of the assumptions used in the analysis. These assumptions include: worst expected meteorological conditions, conservative uncertainties when calculating decay heat, and the worst case failure (e.g., single failure of a manmade structure). The UHS is designed in accordance with Regulatory Guide 1.27 (Ref. 2), which requires a 30 day supply of cooling water in the UHS.
The UHS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The UHS is required to be OPERABLE and is considered OPERABLE if
[it contains a sufficient volume of water at or below the maximum temperature] that would allow the SWS to operate for at least 30 days following the design basis LOCA without the loss of net positive suction head (NPSH), and without exceeding the maximum design temperature of the equipment served by the SWS. To meet this condition, the UHS temperature should not exceed [90]&deg;F, and the level should not fall below
[562] ft [mean sea level] during normal unit operation.
APPLICABILITY      In MODES 1, 2, 3, and 4, the UHS is a normally operating system that is required to support the OPERABILITY of the equipment serviced by the UHS and is required to be OPERABLE in these MODES.
Although the LCO for the UHS is not applicable in MODES 5 and 6, the capability of the UHS to perform its necessary related support functions may be required for OPERABILITY of supported systems.
ACTIONS            [ A.1 If one or more cooling towers have one fan inoperable (i.e., at least one fan per cooling tower is OPERABLE), action must be taken to restore the inoperable cooling tower fan(s) to OPERABLE status within 7 days [or in accordance with the Risk Informed Completion Time Program].
The 7 day Completion Time is reasonable, based on the low probability of an accident occurring during the 7 days that one cooling tower fan is inoperable in one or more cooling towers, the number of available systems, and the time required to complete the Required Action. ]
Babcock & Wilcox STS                   B 3.7.9-2                                        Rev. 5.0

UHS B 3.7.9 BASES ACTIONS (continued)
B.1 and B.2 If the cooling tower fan cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 3). The stored energy in the Reactor Coolant System (RCS) that must be removed by the UHS in the event of an accident in MODE 4 is substantially less than the energy assumed due to an accident at power.
Therefore, the heat load on the UHS is substantially reduced. Because of the reduction in RCS pressure and temperature in MODE 4, the likelihood of an event is also reduced. In addition, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
[ C.1
                     -----------------------------------REVIEWERS NOTE-----------------------------------
The [ ]&deg;F is the maximum allowed UHS temperature value and is based on temperature limitations of the equipment that is relied upon for accident mitigation and safe shutdown of the unit.
With water temperature of the UHS > [90]&deg;F, the design basis assumption associated with initial UHS temperature is bounded provided the temperature of the UHS averaged over the previous 24 hour period is
[90]&deg;F. With the water temperature of the UHS > [90]&deg;F, long term Babcock & Wilcox STS                        B 3.7.9-3                                                       Rev. 5.0

UHS B 3.7.9 BASES ACTIONS (continued) cooling capability of the ECCS loads and DGs may be affected.
Therefore, to ensure long term cooling capability is provided to the ECCS loads when water temperature of the UHS is > [90]&deg;F, Required Action C.1 is provided to more frequently monitor the water temperature of the UHS and verify the temperature is  [90]&deg;F when averaged over the previous 24 hour period. The once per hour Completion Time takes into consideration UHS temperature variations and the increased monitoring frequency needed to ensure design basis assumptions and equipment limitations are not exceeded in this condition. If the water temperature of the UHS exceeds [90]&deg;F when averaged over the previous 24 hour period or the water temperature of the UHS exceeds [ ]&deg;F, Condition D must be entered immediately. ]
[ D.1 and D.2 If the Required Actions and Completion Time of Condition C are not met, or the UHS is inoperable [for reasons other than Condition A or C], the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. ]
SURVEILLANCE         [ SR 3.7.9.1 REQUIREMENTS This SR verifies that adequate long term (30 days) cooling can be maintained. The level specified also ensures NPSH is available for operating the SWS pumps. [ The 24 hour Frequency is based on operating experience related to the trending of the parameter variations during the applicable MODES.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
This SR verifies that the UHS water level is  [ ] ft [mean sea level]. ]
Babcock & Wilcox STS                        B 3.7.9-4                                                       Rev. 5.0

UHS B 3.7.9 BASES SURVEILLANCE REQUIREMENTS (continued)
[ SR 3.7.9.2 This SR verifies that the SWS can cool the CCW System to at least its maximum design temperature within the maximum [ accident or normal heat loads for 30 days following a Design Basis Accident. [ The 24 hour Frequency is based on operating experience related to the trending of the parameter variations during the applicable MODES. This SR verifies that the UHS average water temperature is  [90]&deg;F.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ---------------------------------------------------------------------------------------------- ] ]
[ SR 3.7.9.3 Operating each cooling tower fan for  [15] minutes ensures that all fans are OPERABLE and that all associated controls are functioning properly.
It also ensures that fan or motor failure, or excessive vibration, can be detected for corrective action. [ The 31 day Frequency is based on operating experience, known reliability of the fan units, the redundancy available, and the low probability of significant degradation of the UHS cooling tower fans occurring between surveillances.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ---------------------------------------------------------------------------------------------- ] ]
Babcock & Wilcox STS                        B 3.7.9-5                                                       Rev. 5.0

UHS B 3.7.9 BASES REFERENCES         1. FSAR, Section [9.2.5].
: 2. Regulatory Guide 1.27.
: 3. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS              B 3.7.9-6                                      Rev. 5.0

CREVS B 3.7.10 B 3.7 PLANT SYSTEMS B 3.7.10 Control Room Emergency Ventilation System (CREVS)
BASES BACKGROUND          The CREVS provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke.
The CREVS consists of two independent, redundant trains that recirculate and filter the air in the control room envelope (CRE) and a CRE boundary that limits the inleakage of unfiltered air. Each CREVS train consists of a roughing filter, a water condensing unit, a high efficiency particulate air (HEPA) filter, a charcoal filter for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, doors, barriers, and instrumentation also form part of the system.
The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.
The CREVS is an emergency system. Upon receipt of the activating signal(s), the normal CRE ventilation system is automatically shut down and the CREVS can be manually started. The roughing filters and water condensing units remove any large particles in the air, and any entrained water droplets present, to prevent excessive loading of the HEPA and charcoal filters.
A single CREVS train operating at a flow rate of  [3300] cfm will pressurize the CRE to about 1/8 inch water gauge relative to external areas adjacent to the CRE boundary. The CREVS operation is discussed in the FSAR, Section [9.4] (Ref. 1).
The CREVS is designed to maintain a habitable environment in the CRE for 30 days of continuous occupancy after a DBA, without exceeding a
[5 rem whole body dose or its equivalent to any part of the body] [5 rem total effective dose equivalent (TEDE)].
Babcock & Wilcox STS                    B 3.7.10-1                                        Rev. 5.0

CREVS B 3.7.10 BASES APPLICABLE         The CREVS components are arranged in redundant safety related SAFETY             ventilation trains. The location of components and ducting within the ANALYSES           CRE ensures an adequate supply of filtered air to all areas requiring access. The CREVS provides airborne radiological protection for the CRE occupants as demonstrated by the CRE occupant dose analyses for the most limiting design basis accident fission product release presented in the FSAR, Chapter [15] (Ref. 2).
The CREVS provides protection from smoke and hazardous chemicals to the CRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref. 3). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 4).
The worst case single active failure of a CREVS component, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.
The CREVS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                Two independent and redundant CREVS trains are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other train. Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of [5 rem whole body or its equivalent to any part of the body] [5 rem TEDE] to the CRE occupants in the event of a large radioactive release.
Each CREVS train is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE.
A CREVS train is considered OPERABLE when the associated:
: a. Fan is OPERABLE,
: b. HEPA filter and charcoal absorber are not excessively restricting flow, and are capable of performing their filtration functions, and
: c. Heater, demister, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.
In order for the CREVS trains to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.
Babcock & Wilcox STS                  B 3.7.10-2                                         Rev. 5.0

CREVS B 3.7.10 BASES LCO (continued)
The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls. This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.
APPLICABILITY      In MODES 1, 2, 3, 4, [5, and 6,] and during movement of [recently]
irradiated fuel assemblies, the CREVS must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA.
In MODES [5 and 6], the CREVS is required to cope with the release from a rupture of an outside waste gas tank.
During movement of [recently] irradiated fuel assemblies, the CREVS must be OPERABLE to cope with a release due to a fuel handling accident [involving handling recently irradiated fuel. Due to radioactive decay, the CREVS is only required to mitigate fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [X] days)].
ACTIONS            A.1 With one CREVS train inoperable, for reasons other than an inoperable CRE boundary, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CREVS train is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE CREVS train could result in loss of CREVS function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.
B.1, B.2, and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to [5 rem whole body or its equivalent to Babcock & Wilcox STS                    B 3.7.10-3                                       Rev. 5.0

CREVS B 3.7.10 BASES ACTIONS (continued) any part of the body] [5 rem TEDE]), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.
During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.
C.1 and C.2 In MODE 1, 2, 3, or 4, if the inoperable CREVS train or the CRE boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE overall plant risk is minimized. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 5). The control room is isolated and the CREVS is utilized in the event of an accident, such as a loss of coolant accident, to reduce or eliminate the ingress of radioactive material released during the event into the control room. Because of the reduction in RCS pressure and temperature in MODE 4, the likelihood of an accident is reduced. In addition, there are more accident mitigation systems available and there is more redundancy Babcock & Wilcox STS                    B 3.7.10-4                                        Rev. 5.0

CREVS B 3.7.10 BASES ACTIONS (continued) and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action C.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
[ D.1 and D.2
[ In MODE 5 or 6, or] during movement of [recently] irradiated fuel assemblies, if the inoperable CREVS train cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE CREVS train must immediately be placed in the emergency mode. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure will be readily detected.
An alternative to Required Action D.1 is to immediately suspend activities that could release radioactivity that might require isolation of the CRE.
This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.
Required Action D.1 is modified by a Note indicating to place the system in the emergency mode if automatic transfer to the emergency mode is inoperable. ]
Babcock & Wilcox STS                   B 3.7.10-5                                          Rev. 5.0

CREVS B 3.7.10 BASES ACTIONS (continued)
[ E.1
[In MODE 5 or 6, or] during movement of [recently] irradiated fuel assemblies, when two CREVS trains are inoperable or with one or more CREVS trains inoperable, action must be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position. ]
F.1 If both CREVS trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable CRE boundary (i.e., Condition B), the CREVS may not be capable of performing the intended function and the unit is in a condition outside the accident analysis. Therefore, LCO 3.0.3 must be entered immediately.
SURVEILLANCE         SR 3.7.10.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not severe, testing each train once every month adequately checks this system. Operation [with the heaters on] for  15 continuous minutes demonstrates OPERABILITY of the system. Periodic operation ensures that [heater failure,] blockage, fan or motor failure, or excessive vibration can be detected for corrective action. [ The 31 day Frequency is based on the known reliability of the equipment and the two train redundancy available.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                        B 3.7.10-6                                                      Rev. 5.0

CREVS B 3.7.10 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.7.10.2 This SR verifies that the required CREVS testing is performed in accordance with the [Ventilation Filter Testing Program (VFTP)]. The
[VFTP] includes testing HEPA filter performance, charcoal absorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal. Specific test Frequencies and additional information are discussed in detail in the [VFTP].
SR 3.7.10.3 This SR verifies that [each CREVS train starts] [or the CRE isolates] and operates on an actual or simulated actuation signal. The SR excludes automatic dampers and valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to dampers or valves that are locked, sealed, or otherwise secured in the actuated position since the affected dampers or valves were verified to be in the actuated position prior to being locked, sealed, or otherwise secured.
Placing an automatic valve or damper in a locked, sealed, or otherwise secured position requires an assessment of the OPERABILITY of the system or any supported systems, including whether it is necessary for the valve or damper to be repositioned to the non-actuated position to support the accident analysis. Restoration of an automatic valve or damper to the non-actuated position requires verification that the SR has been met within its required Frequency. [ The Frequency of [18] months is based on industry operating experience and is consistent with the typical refueling cycle.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.7.10-7                                                      Rev. 5.0

CREVS B 3.7.10 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.7.10.4 This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.
The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than [5 rem whole body or its equivalent to any part of the body] [5 rem TEDE] and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 6) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 7). These compensatory measures may also be used as mitigating actions as required by Required Action B.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 8).
Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.
SR 3.7.10.5 This SR verifies the CREVS can supply the CRE with outside air to meet the design requirement. [ The Frequency of [18] months is consistent with industry practice and other filtration SRs.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                  B 3.7.10-8                                        Rev. 5.0

CREVS B 3.7.10 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Section [9.4].
: 2. FSAR, Chapter [15].
: 3. FSAR, Section [6.4].
: 4. FSAR, Section [9.5].
: 5. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
: 6. Regulatory Guide 1.196.
: 7. NEI 99-03, "Control Room Habitability Assessment," June 2001.
: 8. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No. ML040300694).
Babcock & Wilcox STS                      B 3.7.10-9                                                      Rev. 5.0

CREATCS B 3.7.11 B 3.7 PLANT SYSTEMS B 3.7.11 Control Room Emergency Air Temperature Control System (CREATCS)
BASES BACKGROUND          The CREATCS provides temperature control for the control room following isolation of the control room.
The CREATCS consists of two independent and redundant trains that provide cooling of recirculated control room air. A cooling coil and a water cooled condensing unit are provided for each system to provide suitable temperature conditions in the control room for operating personnel and safety related control equipment. Ductwork, valves or dampers, and instrumentation also form part of the system. Two redundant air cooled condensing units are provided as a backup to the water cooled condensing unit. Both the water cooled and air cooled condensing units must be OPERABLE for the CREATCS to be OPERABLE. During emergency operation, the CREATCS maintains the temperature between 70&deg;F and 85&deg;F. The CREATCS is a subsystem providing air temperature control for the control room.
The CREATCS is an emergency system. On detection of high containment building pressure or radiation, low Reactor Coolant System pressure, or high noble gas radioactivity in the station vent, the normal control room ventilation system is automatically shut down, and the Control Room Emergency Ventilation System can be manually started. A single train will provide the required temperature control. The CREATCS operation to maintain control room temperature is discussed in the FSAR, Section [9.4] (Ref. 1).
APPLICABLE          The design basis of the CREATCS is to maintain control room SAFETY              temperature for 30 days of continuous occupancy.
ANALYSES The CREATCS components are arranged in redundant, safety related trains. During emergency operation, the CREATCS maintains the temperature between [70]&deg;F and [95]&deg;F. A single active failure of a CREATCS component does not impair the ability of the system to perform as designed. The CREATCS is designed in accordance with Seismic Category I requirements. The CREATCS is capable of removing sensible and latent heat loads from the control room, including consideration of equipment heat loads and personnel occupancy requirements, to ensure equipment OPERABILITY.
The CREATCS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                    B 3.7.11-1                                       Rev. 5.0

CREATCS B 3.7.11 BASES LCO                Two independent and redundant trains of the CREATCS are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other train. Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident.
The CREATCS is considered OPERABLE when the individual components that are necessary to maintain control room temperature are OPERABLE in both trains. These components include the cooling coils, water cooled condensing units, and associated temperature control instrumentation. In addition, the CREATCS must be OPERABLE to the extent that air circulation can be maintained.
APPLICABILITY      In MODES 1, 2, 3, 4, [5, and 6,] and during movement of [recently]
irradiated fuel assemblies [i.e., fuel that has occupied part of a critical reactor core within the previous [X] days)], the CREATCS must be OPERABLE to ensure that the control room temperature will not exceed equipment OPERABILITY requirements following isolation of the control room.
ACTIONS            A.1 With one CREATCS train inoperable, action must be taken to restore OPERABLE status within 30 days. In this Condition, the remaining OPERABLE CREATCS train is adequate to maintain the control room temperature within limits. However, the overall reliability is reduced because a failure in the OPERABLE CREATCS train could result in a loss of CREATCS function. The 30 day Completion Time is based on the low probability of an event occurring requiring control room isolation, the consideration that the remaining train can provide the required capabilities, and the alternate safety or nonsafety related cooling means that are available.
Concurrent failure of two CREATCS trains would result in the loss of function capability; therefore, LCO 3.0.3 must be entered immediately.
B.1 and B.2 In MODE 1, 2, 3, or 4, if the inoperable CREATCS train cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE in which overall plant risk is minimized.
To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours.
Babcock & Wilcox STS                  B 3.7.11-2                                          Rev. 5.0

CREATCS B 3.7.11 BASES ACTIONS (continued)
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 2). The control room is isolated in the event of an accident, such as a loss of coolant accident, to reduce or eliminate the ingress of radioactive material released during the event into the control room. However, control room ambient temperatures may increase as a result of operating in this manner. The CREATCS mitigates this temperature rise. Because of the reduction in Reactor Coolant System (RCS) pressure and temperature in MODE 4, the likelihood of an accident is also reduced. In addition, there are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner without challenging unit systems.
[ C.1 and C.2
[In MODE 5 or 6, or] during movement of [recently] irradiated fuel, if the inoperable CREATCS train cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE CREATCS train must be placed in operation immediately. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure will be readily detected.
An alternative to Required Action C.1 is to immediately suspend activities that could release radioactivity that might require the isolation of the control room. This places the unit in a condition that minimizes accident risk. This does not preclude the movement of fuel to a safe position. ]
Babcock & Wilcox STS                   B 3.7.11-3                                          Rev. 5.0

CREATCS B 3.7.11 BASES ACTIONS (continued)
[ D.1
[In MODE 5 or 6, or] during movement of [recently] irradiated fuel assemblies, with two CREATCS trains inoperable, action must be taken to immediately suspend activities that could release radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes accident risk. This does not preclude the movement of fuel to a safe position. ]
E.1 If both CREATCS trains are inoperable in MODE 1, 2, 3, or 4, the CREATCS may not be capable of performing the intended function and the unit is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.
SURVEILLANCE         SR 3.7.11.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to remove the heat load assumed in the [safety analyses]. This SR consists of a combination of testing and calculations. [ An [18] month Frequency is appropriate, as significant degradation of the CREATCS is slow and is not expected over this time period.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
REFERENCES           1. FSAR, Section [9.4].
: 2. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                        B 3.7.11-4                                                      Rev. 5.0

EVS B 3.7.12 B 3.7 PLANT SYSTEMS B 3.7.12 Emergency Ventilation System (EVS)
BASES BACKGROUND         The EVS filters air from the area of the active Emergency Core Cooling System (ECCS) components during the recirculation phase of a loss of coolant accident (LOCA).
The EVS consists of two independent, redundant trains. Each train consists of a prefilter, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), and a fan. Ductwork, valves or dampers, and instrumentation also form part of the system. The system initiates filtered ventilation of the Auxiliary Building negative pressure area following receipt of a safety features actuation signal (SFAS).
The EVS is a standby system. During emergency operations, the EVS dampers are realigned, and fans are started to begin filtration. Upon receipt of the SFAS signal(s), normal air discharges from the negative pressure area are isolated, and the stream of ventilation air discharges through the system filter trains. The prefilters remove any large particles in the air, and any entrained water droplets present, to prevent excessive loading of the HEPA filters and charcoal adsorbers.
The EVS is discussed in the FSAR, Sections [6.2.3], [9.4.2], and 15.4.6]
(Refs. 1, 2, and 3, respectively).
APPLICABLE         The design basis of the EVS is established by the large break LOCA.
SAFETY             The system evaluation assumes a passive failure of the ECCS outside ANALYSES           containment, such as an ECCS pump seal failure during the recirculation mode. In such a case, the system limits radioactive release to within 10 CFR 100 (Ref. 4) requirements. The analysis of the effects and consequences of a large break LOCA is presented in Reference 3. The EVS also actuates following a small break LOCA, in those cases where the unit goes into the recirculation mode of long term cooling, and to cleanup releases of smaller leaks, such as from valve stem packing.
Two types of system failures are considered in the accident analysis:
complete loss of function, and excessive LEAKAGE. Either type of failure may result in a lower efficiency of removal of any gaseous and particulate activity released to the ECCS pump rooms following a LOCA.
Following a LOCA, an ESFAS signal starts the EVS fans and opens the dampers located in the penetration room outlet ductwork. The ESFAS signal closes all containment isolation valves and purge system valves.
The purge system fans, if running, are shut down automatically.
Babcock & Wilcox STS                  B 3.7.12-1                                           Rev. 5.0

EVS B 3.7.12 BASES APPLICABLE SAFETY ANALYSES (continued)
The EVS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                Two independent and redundant trains of the EVS are required to be OPERABLE to ensure that at least one is available, assuming that a single failure disables the other train coincident with loss of offsite power.
Total system failure could result in atmospheric release from the negative pressure area boundary exceeding Reference 4 limits in the event of a Design Basis Accident (DBA).
The EVS is considered OPERABLE when the individual components necessary to maintain the negative pressure area boundary filtration are OPERABLE in both trains.
An EVS train is considered OPERABLE when its associated:
: a. Fan is OPERABLE,
: b. HEPA filter and charcoal adsorber are not excessively restricting flow, and are capable of performing their filtration functions, and
: c.   [Heater, demister,] ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.
The LCO is modified by a Note allowing the Auxiliary Building negative pressure area boundary to be opened intermittently under administrative controls. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area.
For other openings, these controls consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual will have a method to rapidly close the opening when a need for Auxiliary Building negative pressure area isolation is indicated.
APPLICABILITY      In MODES 1, 2, 3, and 4, the EVS is required to be OPERABLE consistent with the OPERABILITY requirements of the ECCS.
In MODES 5 and 6, the EVS is not required to be OPERABLE since the ECCS is not required to be OPERABLE.
ACTIONS            A.1 With one EVS train inoperable, action must be taken to restore OPERABLE status within 7 days. During this time, the remaining OPERABLE train is adequate to perform the EVS safety function.
However, the overall reliability is reduced because a single failure in the OPERABLE EVS train could result in loss of EVS function.
Babcock & Wilcox STS                  B 3.7.12-2                                          Rev. 5.0

EVS B 3.7.12 BASES ACTIONS (continued)
The 7 day Completion Time is appropriate because the risk contribution is less than that of the ECCS (72 hour Completion Time), and this system is not a direct support system for the ECCS. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.
B.1
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Adoption of Condition B is dependent on a commitment from the licensee to have written procedures available describing compensatory measures to be taken in the event of an intentional or unintentional entry into Condition B.
If the Auxiliary Building negative pressure area boundary is inoperable, the EVS trains cannot perform their intended functions. Actions must be taken to restore an OPERABLE Auxiliary Building negative pressure area boundary within 24 hours. During the period that the Auxiliary Building negative pressure area boundary is inoperable, appropriate compensatory measures [consistent with the intent, as applicable, of GDC 19, 63, 64 and 10 CFR Part 100] should be utilized to protect plant personnel from potential hazards such as radioactive contamination, toxic chemicals, smoke, temperature and relative humidity, and physical security. Preplanned measures should be available to address these concerns for intentional and unintentional entry into the condition. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 24 hour Completion Time is a typically reasonable time to diagnose, plan and possibly repair, and test most problems with the Auxiliary Building negative pressure area boundary.
C.1 and C.2 If the EVS train or the Auxiliary Building negative pressure area boundary cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
Babcock & Wilcox STS                      B 3.7.12-3                                                      Rev. 5.0

EVS B 3.7.12 BASES SURVEILLANCE       SR 3.7.12.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. Since the environment and normal operating conditions on this system are not severe, testing each train once a month provides an adequate check on this system. Operation [with the heaters on] for 15 continuous minutes demonstrates OPERABILITY of the system.
Periodic operation ensures that [heater failure,] blockage, fan or motor failure, or excessive vibration can be detected for corrective action. [ The 31 day Frequency is based on known reliability of equipment and the two train redundancy available.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.7.12.2 This SR verifies that the required EVS testing is performed in accordance with the [Ventilation Filter Testing Program (VFTP)]. The [VFTP] includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). Specific test frequencies and additional information are discussed in detail in the [VFTP].
SR 3.7.12.3 This SR verifies that each EVS train starts and operates on an actual or simulated actuation signal. The SR excludes automatic dampers and valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to dampers or valves that are locked, sealed, or otherwise secured in the actuated position since the affected dampers or valves were verified to be in the actuated position prior to being locked, sealed, or otherwise secured. Placing an automatic valve or damper in a locked, sealed, or otherwise secured position requires an assessment of the OPERABILITY of the system or any supported Babcock & Wilcox STS                      B 3.7.12-4                                                      Rev. 5.0

EVS B 3.7.12 BASES SURVEILLANCE REQUIREMENTS (continued) systems, including whether it is necessary for the valve or damper to be repositioned to the non-actuated position to support the accident analysis.
Restoration of an automatic valve or damper to the non-actuated position requires verification that the SR has been met within its required Frequency. [ The [18] month Frequency is consistent with that specified in Reference 5.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.7.12.4 This SR verifies the integrity of the negative pressure boundary area.
The ability of the EVS to maintain a negative pressure, with respect to potentially uncontaminated adjacent areas, is periodically tested to verify proper functioning of the EVS. During the [post accident] mode of operation, the EVS is designed to maintain a slight negative pressure in the negative pressure boundary area with respect to adjacent areas to prevent unfiltered LEAKAGE. The EVS is designed to maintain this negative pressure at a flow rate of [3000] cfm from the negative pressure boundary area. [ The Frequency of [18] months on a STAGGERED TEST BASIS is consistent with industry practice and other filtration SRs.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.7.12-5                                                      Rev. 4.0

EVS B 3.7.12 BASES SURVEILLANCE REQUIREMENTS (continued)
[ SR 3.7.12.5 Operating the EVS filter bypass damper is necessary to ensure that the system functions properly. The OPERABILITY of the EVS filter bypass damper is verified if it can be opened. The SR excludes automatic dampers that are locked, sealed, or otherwise secured in the open position. The SR does not apply to dampers that are locked, sealed, or otherwise secured in the open position since the affected dampers were verified to be in the open position prior to being locked, sealed, or otherwise secured. Placing an automatic damper in a locked, sealed, or otherwise secured position requires an assessment of the OPERABILITY of the system or any supported systems, including whether it is necessary for the damper to be closed to support the accident analysis. Restoration of an automatic damper to the closed position requires verification that the SR has been met within its required Frequency. [ An [18] month Frequency is consistent with that specified in Reference 5.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ---------------------------------------------------------------------------------------------- ] ]
REFERENCES           1. FSAR, Section [6.2.3].
: 2. FSAR, Section [9.4.2].
: 3. FSAR, Section [15.4.6].
: 4. 10 CFR 100.11.
: 5. Regulatory Guide 1.52, Rev. [2].
Babcock & Wilcox STS                        B 3.7.12-6                                                      Rev. 5.0

FSPVS B 3.7.13 B 3.7 PLANT SYSTEMS B 3.7.13 Fuel Storage Pool Ventilation System (FSPVS)
BASES BACKGROUND           The FSPVS provides negative pressure in the fuel storage area, and filters airborne radioactive particulates from the area of the fuel pool following a fuel handling accident.
The FSPVS consists of portions of the normal Fuel Handling Area Ventilation System (FHAVS), the station Emergency Ventilation System (EVS), ductwork bypasses, and dampers. The portion of the normal FHAVS used by the FSPVS consists of ducting between the spent fuel pool and the normal FHAVS exhaust fans or dampers, and redundant radiation detectors installed close to the suction end of the FHAVS exhaust fan ducting. The portion of the EVS used by the FSPVS consists of two independent, redundant trains. Each train consists of a heater, prefilter, or high efficiency particulate air (HEPA) filter, activated charcoal adsorber section for removal of gaseous activity (principally iodines), and fan. Ductwork, valves or dampers, and instrumentation also form part of the system. Two isolation valves are installed in series in the ductwork between the FHAVS and the EVS to provide isolation of the EVS from the FHAVS on an Engineered Safety Feature actuation signal. These valves are opened prior to fuel handling operations [involving handling recently irradiated fuel]. The EVS is the subject of LCO 3.7.12, "Emergency Ventilation System (EVS)," and is fully described in the FSAR, Section [6.2.3], Reference 12. A ductwork bypass with redundant dampers connects the FHAVS to the EVS.
During normal operation, the exhaust from the fuel handling area is passed through the FHAVS exhaust filter and is discharged through the station vent stack. In the event of a fuel handling accident, the radiation detectors (one per EVS train), located at the suction of the FHAVS exhaust fan ducting, send signals to isolate the FHAVS supply and exhaust fans and ductwork, open the redundant dampers in the bypass ductwork, and start the EVS fans. The EVS fans pull the air from the fuel handling area, creating a negative pressure, and discharge the filtered air to the station vent.
The FHAVS is discussed in the FSAR, Sections [6.2.3], [9.4.2],
and [15.4.7] (Refs. 1, 2, and 3, respectively), because it may be used for normal as well as post accident, atmospheric cleanup functions.
APPLICABLE           The FSPVS design basis is established by the consequences of the SAFETY               limiting Design Basis Accident (DBA), which is a fuel handling accident ANALYSES             [involving handling recently irradiated fuel]. The analysis of the fuel handling accident, given in Reference 3, assumes that a certain number of fuel rods in an assembly are damaged. The DBA analysis of the fuel Babcock & Wilcox STS                     B 3.7.13-1                                          Rev. 5.0

FSPVS B 3.7.13 BASES APPLICABLE SAFETY ANALYSES (continued) handling accident [involving handling recently irradiated fuel] assumes that only one train of the FSPVS is functional due to a single failure that disables the other train. The accident analysis accounts for the reduction in airborne radioactive material provided by the remaining one train of this filtration system. These assumptions and the analysis follow the guidance provided in Regulatory Guide 1.25 (Ref. 4).
The FSPVS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                [Two] independent and redundant trains of the FSPVS are required to be OPERABLE to ensure that at least one is available, assuming a single failure that disables the other train coincident with a loss of offsite power.
Total system failure could result in the atmospheric release from the fuel handling area exceeding 10 CFR 100 (Ref. 5) limits in the event of a fuel handling accident [involving handling recently irradiated fuel].
The FSPVS is considered OPERABLE when the individual components necessary to control operator exposure in the fuel handling building are OPERABLE in both trains. An FSPVS train is considered OPERABLE when its associated:
: a. Fan is OPERABLE,
: b. HEPA filter and charcoal adsorber are not excessively restricting flow, and are capable of performing their filtration functions, and
: c.    [Heater, demister,] ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.
The LCO is modified by a Note allowing the fuel building boundary to be opened intermittently under administrative controls. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls consist of stationing a dedicated individual at the opening who is in continuous communication with the control room. This individual will have a method to rapidly close the opening when a need for fuel building isolation is indicated.
APPLICABILITY      [ In [MODES 1, 2, 3, and 4,] the FSPVS is required to be OPERABLE to provide fission product removal associated with ECCS leaks due to a loss of coolant accident (refer to LCO 3.7.12) for units that use this system as part of their EVSs.
During movement of [recently] irradiated fuel assemblies in the fuel handling area, the FSPVS is always required to be OPERABLE to mitigate the consequences of a fuel handling accident.
Babcock & Wilcox STS                  B 3.7.13-2                                          Rev. 5.0

FSPVS B 3.7.13 BASES APPLICABILITY (continued)
In MODES 5 and 6, the FSPVS is not required to be OPERABLE since the ECCS is not required to be OPERABLE. ]
ACTIONS            LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
A.1 With one FSPVS train inoperable, action must be taken to restore OPERABLE status within 7 days. During this time period, the remaining OPERABLE train is adequate to perform the FSPVS function. However, the overall reliability is reduced because a single failure in the OPERABLE FSPVS train could result in a loss of FSPVS functioning.
The 7 day Completion Time is based on the risk from an event occurring requiring the inoperable FSPVS train, and ability of the remaining FSPVS train to provide the required protection.
B.1
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Adoption of Condition B is dependent on a commitment from the licensee to have written procedures available describing compensatory measures to be taken in the even of an intentional or unintentional entry into Condition B.
If the fuel building boundary is inoperable in MODE 1, 2, 3, or 4, the FSPVS trains cannot perform their intended functions. Actions must be taken to restore an OPERABLE fuel building boundary within 24 hours.
During the period that the fuel building boundary is inoperable, appropriate compensatory measures [consistent with the intent, as applicable, of GDC 19, 60, 61, 63, 64 and 10 CFR 100] should be utilized to protect plant personnel from potential hazards such as radioactive contamination, toxic chemicals, smoke, temperature and relative humidity, and physical security. Preplanned measures should be available to address these concerns for intentional and unintentional entry into the condition. The 24 hour Completion Time is reasonable based on Babcock & Wilcox STS                      B 3.7.13-3                                                      Rev. 5.0

FSPVS B 3.7.13 BASES ACTIONS (continued) the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 24 hour Completion Time is a typically reasonable time to diagnose, plan and possibly repair, and test most problems with the fuel building boundary.
[ C.1 and C.2 In MODE 1, 2, 3, or 4, when Required Action A.1 or B.1 cannot be completed within the associated Completion Time, or when both FSPVS trains are inoperable for reasons other than an inoperable fuel building boundary (i.e., Condition B), the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. ]
D.1 and D.2 If the inoperable FSPVS train cannot be restored to OPERABLE status within the required Completion Time, during movement of [recently]
irradiated fuel assemblies in the fuel building the OPERABLE FSPVS train must be started immediately or [recently] irradiated fuel movement suspended. This action ensures that the remaining train is OPERABLE, that no undetected failures preventing system operation will occur, and that any active failures will be readily detected.
If the system is not placed in operation, this action requires suspension of
[recently] irradiated fuel movement, which precludes a fuel handling accident [involving handling recently irradiated fuel]. This action does not preclude the movement of fuel assemblies to a safe position.
E.1 When two trains of the FSPVS are inoperable during movement of
[recently] irradiated fuel assemblies in the fuel building, the unit must be placed in a condition in which the LCO does not apply. This LCO involves immediately suspending movement of [recently] irradiated fuel assemblies in the fuel building. This does not preclude the movement of fuel to a safe position.
Babcock & Wilcox STS                    B 3.7.13-4                                         Rev. 5.0

FSPVS B 3.7.13 BASES SURVEILLANCE         [ SR 3.7.13.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not severe, testing each train once every month provides an adequate check on this system. Operation [with the heaters on] for  15 continuous minutes demonstrates OPERABILITY of the system. Periodic operation ensures that [heater failure,] blockage, fan or motor failure, or excessive vibration can be detected for corrective action.
[ The 31 day Frequency is based on the known reliability of the equipment and the two train redundancy available.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ---------------------------------------------------------------------------------------------- ] ]
[ SR 3.7.13.2 This SR verifies that the required FSPVS testing is performed in accordance with the [Ventilation Filter Testing Program (VFTP)]. The
[VFTP] includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations).
Specific test frequencies and additional information are discussed in detail in the [VFTP]. ]
[ SR 3.7.13.3 This SR verifies that each FSPVS train starts and operates on an actual or simulated actuation signal. The SR excludes automatic dampers and valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to dampers or valves that are locked, sealed, or otherwise secured in the actuated position since the affected dampers or valves were verified to be in the actuated position prior to being locked, sealed, or otherwise secured. Placing an automatic valve or damper in a locked, sealed, or otherwise secured position requires an Babcock & Wilcox STS                        B 3.7.13-5                                                      Rev. 5.0

FSPVS B 3.7.13 BASES SURVEILLANCE REQUIREMENTS (continued) assessment of the OPERABILITY of the system or any supported systems, including whether it is necessary for the valve or damper to be repositioned to the non-actuated position to support the accident analysis.
Restoration of an automatic valve or damper to the non-actuated position requires verification that the SR has been met within its required Frequency. [ The 18 month Frequency is consistent with that specified in Reference 6.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ---------------------------------------------------------------------------------------------- ] ]
SR 3.7.13.4 This SR verifies the integrity of the fuel handling area. The ability of the fuel handling area to maintain a negative pressure, with respect to potentially uncontaminated adjacent areas, is periodically tested to verify proper function of the FSPVS. During the [post accident] mode of operation, the FSPVS is designed to maintain a slight negative pressure in the fuel handling area to prevent unfiltered LEAKAGE. The FSPVS is designed to maintain this negative pressure at a flow rate of  [3000] cfm to the fuel handling area. [ The Frequency of [18] months on a STAGGERED TEST BASIS is consistent with industry practice.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                      B 3.7.13-6                                                      Rev. 5.0

FSPVS B 3.7.13 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.7.13.5 Operating the FSPVS filter bypass damper is necessary to ensure that the system functions properly. The OPERABILITY of the FSPVS filter bypass damper is verified if it can be opened. The SR excludes automatic dampers that are locked, sealed, or otherwise secured in the open position since the affected dampers were verified to be in the open position prior to being locked, sealed, or otherwise secured. Placing an automatic damper in a locked, sealed, or otherwise secured position requires an assessment of the OPERABILITY of the system or any supported systems, including whether it is necessary for the damper to be closed to support the accident analysis. Restoration of an automatic damper to the closed position requires verification that the SR has been met within its required Frequency. [ A Frequency of [18] months is specified in Reference 6.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Section [6.2.3].
: 2. FSAR, Section [9.4.2].
: 3. FSAR, Section [15.4.7].
: 4. Regulatory Guide 1.25.
: 5. 10 CFR 100.11.
: 6. Regulatory Guide 1.52, Rev. [2].
Babcock & Wilcox STS                      B 3.7.13-7                                                      Rev. 5.0

Fuel Storage Pool Water Level B 3.7.14 B 3.7 PLANT SYSTEMS B 3.7.14 Fuel Storage Pool Water Level BASES BACKGROUND           The minimum water level in the fuel storage pool meets the assumption of iodine decontamination factors following a fuel handling accident. The specified water level shields and minimizes the general area dose when the storage racks are filled to their maximum capacity. The water also provides shielding during the movement of spent fuel.
A general description of the fuel storage pool design is given in the FSAR, Section [9.1.2], Reference 1. The Spent Fuel Pool Cooling and Cleanup System is given in the FSAR, Section [9.1.3] (Ref. 2). The assumptions of the fuel handling accident are given in the FSAR, Section [15.4.7]
(Ref. 3).
APPLICABLE           The minimum water level in the fuel storage pool meets the assumptions SAFETY               of the fuel handling accident described in Regulatory Guide 1.25 (Ref. 4).
ANALYSES             The resultant 2 hour thyroid dose to a person at the exclusion area boundary is below 10 CFR 100 (Ref. 5) guidelines.
According to Reference 4, there is 23 ft of water between the top of the damaged fuel bundle and the fuel pool surface for a fuel handling accident. With 23 ft, the assumptions of Reference 4 can be used directly. In practice, the LCO preserves this assumption for the bulk of the fuel in the storage racks. In the case of a single bundle dropped and lying horizontally on top of the spent fuel rack, however, there may be
                     < 23 ft above the top of the fuel bundle and the surface, by the width of the bundle. To offset this small nonconservatism, the analysis assumes that all fuel rods fail, although the analysis shows that only the first [few]
rows fail from a hypothetical maximum drop.
The fuel storage pool water level satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
LCO                  The specified water level preserves the assumptions of the fuel handling accident analysis (Ref. 3). As such, it is the minimum required for fuel storage and movement within the fuel storage pool.
APPLICABILITY        This LCO applies during movement of irradiated fuel assemblies in the fuel storage pool since the potential for a release of fission products exists.
Babcock & Wilcox STS                     B 3.7.14-1                                         Rev. 5.0

Fuel Storage Pool Water Level B 3.7.14 BASES ACTIONS            A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.
When the initial conditions for an accident cannot be met, immediate action must be taken to preclude the occurrence of an accident. With the fuel storage pool at less than the required level, the movement of fuel assemblies in the fuel storage pool is immediately suspended. This effectively precludes the occurrence of a fuel handling accident. In such a case, unit procedures control the movement of loads over the spent fuel. This does not preclude movement of a fuel assembly to a safe position.
If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODES 1, 2, 3, and 4, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.
SURVEILLANCE       SR 3.7.14.1 REQUIREMENTS This SR verifies that sufficient fuel storage pool water is available in the event of a fuel handling accident. The water level in the fuel storage pool must be checked periodically. [ The 7 day Frequency is appropriate because the volume in the pool is normally stable.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
Water level changes are controlled by unit procedures and are acceptable, based on operating experience.
During refueling operations, the level in the fuel storage pool is at equilibrium with that in the refueling canal, and the level in the refueling canal is checked daily in accordance with SR 3.9.6.1.
Babcock & Wilcox STS                      B 3.7.14-2                                                      Rev. 4.0

Fuel Storage Pool Water Level B 3.7.14 BASES REFERENCES         1. FSAR, Section [9.1.2].
: 2. FSAR, Section [9.1.3].
: 3. FSAR, Section [15.4.7].
: 4. Regulatory Guide 1.25.
: 5. 10 CFR 100.11.
Babcock & Wilcox STS              B 3.7.14-3                      Rev. 5.0

[Spent Fuel Pool Boron Concentration]
B 3.7.15 B 3.7 PLANT SYSTEMS B 3.7.15 [ Spent Fuel Pool Boron Concentration ]
BASES BACKGROUND            As described in the following LCO 3.7.16, "Spent Fuel Assembly Storage," fuel assemblies are stored in the spent fuel pool racks [in a "checkerboard" pattern] in accordance with criteria based on [initial enrichment and discharge burnup]. Although the water in the spent fuel pool is normally borated to  [500] ppm, the criteria that limit the storage of a fuel assembly to specific rack locations are conservatively developed without taking credit for boron.
APPLICABLE            A fuel assembly could be inadvertently loaded into a spent fuel rack SAFETY                location not allowed by LCO 3.7.16 (e.g., an unirradiated fuel assembly ANALYSES              or an insufficiently depleted fuel assembly). This accident is analyzed assuming the extreme case of completely loading the spent fuel pool racks with unirradiated assemblies of maximum enrichment. Another type of postulated accident is associated with a fuel assembly that is dropped onto the fully loaded spent fuel pool storage rack. Either incident could have a positive reactivity effect, decreasing the margin to criticality.
However, the negative reactivity effect of the soluble boron compensates for the increased reactivity caused by either one of the two postulated accident scenarios.
The concentration of dissolved boron in the fuel storage pool satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                   The specified concentration [ [500] ppm] of dissolved boron in the fuel storage pool preserves the assumption used in the analyses of the potential accident scenarios described above. This concentration of dissolved boron is the minimum required concentration for fuel assembly storage and movement within the fuel storage pool.
APPLICABILITY         This LCO applies whenever fuel assemblies are stored in the spent fuel pool, until a complete spent fuel pool verification has been performed following the last movement of fuel assemblies in the spent fuel pool.
This LCO does not apply following the verification since the verification would confirm that there are no misloaded fuel assemblies. With no further fuel assembly movement in progress, there is no potential for a misloaded fuel assembly or a dropped fuel assembly.
ACTIONS               A.1, A.2.1, and A.2.2 The Required Actions are modified by a Note indicating that LCO 3.0.3 does not apply.
Babcock & Wilcox STS                     B 3.7.15-1                                         Rev. 5.0

[Spent Fuel Pool Boron Concentration]
B 3.7.15 BASES ACTIONS (continued)
When the concentration of boron in the fuel storage pool is less than required, immediate action must be taken to preclude the occurrence of an accident or to mitigate the consequences of an accident in progress.
This is most efficiently achieved by immediately suspending the movement of the fuel assemblies. This does not preclude movement of a fuel assembly to a safe position. The concentration of boron is restored simultaneously with suspending movement of the fuel assemblies.
Alternatively, beginning a verification of the spent fuel pool locations, to ensure proper locations of the fuel, can be performed. However, prior to resuming movement of fuel assemblies, the concentration of boron must be restored.
If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operation. Therefore, inability to suspend movement of fuel assemblies is not a sufficient reason to require a reactor shutdown.
SURVEILLANCE       This SR verifies that the concentration of boron in the fuel storage pool REQUIREMENTS       is within the required limit. As long as this SR is met, the analyzed incidents are fully addressed. [ The 7 day Frequency is appropriate because no major replenishment of pool water is expected to take place over a short period of time.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         None.
Babcock & Wilcox STS                      B 3.7.15-2                                                      Rev. 5.0

[Spent Fuel Pool Storage]
B 3.7.16 B 3.7 PLANT SYSTEMS B 3.7.16 [ Spent Fuel Pool Storage ]
BASES BACKGROUND            The spent fuel storage facility is designed to store either new (nonirradiated) nuclear fuel assemblies, or burned (irradiated) fuel assemblies in a vertical configuration underwater. The storage pool is sized to store [735] fuel assemblies, which includes storage for [15] failed fuel containers. The spent fuel storage cells are installed in parallel rows with center to center spacing of [12 31/32] inches in one direction, and
[13 3/16] inches in the other orthogonal direction. This spacing and "flux trap" construction, whereby the fuel assemblies are inserted into neutron absorbing stainless steel cans, is sufficient to maintain a keff of  0.95 for spent fuel of original enrichment of up to [3.3]%. However, as higher initial enrichment fuel assemblies are stored in the spent fuel pool, they must be stored in a checkerboard pattern taking into account fuel burnup to maintain a keff of 0.95 or less.
APPLICABLE            The spent fuel storage facility is designed for noncriticality by use of SAFETY                adequate spacing, and "flux trap" construction whereby the fuel ANALYSES              assemblies are inserted into neutron absorbing stainless steel cans.
The spent fuel pool storage satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                   The restrictions on the placement of fuel assemblies within the fuel pool, according to Figure [3.7.16-1] in the accompanying LCO, ensure that the keff of the spent fuel pool will always remain < 0.95 assuming the pool to be flooded with unborated water. The restrictions are consistent with the criticality safety analysis performed for the spent fuel pool, according to Figure [3.7.16-1]. Fuel assemblies not meeting the criteria of Figure [3.7.16-1] shall be stored in accordance with Specification 4.3.1.1.
APPLICABILITY         This LCO applies whenever any fuel assembly is stored in [Region 2] of the spent fuel pool.
Babcock & Wilcox STS                      B 3.7.16-1                                         Rev. 5.0

[Spent Fuel Pool Storage]
B 3.7.16 BASES ACTIONS            A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.
When the configuration of fuel assemblies stored in the spent fuel pool is not in accordance with Figure [3.7.16-1], immediate action must be taken to make the necessary fuel assembly movement(s) to bring the configuration into compliance with Figure [3.7.16-1].
If moving fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operation. Therefore, in either case, inability to move fuel assemblies is not sufficient reason to require a reactor shutdown.
SURVEILLANCE       SR 3.7.16.1 REQUIREMENTS This SR verifies by administrative means that the initial enrichment and burnup of the fuel assembly is in accordance with Figure [3.7.16-1] in the accompanying LCO. For fuel assemblies in the unacceptable range of
[Figure 3.7.16-1], performance of the SR will ensure compliance with Specification 4.3.1.1.
REFERENCES         None.
Babcock & Wilcox STS                 B 3.7.16-2                                         Rev. 5.0

Secondary Specific Activity B 3.7.17 B 3.7 PLANT SYSTEMS B 3.7.17 Secondary Specific Activity BASES BACKGROUND          Activity in the secondary coolant results from steam generator tube out-LEAKAGE from the Reactor Coolant System (RCS). Under steady state conditions, the activity is primarily iodines with relatively short half lives and, thus, indicative of current conditions. During transients, I-131 spikes have been observed, as well as increased releases of some noble gases.
Other fission product isotopes, as well as activated corrosion products, in lesser amounts, may also be found in the secondary coolant.
A limit on secondary coolant specific activity during power operation minimizes releases to the environment because of normal operation, anticipated operational occurrences, and accidents.
This limit is lower than the activity value that might be expected from a 1 gpm tube leak (LCO 3.4.13, "RCS Operational Leakage") of primary coolant at the limit of 1.0 &#xb5;Ci/gm (LCO 3.4.16, "RCS Specific Activity").
The steam line failure is assumed to result in the release of the noble gas and iodine activity contained in the steam generator inventory, the feedwater, and the reactor coolant leakage. Most of the iodine isotopes have short half lives (i.e., < 20 hours).
With the specified activity limit, the resultant 2 hour thyroid dose to a person at the exclusion area boundary (EAB) would be about 0.79 rem if the main steam safety valves (MSSVs) are open for the 2 hours following a trip from full power.
Operating a unit at the allowable limits could result in a 2 hour EAB exposure of a small fraction of the 10 CFR 100 (Ref. 1) limits, or the limits established as the NRC staff approved licensing basis.
APPLICABLE          The accident analysis of the main steam line break, as discussed in the SAFETY              FSAR, Chapter [15] (Ref. 2) assumes the initial secondary coolant ANALYSES            specific activity to have a radioactive isotope concentration of 0.1 &#xb5;Ci/gm DOSE EQUIVALENT I-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accident.
The accident analysis, based on this and other assumptions, shows that the radiological consequences of an MSLB do not exceed established limits, (Ref. 1) for whole body and thyroid dose rates.
With a loss of offsite power, the remaining steam generator is available for core decay heat dissipation by venting steam to the atmosphere through the MSSVs and steam generator atmospheric dump valves Babcock & Wilcox STS                    B 3.7.17-1                                          Rev. 5.0

Secondary Specific Activity B 3.7.17 BASES APPLICABLE SAFETY ANALYSES (continued)
(ADVs). The Emergency Feedwater System supplies the necessary makeup to the steam generator. Venting continues until the reactor coolant temperature and pressure has decreased sufficiently for the Shutdown Cooling System to complete the cooldown.
In the evaluation of the radiological consequences of this accident, the activity released from the steam generator connected to the failed steam line is assumed to be released directly to the environment. The unaffected steam generator is assumed to discharge steam and any entrained activity through the MSSVs and ADVs during the event. Since no credit is taken in the analysis for activity plateout or retention, the resultant radiological consequences represent a conservative estimate of the potential integrated dose due to the postulated steam line failure.
Secondary specific activity limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                As indicated in the Applicable Safety Analyses, the specific activity limit in the secondary coolant system of  [0.10] &#xb5; Ci/gm DOSE EQUIVALENT I-131 maintains the radiological consequences of a Design Basis Accident (DBA) to a small fraction of Reference 1 limits.
Monitoring the specific activity of the secondary coolant ensures that, when secondary specific activity limits are exceeded, appropriate actions are taken, in a timely manner, to place the unit in an operational MODE that would minimize the radiological consequences of a DBA.
APPLICABILITY      In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere.
In MODES 5 and 6, the steam generators are not being used for heat removal. Both the RCS and steam generators are at low pressure and primary to secondary LEAKAGE is minimal. Therefore, monitoring of secondary specific activity is not required.
ACTIONS            A.1 and A.2 DOSE EQUIVALENT I-131 exceeding the allowable value in the secondary coolant contributes to increased post accident doses. If secondary specific activity cannot be restored to within limits within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
Babcock & Wilcox STS                 B 3.7.17-2                                            Rev. 5.0

Secondary Specific Activity B 3.7.17 BASES SURVEILLANCE       SR 3.7.17.1 REQUIREMENTS This SR verifies that the secondary specific activity is within the limits of the accident analysis. A gamma isotopic analysis of the secondary coolant, which determines DOSE EQUIVALENT I-131, confirms the validity of the safety analysis assumptions as releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or LEAKAGE. [ The 31 day Frequency is based on the detection of increasing trends of the level of DOSE EQUIVALENT I-131, and allows for appropriate action to be taken to maintain levels below the LCO limit.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. 10 CFR 100.11.
: 2. FSAR, Chapter [15].
Babcock & Wilcox STS                      B 3.7.17-3                                                      Rev. 5.0

Steam Generator Level B 3.7.18 B 3.7 PLANT SYSTEMS B 3.7.18 Steam Generator Level BASES BACKGROUND         A principal function of the steam generators is to provide superheated steam at a constant pressure (900 psia) over the power range. Steam generator water inventory is maintained large enough to provide adequate primary to secondary heat transfer. Mass inventory and indicated water level in the steam generator increases with load as the length of the four heat transfer regions within the steam generator vary.
Inventory is controlled indirectly as a function of power and maintenance of a constant average primary system temperature by the feedwater controls in the Integrated Control System.
The maximum operating steam generator level is based primarily on preserving the initial condition assumptions for steam generator inventory used in the FSAR steam line break (SLB) analysis (Ref. 1). An inventory of 62,600 lb was used in this analysis. The 62,600 lb must not be exceeded due to the concerns of a possible return to criticality because of primary side cooling following an SLB and the maximum pressure in the reactor building.
For a clean once through steam generator, the mass inventory in a steam generator for operating at 100% power is approximately 39,000 lb to 40,000 lb.
As a steam generator becomes fouled and the operating level approaches the limit of 96%, the mass inventory in the downcomer region increases approximately 10,000 lb, and adds to the total mass inventory of the steam generator. In matching unit data of startup level versus power, the steam generator performance codes have shown that fouling of the lower tube support plates does not significantly change the heat transfer characteristics of the steam generator. Thus, the steam temperature, or superheat, is not degraded due to the fouling of the tube support plates, and mass inventory changes are mainly due to the added level in the downcomer.
Analytically, increasing the fouling of the steam generator tube surfaces degrades the heat transfer capability of the steam generator, increases the mass inventory, and decreases the steam superheat at 100% power (2544 MW). The results were presented as the amount of mass inventory in each steam generator versus operating range level and steam superheat.
Babcock & Wilcox STS                  B 3.7.18-1                                       Rev. 5.0

Steam Generator Level B 3.7.18 BASES BACKGROUND (continued)
The limiting curve, which was determined from several steam generator performance code runs at a power level of 100%, conservatively bounds steam generator mass inventory value, when operating at power levels
                   < 100%.
The points displayed in Figure 3.7.18-1, in the accompanying LCO, are the intercept points of the 57,000 lb mass value, and the operating range level x and steam superheat values.
The steam generator performance analysis also indicated that startup and full range level instruments are inadequate indicators of steam generator mass inventory at high power levels due to the combination of static and dynamic pressure losses. If the water level should rise above the 96%
upper limit, the steam superheat would tend to decrease due to reduced feedwater heating through the aspirator ports. Normally, a reduction in water level is manually initiated to maintain steam flow through the aspirator port by reducing the power level. Thus, the superheat versus level limitation also tends to ensure that, in normal operation, water level will remain clear of the aspirator ports.
Feedwater nozzle flooding would impair feedwater heating, and could result in excessive tube to shell temperature differentials, excessive tubesheet temperature differentials, and large variations in pressurizer level.
APPLICABLE         The most limiting Design Basis Accident that would be affected by steam SAFETY             generator operating level is a steam line failure. This accident is ANALYSES           evaluated in Reference 1. The parameter of interest is the mass of water, or inventory, contained in the steam generator due to its role in lowering Reactor Coolant System (RCS) temperature (return to criticality concern),
and in raising containment pressure during an SLB accident. A higher inventory causes the effects of the accident to be more severe.
Figure 3.7.18-1, in the accompanying LCO, is based upon maintaining inventory < 57,000 lb, which is 10% less than the inventory used in the FSAR accident analysis, and therefore is conservative.
The steam generator level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii)
LCO                This LCO is required to preserve the initial condition assumptions of the accident analyses. Failure to meet the maximum steam generator level LCO requirements can result in additional mass and energy released to containment, and excessive cooling (and related core reactivity effects) following an SLB. In addition, feedwater nozzle flooding would impair feedwater heating, and could result in excessive tube to shell temperature differentials and excessive tubesheet temperature gradients.
Babcock & Wilcox STS                  B 3.7.18-2                                       Rev. 5.0

Steam Generator Level B 3.7.18 BASES APPLICABILITY      In MODES 1 and 2, a maximum steam generator water level is required to preserve the initial condition assumption for steam generator inventory used in the steam line failure accident analysis (Ref. 1).
In MODE 3, limits on RCS boron concentrations will prevent a return to criticality in the event of an SLB. In MODES 4, 5, and 6, the water in the steam generator has a low specific enthalpy; therefore, there is no need to limit the steam generator inventory when the unit is in this condition.
ACTIONS            A.1 With the steam generator level in excess of the maximum limit, action must be taken to restore the level to within the bounds assumed in the analysis. To achieve this status, the water level is restored to within the limit. The 15 minute Completion Time is considered to be a reasonable time to perform this evolution.
B.1 If the water level in one or more steam generators cannot be restored to less than or equal to the maximum level in Figure 3.7.18-1, the unit must be placed in a MODE that minimizes the accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours. The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE       SR 3.7.18.1 REQUIREMENTS This SR verifies the steam generator level to be within acceptable limits.
[ The 12 hour Frequency is adequate because the operator will be aware of unit evolutions that can affect the steam generator level between checks. Furthermore, the 12 hour Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to steam generator level status.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                   B 3.7.18-3                                       Rev. 5.0

Steam Generator Level B 3.7.18 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Section [15.4.4].
Babcock & Wilcox STS                      B 3.7.18-4                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources - Operating BASES BACKGROUND           The unit Class 1E AC Electrical Power Distribution System AC sources consist of the offsite power sources (preferred power sources, normal and alternate(s)) and the onsite standby power sources (Train A and Train B diesel generators (DGs)). As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.
The onsite Class 1E AC Distribution System is divided into redundant load groups (trains) so that the loss of any one group does not prevent the minimum safety functions from being performed. Each train has connections to two preferred offsite power sources and a single DG.
Offsite power is supplied to the unit switchyard(s) from the transmission network by [two] transmission lines. From the switchyard(s), two electrically and physically separated circuits provide AC power, through
[step down station auxiliary transformers], to the 4.16 kV ESF buses. A detailed description of the offsite power network and the circuits to the Class 1E ESF buses is found in the FSAR, Chapter [8] (Ref. 2).
An offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1E ESF bus(es).
Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the transformer supplying offsite power to the onsite Class 1E Distribution System. Within [1 minute] after the initiating signal is received, all automatic and permanently connected loads needed to recover the unit or maintain it in a safe condition are returned to service via the load sequencer.
The onsite standby power source for each 4.16 kV ESF bus is a dedicated DG. DGs [11] and [12] are dedicated to ESF buses [11]
and [12], respectively. A DG starts automatically on a Reactor Coolant System (RCS) pressure signal or on an [ESF bus degraded voltage or undervoltage signal] (refer to LCO 3.3.5, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation" [and LCO 3.3.8, "Emergency Diesel Generator (EDG) Loss of Power Starts (LOPS)"]). After the DG has started, it will automatically tie to its respective bus after offsite power is tripped as a consequence of ESF bus undervoltage or degraded voltage, independent of or coincident with a safety injection (SI) signal.
The DGs will also start and operate in the standby mode without tying to the ESF bus on an SI signal alone. Following the trip of offsite power, [a Babcock & Wilcox STS                     B 3.8.1-1                                            Rev. 5.0

AC Sources - Operating B 3.8.1 BASES BACKGROUND (continued) sequencer/an undervoltage signal] strips nonpermanent loads from the ESF bus. When the DG is tied to the ESF bus, loads are then sequentially connected to its respective ESF bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading the DG by automatic load application.
In the event of a loss of preferred power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a loss of coolant accident (LOCA).
Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the DG in the process. Within
[1] minute after the initiating signal is received, all loads needed to recover the unit or maintain it in a safe condition are returned to service.
Ratings for Train A and Train B DGs satisfy the requirements of Regulatory Guide 1.9 (Ref. 3). The continuous service rating of each DG is [7000] kW with [10]% overload permissible for up to 2 hours in any 24 hour period. The ESF loads that are powered from the 4.16 kV ESF buses are listed in Reference 2.
APPLICABLE         The initial conditions of DBA and transient analyses in the FSAR, SAFETY             Chapter [6] (Ref. 4) and Chapter [15] (Ref. 5), assume ESF systems are ANALYSES           OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.
The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This results in maintaining at least one train of the onsite or offsite AC sources OPERABLE during accident conditions in the event of:
: a. An assumed loss of all offsite power or all onsite AC power and
: b. A worst-case single failure.
The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                   B 3.8.1-2                                          Rev. 5.0

AC Sources - Operating B 3.8.1 BASES LCO                  Two qualified circuits between the offsite transmission network and the onsite Class 1E Electrical Power Distribution System and separate and independent DGs for each train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA.
Qualified offsite circuits are those that are described in the FSAR and are part of the licensing basis for the unit.
[ In addition, one required automatic load sequencer per train must be OPERABLE. ]
Each offsite circuit must be capable of providing three phases of AC power, maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESF buses.
[ Offsite circuit #1 consists of Safeguards Transformer B, which is supplied from Switchyard Bus B, and is fed through breaker 52-3 powering the ESF transformer XNB01, which, in turn, powers the #1 ESF bus through its normal feeder breaker. Offsite circuit #2 consists of the Startup Transformer, which is normally fed from the Switchyard Bus A, and is fed through breaker PA 0201 powering the ESF transformer, which, in turn, powers the #2 ESF bus through its normal feeder breaker. ]
Each DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage. This will be accomplished within [10] seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions, such as DG in standby with the engine hot and DG in standby with the engine at ambient conditions.
Additional DG capabilities must be demonstrated to meet required Surveillances, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode.
Proper sequencing of loads, [including tripping of non-essential loads,] is a required function for DG OPERABILITY.
The AC sources in one train must be separate and independent (to the extent possible) of the AC sources in the other train. For the DGs, separation and independence are complete.
For the offsite AC sources, separation and independence are to the extent practical. [A circuit may be connected to more than one ESF bus, with fast-transfer capability to the other circuit OPERABLE, and not Babcock & Wilcox STS                     B 3.8.1-3                                       Rev. 5.0

AC Sources - Operating B 3.8.1 BASES LCO (continued) violate separation criteria. A circuit that is not connected to an ESF bus is required to have OPERABLE fast-transfer interlock mechanisms to at least two ESF buses to support OPERABILITY of that circuit.]
APPLICABILITY      The AC sources [and sequencers] are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients and
: b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
The AC power requirements for MODES 5 and 6 are covered in LCO 3.8.2, "AC Sources - Shutdown."
ACTIONS            A Note prohibits the application of LCO 3.0.4.b to an inoperable DG.
There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
A.1 To ensure a highly reliable power source remains with one offsite circuit inoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met. However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
The turbine driven auxiliary feedwater pump is only required to be considered a redundant required feature, and, therefore, required to be determined OPERABLE by this Required Action, if the design is such that the remaining OPERABLE motor or turbine driven auxiliary feedwater pump(s) is not by itself capable (without any reliance on the motor driven Babcock & Wilcox STS                      B 3.8.1-4                                          Rev. 5.0

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) auxiliary feedwater pump powered by the emergency bus associated with the inoperable diesel generator) of providing 100% of the auxiliary feedwater flow assumed in the safety analysis.
A.2 Required Action A.2, which only applies if the train cannot be powered from an offsite source, is intended to provide assurance that an event coincident with a single failure of the associated DG will not result in a complete loss of safety function of critical redundant required features.
These features are powered from the redundant AC electrical power train.
This includes motor driven emergency feedwater pumps. Single train systems, such as turbine driven emergency feedwater pumps, may not be included.
The Completion Time for Required Action A.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:
: a. The train has no offsite power supplying it loads and
: b. A required feature on the other train is inoperable.
If at any time during the existence of Condition A (one offsite circuit inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked, Discovering no offsite power to one train of the onsite Class 1E Electrical Power Distribution System coincident with one or more inoperable required support or supported features, or both, that are associated with the other train that has offsite power, results in starting the Completion Times for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.
The remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to Train A and Train B of the onsite Class 1E Distribution System. The 24 hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
Babcock & Wilcox STS                      B 3.8.1-5                                                       Rev. 5.0

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)
A.3 According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.] With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the unit safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System.
The 72 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
B.1 To ensure a highly reliable power source remains with an inoperable DG, it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
The turbine driven auxiliary feedwater pump is only required to be considered a redundant required feature, and, therefore, required to be determined OPERABLE by this Required Action, if the design is such that the remaining OPERABLE motor or turbine driven auxiliary feedwater pump(s) is not by itself capable (without any reliance on the motor driven auxiliary feedwater pump powered by the emergency bus associated with the inoperable diesel generator) of providing 100% of the auxiliary feedwater flow assumed in the safety analysis.
B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related trains. This includes motor driven Babcock & Wilcox STS                      B 3.8.1-6                                                       Rev. 5.0

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) emergency feedwater pumps. Single train systems, such as turbine driven emergency feedwater pumps, are not included. Redundant required feature failures consist of inoperable features associated with a train, redundant to the train that has an inoperable DG.
The Completion Time for Required Action B.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:
: a. An inoperable DG exists and
: b. A required feature on the other train is inoperable.
If at any time during the existence of this Condition (one DG inoperable) a required feature subsequently becomes inoperable, this Completion Time begins to be tracked.
Discovering one required DG inoperable coincident with one or more inoperable required support or supported features, or both, that are associated with the OPERABLE DG, results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.
In this Condition, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single-failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour Completion Time takes into account the OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DG(s). If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on Babcock & Wilcox STS                  B 3.8.1-7                                         Rev. 5.0

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) other DG(s), the other DG(s) would be declared inoperable upon discovery and Condition E of LCO 3.8.1 would be entered. Once the failure is repaired, the common cause failure no longer exists and Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s),
performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG.
In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the [plant corrective action program] will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour constraint imposed while in Condition B.
According to Generic Letter 84-15 (Ref. 7), [24] hours is reasonable to confirm that the OPERABLE DG(s) is not affected by the same problem as the inoperable DG.
B.4 According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition B for a period that should not exceed 72 hours.
In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The 72 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
[Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
C.1 and C.2 Required Action C.1, which applies when two offsite circuits are inoperable, is intended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions. The Completion Time for this failure of redundant required features is reduced to 12 hours from that allowed for one train without offsite power (Required Action A.2). The rationale for the reduction to 12 hours is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours for two required offsite circuits inoperable, based upon the assumption that two complete safety trains are OPERABLE. When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of Babcock & Wilcox STS                  B 3.8.1-8                                          Rev. 5.0

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) 12 hours is appropriate. These features are powered from redundant AC safety trains. This includes motor driven auxiliary feedwater pumps.
Single train features, such as turbine driven auxiliary pumps, are not included in the list.
The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:
: a. All required offsite circuits are inoperable and
: b. A required feature is inoperable.
If at any time during the existence of Condition C (two offsite circuits inoperable) and a required feature becomes inoperable, this Completion Time begins to be tracked.
According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition C for a period that should not exceed 24 hours. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.] This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.
Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable.
However, two factors tend to decrease the severity of this level of degradation:
: a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure and
: b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.
With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC Babcock & Wilcox STS                   B 3.8.1-9                                         Rev. 5.0

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued) sources, a LOCA, and a worst-case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.
According to Reference 6, with the available offsite AC sources, two less than required by the LCO, operation may continue for 24 hours. If two offsite sources are restored within 24 hours, unrestricted operation may continue. If only one offsite source is restored within 24 hours, power operation would continue in accordance with Condition A.
D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to any train, the Conditions and Required Actions for LCO 3.8.9, "Distribution Systems - Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of one offsite circuit and one DG without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train.
According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 12 hours. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
Babcock & Wilcox STS                   B 3.8.1-10                                           Rev. 5.0

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)
E.1 With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.
According to Reference 6, with both DGs inoperable, operation may continue for a period that should not exceed 2 hours.
[ F.1 The sequencer(s) is an essential support system to [both the offsite circuit and the DG associated with a given ESF bus]. [Furthermore, the sequencer is on the primary success path for most major AC electrically powered safety systems powered from the associated ESF bus.]
Therefore, loss of an [ESF bus sequencer] affects every major ESF system in the [division]. The [12] hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining sequencer OPERABILITY. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.] This time period also ensures that the probability of an accident (requiring sequencer OPERABILITY) occurring during periods when the sequencer is inoperable is minimal.
This Condition is preceded by a Note that allows the Condition to be deleted if the unit design is such that any sequencer failure mode will only affect the ability of the associated DG to power its respective safety loads under any conditions. Implicit in this Note is the concept that the Condition must be retained if any sequencer failure mode results in the inability to start all or part of the safety loads when required, regardless of power availability, or results in overloading the offsite power circuit to a safety bus during an event thereby causing its failure. Also implicit in the Note is that the Condition is not applicable to any train that does not have a sequencer. ]
Babcock & Wilcox STS                     B 3.8.1-11                                         Rev. 5.0

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)
G.1 and G.2 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 8). There are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. In particular, in MODE 4 the turbine driven emergency feedwater pump[s] are available following a loss of AC sources to provide RCS cooling via the steam generators utilizing natural circulation.
However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action G.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
H.1 Condition H corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.
Babcock & Wilcox STS                 B 3.8.1-12                                          Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE       The AC sources are designed to permit inspection and testing of all REQUIREMENTS       important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 9).
Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions). The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 (Ref. 3), Regulatory Guide 1.108 (Ref. 10), and Regulatory Guide 1.137 (Ref. 11), as addressed in the FSAR.
Where the SRs discussed herein specify voltage and frequency tolerances, the following is applicable. The minimum steady state output voltage of [3740] V is 90% of the nominal 4160 V output voltage. This value, which is specified in ANSI C84.1 (Ref. 12), allows for voltage drop to the terminals of 4000 V motors whose minimum operating voltage is specified as 90% or 3600 V. It also allows for voltage drops to motors and other equipment down through the 120 V level where minimum operating voltage is also usually specified as 90% of name plate rating.
The specified maximum steady state output voltage of [4756] V is equal to the maximum operating voltage specified for 4000 V motors. It ensures that for a lightly loaded distribution system, the voltage at the terminals of 4000 V motors is no more than the maximum rated operating voltages.
The specified minimum and maximum frequencies of the DG are 58.8 Hz and 61.2 Hz, respectively. These values are equal to +/- 2% of the 60 Hz nominal frequency and are derived from the recommendations given in Regulatory Guide 1.9 (Ref. 3).
SR 3.8.1.1 This SR ensures correct breaker alignment for each [required] offsite circuit to ensure that distribution buses and loads are connected to their preferred power source, and that appropriate independence of offsite circuits is maintained. The SR also verifies the indicated availability of three-phase AC electrical power from each [required] offsite circuit to the onsite distribution network. [ The 7 day Frequency is adequate since breaker position is not likely to change without the operator being aware of it and because its status is displayed in the control room.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                   B 3.8.1-13                                        Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.8.1.2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.
To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note (Note 1 for SR 3.8.1.2 and Note for SR 3.8.1.7) to indicate that all DG starts for these Surveillances may be preceded an engine prelube period and followed by a warmup period prior to loading by an engine prelube period.
For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the DGs are started from standby conditions. Standby conditions for a DG means that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.
[ In order to reduce stress and wear on diesel engines, some manufacturers recommend a modified start in which the starting speed of DGs is limited, warmup is limited to this lower speed, and the DGs are gradually accelerated to synchronous speed prior to loading. This is the intent of Note 2, which is only applicable when such modified start procedures are recommended by the manufacturer. ]
SR 3.8.1.7 requires that the DG starts from standby conditions and achieves required voltage and frequency within 10 seconds. The 10 second start requirement supports the assumptions of the design basis LOCA analysis in the FSAR, Chapter [15] (Ref. 5).
The 10 second start requirement is not applicable to SR 3.8.1.2 (see Note 2) when a modified start procedure as described above is used. If a modified start is not used, the 10 second start requirement of SR 3.8.1.7 applies.
Since SR 3.8.1.7 requires a 10 second start, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2.
Babcock & Wilcox STS                        B 3.8.1-14                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
In addition to the SR requirements, the time for the DG to reach steady state operation, unless the modified DG start method is employed, is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance.
[ The 31 day Frequency for SR 3.8.1.2 is consistent with Regulatory Guide 1.9 (Ref. 3). The 184 day Frequency for SR 3.8.1.7 is a reduction in cold testing consistent with Generic Letter 84-15 (Ref. 7). These Frequencies provide adequate assurance of DG OPERABILITY, while minimizing degradation resulting from testing.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.8.1.3 This Surveillance verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.
Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between [0.8 lagging] and
[1.0]. The [0.8] value is the design rating of the machine, while the [1.0] is an operational limitation [to ensure circulating currents are minimized].
The load band is provided to avoid routine overloading of the DG.
Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.
[ The 31 day Frequency for this Surveillance is consistent with Regulatory Guide 1.9 (Ref. 3).
Babcock & Wilcox STS                        B 3.8.1-15                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
This SR is modified by four Notes. Note 1 indicates that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.
SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank [and engine mounted tank] is at or above the level at which fuel oil is automatically added. The level is expressed as an equivalent volume in gallons, and is selected to ensure adequate fuel oil for a minimum of 1 hour of DG operation at full load plus 10%.
[ The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are provided and unit operators would be aware of any large uses of fuel oil during this period.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                        B 3.8.1-16                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil day [and engine mounted] tanks eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. [ The Surveillance Frequency of 31 days is established by Regulatory Guide 1.137 (Ref. 11).
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is for preventive maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during the performance of this Surveillance.
Babcock & Wilcox STS                      B 3.8.1-17                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. This is required to support continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.
[ The Frequency for this SR is variable, depending on individual system design, with up to a [92] day interval. The [92] day Frequency corresponds to the testing requirements for pumps as contained in the ASME Code (Ref. 13); however, the design of fuel transfer systems is such that pumps will operate automatically or must be started manually in order to maintain an adequate volume of fuel oil in the day [and engine mounted] tanks during or following DG testing. In such a case, a 31 day Frequency is appropriate. Since proper operation of fuel transfer systems is an inherent part of DG OPERABILITY, the Frequency of this SR should be modified to reflect individual designs.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.8.1.7 See SR 3.8.1.2.
[ SR 3.8.1.8 Transfer of each [4.16 kV ESF bus] power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the shutdown loads.
[ The [18 month] Frequency of the Surveillance is based on engineering Babcock & Wilcox STS                        B 3.8.1-18                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) judgment, taking into consideration the unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the [18 month] Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note. The reason for the Note is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems.
This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.
Credit may be taken for unplanned events that satisfy this SR. ]
Babcock & Wilcox STS                      B 3.8.1-19                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.8.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. For the CR-3 emergency DGs, the largest single load is 616 kW (HPI pump). After performance of SR 3.8.1.17, the diesel load is reduced to approximately 1200 kW and allowed to run at this load for 3 to 5 minutes. The load is then reduced to  616 kW and the DGs output breaker is opened.
Verification that the DG did not trip is made. This Surveillance may be accomplished by either:
: a. Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power, or while solely supplying the bus, or
: b. Tripping its associated single largest post-accident load with the DG solely supplying the bus.
As required by IEEE-308 (Ref. 14), the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous speed and the overspeed trip setpoint, or 15%
above synchronous speed, whichever is lower.
The time, voltage, and frequency tolerances specified in this SR are derived from Regulatory Guide 1.9 (Ref. 3) recommendations for response during load sequence intervals. The [3] seconds specified is equal to 60% of a typical 5 second load sequence interval associated with sequencing of the largest load. The voltage and frequency specified are consistent with the design range of the equipment powered by the DG.
SR 3.8.1.9.a corresponds to the maximum frequency excursion, while SR 3.8.1.9.b and SR 3.8.1.9.c are steady state voltage and frequency values to which the system must recover to following load rejection. [ The
[18 month] Frequency is consistent with the recommendation of Regulatory Guide 1.108 (Ref. 10).
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                   B 3.8.1-20                                       Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by two Notes. The reason for Note 1 is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems.
This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.
Credit may be taken for unplanned events that satisfy this SR. Note 2 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of  [0.9]. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. Under certain conditions, however, Note 2 allows the Surveillance to be conducted at a power factor other than  [0.9]. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to
[0.9] results in voltages on the emergency busses that are too high.
Under these conditions, the power factor should be maintained as close as practicable to [0.9] while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DC excitation levels needed to obtain a power factor of [0.9]
may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the DC. In such cases, the power factor shall be maintained as close as practicable to
[0.9] without exceeding the DG excitation limits.
Babcock & Wilcox STS                      B 3.8.1-21                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                     -----------------------------------REVIEWERS NOTE-----------------------------------
The above MODE restrictions may be deleted if it can be demonstrated to the staff, on a plant specific basis, that performing the SR with the reactor in any of the restricted MODES can satisfy the following criteria, as applicable:
: a. Performance of the SR will not render any safety system or component inoperable,
: b. Performance of the SR will not cause perturbations to any of the electrical distribution systems that could result in a challenge to steady state operation or to plant safety systems, and
: c. Performance of the SR, or failure of the SR, will not cause, or result in, an AOO with attendant challenge to plant safety systems.
SR 3.8.1.10 This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits.
The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG will not trip upon loss of the load. These acceptance criteria provide DG damage protection. While the DG is not expected to experience this transient during an event and continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.
[ The [18 month] Frequency is consistent with the recommendation of Regulatory Guide 1.108 (Ref. 10) and is intended to be consistent with expected fuel cycle lengths.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                        B 3.8.1-22                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by two Notes. The reason for Note 1 is that during operation with the reactor critical, performance of this SR could cause perturbation to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems.
This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.
Credit may be taken for unplanned events that satisfy this SR.
Note 2 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of  [0.9].
This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. Under certain conditions, however, Note 2 allows the Surveillance to be conducted at a power factor other than  [0.9]. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to  [0.9] results in voltages on the emergency busses that are too high.
Under these conditions, the power factor should be maintained as close as practicable to [0.9] while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DC excitation levels needed to obtain a power factor of [0.9]
may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the DC. In such cases, the power factor shall be maintained as close as practicable to
[0.9] without exceeding the DG excitation limits.
Babcock & Wilcox STS                      B 3.8.1-23                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
The above MODE restrictions may be deleted if it can be demonstrated to the staff, on a plant specific basis, that performing the SR with the reactor in any of the restricted MODES can satisfy the following criteria, as applicable:
: a. Performance of the SR will not render any safety system or component inoperable,
: b. Performance of the SR will not cause perturbations to any of the electrical distribution systems that could result in a challenge to steady state operation or to plant safety systems, and
: c. Performance of the SR, or failure of the SR, will not cause, or result in, an AOO with attendant challenge to plant safety systems.
SR 3.8.1.11 As required by Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(1), this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the non-essential loads and energization of the emergency buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.
The DG auto-start time of [10] seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA.
The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.
The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, high pressure injection systems are not capable of being operated at full flow, or decay heat removal (DHR) systems performing a DHR function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection Babcock & Wilcox STS                      B 3.8.1-24                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
[ The Frequency of [18 months] is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(1), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes.
These shall be measured against the avoided risk of a plant shutdown Babcock & Wilcox STS                        B 3.8.1-25                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for the assessment.
Credit may be taken for unplanned events that satisfy this SR.
[ SR 3.8.1.12 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time
([10] seconds) from the design basis actuation signal (LOCA signal) and operates for  5 minutes. The 5 minute period provides sufficient time to demonstrate stability. SR 3.8.1.12.d and SR 3.8.1.12.e ensure that permanently connected loads and emergency loads are energized from the offsite electrical power system on an ESF signal without loss of offsite power.
The requirement to verify the connection of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads can not actually be connected or loaded without undue hardship or potential for undesired operation. For instance, ECCS injection valves are not desired to be stroked open, high pressure injection systems are not capable of being operated at full flow, or DHR systems performing a DHR function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
[ The Frequency of [18 months] takes into consideration unit conditions required to perform the Surveillance and is intended to be consistent with the expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the [18 month]
Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                    B 3.8.1-26                                       Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes.
These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for the assessment.
Credit may be taken for unplanned events that satisfy this SR. ]
SR 3.8.1.13 This Surveillance demonstrates that DG noncritical protective functions (e.g., high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESF actuation test signal. Noncritical automatic trips are all automatic trips except:
: a. Engine overspeed;
: b. Generator differential current;
[ c. Low lube oil pressure; Babcock & Wilcox STS                        B 3.8.1-27                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
: d. High crankcase pressure; and
: e. Start failure relay.]
The noncritical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.
[ The [18 month] Frequency is based on engineering judgment, taking into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the [18 month] Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
The SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required DG from service. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or Babcock & Wilcox STS                        B 3.8.1-28                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.
Credit may be taken for unplanned events that satisfy this SR.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
The above MODE restrictions may be deleted if it can be demonstrated to the staff, on a plant specific basis, that performing the SR with the reactor in any of the restricted MODES can satisfy the following criteria, as applicable:
: a. Performance of the SR will not render any safety system or component inoperable,
: b. Performance of the SR will not cause perturbations to any of the electrical distribution systems that could result in a challenge to steady state operation or to plant safety systems, and
: c. Performance of the SR, or failure of the SR, will not cause, or result in, an AOO with attendant challenge to plant safety systems.
SR 3.8.1.14 Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(3), requires demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours,
[2] hours of which is at a load equivalent to 110% of the continuous duty rating and the remainder of the time at a load equivalent to the continuous duty rating of the DG. The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelubricating and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.
The load band is provided to avoid routine overloading of the DG.
Routine overloading may result in more frequent teardown inspections, in accordance with vendor recommendations, in order to maintain DG OPERABILITY.
[ The [18 month] Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(3), takes into consideration unit conditions required to perform the Surveillance and is intended to be consistent with expected fuel cycle lengths.
OR Babcock & Wilcox STS                        B 3.8.1-29                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This Surveillance is modified by three Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the power factor limit will not invalidate the test. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. Note 3 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of
[0.9]. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. Under certain conditions, however, Note 3 allows the Surveillance to be conducted at a power factor other than  [0.9]. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to  [0.9] results in voltages on the emergency busses that are too high.
Under these conditions, the power factor should be maintained as close as practicable to [0.9] while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DG excitation levels needed to obtain a power factor of [0.9]
may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the DG. In such cases, the power factor shall be maintained as close as practicable to
[0.9] without exceeding the DG excitation limits. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator Babcock & Wilcox STS                      B 3.8.1-30                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this SR.
SR 3.8.1.15 This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within
[10 seconds]. The [10 second] time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.
[ The [18 month] Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(5).
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
This SR is modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the DG. Routine overloads may result in more frequent teardown inspections, in accordance with vendor recommendations, in order to maintain DG OPERABILITY. The requirement that the diesel has operated for at least [2] hours at full load conditions prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.
Babcock & Wilcox STS                        B 3.8.1-31                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.8.1.16 As required by Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(6), this Surveillance ensures that the manual synchronization and automatic load transfer from the DG to the offsite source can be made and the DG can be returned to ready to load status when offsite power is restored. It also ensures that the auto-start logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready to load status when the DG is at rated speed and voltage, the output breaker is open and can receive and auto-close signal on bus undervoltage, and the load sequence timers are reset.
[ The Frequency of [18 months] is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(6), and takes into consideration unit conditions required to perform the Surveillance.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.
This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or Babcock & Wilcox STS                        B 3.8.1-32                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.
Credit may be taken for unplanned events that satisfy this SR.
[ SR 3.8.1.17 Demonstration of the test mode override ensures that the DG availability under accident conditions will not be compromised as the result of testing and the DG will automatically reset to ready to load operation if a LOCA actuation signal is received during operation in the test mode. Ready to load operation is defined as the DG running at rated speed and voltage with the DG output breaker open. These provisions for automatic switchover are required by IEEE-308 (Ref. 14), paragraph 6.2.6(2).
The requirement to automatically energize the emergency loads with offsite power is essentially identical to that of SR 3.8.1.12. The intent in the requirement associated with SR 3.8.1.17.b is to show that the emergency loading was not affected by the DG operation in test mode. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
[ The [18 month] Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(8), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                        B 3.8.1-33                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.
This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for the assessment. Credit may be taken for unplanned events that satisfy this SR. ]
SR 3.8.1.18 Under accident [and loss of offsite power] conditions loads are sequentially connected to the bus by the [automatic load sequencer]. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents. The [10]% load sequence time interval tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. Reference 2 provides a summary of the automatic loading of ESF buses.
[ The Frequency of [18 months] is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(2), takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                    B 3.8.1-34                                         Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.
This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.
Credit may be taken for unplanned events that satisfy this SR.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
The above MODE restrictions may be deleted if it can be demonstrated to the staff, on a plant specific basis, that performing the SR with the reactor in any of the restricted MODES can satisfy the following criteria, as applicable:
: a. Performance of the SR will not render any safety system or component inoperable,
: b. Performance of the SR will not cause perturbations to any of the electrical distribution systems that could result in a challenge to steady state operation or to plant safety systems, and
: c. Performance of the SR, or failure of the SR, will not cause, or result in, an AOO with attendant challenge to plant safety systems.
Babcock & Wilcox STS                      B 3.8.1-35                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.
This Surveillance demonstrates the DG operation, as discussed in the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
[ The Frequency of [18 months] takes into consideration unit conditions required to perform the Surveillance and is intended to be consistent with an expected fuel cycle length of [18 months].
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for DGs. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and Babcock & Wilcox STS                        B 3.8.1-36                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes.
These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for the assessment.
Credit may be taken for unplanned events that satisfy this SR.
SR 3.8.1.20 This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.
[ The 10 year Frequency is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 10).
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated, and temperature maintained consistent with manufacturer recommendations.
Babcock & Wilcox STS                        B 3.8.1-37                                                      Rev. 5.0

AC Sources - Operating B 3.8.1 BASES REFERENCES         1. 10 CFR 50, Appendix A, GDC 17.
: 2. FSAR, Chapter [8].
: 3. Regulatory Guide 1.9, Rev. 3.
: 4. FSAR, Chapter [6].
: 5. FSAR, Chapter [15].
: 6. Regulatory Guide 1.93, Rev. [0], [date].
: 7. Generic Letter 84-15.
: 8. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
: 9. 10 CFR 50, Appendix A, GDC 18.
: 10. Regulatory Guide 1.108, Rev. [1], [August 1977].
: 11. Regulatory Guide 1.137, Rev. [ ], [date].
: 12. ANSI C84.1-1982.
: 13. ASME Code for Operation and Maintenance of Nuclear Power Plants.
: 14. IEEE Standard 308-[1978].
Babcock & Wilcox STS              B 3.8.1-38                                     Rev. 5.0

AC Sources - Shutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 AC Sources - Shutdown BASES BACKGROUND           A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC Sources - Operating."
APPLICABLE           The OPERABILITY of the minimum AC sources during MODES 5 and 6 SAFETY               and during movement of [recently] irradiated fuel assemblies ensures ANALYSES             that:
: a. The unit can be maintained in the shutdown or refueling condition for extended periods,
: b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status, and
: c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident
[involving handling recently irradiated fuel. Due to radioactive decay, AC electrical power is only required to mitigate fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [x] days)].
In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.
The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst-case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.
During MODES 1, 2, 3, and 4 various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also Babcock & Wilcox STS                      B 3.8.2-1                                          Rev. 5.0

AC Sources - Shutdown B 3.8.2 BASES APPLICABLE SAFETY ANALYSES (continued) required. In MODES 5 and 6, the activities are generally planned and administratively controlled. Relaxations from MODE 1, 2, 3, and 4 LCO requirements are acceptable during shutdown MODES based on:
: a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration,
: b. Requiring appropriate compensatory measures for certain conditions.
These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both,
: c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems, and
: d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) with systems assumed to function during an event.
In the event of an accident during shutdown, this LCO ensures the capability to support systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite diesel generator (DG) power.
The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                One offsite circuit capable of supplying the onsite Class 1E power distribution subsystem(s) of LCO 3.8.10, "Distribution Systems -
Shutdown," ensures that all required loads are powered from offsite power. An OPERABLE DG, associated with a distribution system train required to be OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide electrical power support, assuming a loss of the offsite circuit. Together, OPERABILITY of the required offsite circuit and DG ensures the availability of sufficient AC sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents [involving handling recently irradiated fuel]).
The qualified offsite circuit must be capable of providing three phases of AC power, maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the Engineered Safety Feature (ESF) bus(es). Qualified offsite circuits are those that are described in the FSAR and are part of the licensing basis for the unit.
Babcock & Wilcox STS                   B 3.8.2-2                                         Rev. 5.0

AC Sources - Shutdown B 3.8.2 BASES LCO (continued)
[ Offsite circuit #1 consists of Safeguards Transformer B, which is supplied from Switchyard Bus B, and is fed through breaker 52-3 powering the ESF transformer XNB01, which, in turn, powers the #1 ESF bus through its normal feeder breaker. The second offsite circuit consists of the Startup Transformer, which is normally fed from the Switchyard Bus A, and is fed through breaker PA O201 powering the ESF transformer, which, in turn, powers the #2 ESF bus through its normal feeder breaker. ]
The DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage. This sequence must be accomplished within [10] seconds.
The DG must be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby with the engine hot and DG in standby at ambient conditions.
Proper sequencing of loads, including tripping of non-essential loads, is a required function for DG OPERABILITY.
[ In addition, proper sequencer operation is an integral part of offsite circuit OPERABILITY since its inoperability impacts on the ability to start and maintain energized loads required OPERABLE by LCO 3.8.10. ]
It is acceptable for trains to be cross tied during shutdown conditions, allowing a single offsite power circuit to supply all required trains.
APPLICABILITY        The AC sources required to be OPERABLE in MODES 5 and 6 and during movement of [recently] irradiated fuel assemblies provide assurance that:
: a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies,
: b. Systems needed to mitigate a fuel handling accident [involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [X] days)] are available,
: c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available, and
: d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
Babcock & Wilcox STS                      B 3.8.2-3                                         Rev. 5.0

AC Sources - Shutdown B 3.8.2 BASES APPLICABILITY (continued)
The AC power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.1.
ACTIONS            LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
A.1 An offsite circuit would be considered inoperable if it were not available to one required ESF train. Although two trains are required by LCO 3.8.10, the one train with offsite power available may be capable of supporting sufficient required features to allow continuation of [recently] irradiated fuel movement. By the allowance of the option to declare features inoperable with no offsite power available, appropriate restrictions will be implemented in accordance with the affected required features LCO's ACTIONS.
A.2.1, A.2.2, A.2.3, B.1, B.2, and B.3 With the offsite circuit not available to all required trains, the option would still exist to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With the required DG inoperable, the minimum required diversity of AC power sources is not available. It is, therefore, required to suspend movement of [recently] irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.
Babcock & Wilcox STS                    B 3.8.2-4                                          Rev. 5.0

AC Sources - Shutdown B 3.8.2 BASES ACTIONS (continued)
Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability or the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the unit safety systems.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.
Pursuant to LCO 3.0.6, the Distribution System's ACTIONS are not entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A is entered with no AC power to any required ESF bus, the ACTIONS for LCO 3.8.10 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit, whether or not a train is de-energized. LCO 3.8.10 provides the appropriate restrictions for the situation involving a de-energized train.
SURVEILLANCE       SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, 3, and 4. SR 3.8.1.8 is not required to be met since only one offsite circuit is required to be OPERABLE. SR 3.8.1.12 and SR 3.8.1.19 are not required to be met because the ESF actuation signal is not required to be OPERABLE. SR 3.8.1.6 is not required to be met because the required OPERABLE DG(s) is not required to undergo periods of being synchronized to the offsite circuit. SR 3.8.1.9 is excepted because starting independence is not required with the DG(s) that is not required to be OPERABLE.
This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during performance of SRs, and to preclude deenergizing a required 4160 V ESF bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs must still be Babcock & Wilcox STS                   B 3.8.2-5                                          Rev. 5.0

AC Sources - Shutdown B 3.8.2 BASES SURVEILLANCE REQUIREMENTS (continued) capable of being met, but actual performance is not required during periods when the DG and offsite circuit is required to be OPERABLE.
Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.
REFERENCES         None.
Babcock & Wilcox STS                 B 3.8.2-6                                       Rev. 5.0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air BASES BACKGROUND           Each diesel generator (DG) is provided with a storage tank having a fuel oil capacity sufficient to operate that diesel for a period of [7] days while the DG is supplying maximum post loss of coolant accident load demand discussed in the FSAR, Section [9.5.4.2] (Ref. 1) [and Regulatory Guide 1.137 (Ref. 2)]. The maximum load demand is calculated using the assumption that at least two DGs are available. This onsite fuel oil capacity is sufficient to operate the DGs for longer than the time to replenish the onsite supply from outside sources.
Fuel oil is transferred from storage tank to day tank by either of two transfer pumps associated with each storage tank. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve or tank to result in the loss of more than one DG. All outside tanks, pumps, and piping are located underground.
For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the kinematic viscosity, specific gravity (or API gravity),
and impurity level.
The DG lubrication system is designed to provide sufficient lubrication to permit proper operation of its associated DG under all loading conditions.
The system is required to circulate the lube oil to the diesel engine working surfaces and to remove excess heat generated by friction during operation. Each engine oil sump contains an inventory capable of supporting a minimum of [7] days of operation. [The onsite storage in addition to the engine oil sump is sufficient to ensure [7] days of continuous operation.] This supply is sufficient to allow the operator to replenish lube oil from outside sources.
Each DG has an air start system with adequate capacity for five successive start attempts on the DG without recharging the air start receiver(s).
APPLICABLE           The initial conditions of Design Basis Accident (DBA) and transient SAFETY               analyses in the FSAR, Chapter [6] (Ref. 4) and Chapter [15] (Ref. 5),
ANALYSES             assume Engineered Safety Feature (ESF) systems are OPERABLE. The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, Reactor Coolant System, and containment design Babcock & Wilcox STS                     B 3.8.3-1                                          Rev. 5.0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES APPLICABLE SAFETY ANALYSES (continued) limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.
Since diesel fuel oil, lube oil, and the air start subsystem support the operation of the standby AC power sources, they satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                Stored diesel fuel oil is required to have sufficient supply for [7] days of full load operation. It is also required to meet specific standards for quality. Additionally, sufficient lube oil supply must be available to ensure the capability to operate at full load for [7] days. This requirement, in conjunction with an ability to obtain replacement supplies within [7] days, supports the availability of DGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power. DG day tank fuel requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources - Operating," and LCO 3.8.2, "AC Sources - Shutdown."
The starting air system is required to have a minimum capacity for five successive DG start attempts without recharging the air start receivers.
APPLICABILITY      The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated DBA. Since stored diesel fuel oil, lube oil, and the starting air subsystem support LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil, lube oil, and starting air are required to be within limits when the associated DG is required to be OPERABLE.
ACTIONS            The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DG subsystem. Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG subsystem(s) are governed by separate Condition entry and application of associated Required Actions.
A.1 In this Condition, the [7] day fuel oil supply for a DG is not available.
However, the Condition is restricted to fuel oil level reductions, that maintain at least a [6] day supply. The fuel oil level equivalent to a [6] day supply is [28,285] gallons. These circumstances may be caused by Babcock & Wilcox STS                   B 3.8.3-2                                          Rev. 5.0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS (continued) events, such as full load operation required after an inadvertent start while at minimum required level, or feed and bleed operations which may be necessitated by increasing particulate levels or any number of other oil quality degradations. This restriction allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of fuel oil to the tank. A period of 48 hours is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity (> [6] days), the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.
B.1 In this Condition, the [7] day lube oil inventory i.e., sufficient lube oil to support [7] days of continuous DG operation at full load conditions is not available. However, the Condition is restricted to lube oil volume reductions that maintain at least a [6] day supply. The lube oil inventory equivalent to a [6] day supply is [425] gallons. This restriction allows sufficient time to obtain the requisite replacement volume. A period of 48 hours is considered sufficient to complete restoration of the required volume prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity (> [6] days), the low rate of usage, the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.
C.1 This Condition is entered as a result of a failure to meet the acceptance criterion of SR 3.8.3.5. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample procedures (bottom sampling),
contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend. Since the presence of particulates does not mean failure of the fuel oil to burn properly in the diesel engine, particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable. The 7 day Completion Time allows for further evaluation, resampling, and re-analysis of the DG fuel oil.
Babcock & Wilcox STS                   B 3.8.3-3                                           Rev. 5.0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS (continued)
D.1 With the new fuel oil properties defined in the Bases for SR 3.8.3.4 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or combinations of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is a high likelihood that the DG would still be capable of performing its intended function.
E.1 With starting air receiver pressure < [225] psig, sufficient capacity for five successive DG start attempts does not exist. However, as long as the receiver pressure is > [125] psig, there is adequate capacity for at least one start attempt, and the DG can be considered OPERABLE while the air receiver pressure is restored to the required limit. A period of 48 hours is considered sufficient to complete restoration to the required pressure prior to declaring the DG inoperable. This period is acceptable based on the remaining air start capacity, the fact that most DG starts are accomplished on the first attempt, and the low probability of an event during this brief period.
F.1 With a Required Action and associated Completion Time not met, or one or more DGs with fuel oil, lube oil, or starting air subsystem not within limits for reasons other than addressed by Conditions A through E, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.
SURVEILLANCE       SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for [7] days at full load. The fuel oil level equivalent to a [7] day supply is [33,000] gallons when calculated in accordance with References 2 and 3. The required fuel storage volume is determined using the most limiting energy content of the stored fuel. Using the known correlation of diesel fuel oil absolute specific gravity or API gravity to energy content, the required diesel Babcock & Wilcox STS                   B 3.8.3-4                                         Rev. 5.0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE REQUIREMENTS (continued) generator output, and the corresponding fuel consumption rate, the onsite fuel storage volume required for [7] days of operation can be determined.
SR 3.8.3.3 requires new fuel to be tested to verify that the absolute specific gravity or API gravity is within the range assumed in the diesel fuel oil consumption calculations. The [7] day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.
[ The 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are provided and unit operators would be aware of any large uses of fuel oil during this period.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.8.3.2 This Surveillance ensures that sufficient lube oil inventory is available to support at least [7] days of full load operation for each DG. The lube oil inventory equivalent to a [7] day supply is [500] gallons and is based on the DG manufacturer consumption values for the run time of the DG.
Implicit in this SR is the requirement to verify the capability to transfer the lube oil from its storage location to the DG, when the DG lube oil sump does not hold adequate inventory for [7] days of full load operation without the level reaching the manufacturer recommended minimum level.
[ A 31 day Frequency is adequate to ensure that a sufficient lube oil supply is onsite, since DG starts and run time are closely monitored by the unit staff.
Babcock & Wilcox STS                        B 3.8.3-5                                                       Rev. 5.0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.8.3.3 The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows:
: a. Sample the new fuel oil in accordance with ASTM D4057-[                          ]
(Ref. 6),
: b. Verify in accordance with the tests specified in ASTM D975-[ ]
(Ref. 6) that the sample has an absolute specific gravity at 60/60&deg;F of 0.83 and  0.89 or an API gravity at 60&deg;F of  27&deg; and  39&deg; when tested in accordance with ASTM D1298-[ ] (Ref. 6), a kinematic viscosity at 40&deg;C of  1.9 centistokes and  4.1 centistokes, and a flash point of  125&deg;F, and
: c. Verify that the new fuel oil has a clear and bright appearance with proper color when tested in accordance with ASTM D4176-[ ] or a water and sediment content within limits when tested in accordance with [ASTM D2709-[ )) (Ref. 6).
Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.
Babcock & Wilcox STS                      B 3.8.3-6                                                       Rev. 5.0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE REQUIREMENTS (continued)
Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-[ ] (Ref. 7) are met for new fuel oil when tested in accordance with ASTM D975-[ ] (Ref. 6), except that the analysis for sulfur may be performed in accordance with ASTM D1552-[ ],
ASTM D2622-[ ], or ASTM D4294-[ ] (Ref. 6). The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on DG operation. This Surveillance ensures the availability of high quality fuel oil for the DGs.
Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure.
Particulate concentrations should be determined in accordance with ASTM D5452-[ ] (Ref. 6). This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing. [For those designs in which the total stored fuel oil volume is contained in two or more interconnected tanks, each tank must be considered and tested separately.]
The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals.
SR 3.8.3.4 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available. The system design requirements provide for a minimum of [five] engine start cycles without recharging. [A start cycle is defined by the DG vendor, but usually is measured in terms of time (seconds of cranking) or engine cranking speed.] The pressure specified in this SR is intended to reflect the lowest value at which the [five] starts can be accomplished.
[ The 31 day Frequency takes into account the capacity, capability, redundancy, and diversity of the AC sources and other indications available in the control room, including alarms, to alert the operator to below normal air start pressure.
Babcock & Wilcox STS                      B 3.8.3-7                                        Rev. 5.0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE REQUIREMENTS (continued)
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.8.3.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel storage tanks eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system.
[ The 31 day Frequency is established by Regulatory Guide 1.137 (Ref. 2).
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is for preventive maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during performance of the Surveillance.
Babcock & Wilcox STS                      B 3.8.3-8                                                       Rev. 5.0

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES REFERENCES         1. FSAR, Section [9.5.4.2].
: 2. Regulatory Guide 1.137.
: 3. ANSI N195, 1976.
: 4. FSAR, Chapter [6].
: 5. FSAR, Chapter [15].
: 6. ASTM Standards: D4057-[ ]; D975-[ ]; D1298-[ ]; D4176-[ ];
[D2709-[ ];] D1552-[ ]; D2622-[ ]; D4294-[ ]; D5452-[ ].
: 7. ASTM Standards, D975-[     ] , Table 1.
Babcock & Wilcox STS               B 3.8.3-9                                       Rev. 5.0

DC Sources - Operating B 3.8.4 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.4 DC Sources - Operating BASES BACKGROUND           The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and preferred AC vital bus power (via inverters). As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure. The DC electrical power system also conforms to the recommendations of Regulatory Guide 1.6 (Ref. 2) and IEEE-308 (Ref. 3).
The [125/250] VDC electrical power system consists of two independent and redundant safety related Class 1E DC electrical power subsystems
([Train A and Train B]). Each subsystem consists of [two] 125 VDC batteries [(each battery [50]% capacity)], the associated battery charger[s]
for each battery, and all the associated control equipment and interconnecting cabling.
[ The 250 VDC source is obtained by use of the two 125 VDC batteries connected in series. Additionally, there is [one] spare battery charger per subsystem, which provides backup service in the event that the preferred battery charger is out of service. If the spare battery charger is substituted for one of the preferred battery chargers, then the requirements of independence and redundancy between subsystems are maintained. ]
During normal operation, the [125/250] VDC load is powered from the battery chargers with the batteries floating on the system. In case of loss of normal power to the battery charger, the DC load is automatically powered from the station batteries.
The [Train A and Train B] DC electrical power subsystems provide the control power for its associated Class 1E AC power load group, [4.16] kV switchgear, and [480] V load centers. The DC electrical power subsystems also provide DC electrical power to the inverters, which in turn power the AC vital buses.
The DC power distribution system is described in more detail in Bases for LCO 3.8.9, "Distributions System - Operating," and for LCO 3.8.10, "Distribution Systems - Shutdown."
Babcock & Wilcox STS                    B 3.8.4-1                                       Rev. 5.0

DC Sources - Operating B 3.8.4 BASES BACKGROUND (continued)
Each 125/250 VDC battery is separately housed in a ventilated room apart from its charger and distribution centers. Each subsystem is located in an area separated physically and electrically from the other subsystem to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. [There is no sharing between redundant Class 1E subsystems, such as batteries, battery chargers, or distribution panels.]
Each battery has adequate storage capacity to meet the duty cycle(s) discussed in the FSAR, Chapter [8] (Ref 4). The battery is designed with additional capacity above that required by the design duty cycle to allow for temperature variations and other factors.
The batteries for Train A and Train B DC electrical power subsystems are sized to produce required capacity at 80% of nameplate rating, corresponding to warranted capacity at end of life cycles and the 100%
design demand. The minimum design voltage limit is [105/210] V.
The battery cells are of flooded lead acid construction with a nominal specific gravity of [1.215]. This specific gravity corresponds to an open circuit battery voltage of approximately 120 V for a [58] cell battery (i.e.,
cell voltage of [2.065] volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage  [2.065] Vpc, the battery cell will maintain its capacity for [30] days without further charging per manufacturer's instructions. Optimal long term performance however, is obtained by maintaining a float voltage [2.20 to 2.25] Vpc. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge. The nominal float voltage of [2.22] Vpc corresponds to a total float voltage output of [128.8] V for a [58] cell battery as discussed in the FSAR, Chapter [8] (Ref. 4).
Each Train A and Train B DC electrical power subsystem battery charger has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged. Each battery charger also has sufficient excess capacity to restore the battery from the design minimum charge to its fully charged state within [24] hours while supplying normal steady state loads discussed in the FSAR, Chapter [8] (Ref. 4).
Babcock & Wilcox STS                   B 3.8.4-2                                         Rev. 5.0

DC Sources - Operating B 3.8.4 BASES BACKGROUND (continued)
The battery charger is normally in the float-charge mode. Float-charge is the condition in which the charger is supplying the connected loads and the battery cells are receiving adequate current to optimally charge the battery. This assures the internal losses of a battery are overcome and the battery is maintained in a fully charged state.
When desired, the charger can be placed in the equalize mode. The equalize mode is at a higher voltage than the float mode and charging current is correspondingly higher. The battery charger is operated in the equalize mode after a battery discharge or for routine maintenance.
Following a battery discharge, the battery recharge characteristic accepts current at the current limit of the battery charger (if the discharge was significant, e.g., following a battery service test) until the battery terminal voltage approaches the charger voltage setpoint. Charging current then reduces exponentially during the remainder of the recharge cycle. Lead-calcium batteries have recharge efficiencies of greater than 95%, so once at least 105% of the ampere-hours discharged have been returned, the battery capacity would be restored to the same condition as it was prior to the discharge. This can be monitored by direct observation of the exponentially decaying charging current or by evaluating the amp-hours discharged from the battery and amp-hours returned to the battery.
APPLICABLE         The initial conditions of Design Basis Accident (DBA) and transient SAFETY             analyses in the FSAR, Chapter [6] (Ref. 5) and Chapter [15] (Ref. 6),
ANALYSES           assume that Engineered Safety Feature (ESF) systems are OPERABLE.
The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.
The OPERABILITY of the DC sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining the DC sources OPERABLE during accident conditions in the event of:
: a. An assumed loss of all offsite AC power or all onsite AC power and
: b. A worst-case single failure.
The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                    B 3.8.4-3                                           Rev. 5.0

DC Sources - Operating B 3.8.4 BASES LCO                The DC electrical power subsystems, each subsystem consisting of [two]
batteries, battery charger [for each battery] and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the subsystem are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. Loss of any DC electrical power subsystem does not prevent the minimum safety function from being performed (Ref. 4).
An OPERABLE DC electrical power subsystem requires all required batteries and respective chargers to be operating and connected to the associated DC bus(es).
APPLICABILITY      The DC electrical power sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure safe unit operation and to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients and
: b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.
The DC electrical power requirements for MODES 5 and 6 are addressed in the Bases for LCO 3.8.5, "DC Sources - Shutdown."
ACTIONS            A.1, A.2, and A.3 Condition A represents one subsystem with one [or two] battery chargers inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within [12] hours, the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability.
Babcock & Wilcox STS                   B 3.8.4-4                                         Rev. 5.0

DC Sources - Operating B 3.8.4 BASES ACTIONS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
A plant that cannot meet the 12 hour Completion Time due to an inherent battery charging characteristic can propose an alternate time equal to 2 hours plus the time experienced to accomplish the exponential charging current portion of the battery charge profile following the service test (SR 3.8.4.3).
A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within [12] hours, avoiding a premature shutdown with its own attendant risk.
If established battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours, and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.
If the charger is operating in the current limit mode after 2 hours that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within [12] hours (Required Action A.2).
Required Action A.2 requires that the battery float current be verified as less than or equal to [2] amps. This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it is now fully capable of supplying the maximum expected load requirement. The
[2] amp value is based on returning the battery to [95]% charge and assumes a [5]% design margin for the battery. If at the expiration of the initial [12] hour period the battery float current is not less than or equal to
[2] amps this indicates there may be additional battery problems and the battery must be declared inoperable.
Babcock & Wilcox STS                      B 3.8.4-5                                                       Rev. 5.0

DC Sources - Operating B 3.8.4 BASES ACTIONS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Any licensee wishing to adopt Completion Time greater than 72 hours for Required Action A.3 will need to demonstrate that the longer Completion Time is appropriate for the plant in accordance with the guidance in Regulatory Guide (RG) 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," and RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis."
Alternatively, a 7 day Completion Time can be justified by an acceptable method, such as a regulatory commitment that an alternate means to charge the batteries will be available that is capable of being supplied power from a power source that is independent of the offsite power supply. Otherwise, the 72 hour Completion Time must be adopted.
Required Action A.3 limits the restoration time for the inoperable battery charger to [72] hours. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.] This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The [72] hour Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.
B.1
                   ----------------------------------REVIEWERS NOTES----------------------------------
: 1. The 2 hour Completion Times of Required Actions B.1 and C.1 are in brackets. Any licensee wishing to request a longer Completion Time will need to demonstrate that the longer Completion Time is appropriate for the plant in accordance with the guidance in RG 1.177 and 1.174.
: 2. Condition B is included if Required Action B.1 (One [or two]
batter[y][ies on one subsystem] inoperable) and Required Action C.1 (One DC electrical power subsystem inoperable for reasons other than Condition A [or B]) would have different Completion Times. If the plant design supports different Completion Times when a battery is inoperable but the charger is OPERABLE, then Condition B is used. If not, Condition B is deleted and only Condition C is used.
Babcock & Wilcox STS                      B 3.8.4-6                                                       Rev. 5.0

DC Sources - Operating B 3.8.4 BASES ACTIONS (continued)
Condition B represents one subsystem with one [or two] batter[y][ies]
inoperable. With one [or two] batter[y][ies] inoperable, the DC bus is being supplied by the OPERABLE battery charger[s]. Any event that results in a loss of the AC bus supporting the battery charger[s] will also result in loss of DC to that subsystem. Recovery of the AC bus, especially if it is due to a loss of offsite power, will be hampered by the fact that many of the components necessary for the recovery (e.g., diesel generator control and field flash, AC load shed and diesel generator output circuit breakers, etc.) likely rely upon the batter[y][ies]. In addition the energization transients of any DC loads that are beyond the capability of the battery charger[s] and normally require the assistance of the batter[y][ies] will not be able to be brought online. The [2] hour limit allows sufficient time to effect restoration of an inoperable battery given that the majority of the conditions that lead to battery inoperability (e.g.,
loss of battery charger, battery cell voltage less than [2.07] V, etc.) are identified in Specifications 3.8.4, 3.8.5, and 3.8.6 together with additional specific Completion Times. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
C.1 Condition C represents one subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected subsystem. The 2 hour limit is consistent with the allowed time for an inoperable DC distribution subsystem. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
If one of the required DC electrical power subsystems is inoperable for reasons other than Condition A or B (e.g., inoperable battery charger and associated inoperable battery), the remaining DC electrical power subsystem has the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could, however, result in the loss of the minimum necessary DC electrical subsystems to mitigate a worst case accident, continued power operation should not exceed 2 hours. The 2 hour Completion Time is based on Regulatory Guide 1.93 (Ref. 7) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.
Babcock & Wilcox STS                    B 3.8.4-7                                          Rev. 5.0

DC Sources - Operating B 3.8.4 BASES ACTIONS (continued)
D.1 and D.2 If the inoperable DC electrical power subsystem(s) cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 8). There are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. For example, in MODE 4 the turbine driven emergency feedwater pump[s] are available to provide Reactor Coolant System (RCS) cooling via the steam generators utilizing natural circulation.
However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action D.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the battery chargers, which support the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to optimally charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by Babcock & Wilcox STS                   B 3.8.4-8                                         Rev. 5.0

DC Sources - Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued) the battery manufacturer ([2.20] Vpc times the number of connected cells or [127.6] V for a 58 cell battery at the battery terminals). This voltage maintains the battery plates in a condition that supports maintaining the grid life. [ The 7 day Frequency is consistent with manufacturer recommendations.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.8.4.2 This SR verifies the design capacity of the battery chargers. According to Regulatory Guide 1.32 (Ref. 9), the battery charger supply is recommended to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences.
The minimum required amperes and duration ensures that these requirements can be satisfied.
This SR provides two options. One option requires that each battery charger be capable of supplying [400] amps at the minimum established float voltage for [8] hours. The ampere requirements are based on the output rating of the chargers. The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time period if sufficient for the charger temperature to have stabilized and to have been maintained for at least [2] hours.
The other option requires that each battery charger be capable of recharging the battery after a service test coincident with supplying the largest coincident demands of the various continuous steady state loads (irrespective of the status of the plant during which these demands occur). This level of loading may not normally be available following the battery service test and will need to be supplemented with additional loads. The duration for this test may be longer than the charger sizing Babcock & Wilcox STS                      B 3.8.4-9                                                       Rev. 5.0

DC Sources - Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued) criteria since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current. The battery is recharged when the measured charging current is  [2] amps.
[ The Surveillance Frequency is acceptable, given the unit conditions required to perform the test and the other administrative controls existing to ensure adequate charger performance during these [18 month]
intervals. In addition, this Frequency is intended to be consistent with expected fuel cycle lengths.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
SR 3.8.4.3 A battery service test is a special test of the battery capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length should correspond to the design duty cycle requirements as specified in Reference 4.
[ The Surveillance Frequency of [18 months] is consistent with the recommendations of Regulatory Guide 1.32 (Ref. 9) and Regulatory Guide 1.129 (Ref. 10), which state that the battery service test should be performed during refueling operations, or at some other outage, with intervals between tests not to exceed [18 months].
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                        B 3.8.4-10                                                      Rev. 5.0

DC Sources - Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued)
                    -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                    ------------------------------------------------------------------------------------------------ ]
This SR is modified by two Notes. Note 1 allows the performance of a modified performance discharge test in lieu of a service test.
The reason for Note 2 is that performing the Surveillance would perturb the electrical distribution system and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for the assessment. Credit may be taken for unplanned event that satisfy this SR.
REFERENCES         1. 10 CFR 50, Appendix A, GDC 17.
: 2. Regulatory Guide 1.6, March 10, 1971.
: 3. IEEE-308-[1978].
: 4. FSAR, Chapter [8].
: 5. FSAR, Chapter [6].
: 6. FSAR, Chapter [15].
: 7. Regulatory Guide 1.93, December 1974.
Babcock & Wilcox STS                       B 3.8.4-11                                                      Rev. 5.0

DC Sources - Operating B 3.8.4 BASES REFERENCES (continued)
: 8. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
: 9. Regulatory Guide 1.32, February 1977.
: 10. Regulatory Guide 1.129, December 1974.
Babcock & Wilcox STS              B 3.8.4-12                                     Rev. 5.0

DC Sources - Shutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC Sources - Shutdown BASES BACKGROUND          A description of the DC sources is provided in the Bases for LCO 3.8.4, "DC Sources - Operating."
APPLICABLE          The initial conditions of Design Basis Accident (DBA) and transient SAFETY              analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [15] (Ref. 2),
ANALYSES            assume that Engineered Safety Feature (ESF) systems are OPERABLE.
The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.
The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
The OPERABILITY of the minimum DC electrical power sources during MODES 5 and 6 and during movement of [recently] irradiated fuel assemblies ensures that:
: a. The unit can be maintained in the shutdown or refueling condition for
: b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status, and
: c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident
[involving handling recently irradiated fuel. Due to radioactive decay, DC electrical power is only required to mitigate fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [X] days)].
In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.
The rationale for this is based on the fact that many DBAs that are analyzed in MODES [1, 2, 3, and 4] have no specific analyses in MODES [5 and 6] because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.
Babcock & Wilcox STS                    B 3.8.5-1                                          Rev. 5.0

DC Sources - Shutdown B 3.8.5 BASES APPLICABLE SAFETY ANALYSES (continued)
The shutdown Technical Specification requirements are designed to ensure that the unit has the capability to mitigate the consequences of certain postulated accidents. Worst case DBAs which are analyzed for operating MODES are generally viewed not to be a significant concern during shutdown MODES due to the lower energies involved. The Technical Specifications therefore require a lesser complement of electrical equipment to be available during shutdown than is required during operating MODES. More recent work completed on the potential risks associated with shutdown, however, have found significant risk associated with certain shutdown evolutions. As a result, in addition to the requirements established in the Technical Specifications, the industry has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," as an Industry initiative to manage shutdown tasks and associated electrical support to maintain risk at an acceptable low level. This may require the availability of additional equipment beyond that required by the shutdown Technical Specifications.
The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The DC electrical power subsystems, [each required] [the required]
subsystem consisting of two batteries, one battery charger per battery, and the corresponding control equipment and interconnecting cabling within the subsystem, [are] [is] required to be OPERABLE to support
[required] [one] subsystem[s] of the distribution systems [required OPERABLE by LCO 3.8.10, "Distribution Systems - Shutdown."] This ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents
[involving handling recently irradiated fuel]).
APPLICABILITY      The DC electrical power sources required to be OPERABLE in MODES 5 and 6 and during movement of [recently] irradiated fuel assemblies, provide assurance that:
: a. Required features to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core,
: b. Required features needed to mitigate a fuel handling accident
[involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [X] days)] are available,
: c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available, and Babcock & Wilcox STS                    B 3.8.5-2                                          Rev. 5.0

DC Sources - Shutdown B 3.8.5 BASES APPLICABILITY (continued)
: d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
The DC electrical power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.4.
ACTIONS            LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
A.1, A.2, and A.3
                   -----------------------------------REVIEWERS NOTE-----------------------------------
ACTION A is included only when plant-specific implementation of LCO 3.8.5 includes the potential to require both subsystems of the DC System to be OPERABLE. If plant-specific implementation results in LCO 3.8.5 requiring only one subsystem of the DC System to be OPERABLE, then ACTION A is omitted and ACTION B is renumbered as ACTION A.
Condition A represents one subsystem with one [or two] battery chargers inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within [12] hours, the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability.
Babcock & Wilcox STS                      B 3.8.5-3                                                       Rev. 5.0

DC Sources - Shutdown B 3.8.5 BASES ACTIONS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
A plant that cannot meet the 12 hour Completion Time due to an inherent battery charging characteristic can propose an alternate time equal to 2 hours plus the time experienced to accomplish the exponential charging current portion of the battery charge profile following the service test (SR 3.8.4.3).
A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within [12] hours, avoiding a premature shutdown with its own attendant risk.
If established battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours, and the charger is not operating in the current-limiting modes, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit modes that is necessary during the recovery period following a battery discharge event that the DC system is designed for.
If the charger is operating in the current limit mode after 2 hours that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within [12] hours (Required Action A.2).
Required Action A.2 requires that the battery float current be verified as less than or equal to [2] amps. This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it has now been fully recharged. If at the expiration of the initial [12] hour period the battery float current is not less than or equal to [2] amps this indicates there may be additional battery problems and the battery must be declared inoperable.
Babcock & Wilcox STS                      B 3.8.5-4                                                       Rev. 5.0

DC Sources - Shutdown B 3.8.5 BASES ACTIONS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Any licensee wishing to adopt a Completion Time greater than 72 hours for Required Action A.3 will need to demonstrate that the Completion Time is appropriate for the plant in accordance with the guidance in Regulatory Guide (RG) 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications." Otherwise, the 72 hour Completion Time must be adopted.
Required Action A.3 limits the restoration time for the inoperable battery charger to [72] hours. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The [72] hour Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.
B.1, B.2.1, B.2.2, and B.3
[If two subsystems are required by LCO 3.8.10, the remaining subsystem with DC power available may be capable of supporting sufficient systems to allow continuation of [recently] irradiated fuel movement]. By allowing the option to declare required features inoperable with the associated DC power source(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCO ACTIONS. In many instances this option may involve undesired administrative efforts.
Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend movement of [recently] irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6).] Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration.
This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.
Babcock & Wilcox STS                      B 3.8.5-5                                                       Rev. 5.0

DC Sources - Shutdown B 3.8.5 BASES ACTIONS (continued)
Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystem[s] and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the unit safety systems.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.
SURVEILLANCE       SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires performance of all Surveillances required by SR 3.8.4.1 through SR 3.8.4.3. Therefore, see the corresponding Bases for LCO 3.8.4 for a discussion of each SR.
This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required.
REFERENCES         1. FSAR, Chapter [6].
: 2. FSAR, Chapter [15].
Babcock & Wilcox STS                  B 3.8.5-6                                         Rev. 5.0

Battery Parameters B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Parameters BASES BACKGROUND           This LCO delineates the limits on battery float current as well as electrolyte temperature, level, and float voltage for the DC power subsystem batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources - Operating," and LCO 3.8.5, "DC Sources - Shutdown." In addition to the limitations of this Specification, the [licensee controlled program] also implements a program specified in Specification 5.5.16 for monitoring various battery parameters.
The battery cells are of flooded lead acid construction with a nominal specific gravity of [1.215]. This specific gravity corresponds to an open circuit battery voltage of approximately 120 V for [58] cell battery (i.e., cell voltage of [2.065] volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage  [2.065] Vpc, the battery cell will maintain its capacity for [30] days without further charging per manufacturer's instructions. Optimal long term performance however, is obtained by maintaining a float voltage [2.20 to 2.25] Vpc. This provides adequate over-potential which limits the formation of lead sulfate and self discharge. The nominal float voltage of [2.22] Vpc corresponds to a total float voltage output of [128.8] V for a [58] cell battery as discussed in the FSAR, Chapter [8] (Ref. 2).
APPLICABLE           The initial conditions of Design Basis Accident (DBA) and transient SAFETY               analyses in the FSAR, Chapter [6] (Ref. 3) and Chapter [15] (Ref. 4),
ANALYSES             assume Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.
The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining at least one subsystem of DC sources OPERABLE during accident conditions, in the event of:
: a. An assumed loss of all offsite AC power or all onsite AC power and
: b. A worst-case single failure.
Battery parameters satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                     B 3.8.6-1                                          Rev. 5.0

Battery Parameters B 3.8.6 BASES LCO                Battery parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA. Battery parameter limits are conservatively established, allowing continued DC electrical system function even with limits not met. Additional preventative maintenance, testing, and monitoring performed in accordance with the [licensee controlled program] is conducted as specified in Specification 5.5.16.
APPLICABILITY      The battery parameters are required solely for the support of the associated DC electrical power subsystems. Therefore, battery parameter limits are only required when the DC power source is required to be OPERABLE. Refer to the Applicability discussion in Bases for LCO 3.8.4 and LCO 3.8.5.
ACTIONS            A.1, A.2, and A.3 With one or more cells in one or more batteries in one subsystem
                   < [2.07] V, the battery cell is degraded. Within 2 hours verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage (SR 3.8.4.1) and of the overall battery state of charge by monitoring the battery float charge current (SR 3.8.6.1). This assures that there is still sufficient battery capacity to perform the intended function.
Therefore, the affected battery is not required to be considered inoperable solely as a result of one or more cells in one or more batteries < [2.07] V, and continued operation is permitted for a limited period up to 24 hours.
Since the Required Actions only specify "perform," a failure of SR 3.8.4.1 or SR 3.8.6.1 acceptance criteria does not result in this Required Action not met. However, if one of the SRs is failed the appropriate Condition(s),
depending on the cause of the failures, is entered. If SR 3.8.6.1 is failed then there is not assurance that there is still sufficient battery capacity to perform the intended function and the battery must be declared inoperable immediately.
B.1 and B.2 One or more batteries in one subsystem with float current > [2] amps indicates that a partial discharge of the battery capacity has occurred.
This may be due to a temporary loss of a battery charger or possibly due to one or more battery cells in a low voltage condition reflecting some loss of capacity. Within 2 hours verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage. If the terminal voltage is found to be less than the minimum established float voltage there are two possibilities, the battery charger is inoperable or is operating in the current limit mode. Condition A addresses charger inoperability. If the charger is operating in the current limit mode after Babcock & Wilcox STS                     B 3.8.6-2                                        Rev. 5.0

Battery Parameters B 3.8.6 BASES ACTIONS (continued) 2 hours that is an indication that the battery has been substantially discharged and likely cannot perform its required design functions. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within
[12] hours (Required Action B.2). The battery must therefore be declared inoperable.
If the float voltage is found to be satisfactory but there are one or more battery cells with float voltage less than [2.07] V, the associated "OR" statement in Condition F is applicable and the battery must be declared inoperable immediately. If float voltage is satisfactory and there are no cells less than [2.07] V there is good assurance that, within [12] hours, the battery will be restored to its fully charged condition (Required Action B.2) from any discharge that might have occurred due to a temporary loss of the battery charger.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
A plant that cannot meet the 12 hour Completion Time due to an inherent battery charging characteristic can propose an alternate time equal to 2 hours plus the time experienced to accomplish the exponential charging current portion of the battery charge profile following the service test (SR 3.8.4.3).
A discharged battery with float voltage (the charger setpoint) across its terminals indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within [12] hours, avoiding a premature shutdown with its own attendant risk.
If the condition is due to one or more cells in a low voltage condition but still greater than [2.07] V and float voltage is found to be satisfactory, this is not indication of a substantially discharged battery and [12] hours is a reasonable time prior to declaring the battery inoperable.
Since Required Action B.1 only specifies "perform," a failure of SR 3.8.4.1 acceptance criteria does not result in the Required Action not met.
However, if SR 3.8.4.1 is failed, the appropriate Condition(s), depending on the cause of the failure, is entered.
Babcock & Wilcox STS                      B 3.8.6-3                                                       Rev. 5.0

Battery Parameters B 3.8.6 BASES ACTIONS (continued)
C.1, C.2, and C.3 With one or more batteries in one subsystem with one or more cells electrolyte level above the top of the plates, but below the minimum established design limits, the battery still retains sufficient capacity to perform the intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of electrolyte level not met. Within 31 days the minimum established design limits for electrolyte level must be re-established.
With electrolyte level below the top of the plates there is a potential for dryout and plate degradation. Required Actions C.1 and C.2 address this potential (as well as provisions in Specification 5.5.16, Battery Monitoring and Maintenance Program). They are modified by a Note that indicates they are only applicable if electrolyte level is below the top of the plates.
Within 8 hours level is required to be restored to above the top of the plates. The Required Action C.2 requirement to verify that there is no leakage by visual inspection and the Specification 5.5.16.b item to initiate action to equalize and test in accordance with manufacturer's recommendation are taken from IEEE Standard 450. They are performed following the restoration of the electrolyte level to above the top of the plates. Based on the results of the manufacturer's recommended testing the batter[y][ies] may have to be declared inoperable and the affected cell[s] replaced.
D.1 With one or more batteries in one subsystem with pilot cell temperature less than the minimum established design limits, 12 hours is allowed to restore the temperature to within limits. A low electrolyte temperature limits the current and power available. Since the battery is sized with margin, while battery capacity is degraded, sufficient capacity exists to perform the intended function and the affected battery is not required to be considered inoperable solely as a result of the pilot cell temperature not met.
E.1 With one or more batteries in redundant subsystems with battery parameters not within limits there is not sufficient assurance that battery capacity has not been affected to the degree that the batteries can still perform their required function, given that redundant batteries are involved. With redundant batteries involved this potential could result in a Babcock & Wilcox STS                  B 3.8.6-4                                           Rev. 5.0

Battery Parameters B 3.8.6 BASES ACTIONS (continued) total loss of function on multiple systems that rely upon the batteries. The longer Completion Times specified for battery parameters on non-redundant batteries not within limits are therefore not appropriate, and the parameters must be restored to within limits on at least one subsystem within 2 hours.
F.1 With one or more batteries with any battery parameter outside the allowances of the Required Actions for Condition A, B, C, D, or E, sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding battery must be declared inoperable.
Additionally, discovering one or more batteries in one subsystem with one or more battery cells float voltage less than [2.07] V and float current greater than [2] amps indicates that the battery capacity may not be sufficient to perform the intended functions. The battery must therefore be declared inoperable immediately.
SURVEILLANCE       SR 3.8.6.1 REQUIREMENTS Verifying battery float current while on float charge is used to determine the state of charge of the battery. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a charged state.
The float current requirements are based on the float current indicative of a charged battery. Use of float current to determine the state of charge of the battery is consistent with IEEE-450 (Ref. 1). [ The 7 day Frequency is consistent with IEEE-450 (Ref. 1).
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
This SR is modified by a Note that states the float current requirement is not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1. When this float voltage Babcock & Wilcox STS                      B 3.8.6-5                                                       Rev. 5.0

Battery Parameters B 3.8.6 BASES SURVEILLANCE REQUIREMENTS (continued) is not maintained the Required Actions of LCO 3.8.4 ACTION A are being taken, which provide the necessary and appropriate verifications of the battery condition. Furthermore, the float current limit of [2] amps is established based on the nominal float voltage value and is not directly applicable when this voltage is not maintained.
SR 3.8.6.2 and SR 3.8.6.5 Optimal long term battery performance is obtained by maintaining a float voltage greater than or equal to the minimum established design limits provided by the battery manufacturer, which corresponds to [130.5] V at the battery terminals, or [2.25] Vpc. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge, which could eventually render the battery inoperable. Float voltages in this range or less, but greater than [2.07] Vpc, are addressed in Specification 5.5.16. SRs 3.8.6.2 and 3.8.6.5 require verification that the cell float voltages are equal to or greater than the short term absolute minimum voltage of [2.07] V. [ The Frequency for cell voltage verification every 31 days for pilot cell and 92 days for each connected cell is consistent with IEEE-450 (Ref. 1).
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.8.6.3 The limit specified for electrolyte level ensures that the plates suffer no physical damage and maintains adequate electron transfer capability.
[ The Frequency of 31 days is consistent with IEEE-450 (Ref. 1).
OR Babcock & Wilcox STS                      B 3.8.6-6                                                       Rev. 5.0

Battery Parameters B 3.8.6 BASES SURVEILLANCE REQUIREMENTS (continued)
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.8.6.4 This Surveillance verifies that the pilot cell temperature is greater than or equal to the minimum established design limit (i.e., [40]&deg;F). Pilot cell electrolyte temperature is maintained above this temperature to assure the battery can provide the required current and voltage to meet the design requirements. Temperatures lower than assumed in battery sizing calculations act to inhibit or reduce battery capacity. [ The Frequency of 31 days is consistent with IEEE-450 (Ref. 1).
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
SR 3.8.6.6 A battery performance discharge test is a test of constant current capacity of a battery, normally done in the as found condition, after having been in service, to detect any change in the capacity determined by the acceptance test. The test is intended to determine overall battery degradation due to age and usage.
Babcock & Wilcox STS                      B 3.8.6-7                                                       Rev. 5.0

Battery Parameters B 3.8.6 BASES SURVEILLANCE REQUIREMENTS (continued)
Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.6.6; however, only the modified performance discharge test may be used to satisfy the battery service test requirements of SR 3.8.4.3.
A modified discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a service test.
It may consist of just two rates; for instance the one minute rate for the battery or the largest current load of the duty cycle, followed by the test rate employed for the performance test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a one minute discharge represents a very small portion of the battery capacity, the test rate can be changed to that for the performance test without compromising the results of the performance discharge test. The battery terminal voltage for the modified performance discharge test must remain above the minimum battery terminal voltage specified in the battery service test for the duration of time equal to that of the service test.
The acceptance criteria for this Surveillance are consistent with IEEE-450 (Ref. 1) and IEEE-485 (Ref. 5). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.
Furthermore, the battery is sized to meet the assumed duty cycle loads when the battery design capacity reaches this [80]% limit.
[ The Surveillance Frequency for this test is normally 60 months.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
Babcock & Wilcox STS                        B 3.8.6-8                                                       Rev. 5.0

Battery Parameters B 3.8.6 BASES SURVEILLANCE REQUIREMENTS (continued)
If the battery shows degradation, or if the battery has reached 85% of its expected life and capacity is < 100% of the manufacturer's rating, the Surveillance Frequency is reduced to 12 months. However, if the battery shows no degradation but has reached 85% of its expected life, the Surveillance Frequency is only reduced to 24 months for batteries that retain capacity  100% of the manufacturer's ratings. Degradation is indicated, according to IEEE-450 (Ref. 1), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is  [10%] below the manufacturer's rating.
These Frequencies are consistent with the recommendations in IEEE-450 (Ref. 1).
This SR is modified by a Note. The reason for the Note is that performing the Surveillance would perturb the electrical distribution system and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes.
These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for the assessment.
Credit may be taken for unplanned events that satisfy this SR.
REFERENCES         1. IEEE-450.
: 2. FSAR, Chapter [8].
: 3. FSAR, Chapter [6].
: 4. FSAR, Chapter [15].
: 5. IEEE-485-[1983], June 1983.
Babcock & Wilcox STS                 B 3.8.6-9                                          Rev. 5.0

Inverters - Operating B 3.8.7 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Inverters - Operating BASES BACKGROUND            The inverters are the preferred source of power for the AC vital buses because of the stability and reliability they achieve. The function of the inverter is to provide AC electrical power to the vital bus. The inverters can be powered from an internal AC source/rectifier or from the station battery. The station battery provides an uninterruptible power source for the instrumentation and controls for the Reactor Protection System (RPS) and the Engineered Safety Feature Actuation System (ESFAS). Specific details on inverters and their operating characteristics are found in FSAR, Chapter [8] (Ref. 1).
APPLICABLE            The initial conditions of Design Basis Accident (DBA) and transient SAFETY                analyses in the FSAR, Chapter [6] (Ref. 2), and Chapter [14] (Ref. 3),
ANALYSES              assume Engineered Safety Feature systems are OPERABLE. The inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the RPS and ESFAS instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.
The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining required AC vital buses OPERABLE during accident conditions in the event of:
: a. An assumed loss of all offsite AC electrical power or all onsite AC electrical power and
: b. A worst-case single failure.
Inverters are a part of the distribution system and, as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                   The inverters ensure the availability of AC electrical power for the systems instrumentation required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA.
Babcock & Wilcox STS                      B 3.8.7-1                                         Rev. 5.0

Inverters - Operating B 3.8.7 BASES LCO (continued)
Maintaining the required inverters OPERABLE ensures that the redundancy incorporated into the design of the RPS and ESFAS instrumentation and controls is maintained. The four inverters [(two per train)] ensure an uninterruptible supply of AC electrical power to the AC vital buses even if the 4.16 kV safety buses are de-energized.
OPERABLE inverters require the associated vital bus to be powered by the inverter with output voltage and frequency within tolerances, and power input to the inverter from a [125 VDC] station battery. Alternatively, power supply may be from an internal AC source via rectifier as long as the station battery is available as the uninterruptible power supply.
This LCO is modified by a Note that allows [one/two] inverters to be disconnected from a [common] battery for  24 hours, if the vital bus(es) is powered from a [Class 1E constant voltage transformer or inverter using internal AC source] during the period and all other inverters are OPERABLE. This allows an equalizing charge to be placed on one battery. If the inverters were not disconnected, the resulting voltage condition might damage the inverter[s]. These provisions minimize the loss of equipment that would occur in the event of a loss of offsite power.
The 24 hour time period for the allowance minimizes the time during which a loss of offsite power could result in the loss of equipment energized from the affected AC vital bus while taking into consideration the time required to perform an equalizing charge on the battery bank.
The intent of this Note is to limit the number of inverters that may be disconnected. Only those inverters associated with the single battery undergoing an equalizing charge may be disconnected. All other inverters must be aligned to their associated batteries, regardless of the number of inverters or unit design.
APPLICABILITY      The inverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients and
: b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
Inverter requirements for MODES 5 and 6 are covered in the Bases for LCO 3.8.8, "Inverters - Shutdown."
Babcock & Wilcox STS                    B 3.8.7-2                                        Rev. 5.0

Inverters - Operating B 3.8.7 BASES ACTIONS            A.1 With a required inverter inoperable, its associated AC vital bus becomes inoperable until it is [manually] re-energized from its [Class 1E constant voltage source transformer or inverter using internal AC source].
For this reason, a Note has been included in Condition A requiring entry into the Conditions and Required Actions of LCO 3.8.9, "Distribution Systems - Operating." This ensures the vital bus is re-energized within 2 hours. Required Action A.1 allows 24 hours to fix the inoperable inverter and return it to service. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.] The 24 hour limit is based upon engineering judgment, taking into consideration the time required to repair an inverter and the additional risk to which the unit is exposed because of the inverter inoperability. This has to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When the AC vital bus is powered from its constant voltage source, it is relying upon interruptible AC electrical power sources (offsite and onsite). The uninterruptible inverter source to the AC vital buses is the preferred source for powering instrumentation trip setpoint devices.
B.1 and B.2 If the inoperable devices or components cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 4). There are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. For example, in MODE 4 the turbine driven emergency feedwater pump[s] are available to provide RCS cooling via the steam generators utilizing natural circulation. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment Babcock & Wilcox STS                   B 3.8.7-3                                         Rev. 5.0

Inverters - Operating B 3.8.7 BASES ACTIONS (continued) addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.8.7.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation of the RPS and ESFAS connected to the AC vital buses. [ The 7 day Frequency takes into account the redundant capability of the inverters and other indications available in the control room that alert the operator to inverter malfunctions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Chapter [8].
: 2. FSAR, Chapter [6].
: 3. FSAR, Chapter [14].
: 4. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                      B 3.8.7-4                                                       Rev. 5.0

Inverters - Shutdown B 3.8.8 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Inverters - Shutdown BASES BACKGROUND            A description of the inverters is provided in the Bases for LCO 3.8.7, "Inverters - Operating."
APPLICABLE            The initial conditions of Design Basis Accident (DBA) and transient SAFETY                analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [14] (Ref. 2),
ANALYSES              assume Engineered Safety Feature systems are OPERABLE. The DC to AC inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the Reactor Protection System and Engineered Safety Features Actuation System (ESFAS) instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.
The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
The OPERABILITY of the minimum inverters to each AC vital bus during MODES 5 and 6 ensures that:
: a. The unit can be maintained in the shutdown or refueling condition for extended periods,
: b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status, and
: c. Adequate power is available to mitigate events postulated during shutdown, such as a fuel handling accident [involving handling recently irradiated fuel. Due to radioactive decay, the inverters are only required to mitigate fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [X] days)].
In general, when the unit is shut down, the Technical Specification requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.
The rationale for this is based on the fact that many DBAs that are analyzed in MODES [1, 2, 3, and 4] have no specific analyses in MODES
[5 and 6] because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being Babcock & Wilcox STS                      B 3.8.8-1                                           Rev. 5.0

Inverters - Shutdown B 3.8.8 BASES APPLICABLE SAFETY ANALYSES (continued) significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.
The shutdown Technical Specification requirements are designed to ensure that the unit has the capability to mitigate the consequences of certain postulated accidents. Worst case DBAs which are analyzed for operating MODES are generally viewed not to be a significant concern during shutdown MODES due to the lower energies involved. The Technical Specifications therefore require a lesser complement of electrical equipment to be available during shutdown than is required during operating MODES. More recent work completed on the potential risks associated with shutdown, however, have found significant risk associated with certain shutdown evolutions. As a result, in addition to the requirements established in the Technical Specifications, the industry has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," as an Industry initiative to manage shutdown tasks and associated electrical support to maintain risk at an acceptable low level. This may require the availability of additional equipment beyond that required by the shutdown Technical Specifications.
The inverters were previously identified as part of the distribution system and, as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The inverter[s] ensure the availability of electrical power for the instrumentation for systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA. The battery powered inverter[s] provide[s]
uninterruptible supply of AC electrical power to the AC vital bus[es] even if the 4.16 kV safety buses are de-energized. OPERABILITY of the inverter[s] requires that the vital bus be powered by the inverter. This ensures the availability of sufficient inverter power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents [involving handling recently irradiated fuel]).
APPLICABILITY      The inverter[s] required to be OPERABLE in MODES 5 and 6, and during movement of [recently] irradiated fuel assemblies provide assurance that:
: a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core,
: b. Systems needed to mitigate a fuel handling accident [involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [X] days)] are available, Babcock & Wilcox STS                    B 3.8.8-2                                          Rev. 5.0

Inverters - Shutdown B 3.8.8 BASES APPLICABILITY (continued)
: c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available, and
: d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
Inverter requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.7.
ACTIONS            LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
A.1, A.2.1, A.2.2, and A.2.3
[If two trains are required by LCO 3.8.10, "Distribution Systems -
Shutdown," the remaining OPERABLE inverters may be capable of supporting sufficient required features to allow continuation of fuel movement [involving handling recently irradiated fuel], and operations with a potential for positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6).] Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the Reactor Coolant System (RCS) for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. By the allowance of the option to declare required features inoperable with the associated inverter(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCOs' Required Actions. In many instances, this option may involve undesired Babcock & Wilcox STS                   B 3.8.8-3                                           Rev. 5.0

Inverters - Shutdown B 3.8.8 BASES ACTIONS (continued) administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend movement of [recently]
irradiated fuel assemblies, and operations involving positive reactivity additions).
Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required inverter[s] and to continue this action until restoration is accomplished in order to provide the necessary inverter power to the unit safety systems.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required inverters should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power or powered from a constant voltage source transformer.
SURVEILLANCE       SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation connected to the AC vital buses. [ The 7 day Frequency takes into account the redundant capability of the inverters and other indications available in the control room that alert the operator to inverter malfunctions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Chapter [6].
: 2. FSAR, Chapter [14].
Babcock & Wilcox STS                      B 3.8.8-4                                                       Rev. 5.0

Distribution Systems - Operating B 3.8.9 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.9 Distribution Systems - Operating BASES BACKGROUND            The onsite Class 1E AC, DC, and AC vital bus electrical power distribution systems are divided by train into [two] redundant and independent AC, DC, and AC vital bus electrical power distribution subsystems.
The AC electrical power subsystem for each train consists of a primary Engineered Safety Feature (ESF) 4.16 kV bus and secondary [480 and 120] V buses, distribution panels, motor control centers and load centers.
Each [4.16 kV ESF bus] has at least [one separate and independent offsite source of power] as well as a dedicated onsite diesel generator (DG) source. Each [4.16 kV ESF bus] is normally connected to a preferred offsite source. After a loss of the preferred offsite power source to a 4.16 kV ESF bus, a transfer to the alternate offsite source is accomplished by utilizing a time delayed bus undervoltage relay. If all offsite sources are unavailable, the onsite emergency DG supplies power to the 4.16 kV ESF bus. Control power for the 4.16 kV breakers is supplied from the Class 1E batteries. Additional description of this system may be found in the Bases for LCO 3.8.1, "AC Sources -
Operating," and the Bases for LCO 3.8.4, "DC Sources - Operating."
The secondary AC electrical power distribution subsystem for each train includes the safety related buses, load centers, motor control centers, and distribution panels shown in Table B 3.8.9-1.
The 120 VAC vital buses are arranged in two load groups per train and are normally powered from the inverters. The alternate power supply for the vital buses are Class 1E constant voltage source transformers powered from the same train as the associated inverter, and its use is governed by LCO 3.8.7, "Inverters - Operating." Each constant voltage source transformer is powered from a Class 1E AC bus.
The DC electrical distribution subsystem consists of [125] V bus(es) and distribution panel(s).
The list of all required DC and vital AC distribution buses [and panels] is presented in Table B 3.8.9-1.
APPLICABLE            The initial conditions of Design Basis Accident (DBA) and transient SAFETY                analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [14] (Ref. 2),
ANALYSES              assume ESF systems are OPERABLE. The AC, DC, and AC vital bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of Babcock & Wilcox STS                      B 3.8.9-1                                        Rev. 5.0

Distribution Systems - Operating B 3.8.9 BASES APPLICABLE SAFETY ANALYSES (continued) necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, "Power Distribution Limits," Section 3.4, "Reactor Coolant System (RCS)," and Section 3.6, "Containment Systems."
The OPERABILITY of the AC, DC, and AC vital bus electrical power distribution systems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit.
This includes maintaining power distribution systems OPERABLE during accident conditions in the event of:
: a. An assumed loss of all offsite power or all onsite AC electrical power and
: b. A worst-case single failure.
The distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                The required power distribution subsystems listed in Table B 3.8.9-1 ensure the availability of AC, DC, and AC vital bus electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. The AC, DC, and AC vital bus electrical power distribution subsystems are required to be OPERABLE.
Maintaining the Train A and Train B AC, DC, and AC vital bus electrical power distribution subsystems OPERABLE ensures that the redundancy incorporated into the design of ESF is not defeated. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.
OPERABLE AC electrical power distribution subsystems require the associated buses, load centers, motor control centers, and distribution panels to be energized to their proper voltages. OPERABLE DC electrical power distribution subsystems require the associated buses and distribution panels to be energized to their proper voltage from either the associated battery or charger. OPERABLE vital bus electrical power distribution subsystems require the associated buses to be energized to their proper voltage from the associated [inverter via inverted DC voltage, inverter using internal AC source, or Class 1E constant voltage transformer].
In addition, tie breakers between redundant safety related AC, DC, and AC vital bus power distribution subsystems, if they exist, must be open.
This prevents any electrical malfunction in any power distribution Babcock & Wilcox STS                   B 3.8.9-2                                         Rev. 5.0

Distribution Systems - Operating B 3.8.9 BASES LCO (continued) subsystem from propagating to the redundant subsystem, that could cause the failure of a redundant subsystem and a loss of essential safety function(s). If any tie breakers are closed, the affected redundant electrical power distribution subsystems are considered inoperable. This applies to the onsite, safety related redundant electrical power distribution subsystems. It does not, however, preclude redundant Class 1E 4.16 kV buses from being powered from the same offsite circuit.
APPLICABILITY      The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients and
: b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
Electrical power distribution subsystem requirements for MODES 5 and 6 are covered in the Bases for LCO 3.8.10, "Distribution Systems -
Shutdown."
ACTIONS            A.1 With one or more Train A and B required AC buses, load centers, motor control centers, or distribution panels (except AC vital buses), in one train inoperable and a loss of function has not occurred, the remaining AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the required AC buses, load centers, motor control centers, and distribution panels must be restored to OPERABLE status within 8 hours [or in accordance with the Risk Informed Completion Time Program].
Condition A worst scenario is one train without AC power (i.e., no offsite power to the train and the associated DG inoperable). In this Condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operator's attention be focused on minimizing the potential for loss of power to the remaining train by stabilizing the unit, and on restoring power to the affected train. The 8 hour time limit before requiring a unit shutdown in this Condition is acceptable because of:
Babcock & Wilcox STS                    B 3.8.9-3                                        Rev. 5.0

Distribution Systems - Operating B 3.8.9 BASES ACTIONS (continued)
: a. The potential for decreased safety if the unit operator's attention is diverted from the evaluations and actions necessary to restore power to the affected train to the actions associated with taking the unit to shutdown within this time limit and
: b. The potential for an event in conjunction with a single failure of a redundant component in the train with AC power.
Required Action A.1 is modified by a Note that requires the applicable Conditions and Required Actions of LCO 3.8.4, "DC Sources - Operating,"
to be entered for DC trains made inoperable by inoperable power distribution subsystems. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. Inoperability of a distribution system can result in loss of charging power to batteries and eventual loss of DC power. This Note ensures that the appropriate attention is given to restoring charging power to batteries, if necessary, after loss of distribution systems.
B.1 With one or more AC vital buses inoperable, and a loss of function has not yet occurred, the remaining OPERABLE AC vital buses are capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition. Overall reliability is reduced, however, since an additional single failure could result in the minimum required ESF functions not being supported. Therefore, the
[required] AC vital bus must be restored to OPERABLE status within 2 hours by powering the bus from the associated [inverter via inverted DC, inverter using internal AC Source, or Class 1E constant voltage transformer]. [Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
Condition B represents one or more AC vital buses without power; potentially both the DC source and the associated AC source are nonfunctioning. In this situation the unit is significantly more vulnerable to a complete loss of all noninterruptible power. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining vital buses and restoring power to the affected vital bus.
This 2 hour limit is more conservative than Completion Times allowed for the vast majority of components that are without adequate vital AC power.
Taking exception to LCO 3.0.2 for components without adequate vital AC power, that would have the Required Action Completion Times shorter than 2 hours if declared inoperable, is acceptable because of:
Babcock & Wilcox STS                   B 3.8.9-4                                         Rev. 5.0

Distribution Systems - Operating B 3.8.9 BASES ACTIONS (continued)
: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) and not allowing stable operations to continue,
: b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without adequate vital AC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train, and
: c. The potential for an event in conjunction with a single failure of a redundant component.
The 2 hour Completion Time takes into account the importance to safety of restoring the AC vital bus to OPERABLE status, the redundant capability afforded by the other OPERABLE vital buses, and the low probability of a DBA occurring during this period.
C.1 With one or more DC buses or distribution panels inoperable, and a loss of function has not yet occurred, the remaining DC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystem could result in the minimum required ESF functions not being supported. Therefore, the [required] DC buses and distribution panels must be restored to OPERABLE status within 2 hours by powering the bus from the associated battery or charger.
[Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.]
Condition C represents one or more DC buses or distribution panels without adequate DC power; potentially both with the battery significantly degraded and the associated charger nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss of all DC power. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining trains and restoring power to the affected train.
Babcock & Wilcox STS                   B 3.8.9-5                                         Rev. 5.0

Distribution Systems - Operating B 3.8.9 BASES ACTIONS (continued)
This 2 hour limit is more conservative than Completion Times allowed for the vast majority of components that are without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 2 hours, is acceptable because of:
: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) while allowing stable operations to continue,
: b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to perform the necessary evaluations and actions to restore power to the affected train, and
: c. The potential for an event in conjunction with a single failure of a redundant component.
The 2 hour Completion Time for DC buses is consistent with Regulatory Guide 1.93 (Ref. 3).
D.1 and D.2 If the inoperable distribution subsystem(s) cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.
Remaining within the Applicability of the LCO is acceptable because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 4). There are more accident mitigation systems available and there is more redundancy and diversity in core heat removal mechanisms in MODE 4 than in MODE 5. For example, in MODE 4 the turbine driven emergency feedwater pump[s] are available to provide RCS cooling via the steam generators utilizing natural circulation. However, voluntary entry into MODE 5 may be made as it is also an acceptable low-risk state.
Required Action D.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the Babcock & Wilcox STS                   B 3.8.9-6                                         Rev. 5.0

Distribution Systems - Operating B 3.8.9 BASES ACTIONS (continued) results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
E.1 Condition E corresponds to a level of degradation in the electrical distribution system that causes a required safety function to be lost.
When more than one inoperable electrical power distribution subsystem results in the loss of a required function, the plant is in a condition outside the accident analysis. Therefore, no additional time is justified for continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown.
SURVEILLANCE       SR 3.8.9.1 REQUIREMENTS This Surveillance verifies that the [required] AC, DC, and AC vital bus electrical power distribution systems are functioning properly, with the correct circuit breaker alignment. The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained, and the appropriate voltage is available to each required bus.
The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. [ The 7 day Frequency takes into account the redundant capability of the AC, DC, and AC vital bus electrical power distribution subsystems, and other indications available in the control room that alert the operator to subsystem malfunctions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Babcock & Wilcox STS                   B 3.8.9-7                                          Rev. 5.0

Distribution Systems - Operating B 3.8.9 BASES SURVEILLANCE REQUIREMENTS (continued)
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Chapter [6].
: 2. FSAR, Chapter [14].
: 3. Regulatory Guide 1.93, December 1974.
: 4. BAW-2441-A, Revision 2, Risk Informed Justification for LCO End-State Changes, September 2006.
Babcock & Wilcox STS                      B 3.8.9-8                                                       Rev. 5.0

Distribution Systems - Operating B 3.8.9 Table B 3.8.9-1 (page 1 of 1)
AC and DC Electrical Power Distribution Systems TYPE                VOLTAGE                     TRAIN A*                  TRAIN B*
AC safety buses             [4160 V]             [ESF Bus] [NB01]          [ESF Bus] [NB02]
[480 V]                Load Centers              Load Centers
[NG01, NG03]              [NG02, NG04]
[480 V]                Motor Control             Motor Control Centers                   Centers
[NG01A, NG01I,            [NG02A, NG02I, NG01B, NG03C,             NG02B, NG04C, NG03I, NG03D]             NG04I, NG04D]
[120 V]            Distribution Panels       Distribution Panels
[NP01, NP03]              [NP02, NP04]
DC buses                 [125 V]                 Bus [NK01]                Bus [NK02]
Bus [NK03]                Bus [NK04]
Distribution Panels       Distribution Panels
[NK41, NK43, NK51]        [NK42, NK44, NK52]
AC vital buses              [120 V]                 Bus [NN01]                Bus [NN02]
Bus [NN03]                Bus [NN04]
* Each train of the AC and DC electrical power distribution systems is a subsystem.
Babcock & Wilcox STS                    B 3.8.9-9                                          Rev. 5.0

Distribution Systems - Shutdown B 3.8.10 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.10 Distribution Systems - Shutdown BASES BACKGROUND            A description of the AC, DC and AC vital bus electrical power distribution systems is provided in the Bases for LCO 3.8.9, "Distribution Systems -
Operating."
APPLICABLE            The initial conditions of Design Basis Accident (DBA) and transient SAFETY                analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [14] (Ref. 2),
ANALYSES              assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC, DC, and AC vital bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.
The OPERABILITY of the AC, DC, and AC vital bus electrical power distribution systems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
The OPERABILITY of the minimum AC, DC, and AC vital bus electrical power distribution subsystems during MODES 5 and 6, and during movement of [recently] irradiated fuel assemblies ensures that:
: a. The unit can be maintained in the shutdown or refueling condition for extended periods,
: b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status, and
: c. Adequate power is provided to mitigate events postulated during shutdown, such as a fuel handling accident [involving handling recently irradiated fuel. Due to radioactive decay, AC, DC, and AC vital bus electrical power is only required to mitigate fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [X] days)].
The AC and DC electrical power distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Babcock & Wilcox STS                     B 3.8.10-1                                          Rev. 5.0

Distribution Systems - Shutdown B 3.8.10 BASES LCO                Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the electrical distribution system necessary to support OPERABILITY of required systems, equipment, and components - all specifically addressed in each LCO and implicitly required via the definition of OPERABILITY.
Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the unit in a safe manner to mitigate the consequences of postulated events during shutdown (e.g.,
fuel handling accidents [involving handling recently irradiated fuel]).
APPLICABILITY      The AC and DC electrical power distribution subsystems required to be OPERABLE in MODES 5 and 6, and during movement of [recently]
irradiated fuel assemblies, provide assurance that:
: a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core;
: b. Systems needed to mitigate a fuel handling accident [involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous [X] days)] are available,
: c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available, and
: d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
The AC, DC, and AC vital bus electrical power distribution subsystem requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.9.
ACTIONS            LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
Babcock & Wilcox STS                  B 3.8.10-2                                         Rev. 5.0

Distribution Systems - Shutdown B 3.8.10 BASES ACTIONS (continued)
A.1, A.2.1, A.2.2, A.2.3, and A.2.4 Although redundant required features may require redundant trains of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem train may be capable of supporting sufficient required features to allow continuation of [recently] irradiated fuel movement. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystems LCO's Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend movement of [recently] irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6) with coolant at boron concentrations less than required to assure the RCS boron concentration is maintained.
Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.
Notwithstanding performance of the above conservative Required Actions, a required decay heat removal (DHR) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.5 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the DHR ACTIONS would not be entered. Therefore, Required Action A.2.6 is provided to direct declaring DHR inoperable, which results in taking the appropriate DHR actions.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power.
Babcock & Wilcox STS                  B 3.8.10-3                                          Rev. 5.0

Distribution Systems - Shutdown B 3.8.10 BASES SURVEILLANCE       SR 3.8.10.1 REQUIREMENTS This Surveillance verifies that the AC, DC, and AC vital bus electrical power distribution subsystems are functioning properly, with all the buses energized. The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses.
[ The 7 day Frequency takes into account the capability of the electrical power distribution subsystems, and other indications available in the control room that alert the operator to subsystem malfunctions.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                   -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                   ------------------------------------------------------------------------------------------------ ]
REFERENCES         1. FSAR, Chapter [6].
: 2. FSAR, Chapter [14].
Babcock & Wilcox STS                      B 3.8.10-4                                                      Rev. 5.0

Boron Concentration B 3.9.1 B 3.9 REFUELING OPERATIONS B 3.9.1 Boron Concentration BASES BACKGROUND         The limit on the boron concentrations of the Reactor Coolant System (RCS), the refueling canal, and the refueling cavity during refueling ensures that the reactor remains subcritical during MODE 6. Refueling boron concentration is the soluble boron concentration in the coolant in each of these volumes having direct access to the reactor core during refueling.
The soluble boron concentration offsets the core reactivity and is measured by chemical analysis of a representative sample of the coolant in each of the volumes. The refueling boron concentration limit is specified in the COLR. Unit procedures ensure the specified boron concentration in order to maintain an overall core reactivity of keff  0.95 during fuel handling, with control rods and fuel assemblies assumed to be in the most adverse configuration (least negative reactivity) allowed by unit procedures.
GDC 26 of 10 CFR 50, Appendix A, requires that two independent reactivity control systems of different design principles be provided (Ref. 1). One of these systems must be capable of holding the reactor core subcritical under cold conditions. The Chemical Addition System serves as the system capable of maintaining the reactor subcritical in cold conditions by maintaining the boron concentration.
The reactor is brought to shutdown conditions before beginning operations to open the reactor vessel for refueling. After the RCS is cooled and depressurized and the vessel head is unbolted, the head is slowly removed to form the refueling cavity. The refueling canal and the refueling cavity are then flooded with borated water from the borated water storage tank into the open reactor vessel by gravity feeding or by the use of the Decay Heat Removal (DHR) System pumps.
The pumping action of the DHR System in the RCS, and the natural circulation due to thermal driving heads in the reactor vessel and the refueling cavity, mix the added concentrated boric acid with the water in the refueling canal. The DHR System is in operation during refueling (see LCO 3.9.4, "DHR and Coolant Circulation - High Water Level," and LCO 3.9.5, "DHR and Coolant Circulation - Low Water Level" ) to provide forced circulation in the RCS and assist in maintaining the boron concentrations in the RCS, the refueling canal, and the refueling cavity above the COLR limit.
Babcock & Wilcox STS                   B 3.9.1-1                                         Rev. 5.0

Boron Concentration B 3.9.1 BASES APPLICABLE         During refueling operations, the reactivity condition of the core is SAFETY             consistent with the initial conditions assumed for the boron dilution ANALYSES           accident in the accident analysis and is conservative for MODE 6. The boron concentration limit specified in the COLR is based on the core reactivity at the beginning of each fuel cycle (the end of refueling) and includes an uncertainty allowance.
The required boron concentration and the unit refueling procedures that demonstrate the correct fuel loading plan (including full core mapping) ensure the keff of the core will remain  0.95 during the refueling operation. Hence, at least a 5% k/k margin of safety is established during refueling.
During refueling, the water volume in the spent fuel pool, the transfer canal, the refueling canal, the refueling cavity, and the reactor vessel form a single mass. As a result, the soluble boron concentration is relatively the same in each of these volumes.
The RCS boron concentration satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The LCO requires that a minimum boron concentration be maintained in the RCS, the refueling canal, and the refueling cavity while in MODE 6.
The boron concentration limit specified in the COLR ensures a core keff of 0.95 is maintained during fuel handling operations.
Violation of the LCO could lead to an inadvertent criticality during MODE 6.
APPLICABILITY      This LCO is applicable in MODE 6 to ensure that the fuel in the reactor vessel will remain subcritical. The required boron concentration ensures a keff  0.95. Above MODE 6, LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," and LCO 3.1.2, "Reactivity Balance," ensure that an adequate amount of negative reactivity is available to shut down the reactor and to maintain it subcritical.
The Applicability is modified by a Note. The Note states that the limits on boron concentration are only applicable to the refueling canal and the refueling cavity when those volumes are connected to the RCS. When the refueling canal and the refueling cavity are isolated from the RCS, no potential path for boron dilution exists.
Babcock & Wilcox STS                   B 3.9.1-2                                        Rev. 5.0

Boron Concentration B 3.9.1 BASES ACTIONS            A.1 Continuation of positive reactivity additions (including actions to reduce boron concentration) is contingent upon maintaining the unit in compliance with the LCO. If the boron concentration of any coolant volume in the RCS, the refueling canal, or the refueling cavity is less than its limit, all operations involving positive reactivity additions must be suspended immediately.
Suspension of positive reactivity additions shall not preclude moving a component to a safe position. Operations that individually add limited positive reactivity (e.g., temperature fluctuations from inventory addition or temperature control fluctuations), but when combined with all other operations affecting core reactivity (e.g., intentional boration) result in overall net negative reactivity addition, are not precluded by this action.
A.2 In addition to immediately suspending positive reactivity additions, action to restore the concentration must be initiated immediately.
In determining the required combination of boration flow rate and concentration, there is no unique Design Basis Event that must be satisfied. The only requirement is to restore the boron concentration to its required value as soon as possible. In order to raise the boron concentration as soon as possible, the operator should begin boration with the best source available for unit conditions.
Once actions have been initiated, they must be continued until the boron concentration is restored. The restoration time depends on the amount of boron that must be injected to reach the required concentration.
SURVEILLANCE       SR 3.9.1.1 REQUIREMENTS This SR ensures the coolant boron concentration in the RCS, and connected portions of the refueling canal and the refueling cavity, is within the COLR limits. The boron concentration of the coolant in each required volume is determined periodically by chemical analysis. Prior to re-connecting portions of the refueling canal or the refueling cavity to the RCS, this SR must be met per SR 3.0.4. If any dilution activity has occurred while the cavity or canal were disconnected from the RCS, this SR ensures the correct boron concentration prior to communication with the RCS.
Babcock & Wilcox STS                    B 3.9.1-3                                          Rev. 5.0

Boron Concentration B 3.9.1 BASES SURVEILLANCE REQUIREMENTS (continued)
[ A minimum Frequency of once every 72 hours is therefore a reasonable amount of time to verify the boron concentration of representative samples. The Frequency is based on operating experience, which has shown 72 hours to be adequate.
OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
                     -----------------------------------REVIEWERS NOTE-----------------------------------
Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.
                     ------------------------------------------------------------------------------------------------ ]
REFERENCES           1. 10 CFR 50, Appendix A, GDC 26.
Babcock & Wilcox STS                        B 3.9.1-4                                                       Rev. 5.0

Nuclear Instrumentation B 3.9.2 B 3.9 REFUELING OPERATIONS B 3.9.2 Nuclear Instrumentation BASES BACKGROUND            The source range neutron flux monitors are used during refueling operations to monitor the core reactivity condition. The installed source range neutron flux monitors are part of the Nuclear Instrumentation System (NIS). These detectors are located external to the reactor vessel and detect neutrons leaking from the core. The use of portable detectors is permitted, provided the LCO requirements are met.
The installed source range neutron flux monitors are BF3 detectors operating in the proportional region of the gas filled detector characteristic curve. The detectors monitor the neutron flux in counts per second. The instrument range covers six decades of neutron flux (1E+6 cps) with a
[5]% instrument accuracy. The detectors also provide continuous visual indication in the control room and an audible alarm to alert operators to a possible dilution accident. The NIS is designed in accordance with the criteria presented in Reference 1. If used, portable detectors should be functionally equivalent to the installed NIS source range monitors.
APPLICABLE            Two OPERABLE source range neutron flux monitors are required to SAFETY                provide a signal to alert the operator to unexpected changes in core ANALYSES              reactivity, such as by a boron dilution accident or an improperly loaded fuel assembly. The safety analysis of the uncontrolled boron dilution accident is described in Reference 2. The analysis of the uncontrolled boron dilution accident shows that the normally available SDM would not be lost, and there is sufficient time for the operator to take corrective action.
The source range neutron flux monitors satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                   This LCO requires two source range neutron flux monitors OPERABLE to ensure that redundant monitoring capability is available to detect changes in core reactivity.
APPLICABILITY         In MODE 6, the source range neutron flux monitors must be OPERABLE to determine changes in core reactivity. There is no}}