View source for NUREG-2194 Volume 2, Rev. 1, Standard Technical Specifications, Westinghouse Advanced Passive 1000 (AP1000) Plants, Volume 2: Bases

{{Adams
| number = ML24026A234
| issue date = 01/31/2024
| title = NUREG-2194, Vol. 2, Rev. 1, Standard Technical Specifications, Westinghouse Advanced Passive 1000 (AP1000) Plants, Volume 2: Bases
| author name = Harbuck C
| author affiliation = NRC/NRR
| addressee name = 
| addressee affiliation = 
| docket = 
| license number = 
| contact person = 
| document report number = NUREG-2194 V2 R1
| document type = NUREG
| volume number = 2
| page count = 1
}}

=Text=
{{#Wiki_filter:NUREG-2194, Vol. 2 Revision 1 Standard Technical Specifications Westinghouse Advanced Passive 1000 (AP1000) Plants Volume 2: Bases Office of Nuclear Reactor Regulation

AVAILABILITY OF REFERENCE MATERIALS IN NRC PUBLICATIONS NRC Reference Material                                       Non-NRC Reference Material As of November 1999, you may electronically access           Documents available from public and special technical NUREG-series publications and other NRC records at the       libraries include all open literature items, such as books, NRCs Library at www.nrc.gov/reading-rm.html. Publicly       journal articles, transactions, Federal Register notices, released records include, to name a few, NUREG-series        Federal and State legislation, and congressional reports.
publications; Federal Register notices; applicant, licensee, Such documents as theses, dissertations, foreign reports and vendor documents and correspondence; NRC                 and translations, and non-NRC conference proceedings correspondence and internal memoranda; bulletins and         may be purchased from their sponsoring organization.
information notices; inspection and investigative reports; licensee event reports; and Commission papers and their      Copies of industry codes and standards used in a attachments.                                                 substantive manner in the NRC regulatory process are maintained at NRC publications in the NUREG series, NRC regulations,              The NRC Technical Library and Title 10, Energy, in the Code of Federal Regulations          Two White Flint North may also be purchased from one of these two sources:                11545 Rockville Pike Rockville, MD 20852-2738
: 1. The Superintendent of Documents U.S. Government Publishing Office                     These standards are available in the library for reference Washington, DC 20402-0001                             use by the public. Codes and standards are usually Internet: https://bookstore.gpo.gov/                  copyrighted and may be purchased from the originating Telephone: (202) 512-1800                             organization or, if they are American National Standards, Fax: (202) 512-2104                                   from American National Standards Institute
: 2. The National Technical Information Service                   11 West 42nd Street 5301 Shawnee Road                                            New York, NY 10036-8002 Alexandria, VA 22312-0002                                    Internet: www.ansi.org Internet: https://www.ntis.gov/                              (212) 642-4900 1-800-553-6847 or, locally, (703) 605-6000 Legally binding regulatory requirements are stated only in laws; NRC regulations; licenses, including technical A single copy of each NRC draft report for comment is          specifications; or orders, not in NUREG-series publications.
available free, to the extent of supply, upon written          The views expressed in contractor prepared publications in request as follows:                                            this series are not necessarily those of the NRC.
The NUREG series comprises (1) technical and Address: U.S. Nuclear Regulatory Commission                   administrative reports and books prepared by the staff Office of Administration                            (NUREG-XXXX) or agency contractors (NUREG/CR-XXXX),
Digital Communications and Administrative          (2) proceedings of conferences (NUREG/CP-XXXX),
Services Branch                                   (3) reports resulting from international agreements Washington, DC 20555-0001                          (NUREG/IA-XXXX),(4) brochures (NUREG/BR-XXXX), and (5) compilations of legal decisions and orders of the E-mail: Reproduction.Resource@nrc.gov Commission and the Atomic and Safety Licensing Boards and Facsimile: (301) 415-2289 of Directors decisions under Section 2.206 of the NRCs regulations (NUREG-0750), (6) Knowledge Management Some publications in the NUREG series that are posted         prepared by NRC staff or agency contractors (NUREG/KM-at the NRCs Web site address www.nrc.gov/reading-rm/         XXXX).
doc-collections/nuregs are updated periodically and may       DISCLAIMER: This report was prepared as an account of work differ from the last printed version. Although references to  sponsored by an agency of the U.S. Government. Neither the material found on a Web site bear the date the material       U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or implied, or assumes any was accessed, the material available on the date cited legal liability or responsibility for any third partys use, or the may subsequently be removed from the site.                    results of such use, of any information, apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights.

NUREG-2194, Vol. 2 Revision 1 Standard Technical Specifications Westinghouse Advanced Passive 1000 (AP1000)
Plants Volume 2: Bases Manuscript Completed: January 2024 Date Published: January 2024 Office of Nuclear Reactor Regulation

ABSTRACT This NUREG contains the Standard Technical Specifications (STS) for Westinghouse Advanced Passive 1000 (AP1000) plants. This NUREG is based on the generic technical specifications (TS) of the AP1000 design certification rule, Appendix D, Design Certification Rule for the AP1000 Design, to Title 10 of the Code of Federal Regulations (10 CFR) Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants. This NUREG is also based on the plant-specific TS for Vogtle Electric Generating Plant (VEGP) Unit 3, for which the first combined license (COL) under 10 CFR 52.97, Issuance of combined licenses, was granted by the U.S. Nuclear Regulatory Commission (NRC) (COL No. NFP-91), as revised on September 9, 2013, by Amendment 13 to the VEGP Unit 3 COL (78 FR 64541) (Agencywide Documents Access and Management System (ADAMS) Accession No. ML13238A337).
Subsequently, the NRC has issued additional amendments to the VEGP Unit 3 TS (i.e., through Amendment 186), which inform the basis for Revision 1 of the AP1000 STS NUREG.
The AP1000 generic TS were modeled on the format and applicable content of the improved STS for pre-AP1000 Westinghouse plants in NUREG-1431, STS Westinghouse Plants, Revision 2, issued in 2001 (ADAMS Accession No. ML011840223). Accordingly, the AP1000 STS are also based on applicable NRC-approved generic changes to NUREG-1431 since Revision 2 (with exceptions), which have been incorporated in the improved STS Revision 5, issued in 2021 (ADAMS Accession Nos. ML21259A155 and ML21259A159). In addition, the AP1000 utilities and NRC staff have made editorial changes to increase the clarity and usability of the AP1000 STS NUREG. Most of the changes reflected in this first revision of the AP1000 STS NUREG, are the results of the many plant-specific TS amendments granted since Amendment 13 to the VEGP Unit 3 COL and of experience gained during the construction of VEGP Unit 3. Changes to the AP1000 STS Bases reflect changes in Revisions 1 through 70 of the Bases for the plant-specific TS for VEGP Unit 3.
The improved STS were developed based on the selection criteria for limiting conditions for operation in the Final Commission Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors, dated July 22, 1993 (58 FR 39132), which were subsequently codified by changes to 10 CFR 50.36, Technical specifications (60 FR 36953). Licensees of pre-AP1000 Westinghouse plants are encouraged to upgrade their plant-specific TS consistent with those criteria and conforming, to the extent practical, to Revision 5 of the improved STS.
Likewise, licensees of AP1000 plants are encouraged to update their plant-specific TS to conform, to the extent practical, to Revision 1 of the AP1000 STS. Licensees adapting portions of the STS to existing plant-specific TS should adapt all related requirements, as applicable, to achieve a high degree of standardization and consistency.
Users may access, print, or download the STS NUREGs in PDF format from the NRC website at http://www.nrc.gov.
PAPERWORK REDUCTION ACT This NUREG provides voluntary guidance for implementing the mandatory information collections in 10 CFR Parts 50 and 52 that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). These information collections were approved by the Office of Management and Budget (OMB), under control numbers 3150-011 and 3150-00151, respectively. Send comments regarding this information collection to the FOIA, Library, and Information Collections Branch (T6-A10M), U.S. Nuclear Regulatory Commission, Washington, DC 20555 0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the OMB AP1000 STS                                       iii                                        Rev. 1

reviewer at: OMB Office of Information and Regulatory Affairs (3150-0011 and 3150-0151),
Attn: Desk Officer for the Nuclear Regulatory Commission, 725 17th Street NW, Washington, DC 20503; email: oira_submission@omb.eop.gov.
PUBLIC PROTECTION NOTIFICATION The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB control number.
AP1000 STS                                     iv                                          Rev. 1

TABLE OF CONTENTS                                                                                                                   Page B 2.0   SAFETY LIMITS (SLs)..................................................................................... B 2.1.1-1 B 2.1.1   Reactor Core Safety Limits (SLs).................................................................. B 2.1.1-1 B 2.1.2   Reactor Coolant System (RCS) Pressure SL ................................................ B 2.1.2-1 B 3.0   LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY.................... B 3.0-1 B 3.0   SURVEILLANCE REQUIREMENT (SR) APPLICABILITY ................................ B 3.0-10 B 3.1   REACTIVITY CONTROL SYSTEMS ............................................................... B 3.1.1-1 B 3.1.1   SHUTDOWN MARGIN (SDM) ...................................................................... B 3.1.1-1 B 3.1.2   Core Reactivity ............................................................................................. B 3.1.2-1 B 3.1.3   Moderator Temperature Coefficient (MTC) .................................................... B 3.1.3-1 B 3.1.4   Rod Group Alignment Limits ......................................................................... B 3.1.4-1 B 3.1.5   Shutdown Bank Insertion Limits .................................................................... B 3.1.5-1 B 3.1.6   Control Bank Insertion Limits ........................................................................ B 3.1.6-1 B 3.1.7   Rod Position Indication ................................................................................. B 3.1.7-1 B 3.1.8   PHYSICS TESTS Exceptions - MODE 2...................................................... B 3.1.8-1 B 3.1.9   Chemical and Volume Control System (CVS) Demineralized Water Isolation (DWI) Valves and Makeup Line Isolation (MLI) Valves .............. B 3.1.9-1 B 3.1.10 Rod Withdrawal Test Exception - MODE 5................................................. B 3.1.10-1 B 3.2   POWER DISTRIBUTION LIMITS .................................................................... B 3.2.1-1 B 3.2.1   Heat Flux Hot Channel Factor (FQ(Z)) (Constant Axial Offset Control (CAOC) W(Z) Methodology) .................................................................... B 3.2.1-1 N
B 3.2.2   Nuclear Enthalpy Rise Hot Channel Factor (F H                   A E
A ) .......................................... B 3.2.2-1 B 3.2.3   AXIAL FLUX DIFFERENCE (AFD) (Constant Axial Offset Control (CAOC) Methodology) ............................................................................ B 3.2.3-1 B 3.2.4   QUADRANT POWER TILT RATIO (QPTR) ................................................... B 3.2.4-1 B 3.2.5   On-Line Power Distribution Monitoring System (OPDMS)-Monitored Parameters ............................................................................................. B 3.2.5-1 B 3.3   INSTRUMENTATION ..................................................................................... B 3.3.1-1 B 3.3.1   Reactor Trip System (RTS) Instrumentation ................................................. B 3.3.1-1 B 3.3.2   Reactor Trip System (RTS) Source Range Instrumentation .......................... B 3.3.2-1 B 3.3.3   Reactor Trip System (RTS) Intermediate Range Instrumentation ................. B 3.3.3-1 B 3.3.4   Reactor Trip System (RTS) Engineered Safety Feature Actuation System (ESFAS) Instrumentation ........................................................... B 3.3.4-1 B 3.3.5   Reactor Trip System (RTS) Manual Actuation .............................................. B 3.3.5-1 B 3.3.6   Reactor Trip System (RTS) Automatic Trip Logic ......................................... B 3.3.6-1 B 3.3.7   Reactor Trip System (RTS) Trip Actuation Devices ...................................... B 3.3.7-1 B 3.3.8   Engineered Safety Feature Actuation System (ESFAS)
Instrumentation ....................................................................................... B 3.3.8-1 B 3.3.9   Engineered Safety Feature Actuation System (ESFAS) Manual Initiation .................................................................................................. B 3.3.9-1 B 3.3.10 Engineered Safety Feature Actuation System (ESFAS) Reactor Coolant System (RCS) Hot Leg Level Instrumentation .......................... B 3.3.10-1 B 3.3.11 Engineered Safety Feature Actuation System (ESFAS) Startup Feedwater Flow Instrumentation ........................................................... B 3.3.11-1 B 3.3.12 Engineered Safety Feature Actuation System (ESFAS) Reactor Trip Initiation ................................................................................................ B 3.3.12-1 AP1000 STS                                                   v                                                                    Rev. 1

TABLE OF CONTENTS                                                                                                             Page B 3.3   INSTRUMENTATION (continued)
B 3.3.13 Engineered Safety Feature Actuation System (ESFAS) Main Control Room Isolation and Air Supply Initiation, and Electrical Load De-energization ............................................................................ B 3.3.13-1 B 3.3.14 Engineered Safety Feature Actuation System (ESFAS)
In-containment Refueling Water Storage Tank (IRWST) and Spent Fuel Pool Level Instrumentation.................................................. B 3.3.14-1 B 3.3.15 Engineered Safety Feature Actuation System (ESFAS) Actuation Logic - Operating.................................................................................. B 3.3.15-1 B 3.3.16 Engineered Safety Feature Actuation System (ESFAS) Actuation Logic - Shutdown ................................................................................. B 3.3.16-1 B 3.3.17 Post Accident Monitoring (PAM) Instrumentation ........................................ B 3.3.17-1 B 3.3.18 Remote Shutdown Workstation (RSW) ....................................................... B 3.3.18-1 B 3.3.19 Diverse Actuation System (DAS) Manual Controls...................................... B 3.3.19-1 B 3.3.20 Automatic Depressurization System (ADS) and In-containment Refueling Water Storage Tank (IRWST) Injection Blocking Device................................................................................................... B 3.3.20-1 B 3.4   REACTOR COOLANT SYSTEM (RCS)........................................................... B 3.4.1-1 B 3.4.1   RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits ................................................................................ B 3.4.1-1 B 3.4.2   RCS Minimum Temperature for Criticality ..................................................... B 3.4.2-1 B 3.4.3   RCS Pressure and Temperature (P/T) Limits................................................ B 3.4.3-1 B 3.4.4   RCS Loops ................................................................................................... B 3.4.4-1 B 3.4.5   Pressurizer ................................................................................................... B 3.4.5-1 B 3.4.6   Pressurizer Safety Valves ............................................................................. B 3.4.6-1 B 3.4.7   RCS Operational LEAKAGE ......................................................................... B 3.4.7-1 B 3.4.8   Minimum RCS Flow ...................................................................................... B 3.4.8-1 B 3.4.9   RCS Leakage Detection Instrumentation ...................................................... B 3.4.9-1 B 3.4.10 RCS Specific Activity .................................................................................. B 3.4.10-1 B 3.4.11 Automatic Depressurization System (ADS) - Operating ..............................B 3.4.11-1 B 3.4.12 Automatic Depressurization System (ADS) - Shutdown, RCS Intact .......... B 3.4.12-1 B 3.4.13 Automatic Depressurization System (ADS) - Shutdown, RCS Open .......... B 3.4.13-1 B 3.4.14 Low Temperature Overpressure Protection (LTOP)..................................... B 3.4.14-1 B 3.4.15 RCS Pressure Isolation Valve (PIV) Integrity .............................................. B 3.4.15-1 B 3.4.16 Reactor Vessel Head Vent (RVHV) ............................................................. B 3.4.16-1 B 3.4.17 Steam Generator (SG) Tube Integrity ......................................................... B 3.4.17-1 B 3.5   PASSIVE CORE COOLING SYSTEM (PXS) ................................................... B 3.5.1-1 B 3.5.1   Accumulators ................................................................................................ B 3.5.1-1 B 3.5.2   Core Makeup Tanks (CMTs) - Operating ...................................................... B 3.5.2-1 B 3.5.3   Core Makeup Tanks (CMTs) - Shutdown, Reactor Coolant System (RCS) Intact ............................................................................................ B 3.5.3-1 B 3.5.4   Passive Residual Heat Removal Heat Exchanger (PRHR HX) -
Operating ................................................................................................ B 3.5.4-1 B 3.5.5   Passive Residual Heat Removal Heat Exchanger (PRHR HX) -
Shutdown, Reactor Coolant System (RCS) Intact ................................... B 3.5.5-1 B 3.5.6   In-containment Refueling Water Storage Tank (IRWST) - Operating ............ B 3.5.6-1 B 3.5.7   In-containment Refueling Water Storage Tank (IRWST) -
Shutdown, MODE 5 ................................................................................ B 3.5.7-1 AP1000 STS                                                  vi                                                              Rev. 1

TABLE OF CONTENTS                                                                                                          Page B 3.5 PASSIVE CORE COOLING SYSTEM (PXS) (continued)
B 3.5.8  In-containment Refueling Water Storage Tank (IRWST) -
Shutdown, MODE 6 ................................................................................ B 3.5.8-1 B 3.6   CONTAINMENT SYSTEMS ........................................................................... B 3.6.1-1 B 3.6.1  Containment ................................................................................................. B 3.6.1-1 B 3.6.2  Containment Air Locks .................................................................................. B 3.6.2-1 B 3.6.3  Containment Isolation Valves ........................................................................ B 3.6.3-1 B 3.6.4  Containment Pressure .................................................................................. B 3.6.4-1 B 3.6.5  Containment Air Temperature ....................................................................... B 3.6.5-1 B 3.6.6  Passive Containment Cooling System (PCS)................................................ B 3.6.6-1 B 3.6.7  Containment Penetrations ............................................................................ B 3.6.7-1 B 3.6.8  pH Adjustment .............................................................................................. B 3.6.8-1 B 3.6.9  Vacuum Relief Valves ................................................................................... B 3.6.9-1 B 3.7   PLANT SYSTEMS .......................................................................................... B 3.7.1-1 B 3.7.1  Main Steam Safety Valves (MSSVs) ............................................................. B 3.7.1-1 B 3.7.2  Main Steam Line Flow Path Isolation Valves................................................. B 3.7.2-1 B 3.7.3  Main Feedwater Isolation Valves (MFIVs) and Main Feedwater Control Valves (MFCVs).......................................................................... B 3.7.3-1 B 3.7.4  Secondary Specific Activity ........................................................................... B 3.7.4-1 B 3.7.5  Spent Fuel Pool Water Level ........................................................................ B 3.7.5-1 B 3.7.6  Main Control Room Emergency Habitability System (VES)........................... B 3.7.6-1 B 3.7.7  Startup Feedwater Isolation and Control Valves............................................ B 3.7.7-1 B 3.7.8  Main Steam Line Leakage ............................................................................ B 3.7.8-1 B 3.7.9  Spent Fuel Pool Makeup Water Sources ...................................................... B 3.7.9-1 B 3.7.10 Steam Generator (SG) Isolation Valves ...................................................... B 3.7.10-1 B 3.7.11 Spent Fuel Pool Boron Concentration ..........................................................B 3.7.11-1 B 3.7.12 Spent Fuel Pool Storage ............................................................................. B 3.7.12-1 B 3.7.13 Spent Fuel Pool Cooling System (SFS) Containment Isolation Valves........ B 3.7.13-1 B 3.8   ELECTRIC POWER SYSTEMS ...................................................................... B 3.8.1-1 B 3.8.1  DC Sources - Operating ............................................................................... B 3.8.1-1 B 3.8.2  DC Sources - Shutdown............................................................................... B 3.8.2-1 B 3.8.3  Inverters - Operating .................................................................................... B 3.8.3-1 B 3.8.4  Inverters - Shutdown .................................................................................... B 3.8.4-1 B 3.8.5  Distribution Systems - Operating.................................................................. B 3.8.5-1 B 3.8.6  Distribution Systems - Shutdown ................................................................. B 3.8.6-1 B 3.8.7  Battery Parameters ....................................................................................... B 3.8.7-1 B 3.9   REFUELING OPERATIONS ........................................................................... B 3.9.1-1 B 3.9.1  Boron Concentration ..................................................................................... B 3.9.1-1 B 3.9.2  Unborated Water Source Flow Paths ............................................................ B 3.9.2-1 B 3.9.3  Nuclear Instrumentation ................................................................................ B 3.9.3-1 B 3.9.4  Refueling Cavity Water Level ........................................................................ B 3.9.4-1 B 3.9.5  Decay Time .................................................................................................. B 3.9.5-1 AP1000 STS                                              vii                                                              Rev. 1

Reactor Core SLs B 2.1.1 B 2.0 SAFETY LIMITS (SLs)
B 2.1.1 Reactor Core Safety Limits (SLs)
BASES BACKGROUND          GDC 10 (Ref. 1) requires that specified acceptable fuel design limits are not to be exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs). This is accomplished by having a departure from nucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that DNB will not occur, and by requiring that the fuel centerline temperature stays below the melting temperature.
The restriction of this SL prevents overheating of the fuel and cladding, as well as possible cladding perforation, that would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate (LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.
Fuel centerline melting occurs when the local LHR or power peaking in a region of the fuel is high enough to cause the fuel centerline temperature to reach the melting point of the fuel. Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the point of failure, allowing an uncontrolled release of activity to the reactor coolant.
Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of DNB and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (Zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.
The proper functioning of the Protection and Safety Monitoring System (PMS) and steam generator safety valves prevents violation of the reactor core SLs.
AP1000 STS                                  B 2.1.1-1                                       Rev. 1

Reactor Core SLs B 2.1.1 BASES APPLICABLE    The fuel cladding must not sustain damage as a result of normal SAFETY        operation and AOOs. The reactor core SLs are established to preclude ANALYSES      violation of the following fuel design criteria:
: a. There must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hottest fuel rod in the core does not experience DNB; and
: b. The hottest fuel pellet in the core must not experience centerline fuel melting.
The Reactor Trip System (RTS) setpoints (Ref. 2), in combination with all the LCOs, are designed to prevent any anticipated combination of transient conditions of Reactor Coolant System (RCS) temperature, pressure, and flow; and core I and THERMAL POWER level that would result in a departure from nucleate boiling ratio (DNBR) of less than the DNBR limit and preclude the existence of flow instabilities.
The appropriate operation of the PMS and the steam generator safety valves provides automatic enforcement of these reactor core SLs.
The SLs represent a design requirement for establishing the RTS setpoints. LCO 3.4.1, RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits, or the assumed initial conditions of the safety analyses (as indicated in FSAR Section 7.2 (Ref. 2)) provide more restrictive limits to ensure that the SLs are not exceeded.
SAFETY LIMITS The figure provided in the COLR shows the loci of points of THERMAL POWER, RCS pressure, and cold leg temperature for which the minimum DNBR is not less than the safety analysis limit, the fuel centerline temperature remains below melting, or the exit quality is within the limits defined by the DNBR correlation.
The reactor core SLs are established to preclude violation of the following fuel design criteria:
: a. There must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hottest fuel rod in the core does not experience DNB; and
: b. There must be at least a 95% probability at a 95% confidence level that the hottest fuel pellet in the core does not experience centerline fuel melting.
AP1000 STS                            B 2.1.1-2                                      Rev. 1

Reactor Core SLs B 2.1.1 BASES SAFETY LIMITS (continued)
The reactor core SLs are used to define the various PMS Functions such that the above criteria are satisfied during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs).
To ensure that the PMS precludes the violation of the above criteria, additional criteria are applied to the Overtemperature and Overpower T reactor trip Functions. That is, it must be demonstrated that the core exit quality is within the limits defined by the DNBR correlation and that the Overtemperature and Overpower T reactor trip Functions continue to provide protection if local hot leg streams approach saturation temperature. Appropriate functioning of the PMS ensures that for variations in the THERMAL POWER, RCS pressure, RCS cold leg temperature, RCS flow rate, and I that the reactor core SLs will be satisfied during steady state operation, normal operational transients, and AOOs.
APPLICABILITY     SL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactor is critical. Automatic protection Functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The steam generator safety valves or automatic protection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate a reactor trip Function which forces the unit into MODE 3. Setpoints for the reactor trip Functions are specified in LCO 3.3.1, Reactor Trip System (RTS) Instrumentation. In MODES 3, 4, 5, and 6, applicability is not required since the reactor is not generating significant THERMAL POWER.
SAFETY LIMIT      The following SL violation responses are applicable to the reactor core VIOLATIONS        SLs. If SL 2.1.1 is violated, the requirement to go to MODE 3 places the unit in a MODE in which this SL is not applicable.
The allowed Completion Time of 1 hour recognizes the importance of bringing the unit to a MODE of operation where this SL is not applicable, and reduces the probability of fuel damage.
REFERENCES        1. 10 CFR 50, Appendix A, GDC 10.
: 2. FSAR Section 7.2, Reactor Trip.
AP1000 STS                                B 2.1.1-3                                      Rev. 1

RCS Pressure SL B 2.1.2 B 2.0 SAFETY LIMITS (SLs)
B 2.1.2 Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND          The SL on RCS pressure protects the integrity of the RCS against overpressurization. In the event of fuel cladding failure, fission products are released into the reactor coolant. The RCS then serves as the primary barrier in preventing the release of fission products into the atmosphere. By establishing an upper limit on RCS pressure, the continued integrity of the RCS is ensured. According to 10 CFR 50, Appendix A, GDC 14, Reactor Coolant Pressure Boundary, and GDC 15, Reactor Coolant System Design (Ref. 1), the reactor coolant pressure boundary (RCPB) design conditions are not to be exceeded during normal operation and anticipated operational occurrences (AOOs).
Also, in accordance with GDC 28, Reactivity Limits (Ref. 1), reactivity accidents, including rod ejection, do not result in damage to the RCPB greater than limited local yielding.
The design pressure of the RCS is 2500 psia (2485 psig). During normal operation and AOOs, RCS pressure is limited from exceeding the design pressure by more than 10%, in accordance with Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 2). To ensure system integrity, all RCS components are hydrostatically tested at 125% of design pressure, according to the ASME Code requirements prior to initial operation when there is no fuel in the core. Following inception of unit operation, RCS components shall be pressure tested, in accordance with the requirements of ASME Code, Section XI (Ref. 3).
Overpressurization of the RCS could result in a breach of the RCPB. If such a breach occurs in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere, raising concerns relative to limits on radioactive releases.
APPLICABLE          The RCS pressurizer safety valves, the main steam safety valves SAFETY              (MSSVs), and the reactor High 2 pressurizer pressure trip have settings ANALYSES            established to ensure that the RCS pressure SL will not be exceeded.
The RCS pressurizer safety valves are sized to prevent system pressure from exceeding the design pressure by more than 10%, as specified in Section III of the ASME Code for Nuclear Power Plant Components (Ref. 2). The transient that establishes the required relief capacity, and hence valve size requirements and lift settings, is a complete loss of external load with loss of feedwater flow, without a direct reactor trip.
AP1000 STS                                   B 2.1.2-1                                      Rev. 1

RCS Pressure SL B 2.1.2 BASES APPLICABLE SAFETY ANALYSES (continued)
During the transient, no control actions are assumed except that the safety valves on the secondary plant are assumed to open when the steam pressure reaches the secondary plant safety valve settings.
The Reactor Trip System setpoints (Ref. 4), together with the settings of the MSSVs, provide pressure protection for normal operation and AOOs.
The reactor High 2 pressurizer pressure Nominal Trip Setpoint (NTS) is specifically set to provide protection against overpressurization (Ref. 4).
The safety analyses for both the High 2 pressurizer pressure trip and the RCS pressurizer safety valves are performed using conservative assumptions relative to pressure control devices. More specifically, no credit is taken for operation of the following:
: a. RCS depressurization valves (Automatic Depressurization System
[ADS] valves);
: b. Steam line relief valves (SG power operated relief valves (PORVs));
: c. Turbine Bypass System (Steam Dump System);
: d. Reactor Control System;
: e. Pressurizer Level Control System; or
: f. Pressurizer spray.
SAFETY LIMITS   The maximum transient pressure allowed in the RCS pressure vessel, piping, valves, and fittings under the ASME Code, Section III, is 110% of design pressure; therefore, the SL on maximum allowable RCS pressure is 2733.5 psig.
APPLICABILITY   SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 because this SL could be approached or exceeded in these MODES due to overpressurization events. The SL is not applicable in MODE 6, since the reactor vessel head is removed, or overpressure protection is provided by meeting the requirements of LCO 3.4.14, Low Temperature Overpressure Protection (LTOP).
AP1000 STS                             B 2.1.2-2                                      Rev. 1

RCS Pressure SL B 2.1.2 BASES SAFETY LIMIT If the RCS pressure SL is violated when the reactor is in MODE 1 or 2, VIOLATIONS   the requirement is to restore compliance and be in MODE 3 within 1 hour.
Exceeding the RCS pressure SL may cause immediate RCS failure and create a potential for abnormal radioactive releases (Ref. 5).
The allowable Completion Time of 1 hour recognizes the importance of reducing power level to a MODE of operation where the potential for challenges to safety systems is minimized.
If the RCS pressure SL is exceeded in MODE 3, 4, or 5, RCS pressure must be restored to within the SL value within 5 minutes. Exceeding the RCS pressure SL in MODE 3, 4, or 5 is more severe than exceeding this SL in MODE 1 or 2, since the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5 minutes. The action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress.
REFERENCES   1. 10 CFR 50, Appendix A, GDC 14, GDC 15, and GDC 28.
: 2. ASME, Boiler and Pressure Vessel Code, Section III, Article NB-7000.
: 3. ASME Boiler and Pressure Vessel Code, Section XI, Article IWX-5000.
: 4. FSAR Section 7.2, Reactor Trip.
: 5. 10 CFR 50.34.
AP1000 STS                          B 2.1.2-3                                   Rev. 1

LCO Applicability B 3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs              LCO 3.0.1 through LCO 3.0.7 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.
LCO 3.0.1         LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirements for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification.)
LCO 3.0.2         LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that the ACTIONS Condition is entered, unless otherwise specified.
The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:
: a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and
: b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.
There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.) The second type of Required Action specifies the remedial measures that permit continued operation of the unit that is not further restricted by the Completion Time. In this case compliance with the Required Actions provides an acceptable level of safety for continued operation.
Completing the Required Actions is not required when an LCO is met, or is no longer applicable, unless otherwise stated in the individual Specifications.
AP1000 STS                                 B 3.0-1                                      Rev. 1

LCO Applicability B 3.0 BASES LCO 3.0.2 (continued)
The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Conditions no longer exist. The ACTIONS of individual Specifications specify the Required Actions where this is the case. An example of this is in LCO 3.4.3, RCS Pressure and Temperature (P/T) Limits.
The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The ACTIONS for not meeting a single LCO adequately manage any increase in plant risk, provided any unusual external conditions (e.g., severe weather, offsite power instability) are considered. In addition, the increased risk associated with simultaneous removal of multiple structures, systems, trains or components from service is assessed and managed in accordance with 10 CFR 50.65(a)(4). Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed.
When a change in MODE or other specified condition is required to comply with Required Actions, the unit may enter a MODE or other specified condition in which another Specification becomes applicable. In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable, and the ACTIONS Condition(s) are entered.
LCO 3.0.3           LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met, and:
: a. An associated Required Action and Completion Time are not met and no other Condition applies; or
: b. The associated ACTIONS do not specifically address the condition of the unit. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.
AP1000 STS                                   B 3.0-2                                      Rev. 1

LCO Applicability B 3.0 BASES LCO 3.0.3 (continued)
This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS. Planned entry into LCO 3.0.3 should be avoided. If it is not practicable to avoid planned entry into LCO 3.0.3, plant risk should be assessed and managed in accordance with 10 CFR 50.65(a)(4), and the planned entry into LCO 3.0.3 should have less effect on plant safety than other practicable alternatives.
Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to enter lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit. This reduces thermal stresses on components of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times.
A unit shutdown required in accordance with LCO 3.0.3 may be terminated and LCO 3.0.3 exited if any of the following occurs:
: a. The LCO is now met;
: b. The LCO is no longer applicable;
: c. A Condition exists for which the Required Actions have now been performed; or
: d. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition was initially entered and not from the time LCO 3.0.3 is exited.
The time limits of LCO 3.0.3 allow 37 hours for the unit to be in MODE 5 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for entering the next lower MODE applies. If a lower MODE is entered in less time than allowed, however, the total allowable time to enter MODE 5, or other applicable MODE is not reduced. For example, if AP1000 STS                                   B 3.0-3                                        Rev. 1

LCO Applicability B 3.0 BASES LCO 3.0.3 (continued)
MODE 3 is entered in 2 hours, then the time allowed for entering MODE 4 is the next 11 hours, because the total time for entering MODE 4 is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to enter a lower MODE of operation in less than the total time allowed. Compliance with the time limits of LCO 3.0.3 may rely on the use of non-safety related systems, which are not governed by Technical Specification LCOs.
In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken. The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the unit is already in the most restrictive condition required by LCO 3.0.3.
Exceptions to LCO 3.0.3 are provided in instances where requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in LCO 3.7.5, Spent Fuel Pool Water Level. This Specification has an Applicability of At all times. Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.5 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.5 of Suspend movement of irradiated fuel assemblies in the spent fuel pool is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications.
LCO 3.0.4           LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It precludes placing the unit in a MODE or other specified condition stated in that Applicability (e.g., Applicability desired to be entered) when the following exist:
: a. Unit conditions are such that the requirements of the LCO would not be met in the Applicability desired to be entered; and
: b. Continued noncompliance with the LCO requirements, if the Applicability were entered, would result in the unit being required to exit the Applicability desired to be entered to comply with the Required Actions.
AP1000 STS                                   B 3.0-4                                        Rev. 1

LCO Applicability B 3.0 BASES LCO 3.0.4 (continued)
Compliance with ACTIONS that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change.
Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made and the Required Actions followed after entry into the Applicability. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown.
Exceptions to LCO 3.0.4 are stated in the individual Specifications.
These exceptions allow entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time.
Exceptions may apply to all the ACTIONS or to a specific Required Action of a Specification.
LCO 3.0.4 is applicable only when entering MODE 4 from MODE 5, MODE 3 from MODE 4 or 5, MODE 2 from MODE 3 or 4 or 5, or MODE 1 from MODE 2. Furthermore, LCO 3.0.4 is applicable when entering any other specified condition in the Applicability only while operating in MODE 1, 2, 3, or 4. The requirements of LCO 3.0.4 do not apply in MODES 5 and 6, or in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.
Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, changing MODES or other specified conditions while in an ACTIONS Condition, in compliance with LCO 3.0.4 or where an exception to LCO 3.0.4 is stated, is not a violation of SR 3.0.1 or SR 3.0.4 for those Surveillances that do not have to be performed due to the associated inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.
AP1000 STS                                  B 3.0-5                                        Rev. 1

LCO Applicability B 3.0 BASES LCO 3.0.5  LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate:
: a. The OPERABILITY of the equipment being returned to service; or
: b. The OPERABILITY of other equipment.
The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance. LCO 3.0.5 should not be used in lieu of other practicable alternatives that comply with Required Actions and that do not require changing the MODE or other specified conditions in the Applicability in order to demonstrate equipment is OPERABLE. LCO 3.0.5 is not intended to be used repeatedly.
An example of demonstrating equipment is OPERABLE with the Required Actions not met is opening a manual valve that was closed to comply with Required Actions to isolate a flowpath with excessive Reactor Coolant System (RCS) Pressure Isolation Valve (PIV) leakage in order to perform testing to demonstrate that RCS PIV leakage is now within limit.
Examples of demonstrating equipment OPERABILITY include instances in which it is necessary to take an inoperable channel or trip system out of a tripped condition that was directed by a Required Action, if there is no Required Action Note for this purpose. An example of verifying OPERABILITY of equipment removed from service is taking a tripped channel out of the tripped condition to permit the logic to function and indicate the appropriate response during performance of required testing on the inoperable channel. Examples of demonstrating the OPERABILITY of other equipment are taking an inoperable channel or trip system out of the tripped condition to 1) prevent the trip function from occurring during the performance of required testing on another channel in the other trip system, or 2) permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.
The administrative controls in LCO 3.0.5 apply in all cases to systems or components in Chapter 3 of the Technical Specifications, as long as the AP1000 STS                          B 3.0-6                                       Rev. 1

LCO Applicability B 3.0 BASES LCO 3.0.5 (continued) testing could not be conducted while complying with the Required Actions. This includes the realignment or repositioning of redundant or alternate equipment or trains previously manipulated to comply with ACTIONS, as well as equipment removed from service or declared inoperable to comply with ACTIONS.
LCO 3.0.6           LCO 3.0.6 establishes an exception to LCO 3.0.2 for supported systems that have a support system LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the unit is maintained in a safe condition are specified in the support system LCOs Required Actions. These Required Actions may include entering the supported systems Conditions and Required Actions or may specify other Required Actions.
When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability. However, it is not necessary to enter into the supported systems Conditions and Required Actions unless directed to do so by the support systems Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems LCOs Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the unit is maintained in a safe condition in the support systems Required Actions.
However, there are instances where a support systems Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system.
This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support systems Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.
Specification 5.5.7, Safety Function Determination Program (SFDP),
ensures loss of safety function is detected and appropriate actions are AP1000 STS                                  B 3.0-7                                       Rev. 1

LCO Applicability B 3.0 BASES LCO 3.0.6 (continued) taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.
Cross train checks to identify a loss of safety function for those support systems that support multiple and redundant safety systems are required.
The cross train check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained. If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety functions exists are required to be entered.
This loss of safety function does not require the assumption of additional single failures or loss of offsite power. Since operations are being restricted in accordance with the ACTIONS of the support system, any resulting temporary loss of redundancy or single failure protection is taken into account. There are no support system LCO requirements for offsite power based on the safety related passive design.
When loss of safety function is determined to exist, and the SFDP requires entry into the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists, consideration must be given to the specific type of function affected. Where a loss of function is solely due to a single Technical Specification support system (e.g., loss of automatic actuation capability due to inoperable instrumentation) the appropriate LCO is the LCO for the support system. The ACTIONS for a support system LCO adequately address the inoperabilities of that system without reliance on entering its supported system LCO. When the loss of function is the result of multiple support systems, the appropriate LCO is the LCO for the supported system.
LCO 3.0.7           There are certain special tests and operations required to be performed at various times over the life of the unit. These special tests and operations are necessary to demonstrate select unit performance characteristics, to perform special maintenance activities, and to perform special evolutions.
Test Exception LCOs 3.1.8 and 3.1.10 allow specified Technical Specification (TS) requirements to be changed to permit performance of these special tests and operations, which otherwise could not be AP1000 STS                                  B 3.0-8                                          Rev. 1

LCO Applicability B 3.0 BASES LCO 3.0.7 (continued) performed if required to comply with the requirements of these TS.
Unless otherwise specified, all the other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.
The Applicability of a Test Exception LCO represents a condition not necessarily in compliance with the normal requirements of the TS.
Compliance with Test Exception LCOs is optional. A special operation may be performed either under the provisions of the appropriate Test Exception LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Test Exception LCO, the requirements of the Test Exception LCO shall be followed.
AP1000 STS                                  B 3.0-9                                        Rev. 1

SR Applicability B 3.0 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRs              SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.
SR 3.0.2 and SR 3.0.3 apply in Chapter 5 only when invoked by a Chapter 5 Specification.
SR 3.0.1         SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification ensures that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO. Surveillances may be performed by means of any series of sequential, overlapping, or total steps provided the entire Surveillance is performed within the specified Frequency. Additionally, the definitions related to instrument testing (e.g., CHANNEL CALIBRATION) specify that these tests are performed by means of any series of sequential, overlapping, or total steps.
Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:
: a. The systems or components are known to be inoperable, although still meeting the SRs; or
: b. The requirements of the Surveillance(s) are known not to be met between required Surveillance performances.
Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a test exception are applicable only when the test exception is used as an allowable exception to the requirements of a Specification.
Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR. This allowance includes those SRs whose performance is normally precluded in a given MODE or other specified condition.
AP1000 STS                               B 3.0-10                                       Rev. 1

SR Applicability B 3.0 BASES SR 3.0.1 (continued)
Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met in accordance with SR 3.0.2 prior to returning equipment to OPERABLE status.
Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed.
SR 3.0.2             SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Actions with a Completion Time that requires the periodic performance of the Required Action on a once per interval.
SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).
When a Section 5.5, Programs and Manuals, Specification states that the provisions of SR 3.0.2 are applicable, a 25% extension of the testing interval, whether stated in the Specification or incorporated by reference, is permitted.
The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply.
These exceptions are stated in the individual Specifications. The AP1000 STS                                  B 3.0-11                                       Rev. 1

SR Applicability B 3.0 BASES SR 3.0.2 (continued) requirements of regulations take precedence over the TS. Examples of where SR 3.0.2 does not apply are the Containment Leakage Rate Testing Program required by 10 CFR 50, Appendix J, and the inservice testing of pumps and valves in accordance with applicable American Society of Mechanical Engineers Operation and Maintenance Code, as required by 10 CFR 50.55a. This program establishes testing requirements and Frequencies in accordance with the requirements of regulations. The TS cannot in and of themselves extend a test interval specified in the regulations directly or by reference.
As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a once per  basis. The 25% extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25% extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.
The provisions of SR 3.0.2 are not intended to be used repeatedly to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.
SR 3.0.3             SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been performed within the specified Frequency. A delay period of up to 24 hours or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met.
When a Section 5.5, Programs and Manuals, Specification states that the provisions of SR 3.0.3 are applicable, it permits the flexibility to defer declaring the testing requirement not met in accordance with SR 3.0.3 when the testing has not been completed within the testing interval (including the allowance of SR 3.0.2 if invoked by the Section 5.5 Specification).
AP1000 STS                                    B 3.0-12                                        Rev. 1

SR Applicability B 3.0 BASES SR 3.0.3 (continued)
This delay period provides adequate time to perform Surveillances that have been missed. This delay period permits the performance of a Surveillance before complying with Required Actions or other remedial measures that might preclude performance of the Surveillance.
The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.
When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered not to have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.
SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.
SR 3.0.3 is only applicable if there is a reasonable expectation the associated equipment is OPERABLE or that variables are within limits, and it is expected that the Surveillance will be met when performed. Many factors should be considered, such as the period of time since the Surveillance was last performed, or whether the Surveillance, or a portion thereof, has ever been performed, and any other indications, tests, or activities that might support the expectation that the Surveillance will be met when performed. An example of the use of SR 3.0.3 would be a relay contact that was not tested as required in accordance with a particular SR, but previous successful performances of the SR included the relay contact; the adjacent, physically connected relay contacts were tested during the SR performance; the subject relay contact has been tested by another SR; or historical operation of the subject relay contact has been successful. It is not sufficient to infer the behavior of the associated equipment from the performance of similar equipment. The rigor of determining whether there is a reasonable expectation a Surveillance will be met when performed should increase based on the length of time AP1000 STS                                   B 3.0-13                                         Rev. 1

SR Applicability B 3.0 BASES SR 3.0.3 (continued) since the last performance of the Surveillance. If the Surveillance has been performed recently, a review of the Surveillance history and equipment performance may be sufficient to support a reasonable expectation that the Surveillance will be met when performed. For Surveillances that have not been performed for a long period or that have never been performed, a rigorous evaluation based on objective evidence should provide a high degree of confidence that the equipment is OPERABLE. The evaluation should be documented in sufficient detail to allow a knowledgeable individual to understand the basis for the determination.
Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used repeatedly to extend Surveillance intervals. While up to 24 hours or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants. This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the licensees Corrective Action Program.
If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon AP1000 STS                                    B 3.0-14                                      Rev. 1

SR Applicability B 3.0 BASES SR 3.0.3 (continued) expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.
Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.
SR 3.0.4             SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.
This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit.
The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change.
When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that Surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction on changing MODES or other specified conditions of the Applicability. However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes.
The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown.
AP1000 STS                                  B 3.0-15                                         Rev. 1

SR Applicability B 3.0 BASES SR 3.0.4 (continued)
The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into a MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO Applicability, would have its Frequency specified such that it is not due until the specific conditions needed are met.
Alternately, the Surveillance may be stated in the form of a Note as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs annotation is found in Section 1.4, Frequency.
SR 3.0.4 is applicable only when entering MODE 4 from MODE 5, MODE 3 from MODE 4, MODE 2 from MODE 3 or 4, or MODE 1 from MODE 2. Furthermore, SR 3.0.4 is applicable when entering any other specified condition in the Applicability only while operating in MODE 1, 2, 3, or 4. The requirements of SR 3.0.4 do not apply in MODES 5 and 6, or in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.
AP1000 STS                                    B 3.0-16                                      Rev. 1

SDM B 3.1.1 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM)
BASES BACKGROUND        According to GDC 26 (Ref. 1) the reactivity control systems must be redundant and capable of holding the reactor core subcritical when shutdown under cold conditions. Maintenance of the SDM ensures that postulated reactivity events will not damage the fuel.
SDM requirements provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational occurrences (AOOs). As such, the SDM defines the degree of subcriticality that would be obtained immediately following the insertion or scram of all Rod Cluster Control Assemblies (RCCAs), assuming that the single rod cluster assembly of highest reactivity worth is fully withdrawn. When confirming SDM requirements in MODES 1 and 2 with keff  1.0, the calculation conservatively ignores the insertion of the Gray Rod Cluster Assemblies (GRCAs) upon reactor trip.
When SDM is confirmed in MODE 2 with keff < 1.0, and in MODES 3, 4, and 5, the calculation may include the negative reactivity from the GRCAs if the GRCAs are confirmed inserted and have passed the acceptance criteria for GRCA bank worth measurements performed during startup physics testing (Ref. 2).
The system design requires that two independent reactivity control systems be provided, and that one of these systems be capable of maintaining the core subcritical under cold conditions. These requirements are provided by the use of movable control assemblies and soluble boric acid in the Reactor Coolant System (RCS). The Plant Control System (PLS) can compensate for the reactivity effects of the fuel and water temperature changes accompanying power level changes over the range from full load to no load. In addition, the PLS, together with the boration system, provides the SDM during power operation and is capable of making the core subcritical rapidly enough to prevent exceeding acceptable fuel damage limits, assuming that the rod of highest reactivity worth remains fully withdrawn. The soluble boron system can compensate for fuel depletion during operation and xenon burnout reactivity changes and maintain the reactor subcritical under cold conditions.
During power operation, SDM is calculated and monitored by the On-Line Power Distribution Monitoring System (OPDMS) and controlled by operating with RCCAs sufficiently withdrawn to meet the SDM requirement. When the OPDMS is not monitoring parameters, SDM AP1000 STS                                B 3.1.1-1                                    Rev. 1

SDM B 3.1.1 BASES BACKGROUND (continued) control is ensured by operating within the limits of LCO 3.1.5 Shutdown Bank Insertion Limits, and LCO 3.1.6, Control Bank Insertion Limits.
When the unit is in the shutdown and refueling MODES, the SDM requirements are met by adjustments to the RCS boron concentration.
APPLICABLE       The minimum required SDM is assumed as an initial condition in safety SAFETY           analyses. The safety analyses (Ref. 3) establish an SDM that ensures ANALYSES         that specified acceptable fuel design limits are not exceeded for normal operation and AOOs, with the assumption of the highest worth rod stuck out on scram.
The acceptance criteria for the SDM requirements are that specified acceptable fuel design limits are maintained. This is done by ensuring that:
: a. The reactor can be made subcritical from all operating conditions, transients, and Design Basis Events;
: b. The reactivity transients associated with postulated accident conditions are controllable within acceptable limits (departures from nucleate boiling ratio (DNBR), fuel centerline temperature limits for AOOs, and must not exceed applicable limits (Ref. 4), such as 280 cal/gm energy deposition, for the rod ejection accident); and
: c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.
The most limiting accidents for the SDM requirements are typically from the categories of an increase in Heat Removal from the Primary System or Reactivity and Power Distribution Anomalies, e.g., Steam System Piping Failure or Decrease in Boron Concentration in the Reactor Coolant, as described in the accident analyses (Ref. 5). The increased steam flow in the main steam system causes an increased energy removal from the affected steam generator {SG), and consequently the RCS. This results in a reduction of the reactor coolant temperature. The resultant coolant shrinkage causes a reduction in pressure. In the presence of a negative moderator temperature coefficient (MTC), this cooldown causes an increase in core reactivity. The positive reactivity addition from the moderator temperature decrease will terminate when the affected SG boils dry, thus terminating RCS heat removal and cooldown. Following an increase in heat removal from the primary system, a post trip return to power may occur; however, no fuel damage AP1000 STS                               B 3.1.1-2                                       Rev. 1

SDM B 3.1.1 BASES APPLICABLE SAFETY ANALYSES (continued) occurs as a result of the post trip return to power, and the THERMAL POWER does not violate the Safety Limit (SL) requirement of SL 2.1.1.
In addition to the increase in heat removal from the primary system, the SDM requirement must also protect against:
: a. Inadvertent boron dilution;
: b. An uncontrolled rod withdrawal from subcritical or low power condition; and
: c. Rod ejection.
Each of these events is discussed below.
In the boron dilution analysis, the required SDM defines the reactivity difference between an initial subcritical boron concentration and the corresponding critical boron concentration. These values, in conjunction with the configuration of the RCS and the assumed dilution flow rate, directly affect the results of the analysis. This event is most limiting when critical boron concentrations are highest.
The uncontrolled rod withdrawal transient is terminated by a high neutron flux trip. Power level, RCS pressure, linear heat rate, and the DNBR do not exceed allowable limits.
The ejection of a control rod rapidly adds reactivity to the reactor core, causing both the core power level and heat flux to increase with corresponding increases in reactor coolant temperatures and pressure.
The ejection of a rod also produces a time-dependent redistribution of core power.
SDM satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). SDM is considered an initial condition process variable because it is periodically monitored to ensure that the unit is operating within the bounds of accident analysis assumptions.
LCO              SDM is a core design condition that can be ensured during operation by compliance with LCO 3.2.5, OPDMS Monitored Parameters, item d.
When the OPDMS is not monitoring parameters, SDM is ensured during operation by complying with LCO 3.1.5, Shutdown Bank Insertion AP1000 STS                              B 3.1.1-3                                        Rev. 1

SDM B 3.1.1 BASES LCO (continued)
Limits, and LCO 3.1.6, Control Bank Insertion Limits. When the reactor is in shutdown and refueling MODES, SDM is ensured by maintaining a minimum soluble RCS boron concentration. This minimum boron concentration is based on the present reactor core design, condition and operating history.
The most limiting analyses that establish the SDM value of the LCO are typically from the categories of an Increase in Heat Removal from the Primary System or Reactivity and Power Distribution Anomalies (Ref. 2).
For steam line break (SLB) accidents, if the LCO is violated, there is a potential to exceed the DNBR limit and to exceed 10 CFR 50.34 limits (Ref. 3). For the boron dilution accident, if the LCO is violated, the minimum required time assumed for action to terminate dilution may no longer be applicable.
APPLICABILITY   In MODE 2 with keff < 1.0, and in MODES 3, 4, and 5, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses discussed above. In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, Boron Concentration. In MODE 1 and in MODE 2 with keff  1.0, SDM is ensured by one of two means, depending on the status of the OPDMS.
When the OPDMS is continuously monitoring parameters, SDM is ensured by compliance with LCO 3.2.5, OPDMS Monitored Parameters, item d. When the OPDMS is not monitoring parameters, SDM is ensured by complying with LCO 3.1.5, Shutdown Bank Insertion Limits, and LCO 3.1.6, Control Bank Insertion Limits.
ACTIONS         A.1 If the SDM requirements are not met, boration must be initiated promptly.
A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that boration will be continued until the SDM requirements are met.
In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Since it is imperative to raise the boron concentration of the RCS as soon as possible, the boron concentration should be a concentrated solution. The operator should begin boration with the best source available for the plant conditions.
AP1000 STS                             B 3.1.1-4                                       Rev. 1

SDM B 3.1.1 BASES ACTIONS (continued)
In determining the boration flow rate, the time in core life must be considered. For instance, the most difficult time in core life to increase the RCS boron concentration is at hot shutdown conditions when boron concentration is highest. For example, assuming that a value of 1.0% k/k must be recovered and the boration flow rate is 100 gpm, it is possible to increase the boron concentration of the RCS by approximately 111 ppm in 21 minutes utilizing boric acid solution having a concentration of 4375 ppm. If a boron worth of 9 pcm/ppm is assumed, this combination of parameters will increase the SDM by 1.0% k/k. The boron concentration and system parameters used above represent typical values and are provided for the purpose of offering a specific example.
SURVEILLANCE        SR 3.1.1.1 REQUIREMENTS In MODES 1 and 2 with keff  1.0, SDM is verified by either compliance with the requirements of LCO 3.2.5, OPDMS Monitored Parameters, item d, or when the OPDMS is not monitoring parameters, by observing that the requirements of LCO 3.1.5 Shutdown Bank Insertion Limits, and LCO 3.1.6, Control Bank Insertion Limits are met. In the event that an RCCA is known to be untrippable, however, SDM verification must account for the worth of both the untrippable RCCA as well as another RCCA of maximum worth. This is not applicable to GRCAs as they are not credited in the verification of SDM in MODES 1 and 2 with keff  1.0.
In MODE 2 with keff < 1.0 and in MODES 3, 4, and 5, the SDM is verified by performing a reactivity balance calculation, considering at least the listed reactivity effects:
: a. RCS boron concentration;
: b. RCCA and GRCA position;
: c. RCS average temperature;
: d. Fuel burnup based on gross thermal energy generation;
: e. Xenon concentration;
: f. Samarium concentration; and
: g. Isothermal Temperature Coefficient (ITC).
AP1000 STS                                  B 3.1.1-5                                      Rev. 1

SDM B 3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)
Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical and the fuel temperature will be changing at the same rate as the RCS.
The Frequency of 24 hours is based on the generally slow change in required boron concentration and the low probability of an accident occurring without the required SDM. This allows time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the calculation.
REFERENCES      1. 10 CFR 50, Appendix A, GDC 26.
: 2. WCAP-16943-P-A, Enhanced GRCA (Gray Rod Cluster Assembly)
Rodlet Design.
: 3. FSAR Chapter 15, Accident Analyses.
: 4. NUREG-0800, Standard Review Plan, Section 4.2, Revision 3, Fuel System Design (Appendix B).
: 5. 10 CFR 50.34.
AP1000 STS                             B 3.1.1-6                                      Rev. 1

Core Reactivity B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.2 Core Reactivity BASES BACKGROUND            According to GDC 26, GDC 28, and GDC 29 (Ref. 1), reactivity shall be controllable, such that subcriticality is maintained under cold conditions, and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences. Therefore, reactivity balance is used as a measure of the predicted versus measured core reactivity during power operation. The periodic confirmation of core reactivity is necessary to ensure that Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity difference could be the result of unanticipated changes in fuel, control rod worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity and could potentially result in a loss of SDM or violation of acceptable fuel design limits. Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LCO 3.1.1, SHUTDOWN MARGIN (SDM)) in ensuring the reactor can be brought safely to cold, subcritical conditions.
When the reactor core is critical or in normal power operation, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance since parameters are being maintained relatively stable under steady-state power conditions. The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers producing zero net reactivity.
Excess reactivity can be inferred from the boron letdown curve (or critical boron curve), which provides an indication of the soluble boron concentration in the Reactor Coolant System (RCS) versus cycle burnup.
Periodic measurement of the RCS boron concentration for comparison with the predicted value with other variables fixed (such as control rod position, temperature, pressure, and power), provides a convenient method of ensuring that core reactivity is within design expectations and that the calculation models used to generate the safety analysis are adequate.
In order to achieve the required fuel cycle energy output, the uranium enrichment, in the new fuel loading and in the fuel remaining from the previous cycle, provides excess positive reactivity beyond that required to sustain steady state operation throughout the cycle. When the reactor is critical at RTP and a negative moderator temperature coefficient, the AP1000 STS                                  B 3.1.2-1                                         Rev. 1

Core Reactivity B 3.1.2 BASES BACKGROUND (continued) excess positive reactivity is compensated by burnable absorbers (if any),
control rods, whatever neutron poisons (mainly xenon and samarium) are present in the fuel, and the RCS boron concentration.
When the core is producing THERMAL POWER, the fuel and burnable absorbers are being depleted and excess reactivity is changing. As the fuel and burnable absorbers deplete, the RCS boron concentration is periodically adjusted to compensate for the net core reactivity change and to reposition the Control Banks within the limits defined in LCO 3.1.6, Control Bank Insertion Limits. A predicted RCS boron concentration can be determined for any core condition using a calculational model consistent with the design analysis. Therefore, deviations from the predicted boron letdown curve may indicate deficiencies in the design analysis, deficiencies in the calculational models, or abnormal core conditions, and must be evaluated.
APPLICABLE       The acceptance criteria for core reactivity are that the reactivity balance SAFETY           limit ensures plant operation is maintained within the assumptions of the ANALYSES         safety analyses.
Accurate prediction of core reactivity is either an explicit or implicit assumption in the accident analysis evaluations. Certain accident evaluations (Ref. 2) are, therefore, dependent upon accurate evaluation of core reactivity. In particular, SDM and reactivity transients, such as control rod withdrawal accidents or rod ejection accidents, are sensitive to accurate predictions of core reactivity. These accident analysis evaluations rely on computer codes that have been qualified against available test data, operating plant data, and analytical benchmarks.
Monitoring reactivity balance provides additional assurance that the nuclear methods provide an accurate representation of the core reactivity.
Design calculations and safety analysis are performed for each fuel cycle for the purpose of predetermining reactivity behavior and the RCS boron concentration requirements for reactivity control during fuel depletion.
The comparison between measured and predicted initial core reactivity provides a normalization for the calculational models used to predict core reactivity. If the measured and predicted RCS boron concentrations for identical core conditions at beginning of cycle (BOC) do not agree, then the assumptions used in the reload cycle design analysis or the calculational models used to predict soluble boron requirements may not AP1000 STS                              B 3.1.2-2                                         Rev. 1

Core Reactivity B 3.1.2 BASES APPLICABLE SAFETY ANALYSES (continued) be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured boron concentration. Thereafter, any significant deviations in the measured boron concentration from the predicted boron letdown curve that develop during fuel depletion may be an indication that the calculational model is not adequate for core burnups beyond BOC, or that an unexpected change in core conditions has occurred.
The normalization of predicted RCS boron concentration to the measured value is typically performed after reaching RTP following startup from a refueling outage, with the control rods in their normal positions for power operation. The normalization is performed at BOC conditions so that core reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.
Core reactivity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              Long term core reactivity behavior is a result of the core physics design and cannot be easily controlled once the core design is fixed. During operation, therefore, the Conditions of the LCO can be ensured only through measurement and tracking, and appropriate actions taken as necessary. Large differences between actual and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the Nuclear Design Methodology are larger than expected. A limit on the reactivity balance of +/- 1% k/k has been established based on engineering judgment. A 1% deviation in reactivity from that predicted is larger than expected for normal operation and should therefore be evaluated.
When measured core reactivity is within 1% k/k of the predicted value at steady state thermal conditions, the core is considered to be operating within acceptable design limits. Since deviations from the limit are normally detected by comparing predicted and measured steady state RCS critical boron concentrations, the difference between measured and predicted values would be approximately 100 ppm (depending on the boron worth) before the limit is reached. These values are well within the uncertainty limits for analysis of boron concentration samples, so that spurious violations of the limit due to uncertainty in measuring the RCS boron concentration are unlikely.
AP1000 STS                              B 3.1.2-3                                       Rev. 1

Core Reactivity B 3.1.2 BASES APPLICABILITY The limits on core reactivity must be maintained during MODES 1 and 2 because a reactivity balance must exist when the reactor is critical or producing THERMAL POWER. As the fuel depletes, core conditions are changing, and confirmation of the reactivity balance ensures the core is operating as designed. This Specification does not apply in MODE 3, 4, and 5 because the reactor is shutdown and the reactivity balance is not changing.
In MODE 6, fuel loading results in a continually changing core reactivity.
Boron concentration requirements (LCO 3.9.1, Boron Concentration) ensure that fuel movements are performed within the bounds of the safety analysis. An SDM demonstration is required during the first startup following operations that could have altered core reactivity (e.g.,
fuel movement, control rod replacement, control rod shuffling).
ACTIONS       A.1 and A.2 Should an anomaly develop between measured and predicted core reactivity, an evaluation of the core design and safety analysis must be performed. Core conditions are evaluated to determine their consistency with input to design calculations. Measured core and process parameters are evaluated to determine that they are within the bounds of the safety analysis, and safety analysis calculational models are reviewed to verify that they are adequate for representation of the core conditions. The required Completion Time of 7 days is based on the low probability of a DBA occurring during this period and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.
Following evaluations of the core design and safety analysis, the cause of the reactivity anomaly may be resolved. If the cause of the reactivity anomaly is a mismatch in core conditions at the time of RCS boron concentration sampling, then a recalculation of the RCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected. If an unexpected physical change in the condition of the core has occurred, it must be evaluated and corrected, if possible. If the cause of the reactivity anomaly is in the calculation technique, then the calculational models must be revised to provide more accurate predictions. If any of these results are demonstrated and it is concluded that the reactor core is acceptable for continued operation, then the boron letdown curve may be renormalized and power operation may continue. If operational restriction or additional SRs are necessary to ensure the reactor core is acceptable for continued operation, then they must be defined.
AP1000 STS                           B 3.1.2-4                                       Rev. 1

Core Reactivity B 3.1.2 BASES ACTIONS (continued)
The required Completion Time of 7 days is adequate for preparing whatever operating restrictions or Surveillances that may be required to allow continued reactor operation.
B.1 If the core reactivity cannot be restored to within the 1% k/k limit, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours.
If the SDM for MODE 3 is not met, then the boration required by LCO 3.1.1 Required Action A.1 would occur. The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.1.2.1 REQUIREMENTS Core reactivity is verified by periodic comparisons of measured and predicted RCS boron concentrations. The comparison is made considering that other core conditions are fixed or stable, including control rod position, moderator temperature, fuel temperature, fuel depletion, xenon concentration, and samarium concentration. The Surveillance is performed prior to entering MODE 1 as an initial check on core conditions and design calculations at BOC.
The SR is modified by a Note. The Note indicates that the normalization of predicted core reactivity to the measured value must take place within the first 60 effective full power days (EFPD) after each fuel loading. This allows sufficient time for core conditions to reach steady state, but prevents operation for a large fraction of the fuel cycle without establishing a benchmark for the design calculations. The required subsequent Frequency of 31 EFPD following the initial 60 EFPD after entering MODE 1 is acceptable based on the slow rate of core changes due to fuel depletion and the presence of other indicators (QPTR, OPDMS, AFD, etc.) for prompt indication of an anomaly.
REFERENCES          1. 10 CFR 50, Appendix A, GDC 26, GDC 28, and GDC 29.
: 2. FSAR Chapter 15, Accident Analyses.
AP1000 STS                                  B 3.1.2-5                                      Rev. 1

MTC B 3.1.3 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.3 Moderator Temperature Coefficient (MTC)
BASES BACKGROUND           According to GDC 11 (Ref. 1), the reactor core and its interaction with the Reactor Coolant System (RCS) must be designed for inherently stable power operation even in the possible event of an accident. In particular, the net reactivity feedback in the system must compensate for any unintended reactivity increases.
The MTC relates a change in core reactivity to a change in reactor coolant temperature (a positive MTC means that reactivity increases with increasing moderator temperature; conversely, a negative MTC means that reactivity decreases with increasing moderator temperature). The reactor is designed to operate with a non-positive MTC over the range of fuel cycle operation. Therefore, a coolant temperature increase will cause a reactivity decrease, so that the coolant temperature tends to return toward its initial value. Reactivity increases that cause a coolant temperature increase will thus be self limiting, and stable power operation will result.
MTC values are predicted at selected burnups during the safety evaluation analysis and are confirmed to be acceptable by measurements. Both initial and reload cores are designed so that the MTC is less than zero when THERMAL POWER is at RTP. The actual value of the MTC is dependent on core characteristics such as fuel loading and reactor coolant soluble boron concentration. The core design may require additional fixed distributed poisons (burnable absorbers) to yield an MTC within the range analyzed in the plant accident analysis. The end of cycle (EOC) MTC is also limited by the requirements of the accident analysis. Fuel cycles designed to achieve high burnups that have changes to other characteristics are evaluated to ensure that the MTC does not exceed the EOC limit.
The limitations on MTC are provided to ensure that the value of this coefficient remains within the limiting conditions assumed in the FSAR Chapter 15 accident and transient analyses (Ref. 2).
If the LCO limits are not met, the plant response during transients may not be as predicted. The core could violate criteria that prohibit a return to criticality, or the departure from nucleate boiling ratio criteria of the approved correlation may be violated, which could lead to a loss of the fuel cladding integrity.
AP1000 STS                                    B 3.1.3-1                                         Rev. 1

MTC B 3.1.3 BASES BACKGROUND (continued)
The SRs for measurement of the MTC at the beginning and near the end of the fuel cycle are adequate to confirm that the MTC remains within its limits since this coefficient changes slowly, due principally to the RCS boron concentration changes associated with fuel burnup and burnable absorbers depletion.
APPLICABLE       The acceptance criteria for the specified MTC are:
SAFETY ANALYSES         a. The MTC values must remain within the bounds of those used in the accident analysis (Ref. 2); and
: b. The MTC must be such that inherently stable power operations result during normal operation and accidents, such as overheating and overcooling events.
FSAR Chapter 15 (Ref. 2) contains analyses of accidents that result in both overheating and overcooling of the reactor core. MTC is one of the controlling parameters for core reactivity in these accidents. Both the least negative value and most negative value of the MTC are important to safety, and both values must be bounded. Values used in the analyses consider worst case conditions to ensure that the accident results are bounding (Ref. 3).
The consequences of accidents that cause core heat-up must be evaluated when the MTC is least negative. Such accidents include the rod withdrawal transient from either zero (Ref. 2) or RTP, loss of main feedwater flow, and loss of forced reactor coolant flow. The consequences of accidents that cause core overcooling must be evaluated when the MTC is negative. Such accidents include sudden feedwater flow increase and sudden decrease in feedwater temperature.
In order to ensure a bounding accident analysis, the MTC is assumed to be its most limiting value for the analysis conditions appropriate to each accident. The bounding value is determined by considering rodded and unrodded conditions, whether the reactor is at full or zero power, and whether it is beginning of cycle (BOC) or EOC. The most conservative combination appropriate to the accident is then used for the analysis (Ref. 2).
MTC values are bounded in reload safety evaluations assuming steady state conditions at the limiting time in cycle life. An EOC measurement is conducted at conditions when the RCS boron concentration reaches AP1000 STS                              B 3.1.3-2                                       Rev. 1

MTC B 3.1.3 BASES APPLICABLE SAFETY ANALYSES (continued) approximately 300 ppm. The measured value may be extrapolated to project the EOC value, in order to confirm reload design predictions.
MTC satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Even though it is not directly observed and controlled from the control room, MTC is considered an initial condition process variable because of its dependence on boron concentration.
LCO              LCO 3.1.3 requires the MTC to be within specified limits of the COLR to ensure that the core operates within the assumptions of the accident analysis. During the reload core safety evaluation, the MTC is analyzed to determine that its values remain within the bounds of the accident analysis during operation.
Assumptions made in safety analyses require that the MTC be more negative than a given upper limit and less negative than a given lower limit. The MTC is least negative near BOC; this upper bound must not be exceeded. This maximum upper limit occurs at all rods out (ARO), hot zero power conditions. At EOC the MTC takes on its most negative value, when the lower bound becomes important. This LCO exists to ensure that both the upper and lower bounds are not exceeded.
During operation, therefore, the conditions of the LCO can only be ensured through measurement. The Surveillance checks at BOC and EOC on MTC provide confirmation that the MTC is behaving as anticipated so that the acceptance criteria are met.
During the core safety evaluation, MTC values are predicted at selected burnup accumulation during operations. Based on these predictions, administrative limits may be required on maximum RCS boron concentration and control bank position to maintain the MTC at less than or equal to the upper MTC limit provided in the COLR. These administrative limits consist of tables of the maximum RCS boron concentration versus control rod position, power level, and cycle burnup.
A means for adjusting the maximum RCS boron concentrations is also provided to account for differences between the MTC measured during startup physics testing and the corresponding predicted value. The RCS boron concentration needed to maintain a critical core state may increase with cycle burnup accumulation due to burnable absorber depletion.
However, as the cycle burnup continues to accumulate, the effect of fuel depletion on core reactivity will exceed the effect of burnable absorber depletion and the RCS boron concentration needed to maintain criticality AP1000 STS                             B 3.1.3-3                                      Rev. 1

MTC B 3.1.3 BASES LCO (continued) will decrease. The reduction in critical boron concentration causes the MTC to become more negative. The time in cycle life at which the calculated MTC will meet the upper MTC limit can be determined. At this point in the cycle and beyond, the administrative limits on maximum RCS boron concentration and control bank position are no longer required to meet the upper MTC limit.
The BOC limit and the EOC limit are established in the COLR to allow specifying limits for each particular cycle. This permits the unit to take advantage of improved fuel management and changes in unit operating schedule.
APPLICABILITY   Technical Specifications place both LCO and SR values on MTC, based on the safety analysis assumptions described above.
In MODE 1, the limits on MTC must be maintained to ensure that any accident initiated from THERMAL POWER operation will not violate the design assumptions of the accident analysis. In MODE 2, with the reactor critical, the upper limit must also be maintained to ensure that startup and subcritical accidents (such as the uncontrolled control rod or control rod group withdrawal) will not violate the assumptions of the accident analysis. The lower MTC limit must be maintained in MODES 2 and 3, in addition to MODE 1, to ensure that cooldown accidents will not violate the assumptions of the accident analysis. In MODES 4, 5, and 6, this LCO is not applicable, since no Design Basis Accidents using the MTC as an analysis assumption are initiated from these MODES.
ACTIONS         A.1 If the upper MTC limit is violated, administrative limits are placed on the combination of maximum RCS boron concentration and control bank position to maintain the MTC within its upper limit. A Completion Time of 24 hours provides enough time for evaluating the MTC measurement and computing the required administrative limits.
B.1 If the required administrative limits are not established within 24 hours, the unit must be placed in MODE 2 with keff < 1.0 to prevent operation with an MTC that is less negative than that assumed in safety analyses.
AP1000 STS                             B 3.1.3-4                                       Rev. 1

MTC B 3.1.3 BASES ACTIONS (continued)
The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
C.1 Exceeding the EOC MTC limit means that the safety analysis assumptions for the EOC accidents that use a bounding negative MTC value may be invalid. If the EOC MTC limit is exceeded, the plant must be placed in a MODE or Condition in which the LCO requirements are not applicable. This is done by placing the plant in MODE 4 within 12 hours.
The allowed Completion Time is reasonable, based on operating experience, for reaching the required MODE from full power operation in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.1.3.1 REQUIREMENTS This SR requires measurement of the MTC once at BOC prior to entering MODE 1 in order to demonstrate compliance with the most limiting MTC LCO. Meeting the limit prior to entering MODE 1 ensures that the limit will also be met at higher power levels.
The BOC MTC value for ARO will be inferred from isothermal temperature coefficient measurements obtained during the physics tests after refueling. The ARO value can be directly compared to the MTC limit of the LCO. The measurement results and predicted design values are used to determine if administrative limits on the combination of maximum RCS boron concentration and control bank position are required at any time in the cycle.
SR 3.1.3.2 In similar fashion, the LCO requires that the MTC be less negative than the specified value for EOC full power conditions. This measurement may be performed at any THERMAL POWER, but its results must be extrapolated to the conditions of RTP and all banks withdrawn in order to make a proper comparison with the LCO value. Because the RTP MTC value will gradually become more negative with further core depletion and boron concentration reduction, a 300 ppm SR value of MTC should necessarily be less negative than the EOC LCO limit. The 300 ppm SR AP1000 STS                                B 3.1.3-5                                     Rev. 1

MTC B 3.1.3 BASES SURVEILLANCE REQUIREMENTS (continued) value is sufficiently less negative than the EOC LCO limit value to ensure that the LCO limit will be met at EOC when the 300 ppm Surveillance criterion is met.
The SR is required to be performed once within 7 effective full power days (EFPD) after reaching an RCS boron concentration that is equivalent to an equilibrium RTP ARO boron concentration of 300 ppm.
If the 300 ppm Surveillance limit is exceeded, it is possible that the EOC limit on MTC could be reached before the planned EOC. Because the MTC changes slowly with core depletion, the second Frequency of 14 EFPD thereafter is sufficient to avoid exceeding the EOC limit.
SR 3.1.3.2 is modified by two Notes. The first Note states that an exemption from the measurement may be allowed provided that applicable criteria in the COLR are met. This is based on the requirements of WCAP-13749-P-A (Ref. 4). Reference 4 allows that if a specified revised prediction of the MTC and limits for several core parameters measured during the cycle are within specified bounds, the end of life (EOL) MTC measurement need not be made. The second Note states that the Surveillance limit for RTP boron concentration of 60 ppm is conservative. If the measured MTC at 60 ppm is more positive than the 60 ppm Surveillance limit, the EOC limit will not be exceeded because of the gradual manner in which MTC changes with core burnup, and the continued performance of SR 3.1.3.2 is no longer required.
REFERENCES      1. 10 CFR 50, Appendix A, GDC 11.
: 2. FSAR Chapter 15, Accident Analyses.
: 3. WCAP 9273-NP-A, Westinghouse Reload Safety Evaluation Methodology, July 1985.
: 4. WCAP-13749-NP-A, Safety Evaluation Supporting the Conditional Exemption of the Most Negative EOL Moderator Temperature Coefficient Measurement, March 1997.
AP1000 STS                              B 3.1.3-6                                      Rev. 1

Rod Group Alignment Limits B 3.1.4 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 Rod Group Alignment Limits BASES BACKGROUND           The OPERABILITY (e.g., trippability) of the Rod Cluster Control Assemblies (RCCAs) is an initial assumption in all safety analyses that assume rod insertion upon reactor trip. Although Gray Rod Cluster Assemblies (GRCAs) are released on reactor trip, GRCAs are conservatively excluded from this assumption, in that their reactivity worth is not credited in advance when calculating the total negative reactivity worth potentially available from control rod insertion on a reactor trip. As a result, GRCAs are excluded from the OPERABILITY (i.e., trippability) requirements of this LCO. However, the basis for LCO 3.1.1, SHUTDOWN MARGIN (SDM) defines conditions under which negative reactivity from GRCA banks may be credited for SDM after a shutdown has already occurred. Rod misalignment to the maximum extent allowed by this LCO is an initial assumption in the safety analysis that directly affects core power distributions and assumptions of available SDM.
The applicable criteria for these reactivity and power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, Reactor Design, GDC 26, Reactivity Control System Redundancy and Protection (Ref. 1), and 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants (Ref. 2).
The control rods in the AP1000 design are divided among seven control banks and four shutdown banks. Shutdown banks are designated S1, S2, S3 and S4. Control banks are designated MA, MB, MC, MD, M1, M2, and AO. The control banks provide reactivity and power distribution control during unit operation while the shutdown banks provide rapid shutdown capability for the reactor.
Each bank may be further subdivided into groups to provide for more precise reactivity control. A group consists of four control rods in symmetric core locations that are electrically paralleled to step simultaneously. The only exception to this is the AO bank, which contains a five-rod group that steps simultaneously. A bank consists of one or more groups that are moved in a staggered fashion, but always within one step of each other.
Control rod assemblies are further characterized by their neutron absorption characteristics. More absorbent RCCAs are used in all AP1000 STS                                    B 3.1.4-1                                     Rev. 1

Rod Group Alignment Limits B 3.1.4 BASES BACKGROUND (continued) shutdown banks as well as in control banks M1, M2 and AO. Less absorbent GRCAs are used in control banks MA, MB, MC and MD.
Mechanical or electrical failures may cause an RCCA to become inoperable or cause an RCCA or GRCA to become misaligned from its group. RCCA inoperability or misalignment of a control rod of either type, may cause increased power peaking due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown. Therefore, RCCA and GRCA alignment and RCCA OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM.
Limits on control rod alignment have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
RCCAs and GRCAs are moved by their control rod drive mechanisms (CRDMs). Each CRDM moves its RCCA or GRCA one step (approximately 5/8 inch) at a time but at varying rates (steps per minute) depending on the signal output from the Plant Control System.
The shutdown banks are maintained either in the fully inserted or fully withdrawn position. The control banks are part of the MSHIM (Mechanical Shim) Control System, which utilizes two independent groups of control banks for control of reactivity and axial power distribution.
Reactivity control is provided primarily by control banks MA, MB, MC, MD, M1, and M2, which are referred to as the M banks. These banks operate with a fixed overlap. The bank worth and overlap are defined so as to minimize the impact on axial offset with control bank maneuvering and still retain the reactivity required to meet the desired load changes.
Axial power distribution control is provided by the AO control bank, a relatively high worth bank that moves independently of the M banks.
The control rods are arranged in a radially symmetric pattern so that control bank motion does not introduce radial asymmetries in the core power distributions.
The axial position of shutdown rods and control rods is indicated by two separate and independent means, which are the Bank Demand Position AP1000 STS                              B 3.1.4-2                                       Rev. 1

Rod Group Alignment Limits B 3.1.4 BASES BACKGROUND (continued)
Indication (commonly called group step counters) and the Digital Rod Position Indication (DRPI). DRPI and Bank Demand Position Indication are described in more detail in the Bases for LCO 3.1.7, Rod Position Indication.
Certain control banks will be pre-selected for rapid insertion by the Rapid Power Reduction (RPR) System during load rejection transients or if the main turbine or a main feedwater pump trip occurs above a pre-selected plant power level. When the RPR System actuates, any control rods that are dropped into the core as a result of the RPR actuation, and that are confirmed to reach the fully inserted position using the DRPI System, remain aligned with their group step counter demand position. The group step counter demand position for control rod groups dropped by the RPR System is automatically set to zero steps withdrawn upon actuation of the RPR System. The prescribed sequence and overlap limits are restored upon the first withdrawal demand after actuation of the RPR System.
APPLICABLE       Control rod misalignment accidents are analyzed in the safety analysis SAFETY           (Ref. 3). The acceptance criteria for addressing control rod inoperability ANALYSES         or misalignment are that:
: a. There be no violations of:
: 1. Specified acceptable fuel design limits, or
: 2. Reactor Coolant System (RCS) pressure boundary integrity; and
: b. The core remains subcritical after accident transients.
Two types of misalignment are distinguished. During movement of a control rod group, one rod may stop moving, while the other rods in the group continue. This condition may cause excessive power peaking.
The second type of misalignment occurs if one rod fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition requires an evaluation to determine that sufficient reactivity worth is held in the control rods to meet the SDM requirement with the maximum worth rod stuck fully withdrawn.
Two types of analysis are performed in regard to static rod misalignment (Ref. 3). With control banks at or above their insertion limits, one type of analysis considers the case when any one rod is completely inserted into AP1000 STS                             B 3.1.4-3                                         Rev. 1

Rod Group Alignment Limits B 3.1.4 BASES APPLICABLE SAFETY ANALYSES (continued) the core. The second type of analysis considers the case of a completely withdrawn single rod from a bank inserted to its insertion limit. Satisfying limits on departure from nucleate boiling ratio in both of these cases bounds the situation when a rod is misaligned from its group by 12 steps.
Another type of misalignment occurs if one RCCA fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition is assumed in the evaluation to determine that the required SDM is met with the maximum worth RCCA also fully withdrawn (Ref. 3).
The Required Actions in this LCO ensure that either deviations from the alignment limits will be corrected or that THERMAL POWER will be adjusted so that excessive local linear heat rates will not occur, and that the requirements on SDM and ejected rod worth are preserved.
Continued operation of the reactor with a misaligned control rod is allowed if the heat flux hot channel factor (FQ (Z)) and available SDM and N
the nuclear enthalpy hot channel factor (F H                A E
A ) are verified to be within their limits in the COLR and the safety analysis is verified to remain valid.
N Verification of FQ (Z), F H  A E
A , and SDM can be performed with the On-Line Power Distribution Monitoring System (OPDMS) provided the OPDMS rod position input is corrected to reflect the misaligned rod condition. If the OPDMS is not monitoring parameters, the verifications can be performed by off-line processing of incore detector measurements and by performing a reactivity balance calculation for SDM confirmation. When a control rod is misaligned, the assumptions that are used to determine the rod insertion limits, AFD limits, and quadrant power tilt limits are not preserved. Therefore, the limits may not preserve the design peaking N
factors, and FQ (Z) and F H        A E
A must be verified directly by off-line power distribution measurement if the OPDMS is not monitoring parameters.
With the OPDMS monitoring parameters, and the rod position input corrected to the misaligned condition, the design peaking factors are confirmed by continuous monitoring such that off-line power distribution measurement is not required. Bases Section B 3.2 (Power Distribution Limits) contains more complete discussions of the relation of FQ (Z) and N
F H A
E A to the operating limits.
RCCA OPERABILITY and the alignment of all control rods (RCCAs and GRCAs) are directly related to power distributions and SDM, which are initial conditions assumed in safety analyses. Therefore, they satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                                  B 3.1.4-4                                                          Rev. 1

Rod Group Alignment Limits B 3.1.4 BASES LCO           The limits on shutdown or control rod alignments ensure that the assumptions in the safety analysis will remain valid. The requirements on RCCA OPERABILITY ensure that upon reactor trip, the assumed reactivity will be available and will be inserted. The RCCA OPERABILITY requirements (i.e., trippability) apply to all RCCAs in the shutdown and control banks (not GRCAs) and are separate from the alignment requirements. The alignment requirements ensure that all control rods (RCCAs and GRCAs), and their respective banks maintain power distribution and rod alignment within analyzed limits. The RCCA OPERABILITY requirement is satisfied provided the rod will fully insert in the required rod drop time assumed in the safety analysis. Rod control malfunctions that result in the inability to move an RCCA (e.g., rod lift coil failures), but that do not impact trippability, do not result in RCCA inoperability.
The requirement to maintain the rod alignment to within plus or minus 12 steps is conservative. The minimum misalignment assumed in safety analysis is 24 steps (15 inches), and in some cases a total misalignment from fully withdrawn to fully inserted is assumed.
Failure to meet the requirements of this LCO may produce unacceptable power peaking factors and linear heat rates, or insufficient available SDMs, which may constitute initial conditions inconsistent with the safety analysis.
APPLICABILITY The requirements on RCCA OPERABILITY and alignment of all control rods are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated, and the OPERABILITY (i.e., trippability) and alignment of rods have the potential to affect the safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the control rods are bottomed and the reactor is shut down and not producing fission power. See LCO 3.1.1, SHUTDOWN MARGIN (SDM), for SDM in MODES 3, 4, and 5 and LCO 3.9.1, Boron Concentration, for boron concentration requirements during refueling.
ACTIONS       A.1.1 and A.1.2 In this situation, SDM verification must include the worth of the untrippable rod as well as an additional rod of maximum worth.
When one or more RCCA(s) are inoperable (i.e., untrippable), there is a possibility that the required SDM may be adversely affected. Under AP1000 STS                           B 3.1.4-5                                      Rev. 1

Rod Group Alignment Limits B 3.1.4 BASES ACTIONS (continued) these conditions, it is important to determine the SDM, and if it is less than the required value, initiate boration until the required SDM is recovered. The Completion Time of 1 hour is adequate to identify the inoperable RCCA(s) to the OPDMS and establish continuous monitoring of SDM including the effects of the inoperable rod(s) or to otherwise determine SDM and, if necessary, to initiate boration to restore SDM.
A.2 If the inoperable RCCA(s) cannot be restored to OPERABLE status, the plant must be brought to a MODE or condition in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to MODE 3 within 6 hours.
The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner without challenging plant systems.
B.1.1, B.1.2, and B.2 When a rod becomes misaligned, it can usually be moved and is still trippable. With the OPDMS monitoring parameters, as verified hourly by Required Action B.1.1, adverse peaking factors resulting from the misalignment can be detected. If the rod can be realigned within the Required Action B.1.2 Completion Time of 8 hours, adverse burnup shadowing in the location of the misaligned rod can be avoided. If while operating under Actions B.1.1 and B.1.2, the OPDMS is found to not be monitoring parameters, then Required Action B.2 allows 1 hour to realign the rod. With the OPDMS not monitoring parameters xenon redistribution can potentially cause adverse peaking factors which may not be detected.
However, if the rod can be realigned within the Completion Time of Required Action B.2 of 1 hour from the discovery that the OPDMS is not monitoring parameters, local xenon redistribution during this short interval will not be significant and operation may proceed without further restriction.
An alternative to realigning a single misaligned control rod to the group average position is to align the remainder of the group to the position of the misaligned control rod. However, this must be done without violating the bank sequence, overlap, and insertion limits specified in LCO 3.1.5, Shutdown Bank Insertion Limits, and LCO 3.1.6, Control Bank Insertion Limits. The Completion Time of 1 hour from the discovery that OPDMS is not monitoring parameters gives the operator sufficient time to adjust the AP1000 STS                                B 3.1.4-6                                       Rev. 1

Rod Group Alignment Limits B 3.1.4 BASES ACTIONS (continued) rod positions in an orderly manner. The system design allows alignment of a single rod to the bank or the bank to the rod to allow minimal impact on core flux.
B.3.1.1 and B.3.1.2 With a misaligned rod, in lieu of restoring alignment, SDM must be verified within limit or boration must be initiated to restore SDM within limit.
Power operation may continue with one control rod misaligned, provided that SDM is verified or boration is initiated within 1 hour. The Completion Time of 1 hour represents the time necessary to update the OPDMS with the misaligned rod position indication information or use other methods to determine the actual unit SDM and, if necessary, align and start the necessary systems and components to initiate boration.
B.3.2, B.3.3.1, B.3.3.2.1, B.3.3.2.2, B.3.3.2.3, and B.3.4 For continued operation beyond 1 hour with a misaligned rod, THERMAL POWER must be reduced, SDM must periodically be verified within limits, N
hot channel factors (FQ (Z) and F H A
E A ) must be verified within limits, and the safety analyses must be re-evaluated to confirm continued operation is permissible.
Reduction of THERMAL POWER to 75% of RTP ensures that local linear heat rate (LHR) increases due to a misaligned control rod will not cause the core design criteria to be exceeded (Ref. 3). The Completion Time of 2 hours gives the operator sufficient time to accomplish an orderly THERMAL POWER reduction without challenging the Protection and Safety Monitoring System.
When a rod is known to be misaligned, there is a potential to impact the SDM and core margin to thermal limits. Since the core conditions can change with time, periodic verification of these parameters is required.
The OPDMS provides continuous monitoring of these parameters following update with the misaligned rod position data. Performing SR 3.2.5.1 (verify OPDMS monitored parameters within limits) on a Frequency of 12 hours is sufficient to ensure that these requirements continue to be met while the reactor is operating with a misaligned control rod at THERMAL POWER less than or equal to 75% RTP.
AP1000 STS                                B 3.1.4-7                                             Rev. 1

Rod Group Alignment Limits B 3.1.4 BASES ACTIONS (continued)
When the OPDMS is not monitoring parameters, an off-line verification of N
SDM and the peaking factors FQ (Z) and F H  A E
A must be performed. The off-line verification of SDM is performed with a Frequency of 12 hours, but the verification of the peaking factors is performed on a Frequency of 72 hours. The allowed Completion Time of 72 hours is reasonable considering that the reactor THERMAL POWER is reduced to 75% RTP. This provides significant margin to the limits for fuel LHR and departure from nucleate boiling ratio and subsequently to the peaking N
factor FQ (Z) and F H A
E A limits.
Once current conditions have been verified acceptable, time is available to perform evaluations of accident analyses to determine that core limits will not be exceeded during a Design Basis Accident for the duration of operation under these conditions. The accident analyses presented in FSAR Chapter 15 (Ref. 3) that may be adversely affected will be evaluated to ensure that the analysis results remain valid for the duration under these conditions. A Completion Time of 5 days is sufficient time to obtain the required input data and to perform the analysis.
C.1 When a Required Action for a single misaligned control rod cannot be completed within an associated Completion Time, the unit must be brought to a MODE or condition in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to MODE 3 within 6 hours, which obviates concerns about the development of undesirable xenon or power distributions. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching MODE 3 from full power condition in an orderly manner and without challenging plant systems.
D.1.1 and D.1.2 More than one control rod becoming misaligned from its group average position is not expected, and has the potential to reduce SDM. Therefore, SDM must be evaluated. One hour allows the operator adequate time to determine SDM either through update of the OPDMS rod position data to reflect the misaligned control rods or a reactivity balance calculation, and to initiate boration if necessary to restore SDM to within its limit.
Restoration of the required SDM, if necessary, requires increasing the RCS boron concentration to provide negative reactivity, as described in the Bases of LCO 3.1.1. The required Completion Time of 1 hour for AP1000 STS                                     B 3.1.4-8                                    Rev. 1

Rod Group Alignment Limits B 3.1.4 BASES ACTIONS (continued) initiating boration is reasonable based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to complete the action. This allows the operator sufficient time to align the required valves and start the Chemical and Volume Control System makeup pumps. Boration will continue until the required SDM is restored.
D.2 If more than one rod is found to be misaligned or becomes misaligned because of bank movement, the unit conditions fall outside of the accident analysis assumptions. Since automatic bank sequencing could continue to cause misalignment, the unit must be brought to a MODE or Condition in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to MODE 3 within 6 hours.
The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.1.4.1 REQUIREMENTS Verification that individual rod positions are within the alignment limit at a Frequency of 12 hours provides a history that allows the operator to detect that a rod is beginning to deviate from its expected position. The specified Frequency takes into account other rod position information that is continuously available to the operator in the main control room so that during actual rod motion, deviations can immediately be detected.
The SR is modified by a Note that permits it to not be performed for rods associated with an inoperable demand position indication or an inoperable DRPI. The alignment limit is based on the position indication, and would not be available if the indication is inoperable. LCO 3.1.7, Rod Position Indication, provides Actions to verify the rods are in alignment when one or more rod position indications are inoperable.
Verification that individual rod positions are within the alignment limit may utilize any position indication data, e.g., DRPI and/or incore detector data.
SR 3.1.4.2 Verifying each RCCA is OPERABLE would require that each rod be tripped. However, in MODES 1 and 2, tripping each RCCA would result AP1000 STS                                 B 3.1.4-9                                      Rev. 1

Rod Group Alignment Limits B 3.1.4 BASES SURVEILLANCE REQUIREMENTS (continued) in radial or axial power tilts, or oscillations. Exercising each individual RCCA every 92 days provides increased confidence that all rods continue to be OPERABLE without exceeding the alignment limit, even if they are not regularly tripped. Moving each RCCA by 10 steps will not cause radial or axial power tilts, or oscillations, to occur. The 92 day Frequency takes into consideration other information available to the operator in the control room and SR 3.1.4.1, which is performed more frequently and adds to the determination of OPERABILITY of the RCCAs. Between required performances of SR 3.1.4.2 (determination of RCCA OPERABILITY by movement), if an RCCA is discovered to be immovable, but remains trippable and aligned, the RCCA is considered to be OPERABLE. At any time, if an RCCA is immovable, a determination of the trippability (OPERABILITY) of the RCCA must be made, and appropriate action taken.
GRCAs are excluded from this Surveillance because they are not considered in the calculation of SDM in MODES 1 and 2 with keff  1.0. In MODE 2 with keff < 1.0, SR 3.1.4.2 is not applicable because GRCAs must be verified to be fully inserted to be credited in the calculation of SDM.
SR 3.1.4.3 Verification of RCCA drop times allows the operator to determine that the maximum RCCA drop time permitted is consistent with the assumed rod drop time used in the safety analysis. Measuring RCCA drop times prior to reactor criticality, after each reactor vessel head removal and each earthquake requiring plant shutdown, ensures that the reactor internals and rod drive mechanism will not interfere with RCCA motion or RCCA drop time, and that no degradation in these systems has occurred that would adversely affect control rod motion or drop time. This testing is performed with all reactor coolant pumps operating and the average moderator temperature  500&deg;F to simulate a reactor trip under conservative conditions. GRCAs are excluded from this Surveillance because they are not considered in the calculation of SDM in MODES 1 and 2 with keff  1.0. In MODE 2 with keff < 1.0, SR 3.1.4.3 is not applicable because GRCAs must be verified to be fully inserted to be credited in the calculation of SDM.
This Surveillance is performed during a plant outage due to the plant conditions needed to perform the SR and the potential for an unplanned plant transient if the Surveillance were performed with the reactor at power.
AP1000 STS                               B 3.1.4-10                                      Rev. 1

Rod Group Alignment Limits B 3.1.4 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 10 and GDC 26.
: 2. 10 CFR 50.46.
: 3. FSAR Chapter 15, Accident Analyses.
AP1000 STS                  B 3.1.4-11                                 Rev. 1

Shutdown Bank Insertion Limits B 3.1.5 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.5 Shutdown Bank Insertion Limits BASES BACKGROUND         The insertion limits of the shutdown banks are initial assumptions in the safety analyses, which assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions and assumptions of available ejected rod worth SDM and initial reactivity insertion rate.
The applicable criteria for these reactivity and power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, Reactor Design, GDC 26, Reactivity Control System Redundancy and Protection, GDC 28, Reactivity Limits (Ref. 1), and 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors (Ref. 2). Limits on control rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
The control rods are divided among seven control banks and four shutdown banks. Shutdown banks are designated S1, S2, S3, and S4.
Control banks are designated MA, MB, MC, MD, M1, M2, and AO. The control banks provide reactivity and power distribution control during unit operation while the shutdown banks provide rapid shutdown capability for the reactor. Each shutdown bank consists of eight Rod Cluster Control Assemblies (RCCAs). Each bank may be further subdivided into two groups to provide for precise reactivity control. A group consists of four RCCAs that are electrically paralleled to step simultaneously. A bank of RCCAs consists of two groups that are moved in a staggered fashion, but always within one step of each other. See LCO 3.1.4, Rod Group Alignment Limits, for RCCA OPERABILITY and control rod alignment requirements, and LCO 3.1.7, Rod Position Indication, for position indication requirements.
The design calculations are performed with the assumption that the shutdown banks are withdrawn first. The shutdown banks can be fully withdrawn without the core going critical. This provides available negative reactivity in the event of boration errors. The shutdown banks are controlled manually by the control room operator. During normal unit operation, the shutdown banks are either fully withdrawn or fully inserted.
The shutdown banks must be completely withdrawn from the core, prior to withdrawing any control banks during an approach to criticality. The shutdown banks are then left in this position until the reactor is shut AP1000 STS                                 B 3.1.5-1                                       Rev. 1

Shutdown Bank Insertion Limits B 3.1.5 BASES BACKGROUND (continued) down. They add negative reactivity to shut down the reactor upon receipt of a reactor trip signal.
APPLICABLE       On a reactor trip, all RCCAs, except the most reactive RCCA, are SAFETY           assumed to insert into the core. The shutdown banks shall be at or ANALYSES         above their insertion limits and available to insert the maximum amount of negative reactivity on a reactor trip signal. The control banks may be partially inserted in the core as allowed by LCO 3.1.6, Control Bank Insertion Limits. The shutdown bank and control bank insertion limits are established to ensure that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM (see LCO 3.1.1, SHUTDOWN MARGIN (SDM)) following a reactor trip from full power. The insertion of all RCCAs (except for the most reactive RCCA, which is assumed to be fully withdrawn), is sufficient to take the reactor from full power conditions at rated temperature to zero power, and to maintain the required SDM at the rated no load temperature (Ref. 3). The shutdown bank insertion limit also limits the reactivity worth of an ejected shutdown bank rod.
The acceptance criteria for addressing shutdown bank insertion limits are that:
: a. There be no violations of:
: 1. specified acceptable fuel design limits, or,
: 2. RCS pressure boundary integrity; and
: b. The core remains subcritical after accident transients.
As such, the shutdown bank insertion limits affect safety analyses involving core reactivity and SDM (Ref. 3).
The shutdown bank insertion limits preserve an initial condition assumed in the safety analyses and satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              The shutdown banks must be within their insertion limits any time the reactor is critical or approaching criticality. This in conjunction with LCO 3.1.6, Control Bank Insertion Limits, and LCO 3.2.5, On-Line Power Distribution Monitoring System (OPDMS) Monitored Parameters, Item d, SDM, ensures that a sufficient amount of negative reactivity is AP1000 STS                               B 3.1.5-2                                        Rev. 1

Shutdown Bank Insertion Limits B 3.1.5 BASES LCO (continued) available to shut down the reactor and maintain the required SDM following a reactor trip.
The shutdown bank insertion limits are defined in the COLR.
The LCO is modified by a Note indicating the LCO requirement is not applicable to shutdown banks being inserted while performing SR 3.1.4.2. This SR verifies the freedom of the rods to move, and may require the shutdown bank to move below the LCO limits temporarily, which would normally violate the LCO. This Note applies to each shutdown bank as it is moved below the insertion limit to perform the SR.
This Note is not applicable should a malfunction stop performance of the SR. The rod movements in the plant procedure for performing SR 3.1.4.2 are small and result in no more than one shutdown bank potentially moving below the LCO limit at a time. If a reactor trip occurs during performance of SR 3.1.4.2, the potential loss in available negative reactivity insertion will be negligible.
APPLICABILITY   The shutdown banks must be within their insertion limits with the reactor in MODE 1 and MODE 2. The Applicability in MODE 2 begins at initial AO bank withdrawal, during an approach to criticality, and continues throughout MODE 2 until all control rods are again fully inserted by reactor trip or by shutdown. In MODE 3, 4, 5, or 6 the shutdown banks are fully inserted in the core and contribute to the SDM. Refer to LCO 3.1.1 for SDM requirements in MODE 2 with keff < 1.0, and in MODES 3, 4, and 5. LCO 3.9.1, Boron Concentration ensures adequate SDM in MODE 6.
ACTIONS         A.1.1, A.1.2, and A.2 When one or more shutdown banks is not within insertion limits, 2 hours are allowed to restore the shutdown banks to within the insertion limits.
This is necessary because the available SDM may be significantly reduced with one or more of the shutdown banks not within their insertion limits. Also, verification of SDM or initiation of boration within 1 hour is required, since the SDM in MODES 1 and 2 is ensured by the continuous monitoring of SDM by the OPDMS (see LCO 3.2.5) and adhering to the control and shutdown bank insertion limits (see LCO 3.1.1). If shutdown banks are not within their insertion limits, then SDM will be verified by the OPDMS or by performing a reactivity balance calculation, considering the effects listed in the Bases for SR 3.1.1.1.
AP1000 STS                              B 3.1.5-3                                       Rev. 1

Shutdown Bank Insertion Limits B 3.1.5 BASES ACTIONS (continued)
The allowed Completion Time of 1 hour for verification of SDM is an acceptable time for an operator to interface with the OPDMS to update the rod position of the control rods in violation of the shutdown bank insertion limits or for the performance of the reactivity balance calculation.
The allowed Completion Time of 2 hours provides an acceptable time for evaluating and repairing minor problems without allowing the plant to remain in an unacceptable condition for an extended period of time.
B.1 If a Required Action and associated Completion Time are not met, the unit must be brought to a MODE where the LCO is not applicable. The allowed Completion Time of 6 hours is reasonable based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.1.5.1 REQUIREMENTS Verification that the shutdown banks are within their insertion limits prior to an approach to criticality ensures that when the reactor is critical, or being taken critical, the shutdown banks will be available to shut down the reactor, and the required SDM will be maintained following a reactor trip. This SR and Frequency ensure that the shutdown banks are withdrawn before the control banks are withdrawn during a unit startup.
Since the shutdown banks are positioned manually by the main control room operator, a verification of shutdown bank position at a Frequency of 12 hours, after the reactor is taken critical, is adequate to ensure that they are within their insertion limits. Also, the 12 hour Frequency takes into account other information available in the main control room for the purpose of monitoring the status of shutdown rods.
REFERENCES          1. 10 CFR 50, Appendix A, GDC 10, GDC 26, and GDC 28.
: 2. 10 CFR 50.46.
: 3. FSAR Chapter 15, Accident Analyses.
AP1000 STS                                  B 3.1.5-4                                      Rev. 1

Control Bank Insertion Limits B 3.1.6 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 Control Bank Insertion Limits BASES BACKGROUND            The insertion limits of the control banks are initial assumptions in the safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions and assumptions of available ejected rod worth, available SHUTDOWN MARGIN (SDM), and initial reactivity insertion rate.
The applicable criteria for these reactivity and power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, Reactor Design, GDC 26, Reactivity Control System Redundancy and Protection, GDC 28, Reactivity Limits (Ref. 1) and 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors (Ref. 2). Limits on control rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
The control rods are divided among control banks and shutdown banks.
Shutdown banks are designated S1, S2, S3, and S4. Control banks are designated MA, MB, MC, MD, M1, M2, and AO. The control banks provide reactivity and power distribution control during unit operation while the shutdown banks provide rapid shutdown capability for the reactor. Each control bank consists of either Rod Cluster Control Assemblies (RCCAs) or Gray Rod Cluster Assemblies (GRCAs). RCCAs are used in control banks M1, M2, and AO, while GRCAs are used in control banks MA, MB, MC, and MD. Each bank may be further subdivided into two groups to provide for precise reactivity control. A control bank group consists of four RCCAs or GRCAs that are electrically paralleled to step simultaneously. The only exception to this is the AO bank, which contains a five-rod group that steps simultaneously. The five-rod group is powered by two separate sides of the same power selecting cabinet. A bank of RCCAs or GRCAs consists of one or more groups that are moved in a staggered fashion, but always within 1 step of each other. See LCO 3.1.4, Rod Group Alignment Limits, for RCCA OPERABILITY and control rod alignment requirements, and LCO 3.1.7, Rod Position Indication, for position indication requirements.
The control bank insertion, sequence, and overlap limits are specified in the COLR. The control banks are required to be at or above the applicable insertion limit lines. There are two sets of insertion limits applicable to control banks MA, MB, MC, MD, M1 and M2. Which set is AP1000 STS                                   B 3.1.6-1                                        Rev. 1

Control Bank Insertion Limits B 3.1.6 BASES BACKGROUND (continued) applicable depends on the status of the On-Line Power Distribution Monitoring System (OPDMS).
When the OPDMS is monitoring parameters, it monitors SDM as well as other key power distribution parameters defined in LCO 3.2.5, OPDMS Monitored Parameters. Because of this, the consideration of these parameters can be removed from the basis of the control bank insertion limits that are applicable when the OPDMS is monitoring parameters.
When the OPDMS is not monitoring parameters, the applicable rod insertion limits must include SDM and the key power distribution limits normally monitored by the OPDMS as part of their basis. As a result, the control bank insertion limits applicable when OPDMS is not monitoring parameters may be more restrictive. If the insertion limits applicable when the OPDMS is monitoring parameters are conservatively defined to include consideration of SDM and the other key power distribution limits normally monitored by OPDMS, then both sets of insertion limits may be identical. The COLR identifies which control bank insertion limits apply to banks MA, MB, MC, MD, M1, and M2 when the OPDMS is monitoring and not monitoring parameters.
There is also a single insertion limit applicable to the AO bank in the COLR, which does not depend on the status of the OPDMS. Since the AO bank is moved independently of the other control banks, there is no sequence and overlap setting applicable for the AO bank.
The control banks are used for precise reactivity control of the reactor (banks MA, MB, MC, MD, M1, and M2) and axial power distribution control (AO bank). Banks M1, M2, and AO, which contain only RCCAs, are also credited as being available, as required by LCO 3.1.4, to provide negative trip reactivity for SDM calculations in MODE 1 and in MODE 2 with keff  1.0. The positions of the control banks are normally controlled automatically by the Plant Control System, but can also be manually controlled. They are capable of adding negative or positive reactivity very quickly (compared to borating or diluting), while the AO bank is capable of effectively controlling the axial power distribution to near the AO target value.
The power density at any point in the core must be limited so that the fuel design criteria are maintained. Together, LCO 3.1.4, Rod Group Alignment Limits, LCO 3.1.5, Shutdown Bank Insertion Limits, LCO 3.1.6, Control Bank Insertion Limits, and LCO 3.2.5, On-Line Power Distribution Monitoring System (OPDMS)-Monitored Parameters, AP1000 STS                              B 3.1.6-2                                       Rev. 1

Control Bank Insertion Limits B 3.1.6 BASES BACKGROUND (continued) when the OPDMS is monitoring parameters, or LCO 3.2.3, AXIAL FLUX DIFFERENCE (AFD), and LCO 3.2.4, QUADRANT POWER TILT RATIO (QPTR), when the OPDMS is not monitoring parameters, provide limits on control component operation and on monitored process variables, which ensures that the core operates within the fuel design criteria.
The control bank insertion and alignment limits and power distribution limits are process variables that together characterize and control the three dimensional power distribution of the reactor core. Additionally, the control bank insertion limits control the reactivity that could be added in the event of a rod ejection accident, and the control bank insertion limits ensure the required SDM is maintained when the OPDMS is not monitoring parameters.
Operation within the subject LCO limits will prevent fuel cladding failures that would breach the primary fission product barrier and release fission products to the reactor coolant in the event of a loss of coolant accident (LOCA), loss of flow, ejected rod, or other accident requiring termination by a Reactor Trip System (RTS) trip Function.
Certain control banks are pre-selected for rapid insertion by the Rapid Power Reduction (RPR) System during load rejection transients or if the main turbine or a main feedwater pump trip occurs above a pre-selected plant power level. The prescribed sequence and overlap limits are restored upon the first withdrawal demand after actuation of the RPR system.
APPLICABLE       The applicable control bank insertion limits in conjunction with the SAFETY           applicable LCOs in Section 3.2, Power Distribution Limits, are required ANALYSES         to prevent power distributions that could result in fuel cladding failures in the event of a LOCA, loss of flow, ejected rod, or other accident requiring termination by an RTS trip Function. In addition, when the OPDMS is not monitoring parameters, the applicable control bank insertion limits are required to maintain SDM.
The acceptance criteria for addressing control bank insertion limits are that:
AP1000 STS                             B 3.1.6-3                                        Rev. 1

Control Bank Insertion Limits B 3.1.6 BASES APPLICABLE SAFETY ANALYSES (continued)
: a. There be no violations of:
: 1. Specified fuel design limits, or
: 2. Reactor Coolant System pressure boundary integrity; and
: b. The core remains subcritical after accident transients.
As such, the control bank insertion limits affect safety analyses involving core reactivity and power distributions (Ref. 3).
The SDM requirement is ensured by the continuous monitoring of the OPDMS and by limiting the control and shutdown bank insertion limits when the OPDMS is not monitoring parameters. When the OPDMS is not monitoring parameters, the rod insertion limits ensure that there is sufficient negative reactivity insertion capability available from the RCCAs to shut down the reactor to hot zero power with a reactivity margin that assumes the maximum worth RCCA remains fully withdrawn upon reactor trip (Ref. 3).
Operation at the insertion limits or AFD limits may approach the maximum allowable linear heat generation rate or peaking factor, with the allowed QPTR present. Operation at the insertion limit may also indicate the maximum ejected RCCA worth could be equal to the limiting value in fuel cycles that have sufficiently high ejected RCCA worth.
The control bank insertion limits ensure that safety analyses assumptions for SDM (with OPDMS not monitoring parameters), ejected rod worth, and power distribution peaking factors are preserved (Ref. 3).
The insertion limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii) in that they are initial conditions assumed in the safety analyses.
LCO             The control bank sequence, overlap, and physical insertion limits, which are defined in the COLR, must be maintained because they preserve the core power distribution within applicable limits, ensure that the required SDM is maintained (when OPDMS is not monitoring parameters), ensure that ejected rod worth is maintained consistent with safety analysis assumptions, and ensure adequate negative reactivity insertion is available on reactor trip. The overlap between control banks provides more uniform rates of reactivity insertion and withdrawal and is imposed to maintain acceptable power peaking during control bank motion.
AP1000 STS                              B 3.1.6-4                                       Rev. 1

Control Bank Insertion Limits B 3.1.6 BASES LCO (continued)
The LCO is modified by two Notes. The first Note indicates that the LCO requirement is not applicable to control banks being inserted while performing SR 3.1.4.2. This SR verifies the freedom of the RCCAs to move, and may require the control bank to move below the LCO limit, which would normally violate the LCO. This Note applies to each control bank as it is moved below the insertion limit to perform the Surveillance.
This Note is not applicable should a malfunction stop performance of the Surveillance.
The second Note suspends LCO Applicability to GRCA banks during GRCA bank sequence exchange operations for up to 1 hour. If a GRCA bank sequence exchange is initiated with the GRCA banks at different starting positions, the two exchanging banks will move out of sequence and overlap limits for several minutes during the sequence exchange.
This operation, which occurs frequently throughout the fuel cycle, would normally violate the LCO. A period of 1 hour provides sufficient time to complete the exchange while limiting any impact on local power distribution from the GRCA banks being out of sequence and overlap. A prerequisite to performing the GRCA sequence exchange is that a sufficient peaking factor margin be available. This will ensure that core peaking factor limits will not be challenged while performing the exchange. Considering that this operation is a planned maneuver and involves exchanging the position of low worth GRCA banks over a short time period, suspending the GRCA Applicability of this LCO is acceptable.
APPLICABILITY   The control bank sequence, overlap, and physical insertion limits shall be maintained when the reactor is in MODE 1 and in MODE 2 with keff  1.0.
There are two sets of insertion limits applicable to control banks MA, MB, MC, MD, M1 and M2 depending on OPDMS status. With OPDMS not monitoring parameters, these limits must be maintained to preserve the assumed power distribution, ejected rod worth, SDM, and reactivity insertion rate accident analysis assumptions. With OPDMS continuously monitoring power distribution and SDM, insertion limits must be maintained to preserve the accident analysis assumptions. The insertion limits with OPDMS monitoring parameters may be less restrictive than the insertion limits with OPDMS not monitoring parameters. Sequence and overlap limits must be maintained, since they are also necessary to preserve the assumed power distribution in the accident analyses.
Applicability in MODES 3, 4, and 5 is not required, since neither the power distribution nor accident analysis precondition assumptions would be exceeded in these MODES.
AP1000 STS                             B 3.1.6-5                                      Rev. 1

Control Bank Insertion Limits B 3.1.6 BASES ACTIONS    A.1.1, A.1.2, A.2, B.1.1, B.1.2, and B.2 When the control banks are outside the acceptable insertion limits (except during a GRCA sequence exchange), they must be restored to within those limits. This restoration can occur in two ways:
: a. Reducing power to be consistent with rod position; or
: b. Moving rods to be consistent with power.
Also, verification of SDM or initiation of boration to regain SDM is required within 1 hour, since the SDM in MODES 1 and 2 may have been reduced below the applicable limit. A period of 1 hour allows enough time for the operator to ensure the OPDMS is updated with correct control rod position data if necessary or to perform a reactivity balance calculation, considering the effects listed in the Bases for SR 3.1.1.1 if the OPDMS is not monitoring parameters.
Similarly, if the control banks are found to be out of sequence or in the wrong overlap configuration (except during a GRCA sequence exchange), they must be restored to meet the limits.
If Condition A and/or B is entered due to RPR System actuation, it is possible that the selected control banks may be dropped into a configuration that exceeds the allowed control bank insertion limit, and it is likely that the inserted control banks will be out of their normal overlap condition. The Required Actions are acceptable because the immediate power reduction associated with the actuation of the RPR System prevents exceeding fuel design basis limits after the actuation. In addition, the immediate power reduction and subsequent xenon transient results in maintaining the available SDM at or above the SDM that was present just before the RPR System actuation occurred. Required Action A.2 and/or Required Action B.2 will continue to require restoration of the control banks to an acceptable configuration within 2 hours. This is sufficient to preclude reaching an unacceptable power distribution or SDM condition in the longer term after an RPR System actuation.
AP1000 STS                         B 3.1.6-6                                       Rev. 1

Control Bank Insertion Limits B 3.1.6 BASES ACTIONS (continued)
Operation beyond the LCO limits is allowed for a short time period in order to take conservative action because the simultaneous occurrence of either a LOCA, loss of flow accident, ejected rod accident, or other accident during this short time period, together with an inadequate power distribution or reactivity capability, has an acceptably low probability.
The allowed Completion Time of 2 hours for restoring the banks to within the insertion, sequence and overlap limits provides an acceptable time for evaluating and repairing minor problems without allowing the plant to remain outside the limits for an extended period of time.
C.1 If a Required Action of Condition A or B cannot be completed within the associated Completion Time, the plant must be brought to MODE 2 with keff < 1.0, or to a lower MODE, where the LCO is not applicable. The allowed Completion Time of 6 hours is reasonable based on operating experience for reaching the required MODE from full power condition in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.1.6.1 REQUIREMENTS This Surveillance is required to ensure that the reactor does not achieve criticality with the control banks below their insertion limits.
The estimated critical position (ECP) depends upon a number of factors, one of which is xenon concentration. If the ECP was verified long before criticality, xenon concentration could change to make the ECP substantially in error. Conversely, determining the ECP immediately before criticality could be an unnecessary burden. There are a number of unit parameters requiring operator attention at that point. Performing the ECP verification within 4 hours prior to criticality allows the operator some flexibility to schedule the ECP verification with other startup activities.
SR 3.1.6.2 Verification of the control bank insertion limits at a Frequency of 12 hours is sufficient to detect control banks that may be approaching the insertion limits since the insertion limits are monitored and alarms will occur when approaching and/or exceeding the limit.
AP1000 STS                                 B 3.1.6-7                                        Rev. 1

Control Bank Insertion Limits B 3.1.6 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.1.6.3 When control banks are maintained within their insertion limits as checked by SR 3.1.6.2 above, it is unlikely that their sequence and overlap will not be in accordance with the requirements provided in the COLR. The sequence and overlap requirements must be met while in the MODES of Applicability except during rod trippability testing per SR 3.1.4.2, or during a GRCA bank sequence exchange when the LCO does not apply to the affected GRCA banks for up to 1 hour. A Frequency of 12 hours is consistent with the above control bank insertion limit check Frequency of SR 3.1.6.2.
REFERENCES      1. 10 CFR 50, Appendix A, GDC 10, GDC 26, and GDC 28.
: 2. 10 CFR 50.46.
: 3. FSAR Chapter 15, Accident Analyses.
AP1000 STS                            B 3.1.6-8                                       Rev. 1

Rod Position Indication B 3.1.7 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.7 Rod Position Indication BASES BACKGROUND            According to GDC 13 (Ref. 1), instrumentation to monitor variables and systems over their operating ranges during normal operation, anticipated operational occurrences, and accident conditions must be OPERABLE.
LCO 3.1.7 is required to ensure OPERABILITY of the control rod and shutdown rod position indication to determine rod positions and thereby ensure compliance with the rod alignment and insertion limits.
The OPERABILITY, including position indication, of the shutdown and control rod cluster control assemblies (RCCAs) is an initial assumption in the safety analyses that assume rod insertion upon reactor trip.
Maximum rod misalignment is an initial assumption in the RCCA misalignment safety analysis that directly affects core power distributions and assumptions of available SDM. Rod position indication is required to assess OPERABILITY and misalignment.
Mechanical or electrical failures may cause a control rod to become inoperable or to become misaligned from its group. Control rod inoperability or misalignment may cause increased power peaking due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown. Therefore, control rod alignment and OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM.
Limits on control rod and shutdown rod alignment and OPERABILITY have been established, and rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
RCCAs and Gray Rod Cluster Assemblies (GRCAs), or rods, are moved out of the core (up or withdrawn) or into the core (down or inserted) by their control rod drive mechanisms. The rods are divided among control banks and shutdown banks. Each bank may be further subdivided into one or more groups to provide for precise reactivity control.
The axial positions of shutdown rods and control rods are determined by two separate and independent means: the Bank Demand Position Indication (commonly called group step counters) and the Digital Rod Position Indication (DRPI).
AP1000 STS                                   B 3.1.7-1                                      Rev. 1

Rod Position Indication B 3.1.7 BASES BACKGROUND (continued)
Bank Demand Position Indication counts the pulses from the Rod Control System that moves the rods. There is one step counter for each group of rods. Individual rods in a group receive the same signal to move and therefore, should be at the same position indicated by the group step counter for that group. Bank Demand Position Indication is considered highly precise (+/- 1 step or +/- 5/8 inch). If a rod does not move one step for each demand pulse, the step counter will still count the pulse and incorrectly reflect the position of the rod.
DRPI provides a highly accurate indication of actual control rod position, at a lower precision than the step counters. This indication is based on inductive analog signals from detectors consisting of a series of coils spaced along a hollow tube with a center to center distance of 3.75 inches, which is 6 steps. To increase the reliability of the indication, the inductive coils are divided into A and B coil stacks. The adjacent coils in a given detector will alternate between the A and B stacks so that if there is any single coil failure in a DRPI detector (or coil failures limited to one stack) the DRPI will function at half accuracy with an effective coil spacing of 7.5 inches, which is 12 steps. Therefore, the normal indication accuracy of the DRPI is +/- 6 steps (+/- 3.75 inches), and the maximum uncertainty is +/- 12 steps (+/- 7.5 inches). With an indicated deviation of 12 steps between the group step counter and DRPI, the maximum deviation between actual rod position and the demand position could be 24 steps, or 15 inches. Coil stack A data is transmitted to Data Cabinet A, and coil stack B data is transmitted to Data Cabinet B. Any failure of a single data cabinet would result in DRPI detectors functioning at half accuracy.
APPLICABLE       Control and shutdown rod position accuracy is essential during power SAFETY           operation. Power peaking, ejected rod worth, or SDM limits may be ANALYSES         violated in the event of a Design Basis Accident (Ref. 2), with control or shutdown rods operating outside their limits undetected. Therefore, the acceptance criterion for rod position indication is that rod positions must be known with sufficient accuracy in order to verify the core is operating within the group sequence, overlap, design peaking limits, ejected rod worth, and with minimum SDM (LCO 3.1.5, Shutdown Bank Insertion Limits, LCO 3.1.6, Control Bank Insertion Limits, LCO 3.2.5, OPDMS Monitored Parameters). The rod positions must also be known in order to verify the alignment limits are preserved (LCO 3.1.4, Rod Group Alignment Limits). Rod positions are continuously monitored to provide operators with information that assures the plant is operating within the bounds of the accident analysis assumptions.
AP1000 STS                              B 3.1.7-2                                         Rev. 1

Rod Position Indication B 3.1.7 BASES APPLICABLE SAFETY ANALYSES (continued)
Rod position indication satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
Rod position indication monitors RCCA and GRCA position, which is an initial condition of the accident analyses.
LCO              LCO 3.1.7 specifies that one DRPI for each control rod and one Bank Demand Position Indication for each rod group shall be OPERABLE. For the rod position indication to be OPERABLE SR 3.1.7.1 and the following must be met:
: a. The DRPI for each rod is functioning with full or half accuracy, and;
: b. The Bank Demand Indication for each group has been calibrated either in the fully inserted position or to the DRPI.
OPERABILITY of the DRPI is not affected by the coils as long as all A or all B coils in a given detector are functioning, because position indication for the rod would be provided with half accuracy or better. Half accuracy indication would also be provided if a single data cabinet fails, as long as there are no additional failures for the coils associated with the functioning data cabinet.
The 12 step agreement limit between the Bank Demand Position Indication and the DRPI indicates that the Bank Demand Position Indication is adequately calibrated and can be used for indication of the measurement of rod bank position.
A deviation of less than the allowable limit given in LCO 3.1.4 in position indication for a single rod ensures high confidence that the position uncertainty of the corresponding rod group is within the assumed values used in the analysis (that specified rod group insertion limits).
These requirements provide adequate assurance that rod position indication during power operation and PHYSICS TESTS is accurate, and that design assumptions are not challenged. OPERABILITY of the position indication channels ensures that inoperable, misaligned, or mispositioned rods can be detected. Therefore, power peaking, ejected rod worth, and SDM can be controlled within acceptable limits.
AP1000 STS                               B 3.1.7-3                                      Rev. 1

Rod Position Indication B 3.1.7 BASES APPLICABILITY The requirements on the DRPI and step counters are only applicable in MODES 1 and 2 (consistent with LCOs 3.1.4, 3.1.5, and 3.1.6), because these are the only MODES in which power is generated, and the OPERABILITY and alignment of rods have the potential to affect the safety of the plant. In the shutdown MODES, the OPERABILITY of the shutdown and control banks has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the Reactor Coolant System (RCS).
ACTIONS       The ACTIONS table is modified by a Note indicating that a separate Condition entry is allowed for each inoperable DRPI and each demand position indication. This is acceptable because the Required Actions for each Condition provide appropriate compensatory actions for each inoperable position indication.
A.1 When one DRPI per group fails, the position of the rod can still be determined indirectly by use of the incore detectors. The Required Action may also be satisfied by verifying once per 8 hours that applicable N
power distribution limits (e.g., FQ (Z) and F H A
E A ) and SDM (or insertion limits) are within the limits in the COLR, provided the nonindicating rods have not been moved. Steady state equilibrium normal power operation does not require excessive movement of banks. If a bank has been significantly moved (more than 24 steps in one direction), Condition C must be entered and Required Action C.1 or C.2 taken. Therefore, verification of rod position within the Completion Time of 8 hours is adequate to allow continued full power operation, since the probability of simultaneously having a rod significantly out of position and an event sensitive to that rod position is small.
A.2 Reduction of THERMAL POWER to  50% RTP puts the core into a condition where rod position is not significantly affecting core peaking factors (Ref. 2).
The allowed Completion Time of 8 hours is reasonable, based on operating experience, for reducing power to  50% RTP from full power conditions without challenging plant systems and allowing for rod position determination by Required Action A.1 above.
AP1000 STS                           B 3.1.7-4                                           Rev. 1

Rod Position Indication B 3.1.7 BASES ACTIONS (continued)
B.1 and B.2 When more than one DRPI per group is inoperable, additional actions are necessary to ensure that acceptable power distribution limits are maintained, minimum SDM is maintained, and the potential effects of rod misalignment on associated accident analyses are limited. Placing the Rod Control System in manual (both the MSHIM and AO banks) ensures automatic unplanned rod motion will not occur. This action, together with the indirect position determination available via incore detectors will minimize the potential for rod misalignment. The immediate Completion Time for placing the Rod Control System in manual reflects the urgency with which unplanned or automatic rod motion must be prevented while in this Condition. Manual rod motion, RCS boron concentration changes, or changes in reactor load may occur as necessary to respond to changes in RCS average temperature and AFD.
Verification of control rod position once per 8 hours (per Required Action A.1) is adequate for allowing continued full power operation for a limited, 24 hour period, since the probability of simultaneously having a rod significantly out of position and an event sensitive to that rod position is small. The 24 hour Completion Time provides sufficient time to troubleshoot and restore the DRPI to operation while avoiding the plant challenges associated with a unit shutdown without full rod position indication.
If one or more rods has been significantly moved, Condition C must be entered and Required Action C.1 or C.2 taken.
C.1 and C.2 When one or more rods with one DRPI inoperable have been moved in excess of 24 steps in one direction since the position was last determined, Required Action C.1 is to be performed within 4 hours by analysis of the incore detector data to determine the rod position to verify that these rods are still properly positioned relative to their group positions.
If, within 4 hours, the rod positions have not been determined, THERMAL POWER must be reduced to  50% RTP within 8 hours to avoid undesirable power distributions that could result from continued operation at > 50% RTP, if one or more rods are misaligned by more than 24 steps.
The allowed Completion Time of 4 hours provides an acceptable period of time to verify the rod positions.
AP1000 STS                                 B 3.1.7-5                                       Rev. 1

Rod Position Indication B 3.1.7 BASES ACTIONS (continued)
D.1.1 and D.1.2 With one or more demand position indication per bank inoperable in one or more banks, the rod positions can be determined by the DRPI. Since normal power operation does not require excessive movement of rods, verification by administrative means that the rod position indication is OPERABLE and the most withdrawn rod and the least withdrawn rod are 12 steps apart within the allowed Completion Time of once every 8 hours is adequate.
D.2 Reduction of THERMAL POWER to  50% RTP puts the core into a condition where rod position is not significantly affecting core peaking factor limits (Ref. 2). The allowed Completion Time of 8 hours provides an acceptable period of time to verify the rod positions per Required Actions D.1.1 and D.1.2 or reduce power to  50% RTP.
E.1 If a Required Action cannot be completed within an associated Completion Time, the unit must be brought to a MODE in which the action requirement does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours. The allowed Completion Time is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.1.7.1 REQUIREMENTS Verification that the DRPI agrees with the demand position within 12 steps provides assurance that the DRPI is operating correctly.
This Surveillance is performed prior to reactor criticality after each removal of the reactor head, as there is the potential for unnecessary plant transients if the Surveillance were performed with the reactor at power.
The Surveillance is modified by a Note that states it is not required to be met for DRPI associated with a rod that does not meet LCO 3.1.4. If a rod is known not to be within 12 steps of the group demand position, the ACTIONS of LCO 3.1.4 are appropriate.
AP1000 STS                                 B 3.1.7-6                                       Rev. 1

Rod Position Indication B 3.1.7 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 13.
: 2. FSAR Chapter 15, Accident Analyses.
AP1000 STS                  B 3.1.7-7                               Rev. 1

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.8 PHYSICS TESTS Exceptions - MODE 2 BASES BACKGROUND         The primary purpose of the MODE 2 PHYSICS TESTS exceptions is to permit relaxations of existing LCOs to allow certain PHYSICS TESTS to be performed.
Section XI of 10 CFR 50, Appendix B, (Ref. 1) requires that a test program be established to ensure that structures, systems, and components will perform satisfactorily in service. All functions necessary to ensure that the specified design conditions are not exceeded during normal operation and anticipated operational occurrences must be tested. This testing is an integral part of the design, construction, and operation of the plant. Requirements for prior approval by the NRC, for the purpose of conducting tests and experiments not described in the FSAR, are specified in 10 CFR 50.59 (Ref. 2).
The key objectives of a test program are to (Ref. 3):
: a. Ensure that the facility has been adequately designed;
: b. Validate the analytical models used in the design and analysis;
: c. Verify the assumptions used to predict unit response;
: d. Ensure that installation of equipment in the facility has been accomplished in accordance with the design; and
: e. Verify that the operating and emergency procedures are adequate.
To accomplish these objectives, testing is performed prior to initial criticality, during startup, during low power operations, during power ascension, at high power and after each refueling. The PHYSICS TEST requirements for reload fuel cycles ensure that the operating characteristics of the core are consistent with the design predictions and that the core can be operated as designed (Ref. 4).
PHYSICS TEST procedures are written and approved in accordance with established formats. The procedures include information necessary to permit a detailed execution of the testing required, to ensure that the design intent is met. PHYSICS TESTS are performed in accordance with these procedures and test results are approved prior to continued power escalation and long-term power operation.
AP1000 STS                                 B 3.1.8-1                                      Rev. 1

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES BACKGROUND (continued)
The typical PHYSICS TESTS performed for reload fuel cycles (Ref. 4) in MODE 2 are listed below:
: a. Critical Boron Concentration - Control Rods Withdrawn;
: b. Control Rod Worth; and
: c. Isothermal Temperature Coefficient (ITC).
These tests are performed in MODE 2. These and other supplementary tests may be required to calibrate the nuclear instrumentation or to diagnose operational problems. These tests may cause the operating controls and process variables to deviate from their LCO requirements during their performance.
: a. The Critical Boron Concentration - Control Rods Withdrawn Test measures the critical boron concentration at hot zero power (HZP).
With rods out, the lead control bank is at or near its fully withdrawn position. HZP is where the core is critical (keff = 1.0), and the Reactor Coolant System (RCS) is at design temperature and pressure for zero power. Performance of this test should not violate any of the referenced LCOs.
: b. The Control Rod Worth Test is used to measure the reactivity worth of selected control banks. This test is performed at HZP and has four alternative methods of performance. The first method, the Boron Exchange Method, varies the reactor coolant boron concentration and moves the selected control bank in response to the changing boron concentration. The reactivity changes are measured with a reactivity computer. This sequence is repeated for the remaining control banks. The second method, the Rod Swap Method, measures the worth of a predetermined reference bank using the Boron Exchange Method above. The reference bank is then nearly fully inserted into the core. The selected bank is then inserted into the core as the reference bank is withdrawn. The HZP critical conditions are then determined with the selected bank fully inserted into the core. The worth of the selected bank is calculated based on the position of the reference bank with respect to the selected bank. This sequence is repeated as necessary for the remaining control banks. The third method, the Boron Endpoint Method, moves the selected control bank over its entire length of travel and while varying the reactor coolant boron concentration to maintain HZP criticality again. The difference in boron concentration AP1000 STS                              B 3.1.8-2                                       Rev. 1

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES BACKGROUND (continued) is the worth of the selected control bank. This sequence is repeated for the remaining control banks. The fourth method, Dynamic Rod Worth Measurement, moves each bank, individually, into the core to determine its worth. The bank is dynamically inserted into the core while data is acquired from the excore channel. While the bank is being withdrawn, the data is analyzed to determine the worth of the bank. This is repeated for each control and shutdown bank.
Performance of this test will violate LCO 3.1.4, Rod Group Alignment Limits, LCO 3.1.5, Shutdown Bank Insertion Limits, or LCO 3.1.6, Control Bank Insertion Limits.
: c. The ITC Test measures the ITC of the reactor. This test is performed at HZP. The method is to vary the RCS temperature in a slow and continuous manner. The reactivity change is measured with a reactivity computer as a function of the temperature change.
The ITC is the slope of the reactivity versus the temperature plot.
The final measured ITC may be the average of more than one measurement. Performance of this test could violate LCO 3.4.2, RCS Minimum Temperature for Criticality.
APPLICABLE       The fuel is protected by LCOs that preserve the initial conditions of the SAFETY           core assumed during the safety analyses. The methods for development ANALYSES         of the LCOs that are excepted by this LCO are described in the Westinghouse Reload Safety Evaluation Methodology report (Ref. 5).
The above mentioned PHYSICS TESTS, and other tests that may be required to calibrate nuclear instrumentation or to diagnose operational problems, may require the operating control or process variables to deviate from their LCO limitations.
FSAR Chapter 14 defines requirements for initial testing of the facility, including low power PHYSICS TESTS. Sections 14.2.10.2 and 14.2.10.3 (Ref. 6) summarize the initial criticality and low power tests.
Requirements for reload fuel cycle PHYSICS TESTS are defined in ANSI/ANS-19.6.1-2005 (Ref. 4). Although these PHYSICS TESTS are generally accomplished within the limits for the LCOs, conditions may occur when one or more LCOs must be suspended to make completion of PHYSICS TESTS possible or practical. This is acceptable as long as the fuel design criteria are not violated. When one or more of the requirements specified in:
AP1000 STS                              B 3.1.8-3                                     Rev. 1

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES APPLICABLE SAFETY ANALYSES (continued)
LCO 3.1.3      Moderator Temperature Coefficient (MTC),
LCO 3.1.4      Rod Group Alignment Limits, LCO 3.1.5      Shutdown Bank Insertion Limits, LCO 3.1.6      Control Bank Insertion Limits, and LCO 3.4.2      RCS Minimum Temperature for Criticality, are suspended for PHYSICS TESTS, the fuel design criteria are preserved as long as the power level is limited to  5% RTP, the reactor coolant temperature is kept  541&deg;F, and SDM is within the limits provided in the COLR.
PHYSICS TESTS include measurement of core nuclear parameters or the exercise of control components that affect process variables. Also involved are the movable control components (control and shutdown rods), which are required to shut down the reactor. The limits for these variables are specified for each fuel cycle in the COLR.
As described in LCO 3.0.7, compliance with Test Exception LCOs is optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test Exception LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. The LCO selection criteria satisfied by the other LCOs are discussed in their respective Bases.
LCO              This LCO allows the reactor parameters of moderator temperature coefficient and minimum temperature for criticality to be outside their specified limits. In addition, it allows selected control and shutdown rods to be positioned outside of their specified alignment and insertion limits.
Operation beyond specified limits is permitted for the purpose of performing PHYSICS TESTS and poses no threat to fuel integrity, provided the SRs are met.
The requirements of LCO 3.1.3, LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and LCO 3.4.2 may be suspended and the number of required channels for LCO 3.3.1, Reactor trip System (RTS) Instrumentation, Functions 1, 2, 3 and 4 may be reduced to 3 required channels during the performance of PHYSICS TESTS provided:
: a. RCS lowest loop average temperature is  541&deg;F,
: b. SDM is within the limits provided in the COLR, and
: c. THERMAL POWER is  5% RTP.
AP1000 STS                               B 3.1.8-4                                     Rev. 1

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES APPLICABILITY This LCO is applicable when performing low power PHYSICS TESTS.
The Applicability is stated as During PHYSICS TESTS initiated in MODE 2 to ensure that the 5% RTP maximum power level is not exceeded. Should the THERMAL POWER exceed 5% RTP, and consequently the unit enter MODE 1, this Applicability statement prevents exiting this Specification and its Required Actions.
ACTIONS       A.1 and A.2 If the SDM requirement is not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. The operator should begin boration with the best source available for the plant conditions. Boration will be continued until SDM is within limits.
Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification.
B.1 When THERMAL POWER is > 5% RTP, the only acceptable action is to open the reactor trip breakers (RTBs) to prevent operation of the reactor beyond its design limits. Immediately opening the RTBs will shut down the reactor and prevent operation of the reactor outside of its design limits.
C.1 When the RCS lowest Tavg is < 541&deg;F, the appropriate action is to restore Tavg to within its specified limit. The allowed Completion Time of 15 minutes provides time for restoring Tavg to within limits without allowing the plant to remain in an unacceptable condition for an extended period of time. Operation with the reactor critical and with temperature below 541&deg;F could violate the assumptions for accidents analyzed in the safety analyses.
D.1 If the Required Action of Condition C cannot be completed within the associated Completion Time, the plant must be placed in a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to MODE 3 within an additional 15 minutes. The Completion Time of 15 additional minutes is reasonable, based on AP1000 STS                           B 3.1.8-5                                       Rev. 1

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES ACTIONS (continued) operating experience, to reach MODE 3 from MODE 2 HZP conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.1.8.1 REQUIREMENTS Verification that the RCS lowest loop Tavg is  541&deg;F will ensure that the unit is not operating in a condition that could invalidate the safety analyses. Verification of the RCS temperature at a Frequency of 30 minutes during the performance of the PHYSICS TESTS will provide assurance that the initial conditions of the safety analyses are not violated.
SR 3.1.8.2 Verification that the THERMAL POWER is  5% RTP will ensure that the plant is not operating in a condition that could invalidate the safety analyses. Verification of the THERMAL POWER at a Frequency of 30 minutes during the performance of the PHYSICS TESTS will ensure that the initial conditions of the safety analyses are not violated.
SR 3.1.8.3 The SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects:
: a. RCS boron concentration;
: b. Control bank position;
: c. RCS average temperature;
: d. Fuel burnup based on gross thermal energy generation;
: e. Xenon concentration;
: f. Samarium concentration; and
: g. Isothermal temperature coefficient (ITC).
Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS.
AP1000 STS                                  B 3.1.8-6                                      Rev. 1

PHYSICS TESTS Exceptions - MODE 2 B 3.1.8 BASES SURVEILLANCE REQUIREMENTS (continued)
SDM may also be verified using the Online Power Distribution Monitoring System (OPDMS) in place of a reactivity balance calculation. The OPDMS continuously monitors the available SDM during PHYSICS TESTS and considers all of the above effects.
The Frequency of 24 hours is based on the generally slow change in required boron concentration and on the low probability of an accident occurring without the required SDM.
REFERENCES      1. 10 CFR 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants.
: 2. 10 CFR 50.59, Changes, Tests and Experiments.
: 3. Regulatory Guide 1.68, Revision 2, Initial Test Programs for Water-Cooled Nuclear Power Plants, August 1978.
: 4. ANSI/ANS-19.6.1-2005, Reload Startup Physics Tests for Pressurized Water Reactors, American National Standards Institute, November 29, 2005.
: 5. WCAP-9273-NP-A, Westinghouse Reload Safety Evaluation Methodology, July 1985.
: 6. FSAR Chapter 14, Initial Testing Program.
AP1000 STS                           B 3.1.8-7                                      Rev. 1

CVS DWI and MLI Valves B 3.1.9 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.9 Chemical and Volume Control System (CVS) Demineralized Water Isolation (DWI)
Valves and Makeup Line Isolation (MLI) Valves BASES BACKGROUND           One of the principal functions of the CVS is to maintain the reactor coolant chemistry conditions by controlling the concentration of boron in the coolant for plant startups, normal dilution to compensate for fuel depletion, and shutdown boration. In the dilute mode of operation, unborated demineralized water may be supplied directly to the Reactor Coolant System (RCS). Another of the principal functions of the CVS is to maintain the reactor coolant inventory by providing water makeup for RCS LEAKAGE, shrinkage of the reactor coolant during cooldowns, and RCS boron concentration changes. In the automatic makeup mode of operation, the pressurizer water level starts and stops CVS makeup to the RCS.
Although the CVS is not considered a safety related system, certain functions of the system are considered safety related. The appropriate components have been classified and designed as safety related. The safety related functions provided by the CVS include containment isolation of CVS lines penetrating containment, termination of inadvertent boron dilution, and preservation of the RCS pressure boundary, including isolation of CVS letdown from the RCS. Another safety related function provided by the CVS is the termination of RCS makeup to prevent overfilling of the pressurizer during non-loss-of-coolant accident (non-LOCA) transients or to prevent steam generator overfilling during a steam generator tube rupture (SGTR) accident. The CVS MLI valves provide this RCS makeup isolation function.
APPLICABLE           One of the initial assumptions in the analysis of an inadvertent boron SAFETY               dilution event (Ref. 1) is that the source range instrumentation can detect ANALYSES             the increase in core reactivity created by the dilution event. The source range instrumentation will then supply a signal to the CVS DWI valves and the CVS MLI valves causing these valves to close and terminate the boron dilution event. Thus, the MLI valves and the DWI valves are components that function to mitigate or prevent an anticipated operational occurrence.
AP1000 STS                                  B 3.1.9-1                                     Rev. 1

CVS DWI and MLI Valves B 3.1.9 BASES APPLICABLE SAFETY ANALYSES (continued)
One of the initial assumptions in the analysis of several non-LOCA events and during an SGTR accident is that excessive CVS makeup to the RCS may aggravate the consequences of the accident. The need to isolate the CVS makeup to the RCS is detected by the pressurizer level instruments or the steam generator narrow range level instruments.
These instruments will supply a signal to the CVS MLI valves causing these valves to close and terminate RCS makeup. Thus the CVS makeup isolation valves are components that function to mitigate an accident.
CVS DWI and MLI valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              The requirement that at least two CVS DWI valves (CVS-PL-V136A and V136B) and two CVS MLI valves (CVS-PL-V090 and V091) be OPERABLE ensures that there will be redundant means available to terminate or prevent an inadvertent boron dilution event. The requirement that at least two CVS MLI valves (CVS-PL-V090 and V091) be OPERABLE also ensures that there will be redundant means available to terminate CVS makeup to the RCS during a non-LOCA event or an SGTR accident should that become necessary to provide protection from overfilling the pressurizer or steam generator. In addition, LCO 3.6.3, Containment Isolation Valves, provides additional requirements for the CVS MLI valves.
APPLICABILITY    The requirement that at least two CVS DWI valves and two CVS MLI valves be OPERABLE is applicable in MODES 1, 2, 3, 4, and 5 because a boron dilution event is considered possible in these MODES, and the automatic closure of these valves is assumed in the safety analysis. In MODES 1 and 2, the detection and mitigation of a boron dilution event does not assume the detection of the event by the source range instrumentation. In these MODES, the event would be signaled by an intermediate range trip, a trip on the Power Range Neutron Flux - High (low setpoint nominally at 25% RTP), or Overtemperature T. The two DWI valves close automatically upon reactor trip. In MODE 6, a dilution event is precluded by the requirement in LCO 3.9.2, Unborated Water Source Flow Paths, to close, lock and secure at least one valve in each unborated water source flow path.
AP1000 STS                             B 3.1.9-2                                      Rev. 1

CVS DWI and MLI Valves B 3.1.9 BASES APPLICABILITY (continued)
The pressurizer overfill event is possible in MODES 1, 2, and 3, and in MODE 4 with all four cold leg temperatures > 275&deg;F. The SGTR event is possible in MODES 1, 2, and 3, and in MODE 4 at an RCS temperature 350&deg;F. In MODE 4 with an RCS temperature < 350&deg;F and in MODES 5 and 6, the RCS pressure and temperature are reduced and an SGTR is not credible. In these applicable MODES, the need to isolate the CVS makeup to the RCS is detected by the pressurizer level instruments (High setpoint coincident with safeguards actuation or High 2 setpoint) or the steam generator narrow range level instruments (High setpoint coincident with reactor trip (P-4) or High 3 setpoint).
ACTIONS            The ACTIONS are modified by a Note allowing the affected flow path(s) to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the main control room. In this way, the flow path(s) can be rapidly isolated when a need for isolation is indicated.
A.1 If only one DWI valve and/or only one MLI valve is/are OPERABLE, the redundant valve must be restored to OPERABLE status in 72 hours. The allowed Completion Time ensures expeditious action will be taken, and is acceptable because the safety function of automatically isolating the demineralized water source and/or RCS makeup can be accomplished by the redundant isolation valve(s).
B.1 If the Required Actions and associated Completion Time of Condition A are not met, or if both CVS DWI valves or both CVS MLI valves are not OPERABLE (i.e., not able to be closed automatically), then affected flow path(s) from the demineralized water supply flow path to the RCS must be isolated. Isolation can be accomplished by manually closing the CVS DWI valve(s) or by positioning the 3-way blend valve to only take suction from the boric acid tank. Alternatively, the dilution path may be isolated by closing appropriate isolation valve(s) in the flow path(s) from the demineralized water storage tank to the RCS.
AP1000 STS                                 B 3.1.9-3                                      Rev. 1

CVS DWI and MLI Valves B 3.1.9 BASES SURVEILLANCE SR 3.1.9.1 REQUIREMENTS Verification that the CVS DWI valves and MLI valves stroke closed demonstrates that the valves can perform their safety related function.
The Frequency is in accordance with the Inservice Testing Program.
SR 3.1.9.2 Verification that the closure time of each RCS makeup isolation valve is less than that assumed in the safety analysis (i.e.,  30 seconds) is performed by measuring the time required for each valve to close on an actual or simulated actuation signal. The actual or simulated actuation signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves. The Frequency is in accordance with the Inservice Testing Program.
SR 3.1.9.3 This SR verifies that each CVS DWI valve actuates to the correct position on an actual or simulated actuation signal. The actual or simulated actuation signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valve. The Frequency of 24 months is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operation.
REFERENCES   1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                          B 3.1.9-4                                     Rev. 1

Rod Withdrawal Test Exception - MODE 5 B 3.1.10 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.10 Rod Withdrawal Test Exception - MODE 5 BASES BACKGROUND         In MODE 5, exceptions to LCO 3.4.4, RCS Loops, are required to allow performance of tests that require rod withdrawal and movement. The typical tests that require rod withdrawal in MODE 5 are:
: a. Cold Rod Drop Time Testing. Successful performance of cold rod drop time testing in MODE 5 following reactor vessel (RV) assembly provides an early opportunity to discover any significant anomalies in rod drop performance that might indicate that the rod drop time test of SR 3.1.4.3 in LCO 3.1.4, Rod Group Alignment Limits, would not be met when performed.
: b. Digital Rod Position Indication (DRPI) System and Bank Demand Position Indication System Surveillance Testing. SR 3.1.7.1 specifies verification that each DRPI agrees within 12 steps of the group demand position for the full indicated range of rod travel, prior to criticality after each removal of the reactor head. These indication systems are needed to support Cold Rod Drop time testing.
: c. Rod Control System Testing. Successful testing of the Rod Control System in MODE 5 is necessary to support the performance of Cold Rod Drop time testing following RV assembly.
: d. Control Rod Drive Mechanism (CRDM) Testing. Successful testing of the CRDMs in MODE 5 is necessary to support the performance of Cold Rod Drop time testing following RV assembly.
The MODE 5 Rod Withdrawal Test Exception permits relaxation of LCO 3.4.4 to allow performance of tests that require rod withdrawal and movement. Compensating requirements are applied to provide adequate assurance of subcriticality during the testing.
Preliminary rod drop time testing, DRPI System and Bank Demand Position Indication System Surveillance testing, Rod Control System testing, and CRDM testing may be performed in MODE 5 prior to plant heatup following refueling.
AP1000 STS                                  B 3.1.10-1                                      Rev. 1

Rod Withdrawal Test Exception - MODE 5 B 3.1.10 BASES APPLICABLE    The tests described above require operating the plant with less than the SAFETY        Reactor Coolant System (RCS) flow required by LCO 3.4.4. However, this ANALYSES      exception is acceptable under the subcritical boron concentration limitations imposed by the LCO. Protection from potential reactivity events during shutdown conditions is provided by adequate boration to ensure the reactor core remains subcritical at all times. As such, prevention of criticality is the acceptance criterion for exercising this test exception. The required boration will ensure that the core remains subcritical at all times during any planned rod withdrawals or any inadvertent rod withdrawal errors. As such, there is no challenge to departure from nucleate boiling or other fuel acceptance criteria.
As described in LCO 3.0.7, compliance with Test Exception LCOs is optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test exception LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. The LCO selection criteria satisfied by the other LCOs are discussed in their respective Bases.
LCO           This LCO allows a MODE 5 exception to the LCO 3.4.4 requirement that 100% RCS flow is required whenever the Plant Control System (PLS) is capable of rod withdrawal or one or more rods are not fully inserted.
Control rods are capable of withdrawal when one or more CRDMs are energized such that an automatic or manual signal could power the coils to withdraw the rod(s). An exception to this RCS flow requirement is needed to permit tests involving rod withdrawal.
Subcritical boron concentrations must be met during the use of this test exception LCO, assuming that all shutdown, control, and gray rods are fully withdrawn. The boration limitation specified precludes reactor criticality.
APPLICABILITY This LCO is applicable in MODE 5 with LCO 3.4.4, RCS Loops, not met.
This allows testing that requires rod withdrawal. During testing, rod withdrawal is enabled with the Reactor Trip Breakers closed and the PLS capable of rod withdrawal. Control rods are capable of withdrawal when one or more CRDMs are energized such that an automatic or manual signal could power the coils to withdraw the rod(s).
Rod withdrawal under this LCO may only be enabled in MODE 5 to perform testing.
AP1000 STS                            B 3.1.10-2                                       Rev. 1

Rod Withdrawal Test Exception - MODE 5 B 3.1.10 BASES ACTIONS      A.1 and A.2 If the LCO is not met, the reactor must be brought to a MODE in which the LCO does not apply. To achieve this status, action is initiated immediately to fully insert all rods and, within 1 hour, the PLS is placed in a condition incapable of rod withdrawal. This precludes unanalyzed rod withdrawal events. The Completion Times for Required Actions A.1 and A.2 are reasonable, based on operating experience, to reach the specified condition in an orderly manner and without challenging plant systems.
SURVEILLANCE SR 3.1.10.1 REQUIREMENTS This SR requires verification that boron concentration of the RCS is greater than the all-rods-out boron concentration providing a keff < 0.99.
Assuming all rods are fully withdrawn ensures that the reactor will remain subcritical for all planned tests.
The Frequency of 12 hours is based on the generally slow change in required boron concentration and the low probability of an accident occurring without the required boron concentration. This allows time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the calculation.
REFERENCES   None AP1000 STS                          B 3.1.10-3                                      Rev. 1

FQ(Z) (CAOC W(Z) Methodology)
B 3.2.1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 Heat Flux Hot Channel Factor (F Q (Z)) (Constant Axial Offset Control (CAOC) W(Z)
A E
A Methodology)
BASES BACKGROUND            The purpose of the limits on the values of F Q (Z) is to limit the local (i.e.,
A E
A pellet) peak power density. The value of F Q (Z) varies along the axial A
E A
height (Z) of the core.
F Q (Z) is defined as the maximum local fuel rod linear power density A
E A
divided by the average fuel rod linear power density, assuming nominal fuel pellet and fuel rod dimensions. Therefore, FQ(Z) is a measure of the peak fuel pellet power within the reactor core.
During power operation with the On-Line Power Distribution Monitoring System (OPDMS) not monitoring parameters, the global power distribution is limited by LCO 3.2.3, AXIAL FLUX DIFFERENCE (AFD),
and LCO 3.2.4, QUADRANT POWER TILT RATIO (QPTR), which are directly and continuously measured process variables. These LCOs, along with LCO 3.1.6, Control Bank Insertion Limits, maintain the core limits on power distributions on a continuous basis.
F Q (Z) varies with fuel loading patterns, control bank insertion, fuel A
E A
burnup, and changes in axial power distribution.
With the OPDMS monitoring parameters, peak linear heat rate (which is proportional to FQ(Z)) is measured continuously. With the OPDMS not monitoring parameters, FQ(Z) is measured periodically using the incore detector system. These measurements are generally taken with the core at or near steady state conditions.
With the measured three dimensional power distributions, it is possible to derive a measured value for FQ(Z) with the OPDMS not monitoring parameters. However, because this value represents a steady state condition, it does not include the variations in the value of FQ(Z) that are present during a nonequilibrium situation such as load following.
To account for these possible variations, the steady state value of FQ(Z) is adjusted by an elevation dependent factor to account for the calculated worst case transient conditions.
AP1000 STS                                       B 3.2.1-1                                     Rev. 1

FQ(Z) (CAOC W(Z) Methodology)
B 3.2.1 BASES BACKGROUND (continued)
Core monitoring and control under non-equilibrium conditions and the OPDMS not monitoring parameters are accomplished by operating the core within the limits of the appropriate LCOs, including the limits on AFD, QPTR, and control rod insertion.
APPLICABLE       This LCO precludes core power distributions that violate the following SAFETY           fuel design criteria:
ANALYSES
: a. During a large break loss of coolant accident (LOCA), the peak cladding temperature must not exceed a limit of 2200&deg;F (Ref. 1);
: b. During a loss of forced reactor coolant flow accident, there must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a departure from nucleate boiling (DNB) condition;
: c. During an ejected rod accident, the energy deposition to the fuel must not exceed applicable limits (Ref. 2); and
: d. The control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn (Ref. 3).
Limits on FQ(Z) ensure that the value of the initial total peaking factor assumed in the accident analyses remains valid. Other criteria must also be met (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long term cooling). However, the peak cladding temperature is typically most limiting.
FQ(Z) limits assumed in the LOCA analysis are typically limiting (i.e.,
lower than) relative to the FQ(Z) assumed in safety analyses for other postulated accidents. Therefore, this LCO provides conservative limits for other postulated accidents.
FQ(Z) satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                               B 3.2.1-2                                      Rev. 1

FQ(Z) (CAOC W(Z) Methodology)
B 3.2.1 BASES LCO        The Heat Flux Hot Channel Factor, FQ(Z), shall be limited by the following relationships:
F Q (Z)  CFQ / P A
E A                                                     for P > 0.5 F Q (Z)  CFQ / 0.5 A
E A                                                     for P  0.5 where: CFQ is the F Q (Z) limit at RTP provided in the COLR, A
E A
P = THERMAL POWER / RTP The actual values of CFQ are given in the COLR; however, CFQ is normally a number on the order of 2.60. The normalized F Q (Z) as a                                         A E
A function of core height is independent.
For Constant Axial Offset Control (CAOC) operation, F Q (Z) is                                        A E
A approximated by F CQ (Z) and F W            A E
A                      A E
A               A C
E A           A W
Q (Z). Thus, both F Q (Z) and F Q (Z) must   E A
meet the preceding limits on FQ(Z).
An F CQ (Z) evaluation requires obtaining an incore power distribution A
E A
measurement in MODE 1. From the incore power distribution measurement results the measured value of FQ(Z), called F MQ (Z), is                                            A E
A obtained. Then, F CQ (Z) = F MQ (Z)
* F MU A
E A             A E
A                    A Q (Z)
E A
where F MU                A Q (Z) is a factor that accounts for fuel manufacturing tolerances E
A and flux map measurement uncertainty. F MU                                            A Q (Z) is provided in the COLR.
E A
F CQ (Z) is an excellent approximation for FQ(Z) when the reactor is at the A
E A
steady state power at which the incore flux map was taken.
The expression for F W                              A Q (Z) is:
E A
FW   A         A           A C
Q (Z) = F Q (Z)
* W(Z)
E                 E A
where W(Z) is a cycle-dependent function that accounts for power distribution transients encountered during normal operation. W(Z) is included in the COLR. The F CQ (Z) is calculated at equilibrium conditions.
A E
A The FQ(Z) limits define limiting values for core power peaking that precludes peak cladding temperatures above 2200&deg;F during either a large or small break LOCA.
AP1000 STS                                                     B 3.2.1-3                                                             Rev. 1

FQ(Z) (CAOC W(Z) Methodology)
B 3.2.1 BASES LCO (continued)
This LCO requires operation within the bounds assumed in the safety analyses. Calculations are performed in the core design process to confirm that the core can be controlled in such a manner during operation that it can stay within the LOCA FQ(Z) limits. If either F CQ (Z) or FW A
E A     A Q (Z)
E A
cannot be maintained within the LCO limits, reduction of core THERMAL POWER is required.
Violating the LCO limits for FQ(Z) may result in greater consequences than previously evaluated if a design basis event occurs coincident with the limit violation.
APPLICABILITY   When the OPDMS is not monitoring parameters and core power distribution parameters cannot be continuously monitored, it is necessary to determine FQ(Z) on a periodic basis. Furthermore, the FQ(Z) limits must be maintained in MODE 1 with THERMAL POWER  25% RTP to prevent core power distributions from exceeding the limits assumed in the safety analyses. Applicability in MODE 1 with THERMAL POWER
                < 25% RTP is not required because local power peaking at very low power levels is not limiting with respect to design basis accident analyses and because the incore instrumentation system may not be able to provide an accurate measurement of the core flux distribution at very low THERMAL POWER levels. Applicability in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require a limit on the distribution of core power.
ACTIONS         A.1 Reducing THERMAL POWER by  1% of RTP for each 1% by which F CQ (Z) exceeds its limit, maintains an acceptable absolute power density.
A E
A F CQ (Z) is F MQ (Z) multiplied by a factor accounting for fuel manufacturing A
E A      A E
A tolerances and flux map measurement uncertainties. F MQ (Z) is theA E
A measured value of FQ(Z). The Completion Time of 15 minutes provides an acceptable time to reduce power in an orderly manner without allowing the plant to remain in an unacceptable condition for an extended period of time. The maximum allowable power level initially determined by Required Action A.1 may be affected by subsequent determinations of F CQ (Z) and would require power reductions within 15 minutes of the F CQ (Z)
A E
A                                                                              A E
A determination, if necessary to comply with the decreased maximum allowable power level. Decreases in F CQ (Z) would allow increasing the A
E A
AP1000 STS                                 B 3.2.1-4                                               Rev. 1

FQ(Z) (CAOC W(Z) Methodology)
B 3.2.1 BASES ACTIONS (continued) maximum allowable power level and increasing power up to this revised limit.
A.2 Reduction in the Overpower T trip setpoints (value of K4) by  1% for each 1% by which F CQ (Z) exceeds its limit is a conservative action for A
E A
protection against the consequences of severe transients with unanalyzed power distributions. The Completion Time of 72 hours is sufficient, considering the small likelihood of a severe transient in this time period and the prompt reduction in THERMAL POWER in accordance with Required Action A.1. The maximum allowable Overpower T trip setpoints initially determined by Required Action A.2 may be affected by subsequent determinations of F CQ (Z) and would A                                                                  A E
require Overpower T trip setpoint reductions within 72 hours of the F CQ (Z)          A E determination, if necessary to comply with the decreased maximum A
allowable Overpower T trip setpoints. Decreases in F CQ (Z) would allow A
E A
increasing the maximum allowable Overpower T trip setpoints.
A.3 Verification that F CQ (Z) has been restored to within its limit by performing A
E A
SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above the limit imposed by Required Action A.1, assures that core conditions during operation at higher power levels and future operation are consistent with safety analyses assumptions.
Condition A is modified by a Note that requires Required Action A.3 to be performed whenever the Condition is entered. This ensures that SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing THERMAL POWER above the limit of Required Action A.1, even when Condition A is exited prior to performing Required Action A.3.
Performance of SR 3.2.1.1 and SR 3.2.1.2 is necessary to ensure FQ(Z) is properly evaluated prior to increasing THERMAL POWER.
B.1 If it is found that the maximum calculated value of FQ(Z) which can occur during normal maneuvers, F W             A Q (Z), exceeds its specified limits, there exists E
A a potential for F CQ (Z) to become excessively high if a normal operational A
E A
transient occurs. Reducing the THERMAL POWER by  1% for each 1%
by which F W A Q (Z) exceeds its limit within the allowed Completion Time of E
A AP1000 STS                                          B 3.2.1-5                                          Rev. 1

FQ(Z) (CAOC W(Z) Methodology)
B 3.2.1 BASES ACTIONS (continued) 4 hours maintains an acceptable absolute power density such that even if a transient occurred, core peaking factors would not be exceeded.
B.2 Reduction in the Overpower T trip setpoints value of K4 by  1% for each 1% by which the maximum allowable power is reduced, is a conservative action for protection against the consequences of severe transients with unanalyzed power distributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period, and the preceding prompt reduction in THERMAL POWER in accordance with Required Action B.1.
B.3 Verification that F W A
Q (Z) has been restored to within its limit, by performing E
A SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above the maximum allowable power limit imposed by Required Action B.1 ensures that core conditions during operation at higher power levels and future operation are consistent with safety analyses assumptions.
Condition B is modified by a Note that requires Required Action B.3 to be performed whenever the Condition is entered. This ensures that SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing THERMAL POWER above the limit of Required Action B.1, even when Condition A is exited prior to performing Required Action B.3.
Performance of SR 3.2.1.1 and SR 3.2.1.2 is necessary to ensure FQ(Z) is properly evaluated prior to increasing THERMAL POWER.
C.1 If Required Actions A.1 through A.3 or B.1 through B.3 are not met within their associated Completion Times, the plant must be placed in a MODE or condition in which the LCO requirements are not applicable. This is done by reducing THERMAL POWER to < 25% RTP within 6 hours.
This allowed Completion Time is reasonable based on operating experience regarding the amount of time it takes to reach < 25% RTP from full power operation in an orderly manner without challenging plant systems.
SURVEILLANCE       SR 3.2.1.1 and SR 3.2.1.2 are modified by a Note, which applies to the REQUIREMENTS       situation where the OPDMS is not monitoring parameters at the AP1000 STS                                   B 3.2.1-6                                       Rev. 1

FQ(Z) (CAOC W(Z) Methodology)
B 3.2.1 BASES SURVEILLANCE REQUIREMENTS (continued) beginning of cycle startup, i.e., the Note applies during the first power ascension after a refueling. It states that performance of these SRs is not required if OPDMS was monitoring parameters upon exceeding 75% RTP. Because F CQ (Z) and F W                   A E
A                 A Q (Z) could not have previously been E
A measured in this reload core, the SR 3.2.1.1 and SR 3.2.1.2 Frequency is applicable only for reload cores and requires determination of these parameters before exceeding 75% RTP. This ensures that some determinations of F CQ (Z) and F W  A E
A                        A Q (Z) are made at a lower power level at E
A which adequate margin is available before going to 100% RTP. Also, the SR 3.2.1.1 and SR 3.2.1.2 Frequency together with the SR 3.2.1.3 and SR 3.2.1.4 first Frequency requiring verification of F CQ (Z) and F W                                A E
A       A Q (Z)
E A
following a power increase of more than 10%, ensure that F CQ (Z) and                                      A E
A FWA Q (Z) are verified as soon as RTP (or any other level for extended E
A operation) is achieved. In the absence of these Frequency conditions, it is possible to increase power to RTP and operate for 31 days without verification of F CQ (Z) and F W A
E A                                    A Q (Z). The SR 3.2.1.3 and SR 3.2.1.4 first E
A Frequency is not intended to require verification of these parameters after every 10% increase in power level above the last verification. They require verification only after an equilibrium power level is achieved for extended operation that is 10% higher than that power at which FQ(Z) was last measured.
The SR 3.2.1.3 Note and SR 3.2.1.4 Note 1 apply to the situation where the OPDMS is no longer monitoring parameters while the plant is in MODE 1. Without the continuous monitoring capability of the OPDMS, FQ limits must be monitored on a periodic basis. The first measurement must be made within 24 hours of the OPDMS being declared not monitoring parameters. This is expected to be performed using the most recent contingency surveillance report created automatically during OPDMS monitoring. Subsequent Surveillances are required consistent with the Frequency of 31 effective full power days (EFPD).
SR 3.2.1.1 and SR 3.2.1.3 Verification that F CQ (Z) is within its specified limits involves increasing the A
E A
measured values of F CQ (Z) to allow for manufacturing tolerance and A
E A
measurement uncertainties in order to obtain F CQ (Z). Specifically, F MQ (Z) is               A E
A                    A E
A the measured value of FQ(Z) obtained from incore flux map results and F CQ (Z) = F MQ (Z)
* F MU A
E A     A E
A           A E
A                     A C
Q (Z). F Q (Z) is then compared to its specified limits.
E A
The limit to which F CQ (Z) is compared varies inversely with power above A
E A
50% RTP.
AP1000 STS                                                        B 3.2.1-7                                                               Rev. 1

FQ(Z) (CAOC W(Z) Methodology)
B 3.2.1 BASES SURVEILLANCE REQUIREMENTS (continued)
Performing the Surveillance in MODE 1 prior to exceeding 75% RTP assures that the F CQ (Z) limit is met when RTP is achieved because A
E A
Peaking Factors generally decrease as power level is increased.
If THERMAL POWER has been increased by  10% RTP since the last determination of F CQ (Z), another evaluation of this factor is required A
E A
12 hours after achieving equilibrium conditions at this higher power level (to assure that F CQ (Z) values are being reduced sufficiently with power A
E A
increase to stay within the LCO limits).
The Frequency of 31 EFPD is adequate to monitor the change of power distribution with core burnup because such changes are slow and well controlled when the plant is operated in accordance with Technical Specifications.
SR 3.2.1.2 and SR 3.2.1.4 The nuclear design process includes calculations performed to determine that the core can be operated within the FQ(Z) limits. Because flux maps are taken in steady state conditions, the variations in power distribution resulting from normal operational maneuvers are not present in the flux map data. These variations are, however, conservatively calculated by considering a wide range of unit maneuvers in normal operation. The maximum peaking factor increase over steady state values, calculated as a function of core elevation, Z, is called W(Z). Multiplying the measured total peaking factor, F CQ (Z), by W(Z) gives the maximum FQ(Z) calculated A
E A
to occur in normal operation, F W                  A Q (Z).
E A
The limit to which F W            A Q (Z) is compared varies inversely with power.
E A
The W(Z) curve is provided in the COLR for discrete core elevations.
FWA Q (Z) evaluations are not applicable for the following axial core regions, E
A measured in percent of core height:
: a.       Lower core region, from 0% to 8% inclusive; and
: b.       Upper core region, from 92% to 100% inclusive.
The top and bottom 8% of the core are excluded from the evaluation because of the difficulty of making a precise measurement in these regions and because of the low probability that these regions would be more limiting than the safety analyses.
AP1000 STS                                               B 3.2.1-8                                 Rev. 1

FQ(Z) (CAOC W(Z) Methodology)
B 3.2.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.2.1.4 has been modified by Note 2, which may require that more frequent Surveillances be performed. If F W  A Q (Z) is evaluated and found to E
A be within its limit, an evaluation of the expression below is required to account for any increase to F MQ (Z) that could occur and cause the FQ(Z)
A E
A limit to be exceeded before the next required FQ(Z) evaluation.
If the two most recent FQ(Z) evaluations show an increase in F QC (Z), it is A
E A
required to meet the FQ(Z) limit with the last F W  A Q (Z) increased by the E
A greater of a factor of 1.02 or by an appropriate factor as specified in the COLR or to evaluate FQ(Z) more frequently, each 7 EFPD. These alternative requirements will prevent FQ(Z) from exceeding its limit for any significant period of time without detection.
Performing the Surveillance in MODE 1 prior to exceeding 75% of RTP ensures that the FQ(Z) limit will be met when RTP is achieved, because peaking factors generally decrease as power level is increased.
The Surveillance Frequency of 31 EFPD is adequate to monitor the change of power distribution because such a change is sufficiently slow, when the plant is operated in accordance with Technical Specifications, to preclude the occurrence of adverse peaking factors between 31 EFPD Surveillances. The Surveillance may be done more frequently if required by the results of FQ(Z) evaluations.
FQ(Z) is verified at power increases of at least 10% RTP above the THERMAL POWER of its last verification, 12 hours after achieving equilibrium conditions, to ensure that FQ(Z) will be within its limit at higher power levels.
REFERENCES      1. 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors, 1974.
: 2. NUREG-0800, Standard Review Plan, Section 4.2, Revision 3, Fuel System Design (Appendix B).
: 3. 10 CFR 50, Appendix A, GDC 26.
AP1000 STS                              B 3.2.1-9                                            Rev. 1

N FH B 3.2.2 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (F H                     A N
E A )
BASES BACKGROUND           The purpose of this LCO is to establish limits on the power density at any point in the core so that the fuel design criteria are not exceeded and the accident analysis assumptions remain valid. The design limits on local (pellet) and integrated fuel rod peak power density are expressed in terms of hot channel factors. Control of the core power distribution with respect to these factors ensures that local conditions in the fuel rods and coolant channels do not challenge core integrity at any location during either normal operation or a postulated accident analyzed in the safety analyses.
N F H A
E A is defined as the ratio of the integral of the linear power along the fuel rod with the highest integrated power to the average integrated fuel N
rod power. Therefore, F H           A E
A   is a measure of the maximum total power produced in a fuel rod.
N F H A
E A is sensitive to fuel loading patterns, bank insertion and fuel burnup.
N F H typically increases with control bank insertion and typically A
E A
decreases with fuel burnup.
When the On-Line Power Distribution Monitoring System (OPDMS) is N
monitoring parameters, F H            A E
A is determined continuously by the OPDMS.
N When the OPDMS is not monitoring parameters, F H                       A E
A is not directly measurable but is inferred from a power distribution map obtained with the incore detector system. Specifically, the results of the three N
dimensional power distribution map are analyzed to determine F H                           A E
A . This factor is calculated at least every 31 effective full power days (EFPD).
Also, during power operation with the OPDMS not monitoring parameters, the global power distribution is monitored by LCO 3.2.3, AXIAL FLUX DIFFERENCE (AFD), and LCO 3.2.4, QUADRANT POWER TILT RATIO (QPTR), which are directly and continuously measured process variables.
The COLR provides peaking factor limits that ensure that the design basis value of the departure from nucleate boiling (DNB) is met for normal operation, operational transients, and any transient condition arising from events of moderate frequency. The DNB design basis precludes DNB and is met by limiting the minimum local DNB heat flux ratio. Transient events that may be DNB limited are assumed to begin N
with a F H   A E
A that satisfies the LCO requirements.
AP1000 STS                                            B 3.2.2-1                                                           Rev. 1

N FH B 3.2.2 BASES BACKGROUND (continued)
Operation outside the LCO limits may produce unacceptable consequences if a DNB limiting event occurs. The DNB design basis ensures that there is no overheating of the fuel that results in possible cladding perforation with the release of fission products to the reactor coolant.
APPLICABLE      Limits on F H   A N
E A prevent core power distributions from occurring that would SAFETY          exceed the following fuel design limits:
ANALYSES
: a. There must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hottest fuel rod in the core does not experience a DNB condition;
: b. During a large break loss of coolant accident (LOCA), the peak cladding temperature must not exceed 2200&deg;F;
: c. During an ejected rod accident, the energy deposition to the fuel must not exceed applicable limits (Ref. 1); and
: d. Fuel design limits required by GDC 26 (Ref. 2) for the condition when the control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn.
For transients that may be DNB limited, the Reactor Coolant System flow N                                                                                         N and F H A
E A are the most important core parameters. The limits on F H                        A E
A ensure that the DNB design basis is met for normal operation, operational transients, and any transients arising from events of moderate frequency. The DNB design basis is met by limiting the minimum DNB ratio (DNBR) to the 95/95 DNB criterion. This value provides a high degree of assurance that the hottest fuel rod in the core will not experience a DNB.
N The allowable F H         A E
A   limit increases with decreasing power level. This N
functionality in F H is included in the analyses that provide the Reactor A
E A
Core Safety Limits (SLs) of SL 2.1.1. Therefore, any DNB events in which the calculation of the core limits is modeled implicitly use this N
variable value of F H                 A E
A in the analyses. Likewise, all transients that may be N
DNB limited are assumed to begin with an initial F H                       A E
A as a function of power level defined by the COLR limit equation.
AP1000 STS                                                     B 3.2.2-2                                               Rev. 1

N FH B 3.2.2 BASES APPLICABLE SAFETY ANALYSES (continued)
N The LOCA safety analysis indirectly models F H                          A E
A as an input parameter.
The Nuclear Heat Flux Hot Channel Factor (FQ(Z)) and the axial peaking factors are inserted directly into the LOCA safety analyses that verify the acceptability of the resulting peak cladding temperature (Ref. 3).
The fuel is protected in part by Technical Specifications, which ensure that the initial conditions assumed in the safety and accident analyses remain valid. With the OPDMS monitoring parameters, peak linear heat N
rate and F H         A E
A are directly monitored. Should the OPDMS cease monitoring parameters, the following LCOs ensure that the conditions assumed for the safety analysis remain valid: LCO 3.2.3, AXIAL FLUX DIFFERENCE (AFD), LCO 3.2.4, QUADRANT POWER TILT RATIO (QPTR), LCO 3.1.6, Control Bank Insertion Limits, LCO 3.2.2, Nuclear N
Enthalpy Rise Hot Channel Factor (F H                    A E
A ), and LCO 3.2.1, Heat Flux Hot Channel Factor (FQ(Z)).
When the OPDMS is not available to measure power distribution N
parameters continuously, F H               A E
A and FQ(Z) are measured periodically using the incore detector system. Measurements are generally taken with the core at, or near, steady-state conditions. Without the OPDMS, core monitoring and control under transient conditions (Condition I events) are accomplished by operating the core within the limits of the LCOs on AFD, QPTR, and Bank Insertion Limits.
N F H A
E A satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              F H A
N E
A shall be maintained within the limits of the relationship provided in the COLR.
N The F H    A E
A limit identifies the coolant flow channel with the maximum enthalpy rise. This channel has the least heat removal capability and N
thus the highest probability for a DNB. The limiting value of F H                            A E
A ,
described by the equation contained in the COLR, is the design radial peaking factor used in the unit safety analyses.
A power multiplication factor in this equation includes an additional margin for higher radial peaking from reduced thermal feedback and greater control rod insertion at low power levels. The limiting value of N
F H A
E A is allowed to increase 0.3% for every 1% RTP reduction in THERMAL POWER.
AP1000 STS                                             B 3.2.2-3                                                         Rev. 1

N FH B 3.2.2 BASES APPLICABILITY When the OPDMS is not monitoring parameters and core power distribution parameters cannot be continuously monitored, it is necessary N                                                                  N to monitor F H     A E
A   on a periodic basis. Furthermore, F H            A E
A   limits must be maintained in MODE 1 with THERMAL POWER  25% RTP to preclude core power distributions from exceeding the fuel design limits for DNBR and peak cladding temperature. Applicability in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the coolant to require a limit on the distribution of core power. Specifically, the design basis events that N
are sensitive to F H                 A E
A in other MODES (MODES 2 through 5) have N
significant margin to DNB, and therefore, there is no need to restrict F H                                                      A E
A in these MODES.
ACTIONS       A.1.1 N                                                                                                                N With F H A
E A exceeding its limit, the unit is allowed 4 hours to restore F H                                         A E
A  to within its limits. This restoration may, for example, involve realigning any N
misaligned rods or reducing power enough to bring F H                                         A E
A within its power-dependent limit.
N When the F H     A E
A   limit is exceeded, it is not likely that the DNBR limit would be violated in steady state operation, since events that could significantly N
perturb the F H       A E
A value (e.g., static control rod misalignment) are considered in the safety analyses. However, the DNBR limit may be violated if a DNB limiting event occurs. Thus, the allowed Completion N
Time of 4 hours provides an acceptable time to restore F H                                              A E
A to within its N
limits without allowing the plant to remain outside F H limits for an                 A E
A extended period of time.
Condition A is modified by a Note that requires that Required Actions A.2 and A.3 must be completed whenever Condition A is entered. Thus, if power is not reduced because this Required Action is completed within the 4 hour time period, Required Action A.2 would nevertheless require N
another measurement and calculation of F H                            A E
A within 24 hours in accordance with SR 3.2.2.1.
However, if power were reduced below 50% RTP, Required Action A.3 N
requires that another determination of F H                    A E
A   be done prior to exceeding 50% RTP, prior to exceeding 75% RTP, and within 24 hours after reaching or exceeding 95% RTP. In addition, Required Action A.2 would be performed if power ascension were delayed past 24 hours.
AP1000 STS                                                   B 3.2.2-4                                                                 Rev. 1

N FH B 3.2.2 BASES ACTIONS (continued)
A.1.2.1 and A.1.2.2 N
If the value of F H A
E A is not restored to within its specified limit either by adjusting a misaligned rod or by reducing THERMAL POWER, the alternative option is to reduce THERMAL POWER to < 50% RTP in accordance with Required Action A.1.2.1 and reduce the Overpower T trip setpoints to  55% RTP in accordance with Required Action A.1.2.2.
Reducing THERMAL POWER to < 50% RTP increases the DNB margin and does not likely cause the DNBR limit to be violated in steady state operation. The reduction in trip setpoints ensures that continuing operation remains at an acceptable low power level with adequate DNBR margin. The allowed Completion Time of 4 hours for Required Action A.1.2.1 is consistent with those specified in Required Action A.1.1 and provides an acceptable time to reach the required power level from full power operation without allowing the plant to remain in an unacceptable condition for an extended period of time. The Completion Time of 4 hours for Required Actions A.1.1 and A.1.2.1 are not additive.
The allowed Completion Time of 72 hours to reset the trip setpoints per Required Action A.1.2.2 recognizes that, once power is reduced, the safety analysis assumptions are satisfied and there is no urgent need to reduce the trip setpoints. This is a sensitive operation that may cause an inadvertent reactor trip.
A.2 Once Condition A is entered, an incore flux map (SR 3.2.2.1) must be N
obtained and the measured value of F H               A E
A verified not to exceed the allowed limit. The unit is provided 20 additional hours to perform this task over and above the 4 hours allowed by either Required Action A.1.1 or Required Action A.1.2.1. The Completion Time of 24 hours is acceptable because of the increase in the DNB margin, which is obtained at lower power levels, and the low probability of having a DNB limiting event within this 24 hour period. Additionally, operating experience has indicated that this Completion Time is sufficient to obtain the incore flux N
map, perform the required calculations, and evaluate F H                         A E
A .
A.3 N
Verification that F H A E
A is within its specified limits after an out of limit N
occurrence ensures that the cause that led to the F H                   A E
A exceeding its limit is corrected, and that subsequent operation will proceed within the LCO AP1000 STS                                            B 3.2.2-5                                                   Rev. 1

N FH B 3.2.2 BASES ACTIONS (continued)
N limit. This Action demonstrates that the F H                 A E
A limit is within the LCO limits prior to exceeding 50% of RTP, again prior to exceeding 75% RTP, and within 24 hours after THERMAL POWER is  95% RTP.
This Required Action is modified by a Note that states that THERMAL POWER does not have to be reduced prior to performing this Required Action.
B.1 When any of Required Actions A.1.1 through A.3 cannot be completed within an associated Completion Time, the unit must be placed in a MODE in which the LCO requirements are not applicable. This is done by reducing THERMAL POWER to < 25% RTP within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience regarding the time required to reach < 25% RTP from full power conditions in an orderly manner without challenging plant systems.
SURVEILLANCE        SR 3.2.2.1 and SR 3.2.2.2 REQUIREMENTS N
When the OPDMS is monitoring parameters, the value of F H                              A E
A is directly and continuously monitored. With the OPDMS not monitoring N
parameters, the value of F H             A E
A is determined by using the incore detector system data. A data reduction computer program then calculates the N                                                                      N maximum value of F H      A E
A   from the data. The measured value of F H                    A E
A must be multiplied by a measurement uncertainty factor before making N
comparisons to the F H      A E
A limit.
N After each refueling, with the OPDMS not monitoring parameters, F H                                       A E
A must be determined prior to exceeding 75% RTP. This requirement N
ensures that F H A
E A limits are met at the beginning of each fuel cycle.
SR 3.2.2.1 is modified by a Note, which applies to the situation where the OPDMS is not monitoring parameters at the beginning of cycle startup, i.e., applies during the first power ascension after a refueling. It states that performance is not required if OPDMS was monitoring parameters upon exceeding 75% RTP.
With the OPDMS not monitoring parameters, the 31 EFPD Frequency is acceptable because the power distribution will change relatively slowly AP1000 STS                                       B 3.2.2-6                                                                    Rev. 1

N FH B 3.2.2 BASES SURVEILLANCE REQUIREMENTS (continued) over this amount of fuel burnup. This Frequency is short enough so that N
the F H A
E A limit will not be exceeded for any significant period of operation.
SR 3.2.2.2 is modified by a Note, which applies to the situation where the OPDMS is no longer monitoring parameters. Without the continuous N
monitoring capability of the OPDMS, F H     A E
A limits must be monitored on a periodic basis. The first measurement must be made within 24 hours of the OPDMS being declared not monitoring parameters. This measurement is expected to be performed using the most recent contingency Surveillance report created automatically during OPDMS monitoring. Subsequent Surveillances are required consistent with the 31 EFPD Frequency.
REFERENCES      1. NUREG-0800, Standard Review Plan, Section 4.2, Revision 3, Fuel System Design (Appendix B).
: 2. 10 CFR 50, Appendix A, GDC 26.
: 3. 10 CFR 50.46.
AP1000 STS                                  B 3.2.2-7                                         Rev. 1

AFD (CAOC Methodology)
B 3.2.3 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.3 AXIAL FLUX DIFFERENCE (AFD) (Constant Axial Offset Control (CAOC)
Methodology)
BASES BACKGROUND           The purpose of this LCO is to establish limits on the values of the AFD in order to limit the amount of axial power distribution skewing to either the top or bottom of the core when the On-Line Power Distribution Monitoring System (OPDMS) is not monitoring parameters. By limiting the amount of power distribution skewing, core peaking factors are consistent with the assumptions used in the safety analyses. Limiting power distribution skewing over time also minimizes the xenon distribution skewing which is a significant factor in axial power distribution control.
The operating strategy used to control the axial power distribution, Constant Axial Offset Control (CAOC), involves maintaining the AFD within a tolerance band about a burnup dependent target, known as the target flux difference, to minimize the variation of the axial peaking factor and axial xenon distribution during unit maneuvers.
The target flux difference is determined with reactor power at or near the RTP value, equilibrium xenon conditions, and the control banks positioned at or near a nominally assumed position for steady-state operation at high power levels. The value of the target flux difference obtained at these conditions divided by the fraction of RTP is the target flux difference at RTP for the associated core burnup conditions. Target flux differences for other THERMAL POWER levels are obtained by multiplying the RTP value by the appropriate fractional THERMAL POWER level.
The AFD is monitored on an automatic basis using the computer, which has an AFD monitor alarm. Monitoring of the AFD by the computer is frequent enough (typically once per minute) to provide an essentially continuous accumulation of penalty deviation time that allows the operator to assess the status of the penalty deviation time. The computer determines a time average (typically over 1 minute) of each of the OPERABLE excore detector outputs and provides an alarm message immediately if the AFD for two or more OPERABLE excore channels is outside the target band and the THERMAL POWER is > 90% RTP.
During operation at THERMAL POWER levels < 90% RTP but
                     > 15% RTP, the computer sends an alarm message when the cumulative penalty deviation time is > 1 hour in the previous 24 hours.
AP1000 STS                                  B 3.2.3-1                                       Rev. 1

AFD (CAOC Methodology)
B 3.2.3 BASES BACKGROUND (continued)
Periodic updating of the target flux difference value is necessary to follow the change of the flux difference at steady state conditions with burnup.
N The Nuclear Enthalpy Rise Hot Channel Factor (F H   A E
A ) and QPTR LCOs limit the radial component of the peaking factors. It is expected that AFD will normally be automatically controlled by the Plant Control System (PLS), which will demand movement of the AO bank to maintain AFD within a control dead-band around the target flux difference. The control dead-band is defined to be more restrictive than the CAOC limits associated with this LCO such that automatic control can typically be expected to maintain adherence to this LCO.
APPLICABLE       The AFD is a measure of the axial power distribution skewing to either SAFETY           the top or bottom half of the core. The AFD is sensitive to many core ANALYSES         related parameters such as control bank positions, core power level, axial burnup, axial xenon distribution, and, to a lesser extent, reactor coolant temperature and boron concentration.
The allowed range of the AFD is used in the nuclear design process to confirm that operation within these limits produces core peaking factors and axial power distributions that meet safety analysis requirements.
The CAOC methodology (Refs. 1, 2, and 3) entails:
: a. Establishing an envelope of allowed power shapes and power densities,
: b. Devising an operating strategy for the cycle that maximizes unit flexibility (maneuvering) and minimizes axial power shape changes,
: c. Demonstrating that this strategy does not result in core conditions that violate the envelope of permissible core power characteristics, and
: d. Demonstrating that this power distribution control scheme can be effectively supervised with excore detectors.
With the OPDMS not monitoring parameters, the limits on the AFD ensure that the Heat Flux Hot Channel Factor (FQ(Z)) is not exceeded during either normal operation or in the event of xenon redistribution following power changes. The limits on the AFD also restrict the range of power distributions that are used as initial conditions in the analyses of Condition II, III, or IV events. This ensures that the fuel cladding integrity AP1000 STS                               B 3.2.3-2                                         Rev. 1

AFD (CAOC Methodology)
B 3.2.3 BASES APPLICABLE SAFETY ANALYSES (continued) is maintained for these postulated accidents. The most important Condition IV event is the loss of coolant accident (LOCA). The most important Condition III event is the loss of flow accident. The most important Condition II events are uncontrolled bank withdrawal and boration or dilution accidents. Condition II accidents simulated to begin from within the AFD limits are used to confirm the adequacy of the Overpower T and Overtemperature T trip setpoints.
The limits on the AFD satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              The shape of the power profile in the axial (i.e., the vertical) direction is largely under the control of the operator through either the manual or automatic motion of control banks, particularly motion of the AO bank.
Using the mechanical shim (MSHIM) operation and control strategy, automatic motion of the AO bank is in response to deviations of AFD from the target flux difference resulting from changes in power level, xenon distribution, or positioning of the MSHIM control banks. Automatic motion of the MSHIM control banks is in response to temperature deviations resulting from changes in power level, fuel and burnable absorber depletion, xenon concentration, or RCS boron concentration.
The impact of MSHIM control bank motion on AFD is compensated by movements of the AO bank.
Signals are available to the operator from the Protection and Safety Monitoring System (PMS) excore neutron detectors (Ref. 4). Separate signals are taken from the top and bottom detectors. The AFD is defined as the difference in normalized flux signals between the top and bottom excore detectors in each detector well. For convenience, this flux difference is converted to provide flux difference units expressed as a percentage and labeled as % flux or %I.
The required target band varies with axial burnup distribution, which in turn varies with the core average accumulated burnup. The target band defined in the COLR may provide one target band for the entire cycle or more than one band, each to be followed for a specific range of cycle burnup. With THERMAL POWER  90% RTP, the AFD must be kept within the target band. With the AFD outside the target band with THERMAL POWER  90% RTP, the assumptions of the accident analyses may be violated.
AP1000 STS                             B 3.2.3-3                                          Rev. 1

AFD (CAOC Methodology)
B 3.2.3 BASES LCO (continued)
Violating this LCO on the AFD, with the OPDMS not monitoring parameters, could produce unacceptable consequences if a Condition II, III, or IV event occurs while the AFD is outside its specified limits.
Figure B 3.2.3-1 shows a typical target band and typical AFD acceptable operation limits.
The LCO is modified by four Notes. Note 1 states the conditions necessary for declaring the AFD outside of the target band. Notes 2 and 3 describe how the cumulative penalty deviation time is calculated. It is intended that the unit is operated with the AFD within the target band about the target flux difference. However, during rapid THERMAL POWER reductions, control bank motion may cause the AFD to deviate outside the target band at reduced THERMAL POWER levels. This deviation does not affect the xenon distribution sufficiently to change the envelope of peaking factors that may be reached on a subsequent return to RTP with the AFD within the target band, provided the time duration of the deviation is limited. Accordingly, while THERMAL POWER is 50% RTP and < 90% RTP (i.e., Part b of this LCO), a 1 hour cumulative penalty deviation time, cumulative during the preceding 24 hours, is allowed during which the unit may be operated outside the target band, but within the acceptable operation limits provided in the COLR (Note 2). This penalty time is accumulated at the rate of 1 minute for each 1 minute of operating time within the power range of Part b of this LCO (i.e., THERMAL POWER  50% RTP). The cumulative penalty time is the sum of penalty times from Parts b and c of this LCO.
For THERMAL POWER levels >15% RTP and < 50% RTP (i.e., Part c of this LCO), deviations of the AFD outside of the target are less significant.
Note 3 allows the accumulation of a half minute penalty deviation time per 1 minute of actual time outside the target band and reflects this reduced significance. With THERMAL POWER  15% RTP, AFD is not a significant parameter in the assumptions used in the safety analysis and therefore requires no limits. Because the xenon distribution produced at THERMAL POWER levels less than RTP does affect the power distribution as power is increased, unanalyzed xenon and power distribution is prevented by limiting the accumulation penalty deviation time.
For Surveillance of the Power Range Neutron Flux channels performed according to SR 3.3.1.5, Note 4 allows deviation outside the target band for 16 hours and no penalty deviation time accumulated. Some deviation in the AFD is required for doing the Nuclear Instrumentation System (NIS) calibration with the incore detector system. This calibration is performed every 92 effective full power days (EFPD).
AP1000 STS                             B 3.2.3-4                                       Rev. 1

AFD (CAOC Methodology)
B 3.2.3 BASES APPLICABILITY The AFD requirements are applicable in MODE 1 above 15% RTP when OPDMS is not monitoring parameters. Above 50% RTP the combination of THERMAL POWER and core peaking factors is of primary importance in safety analysis (Ref. 1).
Between 15% RTP and 90% RTP, this LCO is applicable to ensure that the distributions of xenon are consistent with safety analysis assumptions.
At or below 15% RTP and for lower operating MODES, the stored energy in the fuel and the energy being transferred to the reactor coolant are low.
The value of the AFD in these conditions does not affect the consequences of the design basis events.
Low signal levels in the excore channels may preclude obtaining valid AFD signals at or below 15% RTP.
ACTIONS       A.1 With the AFD outside the target band and THERMAL POWER 90% RTP, the assumptions used in the accident analyses may be violated with respect to the maximum heat generation. Therefore, a Completion Time of 15 minutes is allowed to restore the AFD to within the target band because xenon distributions change little in this relatively short time.
B.1 If the AFD cannot be restored within the target band, then reducing THERMAL POWER to < 90% RTP places the core in a condition that has been analyzed and found to be acceptable, provided that the AFD is within the acceptable operation limits provided in the COLR.
The allowed Completion Time of 15 minutes provides an acceptable time to reduce power to < 90% RTP without allowing the plant to remain in an unanalyzed condition for an extended period of time.
C.1 With THERMAL POWER < 90% RTP, but  50% RTP, operation with the AFD outside the target band is allowed for up to 1 hour during the preceding 24 hours if the AFD is within the acceptable operation limits provided in the COLR. With the AFD within these limits, the resulting axial power distribution is acceptable as an initial condition for accident AP1000 STS                           B 3.2.3-5                                      Rev. 1

AFD (CAOC Methodology)
B 3.2.3 BASES ACTIONS (continued) analyses assuming the then existing xenon distributions. The 1 hour cumulative penalty deviation time restricts the extent of xenon redistribution. Without this limitation, unanalyzed xenon axial distributions may result from a different pattern of xenon buildup and decay. The reduction to a power level < 50% RTP puts the reactor at a THERMAL POWER level at which the AFD is not a significant accident analysis parameter.
If the indicated AFD is outside the target band and outside the acceptable operation limits provided in the COLR, the peaking factors assumed in accident analysis may be exceeded with the existing xenon condition. (Any AFD within the target band is acceptable regardless of its relationship to the acceptable operation limits.) The Completion Time of 30 minutes allows for a prompt, yet orderly, reduction in power.
Condition C is modified by a Note stating that Required Action C.1 must be completed whenever this Condition is entered.
D.1 If Required Action C.1 is not completed within its required Completion Time of 30 minutes, the axial xenon distribution starts to become significantly skewed with the THERMAL POWER  50% RTP. In this situation, the assumption that a cumulative penalty deviation time of 1 hour or less during the previous 24 hours while the AFD is outside its target band is acceptable at < 50% RTP, is no longer valid.
Reducing the power level to  15% RTP within the Completion Time of 9 hours and complying with LCO penalty deviation time requirements for subsequent increases in THERMAL POWER ensure that acceptable xenon conditions are restored.
SURVEILLANCE        The Surveillances are modified by a Note allowing 7 days without the REQUIREMENTS        continuous monitoring capability of the OPDMS before AFD must be initially verified. The first performance must be made within 7 days of the most recent date when the OPDMS data have verified parameters. This is consistent with the 7 day Surveillance Frequency for AFD.
SR 3.2.3.1 This Surveillance verifies that the AFD, as indicated by the PMS excore channel, is within the target band. The Surveillance Frequency of 7 days AP1000 STS                                  B 3.2.3-6                                      Rev. 1

AFD (CAOC Methodology)
B 3.2.3 BASES SURVEILLANCE REQUIREMENTS (continued) is adequate considering that the AFD is monitored by a computer and any deviation from requirements is alarmed.
The AFD should be monitored and logged more frequently in periods of operation in which the power level or control bank positions are changing to allow corrective measures when the AFD is more likely to move outside the target band.
SR 3.2.3.2 This Surveillance requires that the target flux difference be updated at a Frequency of 31 EFPD to account for small changes that may occur in the target flux differences in that period due to burnup by performing SR 3.2.3.3.
Alternatively, another acceptable method to update the target flux difference is a linear interpolation between the most recent measurement of the target flux difference and a predicted end of cycle value. This is acceptable because the AFD changes due to burnup tend toward 0% AFD. When the predicted end of cycle AFD from the cycle nuclear design is different from 0%, it may be a better value for the interpolation.
SR 3.2.3.3 Measurement of the target flux difference is determined from an incore power distribution measurement at, or very near equilibrium xenon conditions, preferably at high power levels with the control banks at a reference position. This power distribution measurement provides the equilibrium xenon axial power distribution from which the target value can be determined. It is also used to generate a core flux map.
A Frequency of 31 EFPD after each refueling and 92 EFPD thereafter for remeasuring the target flux differences adjusts the target flux difference for each excore channel to the value measured at steady-state conditions. This is the basis for the CAOC. Remeasurement at this Surveillance interval also establishes the AFD target flux difference values that account for changes in incore excore calibrations that may have occurred in the interim.
A Note modifies this SR to allow the predicted beginning of cycle AFD from the cycle nuclear design to be used to determine the initial target flux difference after each refueling.
AP1000 STS                              B 3.2.3-7                                      Rev. 1

AFD (CAOC Methodology)
B 3.2.3 BASES REFERENCES 1. WCAP-8385, Power Distribution Control and Load Following Procedures, Westinghouse Electric Corporation, September 1974 (Westinghouse Proprietary) and WCAP-8403 (Non-Proprietary).
: 2. T. M. Anderson to K. Kniel (Chief of Core Performance Branch, NRC), 

==Attachment:==
Operation and Safety Analysis Aspects of an Improved Load Follow Package, January 31, 1980.
: 3. C. Eicheldinger to D. B. Vassallo (Chief Light Water Reactors Branch, NRC), Letter NS-CE-687, July 16, 1975.
: 4. FSAR Chapter 15, Accident Analyses.
AP1000 STS                    B 3.2.3-8                                     Rev. 1

AFD (CAOC Methodology)
B 3.2.3 Figure B 3.2.3-1 (page 1 of 1)
AXIAL FLUX DIFFERENCE Acceptable Operation Limits and Target Band Limits as a Function of RATED THERMAL POWER AP1000 STS                             B 3.2.3-9                               Rev. 1

QPTR B 3.2.4 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.4 QUADRANT POWER TILT RATIO (QPTR)
BASES BACKGROUND       With the On-Line Power and Distribution Monitoring System (OPDMS) not monitoring parameters, the QPTR limit ensures that the gross radial power distribution remains consistent with the design values used in the safety analyses. Precise radial power distribution measurements are made during startup testing, after refueling, and periodically during power operation.
The power density at any point in the core must be limited so that the fuel design criteria are maintained. With the OPDMS monitoring parameters, the key power distribution parameters associated with fuel design criteria and bounds of the safety analyses are continuously and directly monitored. With the OPDMS not monitoring parameters, LCO 3.2.3, AXIAL FLUX DIFFERENCE (AFD), LCO 3.2.4, QUADRANT POWER TILT RATIO (QPTR), and LCO 3.1.6, Control Bank Insertion Limits, provide limits on process variables that characterize and control the three dimensional power distribution of the reactor core. Control of these variables ensures that the core operates within the fuel design criteria and that the power distribution remains within the bounds used in the safety analyses.
APPLICABLE       This LCO precludes the occurrence of core power distributions that would SAFETY           violate the following fuel design criteria:
ANALYSES
: a. During a large break loss of coolant accident, the peak cladding temperature must not exceed 2200&deg;F (Ref. 1);
: b. During a loss of forced reactor coolant flow accident, there must be at least a 95% probability at a 95% confidence level (the 95/95 departure from nucleate boiling (DNB) criterion) that the hot fuel rod in the core does not experience a DNB condition;
: c. During an ejected rod accident, the energy deposition to the fuel must not exceed applicable limits (Ref. 2); and
: d. The control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn (Ref. 3).
AP1000 STS                              B 3.2.4-1                                      Rev. 1

QPTR B 3.2.4 BASES APPLICABLE SAFETY ANALYSES (continued)
The LCO limits on the AFD, the QPTR, the Heat Flux Hot Channel Factor N
(FQ (Z)), the Nuclear Enthalpy Rise Hot Channel Factor (F H              A E
A ), and control bank insertion are established to preclude the occurrence of core power distributions that would exceed the safety analyses limits.
Should the OPDMS cease monitoring parameters, the QPTR limits N
ensure that F H   A E
A and FQ (Z) remain below their limiting values by preventing an undetected change in the gross radial power distribution.
N In MODE 1, with the OPDMS not monitoring parameters, the F H                        A E
A and FQ (Z) limits must be maintained to preclude core power distributions from exceeding design limits assumed in the safety analyses.
The QPTR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO             The QPTR limit of 1.02, where corrective action is required, provides a margin of protection for both the DNB ratio (DNBR) and linear heat generation rate contributing to excessive power peaks resulting from X-Y plane power tilts. A limiting QPTR of 1.02 can be tolerated before the N
margin for uncertainty in FQ (Z) and F H      A E
A is possibly challenged.
APPLICABILITY   The QPTR limit must be maintained in MODE 1 with THERMAL POWER
                > 50% RTP and OPDMS not monitoring parameters to preclude core power distributions from exceeding the design limits. Applicability with OPDMS monitoring parameters is not required since OPDMS directly and continuously monitors key power distribution parameters.
Applicability in MODE 1  50% RTP and in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require the implementation of a QPTR limit on the distribution of core power. The QPTR limit in these conditions is, therefore, not important. Note that the N
F H A
E A and FQ (Z) LCOs still apply, but allow progressively higher peaking factors at 50% RTP or lower.
ACTIONS         A.1 With the QPTR exceeding its limit and the OPDMS not monitoring parameters, a power level reduction of 3% RTP for each 1% by which the AP1000 STS                                     B 3.2.4-2                                                      Rev. 1

QPTR B 3.2.4 BASES ACTIONS (continued)
QPTR exceeds 1.00 is a conservative tradeoff of total core power with peak linear power. The Completion Time of 2 hours allows sufficient time to identify the cause and correct the tilt. Note that the power reduction itself may cause a change in the tilted condition.
The maximum allowable power level initially determined by Required Action A.1 may be affected by subsequent determinations of QPTR.
Increases in QPTR would require power reduction within 2 hours of QPTR determination, if necessary to comply with the decreased maximum allowable power level and increasing power up to this revised limit.
A.2 After completion of Required Action A.1, the QPTR alarm may be in its alarmed state. As such, any additional changes in the QPTR are detected by requiring a check of the QPTR once per 12 hours thereafter.
A 12 hour Completion Time is sufficient because any additional change in QPTR would be relatively slow.
A.3 The peaking factors FQ (Z), as approximated by F CQ (Z) and F WA E
A      A Q (Z), and F H E
A         A N
E A
are of primary importance in ensuring that the power distribution remains consistent with the initial conditions used in the safety analyses.
N Performing SRs on F H  A E
A and FQ (Z) within the Completion Time of 24 hours after achieving equilibrium conditions from a THERMAL POWER reduction per Required Action A.1 ensures that these primary indicators of power distribution are within their respective limits. A Completion Time of 24 hours after achieving equilibrium conditions from a Thermal Power reduction per Required Action A.1 takes into consideration the rate at which peaking factors are likely to change, and the time required to stabilize the plant and perform a flux map. If these peaking factors are not within their limits, the Required Actions to perform these Surveillances provide an appropriate response for the abnormal condition. If the QPTR remains above its specified limits, the peaking factor Surveillances are N
required each 7 days thereafter to evaluate F H      A E
A and FQ (Z) with changes in power distribution. Relatively small changes are expected due to either burnup and xenon redistribution or correction of the cause of exceeding the QPTR limit.
AP1000 STS                                  B 3.2.4-3                                                 Rev. 1

QPTR B 3.2.4 BASES ACTIONS (continued)
A.4 N
Although F H A
E A and FQ (Z) are of primary importance as initial conditions in the safety analyses, other changes in the power distribution may occur as the QPTR limit is exceeded and may have an impact on the validity of the safety analysis. A change in the power distribution can affect such reactor parameters as bank worths and peaking factors for rod malfunction accidents. When the QPTR exceeds its limit, it does not necessarily mean a safety concern exists. It does mean that there is an indication of a change in the gross radial power distribution that requires an investigation and evaluation, which is accomplished by examining the incore power distribution. Specifically, the core peaking factors and the quadrant tilt must be evaluated because they are the factors that best characterize the core power distribution. This re-evaluation is required to assure that, before increasing THERMAL POWER to above the limit of Required Action A.1, the reactor core conditions are consistent with the assumptions in the safety analyses.
A.5 If the QPTR has exceeded the 1.02 limit and a re-evaluation of the safety analysis is completed and shows that safety requirements are met, the excore detectors are normalized to restore QPTR to within limits prior to increasing THERMAL POWER to above the limit of Required Action A.1.
Normalization is accomplished in such a manner that the indicated QPTR following normalization is near 1.00. This is done to detect any subsequent significant changes in QPTR.
Required Action A.5 is modified by two Notes. Note 1 states that the QPTR is not restored to within limits until after the re-evaluation of the safety analysis has determined that core conditions at RTP are within the safety analysis assumptions (i.e., Required Action A.4). Note 2 states that if Required Action A.5 is performed, then Required Action A.6 shall be performed. Required Action A.5 normalizes the excore detectors to restore QPTR to within limits, which restores compliance with LCO 3.2.4.
Thus, Note 2 prevents exiting the Actions prior to completing flux mapping to verify peaking factors, per Required Action A.6. These Notes are intended to prevent any ambiguity about the required sequence of actions.
AP1000 STS                                   B 3.2.4-4                                        Rev. 1

QPTR B 3.2.4 BASES ACTIONS (continued)
A.6 Once the flux tilt is restored to within limits (i.e., Required Action A.5 is performed), it is acceptable to return to full power operation. However, as an added check that the core power distribution is consistent with the safety analysis assumptions, Required Action A.6 requires verification that FQ (Z) as approximated by F CQ (Z) and FW A
E A     A E
A        A N
Q (Z), and F H are within their E
A specified limits within 24 hours of achieving equilibrium conditions at RTP.
As an added precaution, if the core power does not reach equilibrium conditions at RTP within 24 hours, but is increased slowly, then the peaking factor Surveillances must be performed within 48 hours after increasing THERMAL POWER above the limit of Required Action A.1.
These Completion Times are intended to allow adequate time to increase THERMAL POWER to above the limit of Required Action A.1, while not permitting the core to remain with unconfirmed power distributions for extended periods of time.
Required Action A.6 is modified by a Note that states that the peaking factor Surveillances may only be done after the excore detectors have been normalized to restore QPTR to within limit (i.e., Required Action A.5). The intent of this Note is to have the peaking factor Surveillances performed at operating power levels, which can only be accomplished after the excore detectors are calibrated to show zero tilt and the core is returned to power.
B.1 If any of Required Actions A.1 through A.6 is not completed within any of its associated Completion Times, the unit must be brought to a MODE or condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 50% RTP within 4 hours. The allowed Completion Time of 4 hours is reasonable based on operating experience regarding the amount of time required to reach the reduced power level without challenging plant systems.
SURVEILLANCE       The Surveillances are modified by a Note allowing 12 hours without the REQUIREMENTS       continuous monitoring capability of the OPDMS before QPTR must be initially verified. The first verification must be made within 12 hours of the most recent date and time when the OPDMS data have verified parameters. This is consistent with the 12 hour Surveillance Frequency for QPTR in SR 3.2.4.2.
AP1000 STS                                  B 3.2.4-5                                           Rev. 1

QPTR B 3.2.4 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.2.4.1 SR 3.2.4.1 is modified by two Notes. Note 1 allows QPTR to be calculated with three Power Range Neutron Flux channels if THERMAL POWER is < 75% RTP and the input from one Power Range Neutron Flux channel is inoperable. Note 2 allows performance of SR 3.2.4.2 in lieu of SR 3.2.4.1.
This Surveillance verifies that the QPTR as indicated by the Protection and Safety Monitoring System (PMS) Power Range Neutron Flux channels is within its limits. The Frequency of 7 days takes into account other information and alarms available to the operator in the control room.
For those causes of QPTR changes that occur quickly (a dropped rod),
there are other indications of abnormality that prompt a verification of core power tilt.
SR 3.2.4.2 This Surveillance is modified by a Note, which states that it is not required until 12 hours after the input from one or more Power Range Neutron Flux channels are inoperable and THERMAL POWER is  75% RTP.
With a PMS Power Range Neutron Flux channel inoperable, tilt monitoring for a portion of the reactor core becomes degraded. Large tilts would likely be detected with the remaining channels, but the capability for detection of small power tilts in some quadrants is decreased.
Performing SR 3.2.4.2 at a Frequency of 12 hours provides an accurate alternative means for ensuring that any tilt remains within its limits.
For purposes of monitoring the QPTR when one Power Range Neutron Flux channel is inoperable, the incore detectors are used to confirm that the normalized symmetric power distribution is acceptable.
With the OPDMS not monitoring parameters and one PMS Power Range Neutron Flux channel inoperable, the Surveillance of the incore power distribution on a 12 hour basis is sufficient to maintain peaking factors within their normal limits, especially considering the other LCOs and ACTIONS required when the OPDMS is out of service.
AP1000 STS                             B 3.2.4-6                                        Rev. 1

QPTR B 3.2.4 BASES REFERENCES 1. 10 CFR 50.46.
: 2. NUREG-0800, Standard Review Plan, Section 4.2, Revision 3, Fuel System Design (Appendix B).
: 3. 10 CFR 50, Appendix A, GDC 26.
AP1000 STS                  B 3.2.4-7                                  Rev. 1

OPDMS-Monitored Parameters B 3.2.5 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.5 On-Line Power Distribution Monitoring System (OPDMS)-Monitored Parameters BASES BACKGROUND          The On-Line Power Distribution Monitoring System (OPDMS) is the display of core monitoring information to the control room. Its purpose is to support the continuous Surveillance of the parameters of LCO 3.2.5 and provide information about core power distribution to the reactor operator. It consists of hardware and software for data transfer, core monitoring instrumentation hardware and software, continuous control room displays (in MODES 1, 2, and 3), operator accessible detailed displays through control room workstations and alarms associated with the monitoring of the parameter limits and the system functionality.
The purpose of the limits on the OPDMS-monitored power distribution parameters is to provide assurance of fuel integrity during Condition I (Normal Operation) events and Condition II (incidents of Moderate Frequency) events by: (1) not exceeding the minimum departure from nucleate boiling ratio (DNBR) in the core, and (2) limiting the fission gas release, fuel pellet temperature, and cladding mechanical properties to within assumed design criteria. In addition, limiting the peak linear heat rate during Condition I events ensures that the initial conditions assumed for the loss of coolant accident (LOCA) analyses are met and the peak cladding temperature limit of 2200&deg;F is not exceeded.
The purpose of the limits on SHUTDOWN MARGIN (SDM) are discussed in the Bases of LCO 3.1.1, SDM.
The definitions of certain quantities used in these Specifications are as follows:
Peak linear             Peak linear heat rate (axially dependent) heat rate               as measured in kW/ft.
N F H A
E A               Ratio of the integral of linear power along the rod with the highest integrated power to the average rod power.
Minimum DNBR            Minimum ratio of the critical heat flux to actual heat flux at any point in the reactor that is allowed in order to ensure that certain performance and safety criteria requirements are met over the range of plant conditions.
AP1000 STS                                 B 3.2.5-1                                         Rev. 1

OPDMS-Monitored Parameters B 3.2.5 BASES BACKGROUND (continued)
By continuously monitoring the core and following its actual operation, it is possible to significantly limit the adverse nature of power distribution initial conditions for transients that may occur at any time.
For simplicity in the continuous monitoring of compliance with the limits of LCO 3.2.5 parameters a, b and c, the margin of the parameters to the limits are converted to the parameter power margin. Power margin is the percent THERMAL POWER increase that would result in the parameter limit being exceeded. Minimum power margin is the smallest margin to limit of the LCO 3.2.5 a, b, and c parameters. Thus, compliance with limits of all three parameters is demonstrated by the minimum power margin being greater than zero. The units of percent power facilitate management of the margins to thermal limits. Operators presented with a challenge to thermal limits would know quantitatively what power reduction is necessary to restore desired margins.
For simplicity in monitoring compliance with the limit of LCO 3.2.5 parameter d, the margin to the limit is expressed as Excess Shutdown Margin (ESDM) and displayed in units of Reactor Coolant System (RCS) boron concentration. ESDM is the excess amount over the SDM limit that the reactor would be shutdown if a trip were to occur, expressed in units of boron concentration. Thus, compliance with the requirement of LCO 3.2.5 for SDM is demonstrated by an ESDM greater than zero. The units of RCS boron concentration facilitate management of the margin to the SDM limit. Operators presented with a challenge to SDM limits would know quantitatively what change in RCS boron concentration would restore the desired margin.
The core monitoring system is the component of the OPDMS that calculates from present plant data the core power distribution and reactivity and determines margin to core thermal limits and required SDM.
The core monitoring system is the Westinghouse BEACON Core Monitoring System. The technology utilized is licensed by the NRC for direct monitoring of core parameters to limits (Ref. 1). The core monitoring system requires present plant data of reactor THERMAL POWER, control rod position and inlet temperature to provide monitoring of SDM in MODES 1 and 2 with keff  1.0. Valid data from the Incore Instrumentation System neutron detectors are required in addition to data required for SDM to monitor reactor core margins to thermal limits in MODE 1 with THERMAL POWER  25% RTP.
AP1000 STS                             B 3.2.5-2                                       Rev. 1

OPDMS-Monitored Parameters B 3.2.5 BASES BACKGROUND (continued)
The ability of the OPDMS to monitor the required parameters is dependent on the functionality of the BEACON Core Monitoring System, Plant Control System (PLS), and Data Display System (DDS). The requirements of OPDMS capabilities fall into the following categories:
: a. A cycle specific nuclear model is installed in the core monitoring system and is updated to reflect the present characteristics of the core;
: b. The core monitoring software is providing indication that the processes are running appropriately;
: c. Present data of good quality and acceptable accuracy from an adequate number of critical sensors are available to the core monitoring system; and
: d. The PLS and DDS are functioning to transmit data to and from the core monitoring system and to correctly display the data and actuate alarms in the main control room.
Table B 3.2.5-1 shows the minimum requirements for data input to the core monitoring system. The core monitoring system continuously checks for the presence and quality of the minimum required parameters. If input data fall below the minimum required, an alarm will actuate for loss of functionality.
APPLICABLE       The limits on the LCO 3.2.5 parameters a, b, and c preclude core power SAFETY           distributions that would violate the following fuel design criteria:
ANALYSES
: a. During a large break LOCA, the peak cladding temperature must not exceed 2200&deg;F (Ref. 2);
: b. During a loss of forced reactor coolant flow accident, there must be at least a 95% probability at a 95% confidence level (the 95/95 departure from nucleate boiling (DNB) criterion) that the hot fuel rod in the core does not experience a DNB condition;
: c. During an ejected rod accident, the energy deposition to the fuel must not exceed applicable limits (Ref. 3); and
: d. The control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn.
AP1000 STS                              B 3.2.5-3                                       Rev. 1

OPDMS-Monitored Parameters B 3.2.5 BASES APPLICABLE SAFETY ANALYSES (continued)
Limits on linear power density or peak linear heat rate ensure that the peak linear heat rate assumed as a base condition in the LOCA analyses is not exceeded during normal operation.
N Limits on F HA E
A ensure that the LOCA analysis assumptions and assumptions made with respect to the Overtemperature T setpoint are maintained.
The limit on DNBR ensures that if transients analyzed in the safety analyses initiate from the conditions within the limit allowed by the OPDMS, the DNB criteria will be met.
The limit on SDM ensures that the safety analysis assumptions related to reactor trip effectiveness and the consequences of design basis actions initiating from shutdown reactor conditions remain valid.
The OPDMS-monitored parameters of this LCO satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              This LCO ensures operation within the bounds assumed in the safety analyses. Calculations are performed in the core design process to confirm that the core can be controlled during operation in such a manner that it can stay within these limits. If the OPDMS-monitored parameters cannot be maintained within LCO limits, reduction of the core power is required.
Violating the OPDMS-monitored power distribution parameter limits could result in unanalyzed conditions should a design basis event occur while the parameters are outside their specified limits.
Peak linear heat rate limits define limiting values for core power peaking that precludes peak cladding temperatures above 2200&deg;F during either a large or small break LOCA. The highest calculated linear power densities in the core at specific core elevations are displayed for operator visual verification relative to the COLR values.
N The determination of F H      A E
A identifies the coolant flow channel with the maximum enthalpy rise. This channel has the least heat removal N
capability and thus the highest probability for DNB. Should F H            A E
A exceed the limit given in the COLR, the possibility exists for DNBR to fall outside the value used as a base condition for the safety analysis.
AP1000 STS                                   B 3.2.5-4                                                  Rev. 1

OPDMS-Monitored Parameters B 3.2.5 BASES LCO (continued)
Two levels of alarm on power distribution parameters and SDM are provided to the operator. One level of alarm serves as a warning before N
any of the three parameters (linear power density, F H        A E
A , DNBR) or SDM are not within their limits in the COLR. The other alarm indicates when the parameters have reached their limits.
APPLICABILITY   The OPDMS-monitored power distribution limits with OPDMS monitored parameters a, b, and c must be maintained in MODE 1 with THERMAL POWER  25% RTP to preclude core power distributions from exceeding the limits assumed in the safety analyses. Applicability in other MODES, and MODE 1 with THERMAL POWER < 25% RTP, is not required because there is either insufficient stored energy in the fuel or insufficient energy transferred to the reactor coolant to require a limit on the distribution of core power. The OPDMS monitoring of SDM is applicable in MODES 1 and 2 with keff  1.0.
N Specifically for F H A
E A     and DNBR, the design basis accidents (DBAs) that N
are sensitive to F H and DNBR in other MODES (MODES 2 through 5)
A E
A have significant margin to DNB, and therefore, there is no need to restrict F NH and DNBR in these MODES.
A E
A In addition to the alarms discussed in the LCO section above (alarms on OPDMS-monitored power distribution parameters), there is an alarm indicating the potential for the OPDMS not to be monitoring parameters.
Should the OPDMS be determined not to be monitoring parameters for reasons other than alarms inoperable, this LCO is no longer applicable and LCOs 3.2.1 through 3.2.4 become applicable.
ACTIONS         A.1 With any of the OPDMS-monitored power distribution parameters outside their limits, the assumptions used as most limiting base conditions for the DBA analyses may no longer be valid. The 1 hour allowed to restore the parameter to within limits is consistent with the basis for the anticipated operational occurrences and provides time to assess if there are instrumentation problems. It also allows the possibility to restore the parameter to within limits by control rod motion if this is possible. The OPDMS will continuously monitor these parameters and provide an indication when they are approaching their limits.
AP1000 STS                                        B 3.2.5-5                                        Rev. 1

OPDMS-Monitored Parameters B 3.2.5 BASES ACTIONS (continued)
B.1 If the OPDMS-monitored power distribution parameters cannot be restored to within their limits within the Completion Time of Required Action A.1, it is likely that the problem is not due to a failure of instrumentation. Most of these parameters can be brought within their respective limits by reducing THERMAL POWER, because this will reduce the absolute power density at any location in the core, thus providing margin to the limit.
If the parameters cannot be returned to within limits as power is being reduced, THERMAL POWER must be reduced to < 25% RTP where the LCOs for OPDMS-monitored power distribution parameters are no longer applicable.
The Completion Time of 4 hours provides an acceptable time to reduce power in an orderly manner and without allowing the reactor to be outside the parameter limits for an extended period of time.
C.1 If the SDM requirements are not met, boration must be initiated promptly.
A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that boration will be continued until the SDM requirements are met. In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied.
Since it is imperative to raise the boron concentration of the RCS as soon as possible, the injection coolant should be a concentrated boron solution. The operator should begin boration with the best source available for the plant conditions.
SURVEILLANCE      With OPDMS monitoring parameters, the power distribution parameters REQUIREMENTS      and SDM are continuously computed and compared against their limits and margins to limits are displayed. Two levels of alarms are provided to the operator. The first alarm provides a warning before any of these N
parameters (peak linear heat rate, F H A E
A , and DNBR) or SDM go outside their limits. The second alarm indicates when they actually reach their limits. A third alarm indicates trouble with the OPDMS.
AP1000 STS                                 B 3.2.5-6                                       Rev. 1

OPDMS-Monitored Parameters B 3.2.5 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.2.5.1 This Surveillance requires the operator to verify that the power distribution parameters are within their limits. This confirmation is a verification in addition to the automated checking performed by the OPDMS. A 24 hour Surveillance interval provides assurance that the system is functioning properly and that the core limits are met.
REFERENCES      1. WCAP-12472-P-A, (Westinghouse Proprietary) and WCAP-12473-A (Non-Proprietary), BEACON Core Monitoring and Operations Support System, August 1994, Addendum 1, May 1996, and Addendum 2, March 2001 and WCAP-12472-P-A (Westinghouse Proprietary) and WCAP-12472-NP-A (Non-Proprietary) Addendum 4, September 2012.
: 2. 10 CFR 50.46.
: 3. NUREG-0800, Standard Review Plan, Section 4.2, Revision 3, Fuel System Design (Appendix B).
AP1000 STS                             B 3.2.5-7                                       Rev. 1

OPDMS-Monitored Parameters B 3.2.5 Table B 3.2.5-1 (page 1 of 1)
OPDMS Minimum Required Input Parameters Data or Sensor                               Minimum Data Required IIS Self Powered Neutron       75% at cycle initial power distribution measurement(b)
Detector segments(a) 40% following initial cycle power distribution measurement 6 Detector segments/quadrant above core mid-plane 6 Detector segments/quadrant below core mid-plane Reactor Power                  One indication(d)
RCS Cold Leg Temperature       Two (2) Channels Control Rod Bank Positions     One (1) indication per bank(e)
(a) Required at THERMAL POWER  25%.
(b) The requirement of 75% detector segments for initial power distribution measurement is not continuously monitored and is administratively implemented.
(c) A detector segment is the difference in signal from two OPERABLE detectors in the same assembly or a single detector signal for the shortest OPERABLE detector in an assembly.
(d) Either calorimetric or average of available T channels.
(e) Either a bank group demand or Digital Rod Position Indication.
AP1000 STS                                   B 3.2.5-8                                   Rev. 1

RTS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Trip System (RTS) Instrumentation BASES BACKGROUND            The RTS initiates a unit shutdown, based on the values of selected unit parameters, to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs) and to assist the Engineered Safety Feature Actuation System (ESFAS) in mitigating accidents.
The Protection and Safety Monitoring System (PMS) has been designed to ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RTS, as well as specifying LCOs on other reactor system parameters and equipment performance.
Technical Specifications are required by 10 CFR 50.36 to include LSSS for variables that have significant safety functions. LSSS are defined by the regulation as Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded. The Safety Analysis Limit (SAL) is the limit of the process variable at which a protective action is initiated, as established by the safety analysis, to ensure that an SL is not exceeded.
However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the SAL to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur. The LSSS values are identified and maintained in the Setpoint Program (SP) and are controlled by 10 CFR 50.59 and the approved setpoint methodology.
The Nominal Trip Setpoint (NTS) specified in the SP is a predetermined field setting for a protection channel chosen to initiate automatic actuation prior to the process variable reaching the SAL and, thus, ensures that the SL is not exceeded. As such, the NTS accounts for uncertainties in setting the channel (e.g., calibration), uncertainties in how the channel might actually perform (e.g., repeatability), changes in the point of action of the channel over time (e.g., drift during Surveillance intervals), and any other factors that may influence its actual performance (e.g., harsh accident environments). In this manner, the NTS ensures that the SLs are not exceeded. Therefore, the NTS meets the 10 CFR 50.36 definition of an LSSS.
AP1000 STS                                   B 3.3.1-1                                        Rev. 1

RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as ...being capable of performing its safety functions(s). Relying solely on the NTS to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the as-found value of a protection channel setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule that are not necessary to ensure safety. For example, an automatic protection channel with a setting that has been found to be different from the NTS due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the NTS, and thus, the automatic protective action would still have ensured that the SL would not be exceeded with the as-found setting of the protection channel. Therefore, the channel would still be OPERABLE since it would have performed its safety function. If the as-found condition of the channel is near the as-found tolerance, recalibration is considered appropriate to allow for drift during the next Surveillance interval.
During AOOs, which are those events expected to occur one or more times during the unit life, the acceptable limits are:
: 1. The departure from nucleate boiling ratio (DNBR) shall be maintained above the SL value to prevent departure from nucleate boiling (DNB);
: 2. Fuel centerline melt shall not occur; and
: 3. The RCS pressure SL of 2750 psia shall not be exceeded.
Operation within the SLs of Specification 2.0, Safety Limits (SLs), also maintains the above values and ensures that offsite doses are within the acceptance criteria during AOOs.
Design basis accidents (DBAs) are events that are analyzed even though they are not expected to occur during the unit life. The acceptable limit during accidents is that the offsite dose shall be maintained within an acceptable fraction of the limits. Different accident categories are allowed a different fraction of these limits, based on the probability of occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.
AP1000 STS                             B 3.3.1-2                                        Rev. 1

RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
The RTS maintains Surveillance on key process variables that are directly related to equipment mechanical limitations, such as pressure, and on variables that directly affect the heat transfer capability of the reactor, such as flow and temperature. Some limits, such as Overtemperature T, are calculated in the Protection and Safety Monitoring System cabinets from other parameters when direct measurement of the variable is not possible.
Protection and Safety Monitoring System (PMS)
The PMS contains the necessary equipment to (Ref. 1):
* Permit acquisition and analysis of the sensor inputs, including plant process sensors and nuclear instrumentation, required for reactor trip and engineered safety feature (ESF) calculations;
* Perform computation or logic operations on variables based on these inputs;
* Provide trip signals to the reactor trip switchgear and ESF actuation data to the ESF coincidence logic as required;
* Permit manual trip or bypass of each individual reactor trip Function and permit manual actuation or bypass of each individual automatic ESF Function;
* Provide data to other systems in the instrumentation and control (I&C) architecture;
* Provide additional redundancy (within a single division) for the reactor trips and ESF actuations; and
* Provide isolation circuitry for control functions that require input from sensors that are also required for protection Functions.
AP1000 STS                             B 3.3.1-3                                         Rev. 1

RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
PMS Overview The four divisions of PMS each consist of the following:
* Field Transmitters and Sensors (non-redundant)
* Nuclear Instrumentation System (NIS) - 1 per division (non-redundant)
* Bistable Processor Logic (BPL) System - 2 BPL subsystems per division (redundant)
* Local Coincidence Logic (LCL) System - 2 LCL subsystems per division (redundant), each subsystem with two reactor trip processors (non-redundant)
* Reactor Trip Initiation Logic - 2 Reactor Trip Matrices (RTMs) per division (undervoltage (UV) and shunt trip (ST) - redundant)
* Reactor Trip Breakers (RTBs) - 2 per division (non-redundant). See LCO 3.3.7, RTS Trip Actuation Devices, for further discussion.
The vital buses that power each PMS division are backed up by the battery bank in the same division. See LCO 3.8.1, DC Sources -
Operating, for further discussion.
PMS equipment duplication within a division (redundancy) is generally provided for active equipment such as processors and communication hardware. Where provided, redundant sets of equipment within a division are not independent and can be subject to common cause failures. This redundancy is provided to increase plant availability and facilitate Surveillance testing. A division or channel is OPERABLE if it is capable of performing its specified safety function(s) and all the required supporting functions or systems are also capable of performing their related support functions.
Within each division, the sensor signals and setpoint bistables are processed in the BPL. The results of the bistable logic (partial reactor trip signals) are communicated to the LCL subsystems in all divisions. The LCL subsystems perform the divisional voting logic (e.g., two-out-of-four (2oo4) logic) and other associated logic.
AP1000 STS                             B 3.3.1-4                                      Rev. 1

RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
Within each division, the LCL reactor trip contact outputs are inputs to two RTMs: one for the RTB UV mechanism (coil), and one for the ST mechanism (coil). The RTMs trip the RTBs by deenergizing the UV coils and energizing the ST coils. Each of the four PMS divisions has two reactor trip circuit breakers. The reactor is tripped when the RTBs in two or more divisions are opened.
Reactor Trip (RT) Channel An RT channel extends from the sensor to the output of the associated BPL subsystem and shall include the sensor (or sensors), the signal conditioning, the BPL subsystem, and associated datalinks to the LCL subsystems. For RT channels containing nuclear instrumentation, the RT channel also includes the signal processing and power supplies for the neutron flux detectors provided by the NIS. In some cases, sensors provide inputs to more than one RT Function. Thus, an inoperability of a shared sensor can affect the OPERABILITY of more than one RT Function.
Automatic Trip Logic The Automatic Trip Logic includes the LCL subsystems and Reactor Trip Initiation logic matrices, including the outputs of the various RT channels (BPL outputs). It does not include the RTBs.
PMS Division The PMS consists of four redundant divisions, designated A, B, C, and D.
All safety system divisions are physically, functionally, and electrically separated from each other and from non-safety systems. Redundant divisions are provided to satisfy single failure criteria and improve plant availability. Each PMS division actuates two RTBs. Actuation of the RTBs in two divisions will trip the reactor.
Field Transmitters and Sensors Normally, four redundant measurements using four separate sensors are made for each variable used for reactor trip. One measurement is processed by each division. The use of four channels for protection Functions is based on a minimum of two channels being required for a reactor trip (e.g., two-out-of-four (2oo4) voting logic), with one channel in test or bypass, and a single failure on the remaining channel. Minimum requirements for protection are achieved with only three channels AP1000 STS                               B 3.3.1-5                                      Rev. 1

RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
OPERABLE. The fourth channel is provided to increase plant availability and permits the plant to run for an indefinite time with a single channel out of service. The circuit design is able to withstand both an input failure to the control system, which may then require the protection Function actuation, and a single failure in the other channels providing the protection Function actuation.
Analog measurements are converted to digital form by analog to digital (A/D) converters within the BPL subsystems. Signal conditioning may be applied to selected inputs following the conversion to digital form.
Except for selected dual element resistance temperature detectors (RTDs), the sensors within each division are non-redundant.
Nuclear Instrumentation System (NIS)
In each division the NIS cabinet provides signal processing and power supplies for the Source Range, Intermediate Range, and Power Range Neutron Flux detectors. The analog and digital pulse signals generated are sent to the BPL for processing. Within each division, each transmitter, sensor, and NIS signal is input in parallel to both BPLs.
Bistable Processor Logic (BPL) System Each PMS division contains two identical and redundant BPL subsystems receiving the same input signals and performing the same calculations and logic. The BPL subsystems receive data from field sensors and manual inputs (such as system-level blocks and resets) from the main control room (MCR) to perform the protection Function calculations.
Within each division, the input from each sensor is provided in parallel to each of the two BPL subsystems' analog or digital input modules. Analog transmitter and sensor measurements are converted from analog to digital form by analog to digital input modules within the BPL subsystems.
Signal conditioning may be applied to selected inputs following the conversion to digital form. The subsystems provide signal outputs for MCR indications and, via the Plant Control System (PLS), for non-safety Remote Shutdown Workstation indications.
Following necessary calculations, processing, and logic, the measurements are compared to the applicable setpoints. The basis of the setpoints is described in References 2 and 3. The results of the required calculations and setpoint comparisons determine the partial trip status for each RT Function.
AP1000 STS                             B 3.3.1-6                                        Rev. 1

RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
The partial RT signals are transmitted to all eight LCLs in the PMS for use in coincidence logic voting. The PMS uses datalinks to communicate the partial trip signals and related status information calculated in the BPL subsystems to the LCL subsystems. These datalinks are used both locally within a division and externally across divisions. A partial trip signal from either BPL subsystem in a division is interpreted by the LCL subsystem as a partial trip signal.
During periodic tests and maintenance performed using the Maintenance and Test Panel and Interface and Test Processor, each BPL subsystem is tested individually. During testing, the LCL processors use the redundant BPL subsystem output for trip status. This permits the division being tested to remain OPERABLE while the testing is being conducted.
In combination with manual tests required by Surveillance Requirements, the BPLs are tested via continuous system self-checking features.
Local Coincidence Logic (LCL) System Each PMS division contains two identical and redundant LCL subsystems receiving the same input signals and performing the same logic. The LCL subsystems perform the logic to combine the partial trip signals from the BPL subsystems and generate a trip output signal to the Reactor Trip Initiation logic.
Eight LCL subsystems are provided in the PMS architecture. Each of the LCL subsystems receives partial reactor trip signals and status signals from each of the eight BPL subsystems. In normal operation, the LCL subsystem logic is programmed to assume that a partial trip signal in either BPL subsystem in a given division is equivalent to a partial trip signal.
In the event of a single BPL processor or associated datalink failure in a division is detected by diagnostics, the LCL subsystem logic will reject the input from the failed component and use the input from the other BPL subsystem from the affected division as the source of the trip information.
This allows the trip Function logic to remain in a 2oo4 logic configuration.
LCL processors will only permit bypass of both BPL inputs of a given trip Function from one division (such as due to a failed sensor). In the event of a division bypass, the LCL reverts to bypass logic in the affected trip Function (e.g., 2oo3 for 2oo4 logic). The LCL subsystems act to initiate a reactor trip when the required number of divisions (channels of a trip Function) reaches a partial trip state (e.g., 2oo4, 1oo2).
AP1000 STS                              B 3.3.1-7                                        Rev. 1

RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued)
Each LCL subsystem provides four contact outputs to the Reactor Trip Initiation logic, two for the UV RTM and two for the ST RTM.
The LCL also provides for the bypass of trip Functions to accommodate periodic tests and maintenance. During LCL subsystem testing, each LCL subsystem is tested individually. During testing, the redundant LCL subsystem is available to provide the UV and ST output signals to the RTMs. This permits the division being tested to remain OPERABLE while the testing is being conducted. In combination with manual tests required by Surveillance Requirements, the LCLs are tested via continuous system self-checking features.
Reactor Trip Initiation Logic The RTM acts as an interface between the LCL subsystems and the RTBs. The RTM receives contact inputs from the LCL subsystems and performs the logic to determine if a division will issue an RT command.
Each PMS division contains two redundant RTMs; one is configured as an ST matrix and the other as a UV matrix. The combination of the two forms the complete RTM for a given division. If the ST logic is satisfied, the RTB ST coils are energized, opening both RTBs in the division. If the UV logic is satisfied, the RTB UV coils are de-energized, opening both RTBs in the division.
The PMS boundary ends at the interposing relay contacts of the RTMs.
Manual RT A manual RT is initiated from the MCR by redundant momentary switches. The switches directly control the power from the RTM logic, actuating the UV and ST attachments in all four divisions.
Nominal Trip Setpoint (NTS)
The NTS is the nominal value at which the trip output is set (trip setpoint).
Any trip output is considered to be properly adjusted when the as-left value is within the band for CHANNEL CALIBRATION (i.e., plus or minus rack calibration accuracy).
The NTSs used in the trip output are based on the SALs stated in Reference 2. The determination of these NTSs is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrument drift, AP1000 STS                              B 3.3.1-8                                     Rev. 1

RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued) and severe environment errors for those RTS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 4), the NTSs specified in the SP are conservative with respect to the SALs. A detailed description of the methodology used to calculate the NTSs, including their explicit uncertainties, is provided in the Westinghouse Setpoint Methodology for Protection Systems (Ref. 3). The as-left tolerance and as-found tolerance band methodology is provided in the SP.
The NTSs listed in the SP are based on the methodology described in Reference 3, which incorporates all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each NTS. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes. Transmitter and signal processing equipment calibration tolerances and drift allowances must be specified in plant calibration procedures, and must be consistent with the values used in the setpoint methodology.
The OPERABILITY of each transmitter or sensor can be evaluated when its as-found calibration data are compared against the as-left data and are shown to be within the setpoint methodology assumptions. The basis of the setpoints is described in References 2 and 3. Trending of calibration results is required by the program description in Technical Specification 5.5.14.d.
Note that the as-left and as-found tolerances listed in the SP define the OPERABILITY limits for a channel during a periodic CHANNEL CALIBRATION. Trip setpoints are continuously and automatically verified by PMS self-checking features between performances of CHANNEL CALIBRATIONS. Before unit startup, the CHANNEL CALIBRATION verifies that the trip setpoint values in the Maintenance and Test Panel (MTP) match the NTS values specified in the SP.
The PMS testing features are designed to allow for complete testing by using a combination of system self-checking and manual tests.
Successful testing consists of verifying that the capability of the system to perform the safety function has not failed or degraded. For hardware functions this would involve verifying that the hardware components and connections have not failed or degraded. Since software does not degrade, software functional testing involves verifying that the software code has not changed and that the software code is executing. To the extent possible, PMS testing will be accomplished with continuous system self-checking features in lieu of manual Surveillance tests. As a result, AP1000 STS                              B 3.3.1-9                                       Rev. 1

RTS Instrumentation B 3.3.1 BASES BACKGROUND (continued) some protective functions do not have manual Surveillance Requirements.
The PMS incorporates continuous system self-checking features wherever practical. Self-checking features include on-line diagnostics for the computer system and the hardware and communications tests. Faults detected by the self-checking features are alarmed in the MCR to alert the operator. These self-checking tests do not interfere with normal system operation.
Manual tests are included for those parts of the system that are not tested with self-checking features. This includes manual functional checks, calibration verification, response time testing, and actuated component testing. The test features again include a combination of continuous testing features and manual testing features.
All of the tests are designed so that the duration of the testing is as short as possible. The manual tests are designed so that the actual logic is not modified. To prevent unwanted actuation, the tests are designed with the capability to bypass a protection Function during testing and/or limit the number of signals allowed to be placed in test at one time.
APPLICABLE        The RTS functions to maintain compliance with the SLs during all AOOs SAFETY            and mitigates the consequences of DBAs in all MODES in which the ANALYSES, LCO,    RTBs are closed.
and APPLICABILITY Each of the analyzed accidents and transients which require reactor trip can be detected by one of more RTS Functions. The accident analysis described in Reference 2 takes credit for most RTS trip Functions. RTS trip Functions not specifically credited in the accident analysis were qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the plant. These RTS trip Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate function performance. These RTS trip Functions may also serve as backups to RTS trip Functions that were credited in the accident analysis.
Permissive and interlock functions are based on the associated protection Function instrumentation. Because they do not have to operate in adverse environmental conditions, the trip settings of the permissive and interlock functions use the normal environment, steady-state instrument uncertainties of the associated protection Function. This AP1000 STS                              B 3.3.1-10                                        Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) results in OPERABILITY criteria (i.e., as-found tolerance and as-left tolerance) that are the same as the associated protection Function sensor and process rack modules. The NTSs for permissives and interlocks are based on the associated protection Function OPERABILITY requirements; i.e., permissives and interlocks performing enabling functions must be set to occur prior to the specified trip setting of the associated protection Function.
The LCO requires all instrumentation performing an RTS Function, listed in Table 3.3.1-1 in the accompanying LCO, to be OPERABLE. The as-left and as-found tolerances specified in the SP define the OPERABILITY limits for a channel during a CHANNEL CALIBRATION.
As such, the as-left and as-found tolerances differ from the NTS by plus or minus the PMS rack calibration accuracy and envelope the expected calibration accuracy and drift. In this manner, the actual setting of the channel (NTS) prevents exceeding an SL at any given point in time as long as the channel has not drifted beyond the expected tolerances during the Surveillance interval. Note that the as-left and as-found recorded values must be confirmed to be within the assumptions of the statistical uncertainty calculations.
If the actual setting of the channel is found outside the as-found tolerance, the channel is considered inoperable. This condition of the channel will be further evaluated during performance of the Surveillance.
This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance), and evaluating the channel's response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.
A channel trip setting may be adjusted to be more conservative than the NTS as necessary in response to plant conditions. However, in this case, the OPERABILITY of this instrument must be verified based on the actual field setting and not the NTS. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
Reactor Trip System Interlocks Reactor protection interlocks are provided to ensure reactor trip Functions are in the correct configuration for the current plant status. They back up operator actions to ensure protection system Functions are not blocked AP1000 STS                             B 3.3.1-11                                       Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) during plant conditions in which the safety analysis assumes the Functions are OPERABLE. Therefore, the interlock does not need to be OPERABLE when the associated reactor trip Functions are outside the applicable MODES. Proper operation of these interlocks supports OPERABILITY of the associated reactor trip Functions and/or the requirement for actuation logic OPERABILITY. Interlocks must be in the required state, as appropriate, to support OPERABILITY of the associated reactor trip Functions. The interlocks are described below:
Intermediate Range Neutron Flux, P-6 The Intermediate Range Neutron Flux, P-6 interlock is actuated when the respective PMS division Intermediate Range Neutron Flux channel increases to approximately one decade above the channel lower range limit. The P-6 interlock ensures that the following are performed:
(1) On increasing power, the P-6 interlock allows the manual block of the respective PMS division Source Range Neutron Flux  High Setpoint reactor trip Function channel (LCO 3.3.2, RTS Source Range Instrumentation). This prevents a premature block of the Source Range Neutron Flux  High Setpoint reactor trip Function channel and allows the operator to ensure that the Intermediate Range Neutron Flux  High reactor trip Function channels (LCO 3.3.3, RTS Intermediate Range Instrumentation) are OPERABLE prior to leaving the source range. When a Source Range Neutron Flux  High Setpoint reactor trip Function channel is blocked, the high voltage to the detector of the Source Range Neutron Flux channel is also removed.
(2) On decreasing power, the P-6 interlock automatically energizes the respective PMS division Source Range Neutron Flux detector and enables the respective PMS division Source Range Neutron Flux High Setpoint reactor trip Function channel.
(3) On decreasing power, the P-6 interlock automatically resets the flux doubling block control ensuring the source range neutron flux doubling circuit (LCO 3.3.8 Function 17, Source Range Neutron Flux Doubling) is enabled. Normally, the source range neutron flux doubling circuit actuation of the Boron Dilution Block and Chemical and Volume Control System (CVS) isolation functions is manually blocked above P-6 by the MCR operator during the reactor startup.
AP1000 STS                             B 3.3.1-12                                    Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Reactor Coolant Average Temperature (Tavg), P-9 With Tavg channels less than the P-9 setpoint, the operator can manually block the Steam Generator Narrow Range Water Level  Low 2 reactor trip Function. This allows rod testing during routine maintenance. With Tavg channels greater than P-9 setpoint, the Steam Generator Narrow Range Water Level  Low 2 reactor trip Function is automatically unblocked.
Power Range Neutron Flux, P-10 The Power Range Neutron Flux, P-10 interlock is actuated at approximately 10% RTP as determined by the respective PMS division Power Range Neutron Flux channel detectors. The P-10 interlock ensures that the following are performed:
(1) On increasing power, the respective PMS division P-10 interlock channel automatically enables reactor trips on the following Functions:
* Pressurizer Pressure  Low 2 Setpoint (RTS Function 5.a),
* Pressurizer Water Level  High 3 (RTS Function 6),
* Reactor Coolant Flow  Low 2 (RTS Function 7), and
* Reactor Coolant Pump (RCP) Speed  Low 2 (RTS Function 9).
These reactor trip Functions are only required when operating above the P-10 setpoint (approximately 10% power). These reactor trips provide protection against violating the DNBR limit. Below the P-10 setpoint, the RCS is capable of providing sufficient natural circulation without any RCP running.
(2) On increasing power, the P-10 interlock allows the operator to manually block the Intermediate Range Neutron Flux  High reactor trip Function (LCO 3.3.3).
(3) On increasing power, the P-10 interlock allows the operator to manually block the Power Range Neutron Flux  Low Setpoint reactor trip (RTS Function 1.b).
(4) On increasing power, the respective PMS division P-10 interlock channel automatically provides a backup signal to block the respective PMS division Source Range Neutron Flux reactor trip channel (LCO 3.3.2) and also to de-energize the respective PMS division Source Range Neutron Flux detector.
AP1000 STS                             B 3.3.1-13                                      Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
(5) On decreasing power, the P-10 interlock automatically blocks reactor trips on the following Functions:
* Pressurizer Pressure  Low 2 Setpoint,
* Pressurizer Water Level  High 3,
* Reactor Coolant Flow  Low 2, and
* RCP Speed  Low 2.
(6) On decreasing power, the respective PMS division P-10 interlock channel automatically enables the respective Power Range Neutron Flux  Low Setpoint reactor trip channel and the respective Intermediate Range Neutron Flux  High reactor trip (and rod stop) channel.
Pressurizer Pressure, P-11 With pressurizer pressure channels less than the P-11 setpoint, the operator can manually block the Steam Generator Narrow Range Water Level  High 3 reactor trip signal (RTS Function 11). This allows rod testing with the steam generators in cold wet layup. With pressurizer pressure channels greater than the P-11 setpoint, the Steam Generator Narrow Range Water Level  High 3 reactor trip Function is automatically enabled. The operator can also enable these actuations by use of the respective manual reset.
The LCO generally requires OPERABILITY of four channels in each RTS instrumentation Function.
Reactor Trip System Functions The safety analyses and OPERABILITY requirements applicable to each RTS Function are discussed below:
: 1. Power Range Neutron Flux The Power Range Neutron Flux detectors are located external to the reactor vessel and measure neutrons leaking from the core. The Power Range Neutron Flux detectors provide input to the PLS.
Minimum requirements for protection and control are achieved with three channels OPERABLE. The fourth channel is provided to increase plant availability and permits the plant to run for an indefinite time with a single channel in trip or bypass. This Function also satisfies the requirements of IEEE 603 (Ref. 5) with 2oo4 logic.
AP1000 STS                              B 3.3.1-14                                     Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
This Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor. Each flux signal is compensated for changes in cold leg density, using cold leg temperature and pressurizer pressure.
: a. Power Range Neutron Flux  High Setpoint The Power Range Neutron Flux  High Setpoint trip Function provides backup protection, at high power levels, against a positive reactivity excursion during power operations. Positive reactivity excursions can be caused by rod withdrawal or reductions in RCS temperature.
The LCO requires four Power Range Neutron Flux  High Setpoint channels to be OPERABLE in MODES 1 and 2.
In MODE 1 or 2, when a positive reactivity excursion could occur, the Power Range Neutron Flux  High Setpoint trip Function must be OPERABLE. This Function provides a backup trip to Overtemperature T, Overpower T, and Power Range Neutron Flux  High Positive Rate to terminate the reactivity excursion and shut down the reactor. In MODE 3, 4, 5, or 6, the Power Range Neutron Flux  High Setpoint trip Function does not have to be OPERABLE because the reactor is shutdown and a reactivity excursion in the power range cannot occur. Other RTS Functions and administrative controls provide protection against reactivity additions when in MODE 3, 4, 5, or 6. In addition, the Power Range Neutron Flux detectors cannot detect neutron flux levels in this range.
: b. Power Range Neutron Flux  Low Setpoint The LCO requirement for the Power Range Neutron Flux  Low Setpoint trip Function ensures that protection is provided against a positive reactivity excursion from low power or subcritical conditions. The NTS reflects only steady state instrument uncertainties as this Function does not provide primary protection for any event that results in a harsh environment.
AP1000 STS                           B 3.3.1-15                                        Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The LCO requires four of the Power Range Neutron Flux  Low Setpoint channels to be OPERABLE in MODE 1 below the Power Range Neutron Flux P-10 setpoint and in MODE 2.
In MODE 1, below the Power Range Neutron Flux P-10 setpoint and in MODE 2, the Power Range Neutron Flux  Low Setpoint trip Function must be OPERABLE. Each channel of this Function may be manually blocked by the operator when the respective division Power Range Neutron Flux channel is greater than approximately 10% of RTP (P-10 setpoint). Each channel of this Function is automatically unblocked when the respective division Power Range Neutron Flux channel is below the P-10 setpoint. Above the P-10 setpoint, positive reactivity additions are mitigated by the Power Range Neutron Flux High Setpoint trip Function.
In MODE 3, 4, 5, or 6, the Power Range Neutron Flux  Low Setpoint trip Function does not have to be OPERABLE because the reactor is shutdown and the Power Range Neutron Flux detectors cannot detect the neutron flux levels generated in MODES 3, 4, 5, and 6. Other RTS trip Functions and administrative controls provide protection against positive reactivity additions or power excursions in MODE 3, 4, 5, or 6.
: 2. Power Range Neutron Flux  High Positive Rate The Power Range Neutron Flux  High Positive Rate trip Function ensures that protection is provided against moderate to rapid increases in neutron flux which are characteristic of an uncontrolled rod cluster control assembly (RCCA) withdrawal or a drive rod housing rupture and the accompanying ejection of the RCCA. This Function works with Overtemperature T and Overpower T trip functions, through overlap, to prevent overpower and low DNBR for moderate to rapid power excursions. The Power Range Neutron Flux  High Positive Rate trip Function uses the same Power Range Neutron Flux channels as discussed for Function 1 above. Each flux signal is compensated for changes in cold leg density, using cold leg temperature and pressurizer pressure.
The LCO requires four Power Range Neutron Flux  High Positive Rate channels to be OPERABLE. In MODE 1 or 2, when there is a potential to add positive reactivity from an uncontrolled RCCA withdrawal or a rod ejection accident (REA), the Power Range AP1000 STS                           B 3.3.1-16                                      Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Neutron Flux - High Positive Rate trip must be OPERABLE. In MODE 3, 4, 5, or 6, the Power Range Neutron Flux - High Positive Rate trip Function does not have to be OPERABLE because other RTS trip Functions and administrative controls will provide protection against positive reactivity additions. Also, since only the shutdown banks may be withdrawn in MODE 3, 4, or 5, the remaining complement of control bank worth ensures an SDM in the event of an REA. In MODE 6, no rods are withdrawn and the SDM is increased during refueling operations. The reactor vessel head is also removed or overpressure protection is provided by meeting the requirements of LCO 3.4.14, Low Temperature Overpressure Protection (LTOP). In addition, the Power Range Neutron Flux detectors cannot detect neutron flux levels present in MODE 6.
: 3. Overtemperature T The Overtemperature T trip Function provides protection to ensure that the design limit DNBR is met. This trip Function also limits the range over which the Overpower T trip Function must provide protection. This Function works with the Power Range Neutron Flux High Positive Rate trip Function to provide DNB protection for low to moderate positive reactivity excursions due to uncontrolled RCCA withdrawal events. The inputs to the Overtemperature T trip Function include all combinations of pressure, power, coolant temperature, and axial power distribution, assuming full reactor coolant flow. Protection from violating the DNBR limit is ensured for those transients that are slow with respect to delays from the core to the measurement system. The Overtemperature T trip Function uses the measured Thot and Tcold in each loop, together with the measured pressurizer pressure, to compute the reactor core THERMAL POWER. Equations to fit the properties of density and enthalpy are programmed in the software, such that the T power signal is presented as a percent of RTP for direct comparison with measured calorimetric power. The Overtemperature T trip setpoint is automatically varied for changes in the parameters that affect DNB as follows:
* Reactor core inlet temperature  the trip setpoint is varied to correct for changes in core inlet temperature based on measured changes in cold leg temperature with dynamic compensation to account for cold leg-to-core transit time;
* Pressurizer pressure  the trip setpoint is varied to correct for changes in system pressure; and AP1000 STS                            B 3.3.1-17                                       Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
* Axial power distribution  the trip setpoint is varied to account for imbalances in the axial power distribution as detected by the upper and lower Power Range Neutron Flux detectors. If axial peaks are greater than the design limit, as indicated by the difference between the upper and lower Power Range Neutron Flux detectors, the trip setpoint is reduced in accordance with algorithms documented in the SP.
Dynamic compensation of the T power signal is included for system piping delays from the core to the temperature measurement system. The Overtemperature T trip Function is calculated for each loop as described in the SP. A detailed description of this trip Function is provided in Reference 6. This Function also provides a signal to generate a turbine runback prior to reaching the NTS. A turbine runback will reduce turbine power and reactor power. A reduction in power will normally alleviate the Overtemperature T condition and may prevent a reactor trip. No credit is taken in the safety analyses for the turbine runback.
The LCO requires four channels (two per loop) of the Overtemperature T trip Function to be OPERABLE in MODES 1 and 2. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function. Note that the Overtemperature T trip Function receives input from channels shared with other RTS Functions. Failures that affect multiple RTS Functions require entry into the Conditions applicable to all affected RTS Functions.
In MODE 1 or 2, the Overtemperature T trip Function must be OPERABLE to prevent DNB. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about DNB.
: 4. Overpower T The Overpower T trip Function provides protection to ensure the integrity of the fuel (i.e., no fuel pellet melting and less than 1%
cladding strain) under all possible overpower conditions. This trip Function also limits the required range of the Overtemperature T trip Function. This Function works with the Power Range Neutron Flux  High Positive Rate trip Function to limit overpower for low to moderate positive reactivity excursions due to uncontrolled RCCA AP1000 STS                            B 3.3.1-18                                        Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) withdrawal events. The Overpower T trip Function ensures that the allowable heat generation rate (kW/ft) of the fuel is not exceeded.
It uses the same T power signal generated for the Overtemperature T. The trip setpoint is automatically varied with the following parameter:
* Axial power distribution  the trip setpoint is varied to account for imbalances in the axial power distribution as detected by the upper and lower Power Range Neutron Flux detectors. If axial peaks are greater than the design limit, as indicated by the difference between the upper and lower Power Range Neutron Flux detectors, the trip setpoint is reduced in accordance with algorithms documented in the SP.
The Overpower T trip Function is calculated for each loop as described in the SP. A detailed description of this trip Function is provided in Reference 6. The NTS reflects the inclusion of both steady state and adverse environmental instrument uncertainties as the detectors provide protection for a steam line break and may be in a harsh environment. Note that this trip Function also provides a signal to generate a turbine runback prior to reaching the NTS. A turbine runback reduces turbine power and reactor power. A reduction in power normally alleviates the Overpower T condition and may prevent a reactor trip.
The LCO requires four channels (two per loop) of the Overpower T trip Function to be OPERABLE in MODES 1 and 2. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function. The Overpower T trip Function receives input from channels shared with other RTS Functions. Failures that affect multiple RTS Functions require entry into the Conditions applicable to all affected RTS Functions.
In MODE 1 or 2, the Overpower T trip Function must be OPERABLE. These are the only times that enough heat is generated in the fuel to be concerned about the heat generation rates and overheating of the fuel. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about fuel overheating and fuel damage.
AP1000 STS                           B 3.3.1-19                                         Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 5. Pressurizer Pressure The same sensors provide input to the Pressurizer Pressure High 2 and  Low 2 trip Functions and the Overtemperature T trip Function.
: a. Pressurizer Pressure  Low 2 The Pressurizer Pressure  Low 2 trip Function ensures that protection is provided against violating the DNBR limit due to low pressure. The NTS reflects both steady state and adverse environmental instrument uncertainties as the detectors provide primary protection for an event that results in a harsh environment.
The LCO requires four channels of the Pressurizer Pressure Low 2 trip Function to be OPERABLE in MODE 1 above P-10.
Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function.
In MODE 1, when DNB is a major concern, the Pressurizer Pressure  Low 2 trip Function must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-10 interlock. On decreasing power, this trip Function is automatically blocked below P-10. Below the P-10 setpoint, no conceivable power distributions can occur that would cause DNB concerns.
: b. Pressurizer Pressure  High 2 The Pressurizer Pressure  High 2 trip Function ensures that protection is provided against overpressurizing the RCS. This trip Function operates in conjunction with the safety valves to prevent RCS overpressure conditions. The NTS reflects only steady state instrument uncertainties as the detectors do not provide primary protection for any event that results in a harsh environment.
The LCO requires four channels of the Pressurizer Pressure High 2 trip Function to be OPERABLE in MODES 1 and 2. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function.
AP1000 STS                          B 3.3.1-20                                      Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
In MODE 1 or 2, the Pressurizer Pressure  High 2 trip Function must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the safety valves. In MODE 3, 4, 5, or 6, the Pressurizer Pressure  High 2 trip Function does not have to be OPERABLE because transients which could cause an overpressure condition will be slow to occur. Therefore, the operator will have sufficient time to evaluate plant conditions and take corrective actions. Additionally, low temperature overpressure protection systems provide overpressure protection when MODE 4 with any cold leg temperature 275&deg;F, in MODE 5, and in MODE 6 with the reactor vessel head on, as required by LCO 3.4.14, Low Temperature Overpressure Protection.
: 6. Pressurizer Water Level  High 3 The Pressurizer Water Level  High 3 Setpoint trip Function provides a backup signal for the Pressurizer Pressure  High 2 Setpoint trip Function and also provides protection against water relief through the pressurizer safety valves. These valves are designed to pass steam in order to achieve their design energy removal rate. Each water level signal is compensated using pressurizer reference leg temperature, pressurizer pressure and RCS wide range pressure. A reactor trip is actuated prior to the pressurizer becoming water solid.
The NTS reflects only steady state instrument uncertainties as the detectors do not provide primary protection for any event that results in a harsh environment. The level channels do not actuate the safety valves.
The LCO requires four channels of the Pressurizer Water Level -
High 3 trip Function to be OPERABLE in MODE 1 above P-10. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function.
In MODE 1 when there is a potential for overfilling the pressurizer, the Pressurizer Water Level  High 3 trip Function must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-10 interlock. On decreasing power, this trip Function is automatically blocked below P-10. Below the P-10 setpoint, transients that could raise the pressurizer water level will be slow and the operator will have sufficient time to evaluate plant conditions and take corrective actions.
AP1000 STS                            B 3.3.1-21                                       Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 7. Reactor Coolant Flow  Low 2 The Reactor Coolant Flow  Low 2 trip Function ensures that protection is provided against violating the DNBR limit due to low flow in one or more RCS hot legs. Above the P-10 setpoint, a loss of flow in any RCS hot leg will actuate a reactor trip.
Each RCS hot leg has four flow detectors to monitor flow. Each flow signal is compensated for changes in reactor coolant density using the T power signal. The NTS reflects only steady state instrument uncertainties as the detectors do not provide primary protection for any event that results in a harsh environment. Two first-order lag filters in series are used to reduce noise on the input signals.
The LCO requires four Reactor Coolant Flow  Low 2 channels per hot leg to be OPERABLE in MODE 1 above P-10. Four OPERABLE channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function In MODE 1 above the P-10 setpoint, when a loss of flow in one RCS hot leg could result in DNB conditions in the core, the Reactor Coolant Flow  Low 2 trip Function must be OPERABLE.
: 8. Reactor Coolant Pump (RCP) Bearing Water Temperature  High 2 The RCP Bearing Water Temperature  High 2 reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in one RCS cold leg. This trip Function is lead-lag compensated. The NTS reflects only steady state instrument uncertainties as the detectors do not provide primary protection for any event that results in a harsh environment.
The LCO requires four RCP Bearing Water Temperature  High 2 channels per RCP to be OPERABLE in MODES 1 and 2. Four channels are provided to permit one channel in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function.
In MODE 1 or 2, when a loss of flow in any RCS cold leg could result in DNB conditions in the core, the RCP Bearing Water Temperature High 2 trip Function must be OPERABLE.
AP1000 STS                             B 3.3.1-22                                      Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 9. Reactor Coolant Pump Speed  Low 2 The RCP Speed  Low 2 trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS cold legs. The speed of each RCP is monitored.
Above the P-10 setpoint a low speed detected on two or more RCPs will initiate a reactor trip. The NTS reflects only steady state instrument uncertainties as the detectors do not provide primary protection for any event that results in a harsh environment.
The LCO requires four RCP Speed  Low 2 channels (one per pump) to be OPERABLE in MODE 1 above P-10. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function.
In MODE 1 above the P-10 setpoint, the RCP Speed  Low 2 trip Function must be OPERABLE. Below the P-10 setpoint, all reactor trips on loss of flow are automatically blocked since no power distributions are expected to occur that would cause a DNB concern at this low power level. Above the P-10 setpoint, the reactor trip on loss of flow in two or more RCS cold legs is automatically enabled.
: 10. Steam Generator Narrow Range Water Level  Low 2 The Steam Generator (SG) Narrow Range Water Level  Low 2 trip Function ensures that protection is provided against a loss of heat sink. The SGs are the heat sink for the reactor. In order to act as a heat sink, the SGs must contain a minimum amount of water. A narrow range Low 2 water level in any SG is indicative of a loss of heat sink for the reactor. Each water level signal is compensated using steam line pressure. The NTS reflects the inclusion of both steady state and adverse environmental instrument uncertainties as the detectors provide primary protection for an event that results in a harsh environment. This trip Function also contributes to the coincidence logic for the ESFAS Function of opening the Passive Residual Heat Removal (PRHR) discharge valves.
The LCO requires four channels of SG Narrow Range Water Level Low 2 per SG to be OPERABLE in MODES 1 and 2. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function.
AP1000 STS                             B 3.3.1-23                                       Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
In MODES 1 and 2, when the reactor requires a heat sink, the SG Narrow Range Water Level  Low 2 trip Function must be OPERABLE. The normal source of water for the SGs is the Main Feedwater System (non-safety related). The Main Feedwater System is normally in operation in MODES 1 and 2. PRHR is the safety related backup heat sink for the reactor. During normal startups and shutdowns, the Main and Startup Feedwater Systems (non-safety related) can provide feedwater to maintain SG water level. In MODE 3, 4, 5, or 6, the SG Narrow Range Water Level Low 2 trip Function does not have to be OPERABLE because the reactor is not operating or even critical. The P-9 interlock is provided on this trip Function to permit bypass of the trip Function when Tavg is below P-9.
: 11. Steam Generator Narrow Range Water Level  High 3 The SG Narrow Range Water Level  High 3 trip Function ensures that protection is provided against excessive feedwater flow by closing the main feedwater control valves, tripping the turbine, and tripping the reactor. Each water level signal is compensated using steam line pressure. While the transmitters (differential pressure cells) are located inside containment, the events which this trip Function protects against cannot cause a severe environment in containment. Therefore, the NTS reflects only steady state instrument uncertainties.
The LCO requires four channels of the SG Narrow Range Water Level  High 3 trip Function per SG to be OPERABLE in MODES 1 and 2. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function.
In MODES 1 and 2 above the P-11 interlock, the SG Narrow Range Water Level  High 3 trip Function must be OPERABLE. The normal source of water for the SGs is the Main Feedwater System (non-safety related). The Main Feedwater System is only in operation in MODES 1 and 2. In MODE 3, 4, 5, or 6, the SG Narrow Range Water Level  High 3 trip Function does not have to be OPERABLE because the reactor is not operating or even critical. The P-11 interlock is provided on this trip Function to permit bypass of the trip Function when the pressure is below P-11. This bypass is necessary to permit rod testing when the steam generators are in wet layup.
AP1000 STS                            B 3.3.1-24                                       Rev. 1

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 12. Passive Residual Heat Removal Actuation The Passive Residual Heat Removal (PRHR) Actuation reactor trip Function ensures that a reactivity excursion due to cold water injection will be minimized upon an inadvertent operation of the PRHR discharge valves. The reactor trip is needed to ensure the reactor is tripped in the event PRHR is not initiated by ESFAS actuation signals. The two discharge valves for the PRHR HX are monitored by PMS using valve position indicators as inputs into PMS.
The LCO requires four channels of PRHR discharge valve position indication per valve to be OPERABLE in MODES 1 and 2. Four channels are provided to permit one channel in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function.
In MODES 1 and 2, the PRHR Actuation reactor trip Function must be OPERABLE. In MODES 3, 4, 5, and 6, the PRHR Actuation reactor trip Function does not have to be OPERABLE because the reactor is not operating or critical.
The RTS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS          A Note has been added to the ACTIONS table to clarify the application of Completion Time rules. The ACTIONS Conditions of this Specification may be entered independently for each RTS protection (trip) Function listed in Table 3.3.1-1.
In the event a channel's as-found condition is outside the as-found tolerance described in the SP, or the channel is not functioning as required, or the transmitter, instrument loop, signal processing electronics, or trip output is found inoperable, then that channel must be declared inoperable for each trip Function that uses the channel's partial trip signal in its LCL and the applicable ACTIONS Condition(s) entered for all affected trip Function(s).
A.1 Condition A addresses the situation where one required channel for one or more trip Functions is inoperable. With one channel inoperable, the inoperable channel must be placed in a bypass or trip condition within AP1000 STS                              B 3.3.1-25                                       Rev. 1

RTS Instrumentation B 3.3.1 BASES ACTIONS (continued) 6 hours. If one inoperable channel is bypassed, the coincidence logic becomes two out-of-three, while still meeting the single failure criterion.
(A failure in one of the three remaining channels will not prevent a reactor trip on any of the affected trip Function(s).) If one inoperable channel is tripped, the logic becomes one-out-of-three, while still meeting the single failure criterion. (A failure in one of the three remaining channels will not prevent a reactor trip on any of the affected trip Function(s).) The 6 hours allowed to place the inoperable channel(s) in the bypassed or tripped condition is justified in Reference 7.
B.1 and B.2 Condition B addresses the situation where one or more trip Functions have two required channels inoperable. With two channels for a trip Function inoperable, one inoperable channel must be placed in a bypass condition within 6 hours and one inoperable channel must be placed in a trip condition within 6 hours. If one channel is bypassed and one channel is tripped, the coincidence logic becomes one-out-of-two, while still meeting the single failure criterion. The 6 hours allowed to place the inoperable channels in the bypassed or tripped condition is justified in Reference 7.
C.1 Condition C addresses the situation where any Required Action and associated Completion Time of Condition A or B are not met, or three or more channels are inoperable for one or more trip Functions. Required Action C.1 directs entry into the appropriate ACTIONS Condition referenced in Table 3.3.1-1.
D.1 Condition D is entered from Required Action C.1 when any Required Action and associated Completion Time of Condition A or B are not met, or three or more channels are inoperable for one or more trip Functions, and it is identified as the appropriate Condition referenced in Table 3.3.1-1. If the channel(s) is not restored to OPERABLE status or placed in trip or bypass, as applicable, within the allowed Completion Time, or three or more channels are inoperable for a trip Function, the plant must be placed in MODE 3. Six hours are allowed to place the plant in MODE 3. This is a reasonable time, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging plant systems.
AP1000 STS                                B 3.3.1-26                                      Rev. 1

RTS Instrumentation B 3.3.1 BASES ACTIONS (continued)
E.1 Condition E is entered from Required Action C.1 when any Required Action and associated Completion Time of Condition A or B are not met, or three or more channels for one or more trip Functions are inoperable, and it is identified as the appropriate Condition referenced in Table 3.3.1-1. If the channel(s) is not restored to OPERABLE status or placed in trip or bypass, as applicable, within the allowed Completion Time of 6 hours, or three or more channels are inoperable for a trip Function, THERMAL POWER must be reduced to below the P-10 setpoint, which is a condition in which the LCO does not apply. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        The SRs for each RTS protection Function are identified in the SRs REQUIREMENTS        column of Table 3.3.1-1 for that reactor trip Function.
A Note has been added to the SRs table stating that Table 3.3.1-1 determines which SRs apply to each RTS protection Function.
SR 3.3.1.1 This SR compares the calorimetric heat balance to the nuclear instrumentation channel output every 24 hours. If the calorimetric measurement at  15% RTP differs from the nuclear instrument channel output by > 5% RTP, the nuclear instrument channel is not declared inoperable, but must be adjusted. If the nuclear instrument channel output cannot be properly adjusted, the channel is declared inoperable.
Two Notes modify this SR. The first Note clarifies that this Surveillance is required only if reactor power is  15% RTP and that 12 hours is allowed for performing the first Surveillance after reaching 15% RTP. At lower power levels the calorimetric data from feedwater flow venturi measurements are less accurate. The second Note is required because, at power levels  15% RTP, calorimetric uncertainty and control rod insertion create the potential for miscalibration of the nuclear instrumentation channel. Therefore, if the calorimetric heat measurement is  15% RTP, and if the nuclear instrumentation channel indicated power is lower than the calorimetric measurement by
                    > 5% RTP, then the nuclear instrumentation channel shall be adjusted upward to match the calorimetric measurement. No nuclear AP1000 STS                                 B 3.3.1-27                                    Rev. 1

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) instrumentation channel adjustment is required if the nuclear instrumentation channel is higher than the calorimetric measurement.
The Frequency of every 24 hours is adequate based on plant operating experience, considering instrument reliability and operating history data for instrument drift.
Together, these factors demonstrate that the change in the absolute difference between nuclear instrumentation and heat balance calculated powers rarely exceeds 5% RTP in any 24 hour period.
In addition, MCR operators periodically monitor redundant indications and alarms to detect deviations in channel outputs.
SR 3.3.1.2 This SR compares the calorimetric heat balance to the calculated T power (qT) in each Division every 24 hours. If the calorimetric measurement between 70% and 100% RTP differs from the calculated T power by > 3% RTP, the Function is not declared inoperable, but the conversion factor, T&deg;, must be adjusted. If T&deg; cannot be properly adjusted, the Function is declared inoperable in the affected Division(s).
Three Notes modify this SR. The first Note indicates that T&deg; shall be adjusted consistent with the calorimetric results if the absolute difference between the calculated T power and the calorimetric measurement between 70% and 100% RTP is > 3% RTP.
The second Note clarifies that this Surveillance is required only if reactor power is  50% RTP and that 12 hours is allowed for performing the first Surveillance after reaching 50% RTP. At lower power levels, the calorimetric data from feedwater flow venturi measurements are less accurate. The calculated T power is normally stable (less likely than the nuclear instrumentation to need adjustment or to be grossly affected by changes in the core loading pattern), and its calibration should not be unnecessarily altered by a possibly inaccurate calorimetric measurement at low power.
The third Note is required because at power levels below 70% RTP, calorimetric uncertainty creates the potential for non-conservative adjustment of the T&deg; conversion factor, in cases where the calculated T power would be reduced to match the calorimetric power. Therefore, if the calorimetric heat measurement is less than 70% RTP, and if the AP1000 STS                            B 3.3.1-28                                        Rev. 1

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) calculated T power is lower than the calorimetric measurement by
                > 5% RTP, then the T&deg; conversion factor shall be adjusted so that the calculated T power matches the calorimetric measurement. No T&deg; conversion factor adjustment is required if the calculated T power is higher than the calorimetric measurement.
The Frequency of every 24 hours is based on plant operating experience, considering instrument reliability and the limited effects of fuel burnup and rod position changes on the accuracy of the calculated T power.
SR 3.3.1.3 This SR compares the AXIAL FLUX DIFFERENCE (AFD) determined using the incore neutron flux detector system to the excore nuclear instrument channel AFD every 31 effective full power days (EFPD) and adjusts the excore nuclear instrument channel if the absolute difference between the incore and excore AFD is  1.5% AFD.
Each nuclear instrument channel is calibrated to an average weighted peripheral AFD, which accounts for the fact that neutron leakage from the peripheral fuel assemblies nearest each excore detector will have the largest effect on the channel response. This calibration method reduces the effect of changes in the radial power distribution, caused by either burnup or control rod motion, on the channel AFD calibration. The calibration method is consistent with the development of the f(I) penalty functions for the Overpower T and Overtemperature T reactor trip Functions, which are made a function of the same average weighted peripheral AFD (i.e., the AFD used in determining the f(I) penalty is calculated using the same radial weighting factors as are used to calibrate the excore detector nuclear instrument channels). The incore AFD used as the basis for comparison when performing this SR is also calculated in the same weighted peripheral manner.
If the absolute difference is  1.5% AFD the excore nuclear instrument channel is still OPERABLE, but must be readjusted. If the excore nuclear instrument channel cannot be properly readjusted, the channel is declared inoperable. This Surveillance is performed to verify the f(I) input to the Overpower T and Overtemperature T reactor trip Functions.
Two Notes modify this SR. The first Note indicates that the excore nuclear instrument channel shall be adjusted if the absolute difference between the incore and excore AFD is  1.5% AFD. Note 2 clarifies that AP1000 STS                             B 3.3.1-29                                       Rev. 1

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) the Surveillance is required only if reactor power is  20% RTP and that 24 hours are allowed for performing the first Surveillance after reaching 20% RTP. Below 20% RTP, the design of the incore detector system, low core power density, and detector accuracy make the incore detectors inadequate for use as a reference standard for comparison to the excore channels.
The Frequency of every 31 EFPD is adequate based on plant operating experience, considering instrument reliability and operating history data for instrument drift. Also, the slow changes in neutron flux during the fuel cycle can be detected during this interval.
SR 3.3.1.4 This SR is a calibration of the excore nuclear instrument (Power Range Neutron Flux) detectors to the incore neutron flux detectors. If the measurements do not agree, the excore nuclear instrument channels are not declared inoperable but must be adjusted to agree with the incore neutron flux detector measurements. If the excore nuclear instrument channels cannot be adjusted, the excore nuclear instrument channels are declared inoperable. This Surveillance is performed to verify the f(I) input to the Overtemperature T reactor trip Function.
A Note modifies this SR. The Note states that this Surveillance is required only if reactor power is > 50% RTP and that 24 hours is allowed for performing the first Surveillance after reaching 50% RTP.
The Frequency of 92 EFPD is adequate based on industry operating experience, considering instrument reliability and operating history data for instrument drift.
SR 3.3.1.5 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. The CHANNEL CALIBRATION is performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
The CHANNEL CALIBRATION is performed in accordance with the SP.
If the actual setting of the channel is found to be outside the as-found tolerance, the channel is considered inoperable. This condition of the AP1000 STS                             B 3.3.1-30                                      Rev. 1

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) channel will be further evaluated during performance of the SR. This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance), and evaluating the channels response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation. Transmitter calibration must be performed consistent with the assumptions of the setpoint methodology. The differences between the current as-found values and the previous as-left values must be consistent with the transmitter drift allowance used in the setpoint methodology.
The setpoint methodology requires that 30 months drift be used (1.25 times the Surveillance calibration interval, 24 months).
Interlocks implicitly required to support the Function's OPERABILITY are also addressed by this CHANNEL CALIBRATION. This portion of the CHANNEL CALIBRATION ensures the associated Function is not bypassed when required to be enabled. This can be accomplished by ensuring the interlocks are calibrated properly in accordance with the SP.
If the interlock is not automatically functioning as designed, the condition is entered into the Corrective Action Program and appropriate OPERABILITY evaluations performed for the affected Function. The affected Functions OPERABILITY can be met if the interlock is manually enforced to properly enable the affected Function. When an interlock is not supporting the associated Functions OPERABILITY at the existing plant conditions, the affected Function's channels must be declared inoperable and appropriate ACTIONS taken.
The RCP speed sensor (Function 9) is calibrated using a qualitative assessment of the behavior that is obtained through insulation resistance and sensor resistance testing to complement the normal calibration of the remaining adjustable devices in Function 9.
This SR is modified by a Note stating that this test shall include verification that the time constants are adjusted to within limits where applicable.
SR 3.3.1.6 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. This SR is modified by a Note stating AP1000 STS                              B 3.3.1-31                                     Rev. 1

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) that neutron detectors are excluded from the CHANNEL CALIBRATION.
The CHANNEL CALIBRATION is performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
The CHANNEL CALIBRATION is performed in accordance with the SP.
If the actual setting of the channel is found to be outside the as-found tolerance, the channel is considered inoperable. This condition of the channel will be further evaluated during performance of the Surveillance.
This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance), and evaluating the channels response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.
This Surveillance does not include the CHANNEL CALIBRATION for the Power Range Neutron Flux detectors, which consists of a normalization of the detectors based on a power calorimetric and flux map performed above 20% RTP. Below 20% RTP, the design of the incore detector system, low core power density, and detector accuracy make use of the incore detectors inadequate for use as a reference standard for comparison to the excore Power Range Neutron Flux detectors.
Interlocks implicitly required to support the Function's OPERABILITY are also addressed by this CHANNEL CALIBRATION. This portion of the CHANNEL CALIBRATION ensures the associated Function is not bypassed when required to be enabled. This can be accomplished by ensuring the interlocks are calibrated properly in accordance with the SP.
If the interlock is not automatically functioning as designed, the condition is entered into the Corrective Action Program and appropriate OPERABILITY evaluations performed for the affected Function. The affected Functions OPERABILITY can be met if the interlock is manually enforced to properly enable the affected Function. When an interlock is not supporting the associated Functions OPERABILITY at the existing plant conditions, the affected Function's channels must be declared inoperable and appropriate ACTIONS taken.
The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown AP1000 STS                             B 3.3.1-32                                       Rev. 1

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) these components usually pass the Surveillance when performed at the 24 month Frequency.
SR 3.3.1.7 This SR is the performance of a TADOT of the Passive Residual Heat Removal (PRHR) Actuation valve position indicator contact inputs. This TADOT is performed every 24 months.
The Frequency is based on the known reliability of the Function and the multichannel redundancy available, and has been shown to be acceptable through operating experience.
The SR is modified by a Note that excludes verification of setpoints from the TADOT. The Function (reactor trip on PRHR Actuation) affected by this SR has no setpoints associated with it.
SR 3.3.1.8 This SR verifies that the individual channel/division actuation response times are less than or equal to the maximum values assumed in the accident analysis. Response Time testing criteria are included in Reference 2.
In lieu of measurement, the response time for the protection and safety monitoring system equipment is based on allocated values (Ref. 9). The overall response time may be determined by a series of overlapping tests and allocated values such that the entire response time is measured, with the resulting measured response time compared to the appropriate FSAR Chapter 7 (Ref. 8) response time.
Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the allocated sensor, signal processing and actuation logic response times, where approved, with actual response time tests on the remainder of the channel. Allocations for signal processing and actuation logic response times may be obtained from the Protection and Safety Monitoring System Functional Requirements document. The response time of the RCP speed sensor (Function 9) and its associated preamplifier is allocated in lieu of measurement, based on the specific design of the component models being used (Ref. 10).
AP1000 STS                            B 3.3.1-33                                     Rev. 1

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued)
The PRHR Actuation Function RTS RESPONSE TIME is the time interval between input of a PRHR discharge valve not-fully-closed position feedback signal and the loss of gripper coil voltage. The RTS RESPONSE TIME for the PRHR actuation does not include testing the actuation of the discharge valves by ESFAS instrumentation signals because it cannot be tested if an ESFAS function (e.g., Core Makeup Tank (CMT) Actuation) has already caused a reactor trip.
Each division response must be verified every 24 months on a STAGGERED TEST BASIS (i.e., all four Protection Channel Sets would be tested after 96 months). Response times cannot be determined during plant operation because equipment operation is required to measure response times. Experience has shown that these components usually pass this Surveillance when performed on a refueling frequency.
Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
This SR is modified by a Note indicating that neutron detectors are excluded from RTS RESPONSE TIME testing. This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response.
REFERENCES      1. WCAP-16675-P, AP1000 Protection and Safety Monitoring System Architecture Technical Support.
: 2. FSAR Chapter 15, Accident Analyses.
: 3. WCAP-16361-P, Westinghouse Setpoint Methodology for Protection Systems - AP1000, February 2011 (proprietary).
: 4. 10 CFR 50.49, Environmental Qualifications of Electric Equipment Important to Safety for Nuclear Power Plants.
: 5. Institute of Electrical and Electronic Engineers, IEEE 603-1991, IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations, June 27, 1991.
: 6. APP-GW-GLR-137, Revision 1, Bases of Digital Overpower and Overtemperature Delta-T (OPT/ OTT) Reactor Trips, Westinghouse Electric Company LLC.
AP1000 STS                              B 3.3.1-34                                    Rev. 1

RTS Instrumentation B 3.3.1 BASES REFERENCES (continued)
: 7. APP-GW-GSC-020, Technical Specification Completion Time and Surveillance Frequency Justification.
: 8. FSAR Chapter 7, Instrumentation and Controls.
: 9. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos. 168 and 166 to the Combined License Nos. NPF-91 and NPF-92, respectively, Vogtle Electric Generating Plant Units 3 and 4, Docket Nos. 52-025 and 52-026, dated November 21, 2019 [ML19297C988 (Proprietary) and ML19297D159 (non-proprietary)].
: 10. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos. 166 and 164 to the Combined License Nos. NPF-91 and NPF-92, respectively, Vogtle Electric Generating Plant Units 3 and 4, Docket Nos. 52-025 and 52-026, dated November 15, 2019 [ML19282D472].
AP1000 STS                           B 3.3.1-35                                    Rev. 1

RTS Source Range Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Reactor Trip System (RTS) Source Range Instrumentation BASES BACKGROUND           A description of the RTS Instrumentation is provided in the Bases for LCO 3.3.1, Reactor Trip System (RTS) Instrumentation.
APPLICABLE           The RTS functions to maintain compliance with the SLs during all AOOs SAFETY               and mitigates the consequences of DBAs in all MODES in which the ANALYSES, LCO,       reactor trip breakers (RTBs) are closed. A description of RTS interlocks is and APPLICABILITY    provided in the Bases for LCO 3.3.1.
The RTS Source Range Neutron Flux  High reactor trip Function provides protection against an uncontrolled bank rod withdrawal accident from a subcritical condition during startup. This reactor trip Function provides redundant protection to the Power Range Neutron Flux  Low Setpoint and Intermediate Range Neutron Flux reactor trip Functions. In MODES 3, 4, and 5, administrative controls also prevent the uncontrolled withdrawal of rods. The Protection and Safety Monitoring System (PMS)
Source Range Neutron Flux detectors are located external to the reactor vessel and measure neutrons leaking from the core. The safety analyses do not take credit for the Source Range Neutron Flux  High reactor trip Function. Even though the safety analyses take no credit for this reactor trip Function, the functional capability at the specified NTS is assumed to be available and this reactor trip Function is implicitly assumed in the safety analyses.
The NTS reflects only steady state instrument uncertainties as the Source Range Neutron Flux detectors do not provide primary protection for any events that result in a harsh environment. This reactor trip Function can be manually blocked by the main control room operator when above the P-6 setpoint (Intermediate Range Neutron Flux interlock) and is automatically unblocked when below the P-6 setpoint. The manual block of the Source Range Neutron Flux reactor trip Function also de-energizes the Source Range Neutron Flux detectors. The Source Range Neutron Flux detectors are automatically re-energized when below the P-6 setpoint. This reactor trip Function is automatically blocked when above the P-10 setpoint (Power Range Neutron Flux interlock). The Source Range Neutron Flux reactor trip Function is the only RTS automatic protection Function required in MODES 3, 4, and 5. Therefore, the functional capability at the specified NTS is assumed to be available.
AP1000 STS                                  B 3.3.2-1                                       Rev. 1

RTS Source Range Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The LCO requires four channels of the Source Range Neutron Flux High reactor trip Function to be OPERABLE in MODE 2 below P-6 and in MODE 3, 4, or 5 with the Plant Control System (PLS) capable of rod withdrawal or one or more rods not fully inserted. Control rods are capable of withdrawal when one or more control rod drive mechanisms (CRDMs) is energized such that an automatic or manual signal could power the coils to withdraw the rod(s). Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this reactor trip Function. In MODE 3, 4, or 5 with the PLS incapable of rod withdrawal and all rods fully inserted, the LCO does not require the Source Range Neutron Flux  High reactor trip Function channels to be OPERABLE.
In MODE 2 when below the P-6 setpoint during a reactor startup, the Source Range Neutron Flux  High reactor trip Function must be OPERABLE. Above the P-6 setpoint, the Intermediate Range Neutron Flux  High and Power Range Neutron Flux  Low Setpoint reactor trip Functions will provide core protection for reactivity accidents.
In MODE 3, 4, or 5 with the reactor shutdown, the Source Range Neutron Flux  High reactor trip Function must also be OPERABLE. If the PLS is capable of rod withdrawal or one or more rods are not fully inserted, the Source Range Neutron Flux  High reactor trip Function must be OPERABLE to provide core protection against a rod withdrawal accident.
If the PLS is not capable of rod withdrawal, the Source Range Neutron Flux detectors are required to be OPERABLE to provide monitoring of neutron flux levels and provide protection for events like an inadvertent boron dilution. These Functions are addressed in LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS) Instrumentation, Function 17, Source Range Neutron Flux Doubling, LCO 3.3.15, Engineered Safety Feature Actuation System (ESFAS) Actuation Logic Operating, and LCO 3.3.16, Engineered Safety Feature Actuation System (ESFAS) Actuation Logic  Shutdown. The requirements for the Source Range Neutron Flux detectors in MODE 6 are addressed in LCO 3.9.3, Nuclear Instrumentation.
The RTS Source Range Neutron Flux  High trip Function instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                            B 3.3.2-2                                        Rev. 1

RTS Source Range Instrumentation B 3.3.2 BASES ACTIONS    In the event a Source Range Neutron Flux  High reactor trip Function channel's as-found trip setting is outside the as-found tolerance described in the SP, or the channel is not functioning as required, or the transmitter, instrument loop, signal processing electronics, or trip output is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the ACTIONS Condition(s) entered for the protection Function(s) affected.
A.1 Condition A addresses the situation where one Source Range Neutron Flux  High Setpoint reactor trip Function channel is inoperable in MODE 2. With one channel inoperable, the inoperable channel must be placed in a bypass or trip condition within two hours. If one channel is bypassed, the logic becomes two-out-of-three, while still meeting the single failure criterion. (A failure in one of the three remaining channels will not prevent the protective function.) If one channel is tripped, the logic becomes one-out-of-three, while still meeting the single failure criterion.
(A failure in one of the three remaining channels will not prevent the protective function). The 2 hours allowed to place the inoperable channel in the bypassed or tripped condition is consistent with the Required Action Completion Time for an inoperable channel of the Intermediate Range Neutron Flux  High reactor trip Function provided in LCO 3.3.3.
B.1 and B.2 Condition B addresses the situation where two Source Range Neutron Flux  High Setpoint reactor trip Function channels are inoperable in MODE 2. With two channels inoperable, one affected channel must be placed in a bypass condition within 2 hours and one affected channel must be placed in a trip condition within 2 hours. If one channel is bypassed and one channel is tripped, the logic becomes one-out-of-two, while still meeting the single failure criterion. The 2 hours allowed to place the inoperable channel(s) in the bypassed or tripped condition is consistent with the Required Action Completion Time for two inoperable channels of the Intermediate Range Neutron Flux  High reactor trip Function provided in LCO 3.3.3.
C.1 Condition C is entered when any Required Action and associated Completion Time of Condition A or B are not met. If the inoperable Source Range Neutron Flux  High reactor trip Function channel(s) is not restored to OPERABLE status or placed in trip or bypass, as applicable, within the allowed Completion Time, Required Action C.1 requires AP1000 STS                         B 3.3.2-3                                       Rev. 1

RTS Source Range Instrumentation B 3.3.2 BASES ACTIONS (continued) immediate suspension of operations involving positive reactivity additions that could result in a loss of required SDM.
D.1 Condition D addresses the situation where one or two Source Range Neutron Flux  High reactor trip Function channels are inoperable in MODE 3, 4, or 5. With one or two Source Range Neutron Flux  High reactor trip Function channels inoperable, three of the four required channels must be restored to OPERABLE status within 48 hours. The Completion Time of 48 hours to restore three of four Source Range Neutron Flux  High reactor trip Function channels to OPERABLE status is justified in Reference 1.
E.1 and E.2 Condition E is entered when the Required Action and associated Completion Time of Condition D are not met. If three of the four required Source Range Neutron Flux  High reactor trip Function channels are not restored to OPERABLE status within the allowed Completion Time, Required Action E.1 requires that action be initiated to fully insert all rods within 1 hour, and Required Action E.2 requires that the PLS be placed in a condition incapable of rod withdrawal within 1 hour. The allowed Completion Times are reasonable, based on operating experience, to reach the specified condition in an orderly manner and without challenging plant systems.
F.1 Condition F addresses the situation where three or more Source Range Neutron Flux  High reactor trip Function channels are inoperable. With three or more channels inoperable, the single failure criterion cannot be met and the RTBs must be opened immediately.
SURVEILLANCE      SR 3.3.2.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 12 hours ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two AP1000 STS                                B 3.3.2-4                                       Rev. 1

RTS Source Range Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) instrument channels could be an indication of excessive instrument drift in one of the channels or of even something more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying thatthe instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment have drifted outside their corresponding limits.
The Frequency is based on operating experience that demonstrates that channel failure is rare. Automated operator aids may be used to facilitate the performance of the CHANNEL CHECK.
SR 3.3.2.2 This SR is the performance of a CHANNEL CALIBRATION every 24 months or approximately at every refueling. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. The CHANNEL CALIBRATION is performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
The CHANNEL CALIBRATION is performed in accordance with the SP.
If the actual trip setting of the channel is found to be outside the as-found tolerance, the channel is considered inoperable. This condition of the channel will be further evaluated during performance of the Surveillance.
This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance), and evaluating the channels response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.
The CHANNEL CALIBRATION for the Source Range Neutron Flux detectors consists of obtaining the preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturers data.
Interlocks implicitly required to support the Function's OPERABILITY are also addressed by this CHANNEL CALIBRATION. This portion of the AP1000 STS                               B 3.3.2-5                                       Rev. 1

RTS Source Range Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
CHANNEL CALIBRATION ensures the associated Function is not bypassed when required to be enabled. This can be accomplished by ensuring the interlocks are calibrated properly in accordance with the SP.
If the interlock is not automatically functioning as designed, the condition is entered into the Corrective Action Program and appropriate OPERABILITY evaluations performed for the affected Function. The affected Functions OPERABILITY can be met if the interlock is manually enforced to properly enable the affected Function. When an interlock is not supporting the associated Functions OPERABILITY at the existing plant conditions, the affected Function's channels must be declared inoperable and appropriate ACTIONS taken.
The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed on the 24 month Frequency.
SR 3.3.2.3 This SR verifies that the individual channel actuation response times are less than or equal to the maximum values assumed in the accident analysis. Response Time testing criteria are included in Reference 2.
In lieu of measurement, the response time for the PMS equipment is based on allocated values (Ref, 3). The overall response time may be determined by a series of overlapping tests and allocated values such that the entire response time is verified, with the resulting verified response time compared to the appropriate FSAR Chapter 7 (Ref. 2) response time.
Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the allocated sensor, signal processing and actuation logic response times, where approved, with actual response time tests on the remainder of the channel.
Each channel response must be verified every 24 months on a STAGGERED TEST BASIS (i.e., all four Protection Channel Sets would be tested after 96 months). Response times cannot be determined during plant operation because equipment operation is required to measure AP1000 STS                              B 3.3.2-6                                      Rev. 1

RTS Source Range Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) response times. Experience has shown that these components usually pass this Surveillance when performed on a refueling frequency.
Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
This SR is modified by a Note exempting neutron detectors from RTS RESPONSE TIME testing. This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response.
REFERENCES      1. APP-GW-GSC-020, Technical Specification Completion Time and Surveillance Frequency Justification.
: 2. FSAR Chapter 7, Instrumentation and Controls.
: 3. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos. 168 and 166 to the Combined License Nos. NPF-91 and NPF-92, respectively, Vogtle Electric Generating Plant Units 3 and 4, Docket Nos. 52-025 and 52-026, dated November 21, 2019 [ML19297C988 (Proprietary) and ML19297D159 (non-proprietary)].
AP1000 STS                              B 3.3.2-7                                     Rev. 1

RTS Intermediate Range Instrumentation B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Reactor Trip System (RTS) Intermediate Range Instrumentation BASES BACKGROUND           A description of the RTS Instrumentation is provided in the Bases for LCO 3.3.1, Reactor Trip System (RTS) Instrumentation.
APPLICABLE           The RTS functions to maintain compliance with the SLs during all SAFETY               anticipated operational occurrences (AOOs) and mitigates the ANALYSES, LCO,       consequences of design basis accidents (DBAs) in all MODES in which and APPLICABILITY    the reactor trip breakers (RTBs) are closed.
The Intermediate Range Neutron Flux  High trip Function ensures that protection is provided against an uncontrolled RCCA bank withdrawal accident from a subcritical condition during startup. This trip Function provides redundant protection to the Power Range Neutron Flux  Low Setpoint trip Function. The Protection and Safety Monitoring System (PMS) Intermediate Range Neutron Flux detectors are located external to the reactor vessel and measure neutrons leaking from the core. The safety analyses do not take credit for the Intermediate Range Neutron Flux trip Function. Even though the safety analyses take no credit for the Intermediate Range Neutron Flux reactor trip, the functional capability at the specified NTS enhances the overall diversity of the RTS. The NTS reflects only steady state instrument uncertainties as the detectors do not provide primary protection for any events that result in a harsh environment. This trip Function can be manually blocked by the main control room operator when above the P-10 setpoint, which is the respective PMS division Power Range Neutron Flux channel greater than 10% RTP, and is automatically unblocked when below the P-10 setpoint, which is the respective PMS division Power Range Neutron Flux channel less than 10% RTP.
This trip Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor.
The LCO requires four channels of Intermediate Range Neutron Flux to be OPERABLE. Four channels are provided to permit one channel in trip or bypass indefinitely and still ensure no single random failure will disable this trip Function.
AP1000 STS                                 B 3.3.3-1                                         Rev. 1

RTS Intermediate Range Instrumentation B 3.3.3 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
In MODE 1 below the P-10 setpoint, and in MODE 2, when there is a potential for an uncontrolled rod withdrawal accident during reactor startup, the Intermediate Range Neutron Flux trip Function must be OPERABLE. Above the P-10 setpoint, the Power Range Neutron Flux High Setpoint trip Function and the Power Range Neutron Flux  High Positive Rate trip Function provide core protection for a rod withdrawal accident. In MODE 3, 4, or 5, the Intermediate Range Neutron Flux trip Function does not have to be OPERABLE because the control rods must be fully inserted and only the shutdown rods may be withdrawn. The reactor cannot be started up in this condition. The core also has the required SDM to mitigate the consequences of a positive reactivity addition accident. In MODE 6, all rods are fully inserted and the core has a required increased SDM. Also, the Intermediate Range Neutron Flux detectors cannot detect neutron flux levels present in this MODE.
The RTS Intermediate Range Neutron Flux  High trip Function instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS          In the event a channel's as-found condition is outside the as-found tolerance described in the SP, or the channel is not functioning as required, or the transmitter, instrument loop, signal processing electronics, or trip output is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.
A.1, A.2, and A.3 Condition A addresses the situation where one Intermediate Range Neutron Flux  High reactor trip Function channel is inoperable with THERMAL POWER greater than or equal to the P-6 interlock Setpoint.
With one channel inoperable, the affected channel must be placed in a bypass or trip condition within 2 hours, or THERMAL POWER must be either reduced below the P-6 interlock Setpoint or increased above the P-10 interlock Setpoint within 2 hours. If one channel is bypassed, the logic becomes two-out-of-three, while still meeting the single failure criterion. (A failure in one of the three remaining channels will not prevent the protective function.) If one channel is tripped, the logic becomes one-out-of-three, while still meeting the single failure criterion.
(A failure in one of the three remaining channels will not prevent the protective function.) The 2 hours allowed to place the inoperable channel(s) in the bypassed or tripped condition is justified in Reference 1.
AP1000 STS                               B 3.3.3-2                                      Rev. 1

RTS Intermediate Range Instrumentation B 3.3.3 BASES ACTIONS (continued)
As an alternative to placing the inoperable channel in bypass or trip if THERMAL POWER is greater than the P-6 interlock setpoint but less than the P-10 interlock setpoint, 2 hours are allowed to reduce THERMAL POWER below the P-6 interlock setpoint or to increase THERMAL POWER above the P-10 interlock setpoint. The Intermediate Range Neutron Flux channels must be OPERABLE when the power level is above the capability of the Source Range Neutron Flux detectors, P-6, and below the capability of the Power Range Neutron Flux detectors, P-10. If THERMAL POWER is greater than the P-10 interlock setpoint, the Power Range Neutron Flux channels perform the monitoring and protection Functions and the Intermediate Range Neutron Flux channels are not required. The Completion Times allow for a slow and controlled power adjustment below P-6, and take into account the redundant capability afforded by the three remaining OPERABLE Intermediate Range Neutron Flux  High reactor trip Function channels and the low probability of their failure during this period.
B.1.1, B.1.2, B.2, and B.3 Condition B addresses the situation where two Intermediate Range Neutron Flux  High channels are inoperable with THERMAL POWER greater than or equal to the P-6 interlock setpoint. With two Intermediate Range Neutron Flux  High channels inoperable, one affected channel must be placed in a bypass condition and one affected channel must be placed in a trip condition within 2 hours, or THERMAL POWER must be either reduced below the P-6 interlock setpoint or increased above the P-10 interlock setpoint within 2 hours. If one channel is bypassed and one channel is tripped, the logic becomes one-out-of-two, while still meeting the single failure criterion. The 2 hours allowed to place the affected channel(s) in the bypassed or tripped condition is justified in Reference 1.
As an alternative to placing the affected channels in bypass or trip if THERMAL POWER is greater than the P-6 interlock setpoint but less than the P-10 interlock Setpoint, 2 hours are allowed to reduce THERMAL POWER below the P-6 interlock setpoint or to increase the THERMAL POWER above the P-10 interlock setpoint. The Intermediate Range Neutron Flux channels must be OPERABLE when the power level is above the capability of the Source Range Neutron Flux detectors, P-6, and below the capability of the Power Range Neutron Flux detectors, P-10. If THERMAL POWER is greater than the P-10 interlock setpoint, the Power Range Neutron Flux channels perform the monitoring and protection Functions and the Intermediate Range Neutron Flux channels are not required. The Completion Times allow for a slow and controlled AP1000 STS                                 B 3.3.3-3                                     Rev. 1

RTS Intermediate Range Instrumentation B 3.3.3 BASES ACTIONS (continued) power adjustment below P-6, and takes into account the redundant capability afforded by the two remaining OPERABLE channels and the low probability of their failure during this period.
C.1 Condition C addresses the situation of one or two Intermediate Range Neutron Flux  High reactor trip Function channels inoperable with THERMAL POWER below the P-6 interlock setpoint. Below P-6, the Source Range Neutron Flux channels will be able to monitor the core power level. With one or two Intermediate Range Neutron Flux  High reactor trip Function channels inoperable, three of the four channels must be restored to OPERABLE status prior to increasing THERMAL POWER above the P-6 interlock setpoint. With the unit in this condition, below P-6, the Source Range Neutron Flux channels perform the monitoring and protection Functions.
D.1, D.2, and D.3 Condition D addresses the situation where three or more Intermediate Range Neutron Flux  High reactor trip Function channels are inoperable.
With three or more channels inoperable, positive reactivity additions that could result in a loss of required SDM must be suspended immediately.
This will preclude any power level increase since there are insufficient OPERABLE Intermediate Range Neutron Flux  High reactor trip Function channels to adequately monitor power escalation. In addition, THERMAL POWER must be reduced below the P-6 interlock setpoint within 2 hours, and the plant must be placed in MODE 3 within 7 hours.
The allowed Completion Times for Required Actions D.2 and D.3 are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.3.3.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 12 hours ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift AP1000 STS                                B 3.3.3-4                                       Rev. 1

RTS Intermediate Range Instrumentation B 3.3.3 BASES SURVEILLANCE REQUIREMENTS (continued) in one of the channels or of even something more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment have drifted outside their corresponding limits.
This SR is modified by a Note. The Note states that the SR is not applicable in MODE 1. In MODE 1, the OPERABILITY of the Intermediate Range Neutron Flux Instrumentation is verified by self-checking features in lieu of performing a CHANNEL CHECK.
The Frequency is based on operating experience that demonstrates that channel failure is rare. Automated operator aids may be used to facilitate the performance of the CHANNEL CHECK.
SR 3.3.3.2 This SR is the performance of a CHANNEL CALIBRATION every 24 months, or approximately at every refueling. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. The CHANNEL CALIBRATION is performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
The CHANNEL CALIBRATION is performed in accordance with the SP. If the actual trip setting of the channel is found to be outside the as-found tolerance, the channel is considered inoperable. This condition of the channel will be further evaluated during performance of the Surveillance.
This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance), and evaluating the channels response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.
AP1000 STS                              B 3.3.3-5                                       Rev. 1

RTS Intermediate Range Instrumentation B 3.3.3 BASES SURVEILLANCE REQUIREMENTS (continued)
The CHANNEL CALIBRATION for the Intermediate Range Neutron Flux detectors consists of obtaining the detector plateau curves, evaluating those curves, and comparing the curves to the manufacturers data.
Interlocks implicitly required to support the Function's OPERABILITY are also addressed by this CHANNEL CALIBRATION. This portion of the CHANNEL CALIBRATION ensures the associated Function is not bypassed when required to be enabled. This can be accomplished by ensuring the interlocks are calibrated properly in accordance with the SP.
If the interlock is not automatically functioning as designed, the condition is entered into the Corrective Action Program and appropriate OPERABILITY evaluations performed for the affected Function. The affected Functions OPERABILITY can be met if the interlock is manually enforced to properly enable the affected Function. When an interlock is not supporting the associated Functions OPERABILITY at the existing plant conditions, the affected Function's channels must be declared inoperable and appropriate ACTIONS taken.
The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed on the 24 month Frequency.
SR 3.3.3.3 This SR verifies that the individual channel actuation response times are less than or equal to the maximum values assumed in the accident analysis. Response Time testing criteria are included in Reference 2.
In lieu of measurement, the response time for the Protection And Safety Monitoring System equipment is based on allocated values (Ref, 3). The overall response time may be determined by a series of overlapping tests and allocated values such that the entire response time is verified, with the resulting verified response time compared to the appropriate FSAR Chapter 7 (Ref. 2) response time.
Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the allocated sensor, signal processing and actuation logic response times, where approved, with actual response time tests on the remainder of the channel.
AP1000 STS                              B 3.3.3-6                                     Rev. 1

RTS Intermediate Range Instrumentation B 3.3.3 BASES SURVEILLANCE REQUIREMENTS (continued)
Each channel response must be verified every 24 months on a STAGGERED TEST BASIS (i.e., all four Protection Channel Sets would be tested after 96 months). Response times cannot be determined during plant operation because equipment operation is required to measure response times. Experience has shown that these components usually pass this Surveillance when performed on a refueling frequency.
Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
This SR is modified by a Note exempting neutron detectors from RTS RESPONSE TIME testing. This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response.
REFERENCES      1. APP-GW-GSC-020, Technical Specification Completion Time and Surveillance Frequency Justification.
: 2. FSAR Chapter 7, Instrumentation and Controls.
: 3. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos. 168 and 166 to the Combined License Nos. NPF-91 and NPF-92, respectively, Vogtle Electric Generating Plant Units 3 and 4, Docket Nos. 52-025 and 52-026, dated November 21, 2019 [ML19297C988 (Proprietary) and ML19297D159 (non-proprietary)].
AP1000 STS                              B 3.3.3-7                                     Rev. 1

RTS ESFAS Instrumentation B 3.3.4 B 3.3 INSTRUMENTATION B 3.3.4 Reactor Trip System (RTS) Engineered Safety Feature Actuation System (ESFAS)
Instrumentation BASES BACKGROUND            A description of the RTS Instrumentation is provided in the Bases for LCO 3.3.1, Reactor Trip System (RTS) Instrumentation.
APPLICABLE            The RTS functions to maintain compliance with the SLs during all SAFETY                anticipated operational occurrences (AOOs) and mitigates the ANALYSES, LCO,        consequences of design basis accidents (DBAs) in all MODES in which and APPLICABILITY     the reactor trip breakers (RTBs) are closed.
This LCO provides requirements for the automatic inputs from the Engineered Safety Feature Actuation System (ESFAS) to the RTS. The safety analyses and OPERABILITY requirements applicable to the RTS ESFAS Instrumentation Functions are discussed below:
: 1. Safeguards Actuation Input from Engineered Safety Feature Actuation System  Automatic The Safeguards Actuation Input from ESFAS  Automatic ensures that if a reactor trip has not already been generated by the RTS, the ESFAS automatic actuation logic will initiate a reactor trip upon any signal which initiates the Safeguards Actuation signal. This is a condition of acceptability for the Loss of Coolant Accident (LOCA).
However, other transients and accidents take credit for varying levels of ESFAS performance and rely upon rod insertion, except for the most reactive rod, which is assumed to be fully withdrawn, to ensure reactor shutdown.
The LCO requires four automatic divisions of Safeguards Actuation Signal Input from ESFAS to be OPERABLE in MODES 1 and 2.
Four automatic divisions are provided to permit one division to be in bypass indefinitely and still ensure no single random failure will disable this trip Function.
A reactor trip is initiated every time a Safeguards Actuation signal is present. Therefore, this trip Function must be OPERABLE in MODE 1 and in MODE 2, when the reactor is critical or near critical, and must be shut down in the event of an accident. In MODE 3, 4, 5, or 6, the reactor is not critical.
AP1000 STS                                   B 3.3.4-1                                      Rev. 1

RTS ESFAS Instrumentation B 3.3.4 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 2. ADS Stages 1, 2 and 3 Actuation Input from Engineered Safety Feature Actuation System  Automatic The LCO requirement for this Function provides a reactor trip for any event that may initiate depressurization of the reactor.
The LCO requires four automatic divisions of the ADS Stages 1, 2, and 3 Actuation Input from ESFAS Function to be OPERABLE.
Four OPERABLE divisions are provided to ensure that a random failure of a single logic division will not prevent reactor trip.
This trip Function must be OPERABLE in MODE 1 and in MODE 2 when the reactor is critical or near critical. In MODE 3, 4, or 5, this RTS trip Function must be OPERABLE when the Plant Control System (PLS) is capable of rod withdrawal or one or more rods are not fully inserted. A rod is capable of withdrawal when its control rod drive mechanism (CRDM) is energized such that an automatic or manual signal could power the coils to withdraw the rod.
: 3. Core Makeup Tank (CMT) Actuation Input from Engineered Safety Feature Actuation System  Automatic The LCO requirement for this Function provides a reactor trip for any event that may initiate CMT injection.
The LCO requires four divisions of the CMT Actuation Input from ESFAS Function to be OPERABLE. Four OPERABLE divisions are provided to ensure that random failure of a single logic division will not prevent reactor trip.
This trip Function must be OPERABLE in MODE 1 and in MODE 2 when the reactor is critical or near critical. In MODE 3, 4, or 5, this RTS trip Function must be OPERABLE when the PLS is capable of rod withdrawal or one or more rods are not fully inserted. A rod is capable of withdrawal when its control rod drive mechanism (CRDM) is energized such that an automatic or manual signal could power the coils to withdraw the rod.
The RTS ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                             B 3.3.4-2                                       Rev. 1

RTS ESFAS Instrumentation B 3.3.4 BASES ACTIONS    A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The ACTIONS Conditions of this Specification may be entered independently for each Function listed in Table 3.3.4-1.
A.1 Condition A addresses the situation where one or more Functions have one or two divisions inoperable in MODE 1 or MODE 2. With one or two divisions inoperable, three of four divisions must be restored to OPERABLE status within 6 hours. Restoring all divisions but one to OPERABLE status ensures that a single failure will not prevent the protective function, nor will it cause the protective function (with the exception of a limited number of PMS component failures). The Completion Time takes into consideration the redundant capability provided by the remaining redundant OPERABLE divisions and the low probability of occurrence of an event during this period that may require the protection afforded by this Function. The 6 hour Completion Time is considered reasonable since the protective function will still be capable of initiating a reactor trip.
B.1 Condition B addresses the situation where the Required Action and associated Completion Time of Condition A are not met, or there are one or more Functions with three or more divisions inoperable in MODE 1 or MODE 2. Required Action B.1 directs that the plant must be placed in MODE 3 within 6 hours. The allowed Completion Time for Required Action B.1 is reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.
C.1 Condition C addresses the situation where one or more Functions have one or two divisions inoperable in MODE 3, 4 or 5. With one or two divisions inoperable, three of the four divisions must be restored to OPERABLE status in 48 hours. Restoring all channels but one to OPERABLE status ensures that a single failure will not prevent the protective function, nor will it cause the protective function (with the exception of a limited number of PMS component failures). The 48 hour Completion Time is considered reasonable since the protective function will still be capable of initiating a reactor trip.
AP1000 STS                         B 3.3.4-3                                       Rev. 1

RTS ESFAS Instrumentation B 3.3.4 BASES ACTIONS (continued)
D.1 and D.2 Condition D addresses the situation where the Required Action and associated Completion Time of Condition C are not met, or there are one or more Functions with three or more divisions inoperable in MODE 3, 4, or 5. Required Action D.1 requires initiating action to fully insert all rods within 1 hour, and Required Action D.2 requires that the Plant Control System be placed in a condition incapable of rod withdrawal within 1 hour. The allowed Completion Times are reasonable, based on operating experience, to reach the specified condition in an orderly manner and without challenging plant systems.
SURVEILLANCE        The SR for each RTS ESFAS Function is identified in the SRs column of REQUIREMENTS        Table 3.3.4-1 for that Function. A Note has been added to the Surveillance Requirements table stating that Table 3.3.4-1 determines which SRs apply to each RTS ESFAS Function. Function 2 and Function 3 do not require Surveillance Requirements because self-checking features alert the operator to any failures.
SR 3.3.4.1 This SR verifies that the individual ESFAS logic division actuation response times are less than or equal to the maximum values assumed in the accident analysis. In lieu of measurement, the response time for the Protection and Safety Monitoring System equipment is based on allocated values (Ref. 2). The overall response time may be determined by any series of sequential, overlapping, or total channel (and actuation logic division) measurements such that the entire response time (process sensor to actuated device) is verified, with the resulting verified response time compared to the appropriate FSAR Chapter 7 (Ref. 1) response time.
This SR measures the response time for the generation of a reactor trip signal from the Safeguards Actuation Input from ESFAS logic divisions.
SR 3.3.8.3 measures the ESF RESPONSE TIME for the generation of the safeguards signal itself.
Response time may be verified by actual response time tests or by the allocated response times, where approved, with actual response time tests on the remainder of the channel or division.
AP1000 STS                               B 3.3.4-4                                           Rev. 1

RTS ESFAS Instrumentation B 3.3.4 BASES SURVEILLANCE REQUIREMENTS (continued)
Each ESFAS logic division actuation response time must be verified every 24 months on a STAGGERED TEST BASIS (i.e., all four protective function division sets would be tested after 96 months). Response times cannot be determined during plant operation because equipment operation is required to measure response times. Experience has shown that these components usually pass this Surveillance when performed on a refueling Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
REFERENCES      1. FSAR Chapter 7, Instrumentation and Controls.
: 2. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos. 168 and 166 to the Combined License Nos. NPF-91 and NPF-92, respectively, Vogtle Electric Generating Plant Units 3 and 4, Docket Nos. 52-025 and 52-026, dated November 21, 2019 [ML19297C988 (Proprietary) and ML19297D159 (non-proprietary)].
AP1000 STS                            B 3.3.4-5                                    Rev. 1

RTS Manual Actuation B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Reactor Trip System (RTS) Manual Actuation BASES BACKGROUND            A description of the RTS Instrumentation is provided in the Bases for LCO 3.3.1, Reactor Trip System (RTS) Instrumentation.
APPLICABLE            The RTS functions to maintain compliance with the SLs during all SAFETY                anticipated operational occurrences (AOOs) and mitigates the ANALYSES, LCO,        consequences of design basis accidents (DBAs) in all MODES in which and APPLICABILITY     the reactor trip breakers (RTBs) are closed.
This LCO requires all RTS manual actuation channels performing an RTS Function, listed in Table 3.3.5-1, to be OPERABLE.
The safety analyses and OPERABILITY requirements applicable to the RTS manual actuation Functions are discussed below:
: 1. Manual Reactor Trip The Manual Reactor Trip Function ensures that the main control room operator can initiate a reactor trip at any time by using either of two reactor trip actuation devices (switches) in the main control room. A Manual Reactor Trip accomplishes the same results as any one of the automatic trip Functions. It can be used by the reactor operator to shut down the reactor whenever any parameter is rapidly trending toward its NTS. The safety analyses do not take credit for the Manual Reactor Trip.
The LCO requires two Manual Reactor Trip actuation channels to be OPERABLE in MODES 1 and 2, and in MODES 3, 4, and 5 when the Plant Control System (PLS) is capable of rod withdrawal, or one or more rods are not fully inserted. A rod is capable of withdrawal when its control rod drive mechanism (CRDM) is energized such that an automatic or manual signal could power the coils to withdraw the rod. Two independent actuation channels are required to be OPERABLE so that no single random failure will disable the Manual Reactor Trip Function.
In MODE 1 or 2, manual initiation of a reactor trip must be OPERABLE. These are the MODES in which rods are partially or fully withdrawn from the core. In MODE 3, 4, or 5, the manual AP1000 STS                                  B 3.3.5-1                                       Rev. 1

RTS Manual Actuation B 3.3.5 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) initiation Function must also be OPERABLE if rods are withdrawn or the PLS is capable of withdrawing rods. In MODES 3, 4, and 5, manual initiation of a reactor trip does not have to be OPERABLE if the PLS is not capable of withdrawing rods or all rods are fully inserted. If the rods cannot be withdrawn from the core, there is no need to be able to trip the reactor because all of the rods are inserted. In MODE 6, no rods are permitted to be withdrawn and the CRDMs are disconnected from all rods. Therefore, the manual initiation Function does not have to be OPERABLE.
: 2. Safeguards Actuation Input from Engineered Safety Feature Actuation System  Manual The Safeguards Actuation signal from ESFAS ensures that if a reactor trip has not already been generated by the RTS, the ESFAS automatic actuation logic will initiate a reactor trip upon any signal which initiates the Safeguards Actuation signal. This is a condition of acceptability for the Loss of Coolant Accident (LOCA). However, other transients and accidents take credit for varying levels of ESFAS performance and rely upon rod insertion, except for the most reactive rod, which is assumed to be fully withdrawn, to ensure reactor shutdown.
The LCO requires two manual channels of Safeguards Actuation Input from ESFAS to be OPERABLE in MODES 1 and 2 to ensure a random failure of a single manual channel will not prevent reactor trip. Each channel has one manual switch for this trip Function that is sufficient to initiate a reactor trip by manually generating a Safeguards Actuation signal.
A reactor trip is initiated every time a Safeguards Actuation signal is present. Therefore, this trip Function must be OPERABLE in MODE 1 and in MODE 2, when the reactor is critical or near critical, and must be shut down in the event of an accident. In MODE 3, 4, 5, or 6, the reactor is not critical.
: 3. ADS Stages 1, 2 and 3 Actuation Input from Engineered Safety Feature Actuation System  Manual The LCO requirement for this Function provides a reactor trip for any event that may initiate depressurization of the reactor.
AP1000 STS                              B 3.3.5-2                                      Rev. 1

RTS Manual Actuation B 3.3.5 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The LCO requires two manual actuation switch sets for the ADS Stages 1, 2 and 3 Actuation Input from ESFAS to be OPERABLE.
Each channel has one manual actuation switch set for this trip Function that is sufficient to initiate a reactor trip by manually generating an ADS Stages 1, 2 and 3 Actuation signal. Two OPERABLE manual actuation switch sets are provided to ensure that a random failure of a single logic channel will not prevent reactor trip.
This trip Function must be OPERABLE in MODE 1 and in MODE 2 when the reactor is critical or near critical, and must be shut down in the event of an accident. In MODES 3, 4, and 5, this manual trip Function must be OPERABLE when the PLS is capable of rod withdrawal, or one or more rods are not fully inserted. A rod is capable of withdrawal when its control rod drive mechanism (CRDM) is energized such that an automatic or manual signal could power the coils to withdraw the rod.
: 4. Core Makeup Tank (CMT) Actuation Input from Engineered Safety Feature Actuation System  Manual The LCO requirement for this Function provides a reactor trip for any event that may initiate CMT injection.
The LCO requires two manual actuation channels for the CMT Actuation Input from ESFAS to be OPERABLE. Each channel has one manual switch for this trip Function that is sufficient to initiate a reactor trip by manually generating a CMT Actuation signal. Two OPERABLE manual actuation channels are provided to ensure that random failure of a single manual actuation channel will not prevent reactor trip.
This trip Function must be OPERABLE in MODE 1 and in MODE 2 when the reactor is critical or near critical, and must be shut down in the event of an accident. In MODES 3, 4, and 5 this manual trip Function must be OPERABLE when the PLS is capable of rod withdrawal, or one or more rods are not fully inserted. A rod is capable of withdrawal when its control rod drive mechanism (CRDM) is energized such that an automatic or manual signal could power the coils to withdraw the rod.
The RTS Manual Actuation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                            B 3.3.5-3                                         Rev. 1

RTS Manual Actuation B 3.3.5 BASES ACTIONS      A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.5-1.
A.1 Condition A applies to the RTS manual actuation Functions identified in Table 3.3.5-1. Condition A addresses the situation where one or more Functions have one manual actuation channel inoperable. One manual actuation channel consists of an initiation switch and the associated hardware (such as contacts and wiring) up to but not including the eight Reactor Trip Breakers. With one manual actuation channel inoperable, the inoperable channel must be restored to OPERABLE status within 48 hours. In this Condition, the remaining OPERABLE device is adequate to perform the safety function.
B.1 Condition B addresses the situation where the Required Action and associated Completion Time of Condition A are not met in MODE 1 or 2, or there are one or more Functions with two manual actuation channels inoperable in MODE 1 or 2. Required Action B.1 directs that the plant must be placed in MODE 3 within 6 hours. The allowed Completion Time for Required Action B.1 is reasonable, based on operating experience to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.
C.1 and C.2 Condition C addresses the situation where the Required Action and associated Completion Time of Condition A is not met in MODE 3, 4, or 5, or there are one or more Functions with two manual actuation channels inoperable in MODE 3, 4, or 5. Required Action C.1 requires that action be initiated to fully insert all control rods within 1 hour, and Required Action C.2 requires that the Plant Control System be placed in a condition incapable of rod withdrawal within 1 hour. The allowed Completion Times are reasonable, based on operating experience, to reach the specified condition in an orderly manner and without challenging plant systems.
SURVEILLANCE SR 3.3.5.1 REQUIREMENTS SR 3.3.5.1 is the performance of a TADOT of the RTS inputs for Manual Reactor Trip, and from the ESFAS logic for Safeguards Actuation, ADS AP1000 STS                          B 3.3.5-4                                          Rev. 1

RTS Manual Actuation B 3.3.5 BASES SURVEILLANCE REQUIREMENTS (continued)
Stages 1, 2, and 3 Actuation, and CMT Actuation. This TADOT is performed every 24 months. The test shall independently verify the OPERABILITY of the undervoltage and shunt trip mechanisms for the Manual Reactor Trip Function for the Reactor Trip Breakers.
The Frequency is based on the known reliability of the Functions and the manual reactor trip actuation device multichannel redundancy available, and has been shown to be acceptable through operating experience.
The SR is modified by a Note that excludes verification of setpoints from the TADOT. The Functions affected have no setpoints associated with them.
REFERENCES      None AP1000 STS                           B 3.3.5-5                                      Rev. 1

RTS Automatic Trip Logic B 3.3.6 B 3.3 INSTRUMENTATION B 3.3.6 Reactor Trip System (RTS) Automatic Trip Logic BASES BACKGROUND            A description of the RTS Instrumentation is provided in the Bases for LCO 3.3.1, Reactor Trip System (RTS) Instrumentation.
APPLICABLE            The RTS functions to maintain compliance with the SLs during all SAFETY                anticipated operational occurrences (AOOs) and mitigates the ANALYSES, LCO,        consequences of design basis accidents (DBAs) in all MODES in which and APPLICABILITY     the reactor trip breakers (RTBs) are closed.
The RTS automatic trip logic is required to ensure RTS Automatic Functions can provide the necessary protection.
The automatic trip logic ensures that means are provided to interrupt the power to the CRDMs and allow the rods to fall into the reactor core.
The automatic trip logic includes the Engineered Safety Features (ESF) coincidence logic and the voting logic.
The LCO requires four divisions of RTS automatic trip logic to be OPERABLE. Four OPERABLE divisions are provided to ensure that a random failure of a single logic channel will not prevent reactor trip.
The trip Function must be OPERABLE in MODE 1 or 2 and in MODE 3, 4, or 5, when the Plant Control System (PLS) is capable of rod withdrawal or one or more rods are not fully inserted. A rod is capable of withdrawal when its control rod drive mechanism (CRDM) is energized such that an automatic or manual signal could power the coils to withdraw the rod.
The RTS automatic trip logic satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS               A.1 Condition A addresses the situation where one or two RTS automatic trip logic divisions are inoperable in MODE 1 or 2. With one or two divisions inoperable, the Required Action is to restore three of the four divisions to OPERABLE status within 6 hours. Restoring all divisions but one to OPERABLE status ensures that a single failure will not prevent the AP1000 STS                                  B 3.3.6-1                                        Rev. 1

RTS Automatic Trip Logic B 3.3.6 BASES ACTIONS (continued) protective function, nor will it cause the protective function (with the exception of a limited number of PMS component failures). The 6 hour Completion Time is considered reasonable since the protective function will still function.
B.1 Condition B addresses the situation where the Required Action and associated Completion Time of Condition A is not met, or there are three or more divisions inoperable in MODE 1 or 2. Required Action B.1 directs that the plant must be placed in MODE 3 within 6 hours. The allowed Completion Time is reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.
C.1 Condition C addresses the situation where one or two RTS automatic trip logic divisions are inoperable in MODE 3, 4, or 5. With one or two divisions inoperable, the Required Action is to restore three of four divisions to OPERABLE status within 48 hours. Restoring all divisions but one to OPERABLE status ensures that a single failure will not prevent the protective function, nor will it cause the protective function (with the exception of a limited number of PMS component failures). The 48 hour Completion Time is considered reasonable since the protective function will still function.
D.1 and D.2 Condition D addresses the situation where the Required Action and associated Completion Time of Condition C is not met, or three or more RTS automatic trip logic divisions are inoperable in MODE 3, 4, or 5.
Required Action D.1 requires that action be initiated to fully insert all control rods within 1 hour, and Required Action D.2 requires that the Plant Control System be placed in a condition incapable of rod withdrawal within 1 hour. The allowed Completion Times are reasonable, based on operating experience, to reach the specified condition in an orderly manner and without challenging plant systems.
AP1000 STS                               B 3.3.6-2                                         Rev. 1

RTS Automatic Trip Logic B 3.3.6 BASES SURVEILLANCE None are required due to self-checking features that continuously REQUIREMENTS monitor logic OPERABILITY and alert the operator to any failures. The OPERABILITY of the Reactor Trip Digital Outputs and the Reactor Trip Matrix Termination Units are verified by the TADOT performed in SR 3.3.7.1.
REFERENCES   None.
AP1000 STS                       B 3.3.6-3                                     Rev. 1

RTS Trip Actuation Devices B 3.3.7 B 3.3 INSTRUMENTATION B 3.3.7 Reactor Trip System (RTS) Trip Actuation Devices BASES BACKGROUND            A description of the RTS Instrumentation is provided in the Bases for LCO 3.3.1, Reactor Trip System (RTS) Instrumentation.
APPLICABLE            The RTS functions to maintain compliance with the SLs during all SAFETY                anticipated operational occurrences (AOOs) and mitigates the ANALYSES, LCO,        consequences of design basis accidents (DBAs) in all MODES in which and APPLICABILITY     the reactor trip breakers (RTBs) are closed (Ref. 1).
The RTS trip actuation devices are required to ensure RTS Automatic and Manual Functions can provide the necessary protection.
The LCO requires OPERABILITY of four RTS divisions with two RTBs per division, and one undervoltage trip mechanism and one shut trip mechanism per in-service RTB.
The safety analyses and OPERABILITY requirements applicable to the RTS trip actuation devices are discussed below:
: 1. Reactor Trip Breakers This trip Function applies to the RTBs exclusive of individual trip mechanisms. There are eight reactor trip breakers with two breakers in each division. The reactor trip circuit breakers are arranged in a two-out-of-four logic configuration, such that the tripping of the two circuit breakers associated with one division does not cause a reactor trip. This circuit breaker arrangement is illustrated in FSAR Figure 7.2-1. The LCO requires four divisions of the Reactor Trip Switchgear to be OPERABLE with two trip breakers associated with each required division. This logic is required to meet the safety function assuming a single failure.
This trip Function must be OPERABLE in MODES 1 and 2. In MODES 3, 4, and 5, this RTS trip Function must be OPERABLE when the Plant Control System (PLS) is capable of rod withdrawal or when one or more rods are not fully inserted. A rod is capable of withdrawal when its control rod drive mechanism (CRDM) is energized such that an automatic or manual signal could power the coils to withdraw the rod.
AP1000 STS                                   B 3.3.7-1                                      Rev. 1

RTS Trip Actuation Devices B 3.3.7 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 2. Reactor Trip Breaker Undervoltage and Shunt Trip Mechanisms The LCO requires both the Undervoltage and Shunt Trip Mechanisms to be OPERABLE for each RTB that is in service. The trip mechanisms are not required to be OPERABLE for trip breakers that are open, racked out, incapable of supplying power to the Plant Control System (PLS), or declared inoperable under Function 1 above. OPERABILITY of both trip mechanisms on each breaker ensures that no single trip mechanism failure will prevent opening the breakers on a valid signal.
This trip Function must be OPERABLE in MODES 1 and 2. In MODES 3, 4, and 5, this RTS trip Function must be OPERABLE when the Plant Control System (PLS) is capable of rod withdrawal or when one or more rods are not fully inserted. A rod is capable of withdrawal when its control rod drive mechanism (CRDM) is energized such that an automatic or manual signal could power the coils to withdraw the rod.
The RTS trip actuation devices satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS          A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in LCO 3.3.7.
A.1 Condition A addresses the situation where one or both RTS trip actuation device functions within one division are inoperable. With one division inoperable, the Required Action is to open the affected RTB(s) in the inoperable division within 8 hours. The 8 hour Completion Time is considered reasonable since the protective function will still function.
B.1 Condition B addresses the situation where one or both RTS trip actuation device functions within two divisions are inoperable. With two divisions inoperable, the Required Action is to restore one division to OPERABLE status within 1 hour. The 1 hour Completion Time is considered reasonable since the protective function will still function.
AP1000 STS                             B 3.3.7-2                                       Rev. 1

RTS Trip Actuation Devices B 3.3.7 BASES ACTIONS (continued)
C.1 Condition C addresses the situation where the Required Action and associated Completion Time of Condition A or B are not met in MODE 1 or 2, or there are one or both RTS trip actuation device functions within three or more divisions inoperable in MODE 1 or MODE 2. Required Action C.1 directs that the plant must be placed in MODE 3 within 6 hours. The allowed Completion Times for Required Action C.1 is reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.
D.1 and D.2 Condition D addresses the situation where the Required Action and associated Completion Time of Condition A or B are not met in MODE 3, 4, or 5, or there are one or both RTS trip actuation device functions within three or more divisions inoperable in MODE 3, 4, or 5. Required Action D.1 requires initiating action to fully insert all control rods within 6 hours, and Required Action D.2 requires that the Plant Control System be placed in a condition incapable of rod withdrawal within 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the specified condition in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.3.7.1 REQUIREMENTS SR 3.3.7.1 is the performance of a TADOT on the Reactor Trip Digital Outputs, the Reactor Trip Matrix Termination Units, and on both reactor trip breakers associated with a single division every 92 days on a STAGGERED TEST BASIS for four divisions. This test shall verify OPERABILITY by actuation of the end devices.
The reactor trip breaker (RTB) test shall include separate verification of the undervoltage and shunt trip mechanisms. Each RTB in a division shall be tested separately in order to minimize the possibility of an inadvertent trip. Both breakers in a single division are tested during each STAGGERED TEST.
The Frequency of every 92 days on a STAGGERED TEST BASIS is adequate based on industry operating experience, considering AP1000 STS                                 B 3.3.7-3                                          Rev. 1

RTS Trip Actuation Devices B 3.3.7 BASES SURVEILLANCE REQUIREMENTS (continued) instrument reliability and operating history data. In addition, the design provides additional breakers to enhance reliability.
REFERENCES      1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                             B 3.3.7-4                                      Rev. 1

ESFAS Instrumentation B 3.3.8 B 3.3 INSTRUMENTATION B 3.3.8 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND           The ESFAS initiates necessary safety systems, based upon the values of selected unit parameters, to protect against violating core design limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate accidents. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the ESFAS, as well as specifying LCOs on other reactor system parameters and equipment performance.
Technical Specifications are required by 10 CFR 50.36 to include LSSS for variables that have significant safety functions. LSSS are defined by the regulation as Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded. The Safety Analysis Limit (SAL) is the limit of the process variable at which a protective action is initiated, as established by the safety analysis, to ensure that an SL is not exceeded.
However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the SAL to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur. The LSSS values are identified and maintained in the Setpoint Program (SP) and are controlled by 10.CFR.50.59.
The Nominal Trip Setpoint (NTS) specified in the SP is a predetermined field setting for a protection channel chosen to initiate automatic actuation prior to the process variable reaching the SAL and, thus, assures that the SL is not exceeded. As such, the NTS accounts for uncertainties in setting the channel (e.g., calibration), uncertainties in how the channel might actually perform (e.g., repeatability), changes in the point of action of the channel over time (e.g., drift during Surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the NTS assures that the SLs are not exceeded. Therefore, the NTS meets the 10 CFR 50.36 definition of an LSSS.
Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as ...being capable of performing its safety functions(s). Relying solely on the NTS to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it AP1000 STS                                  B 3.3.8-1                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES BACKGROUND (continued) were applied as an OPERABILITY limit for the as-found value of a protection channel setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule that are not necessary to ensure safety. For example, an automatic protection channel with a setting that has been found to be different from the NTS due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the NTS, and thus, the automatic protective action would still have assured that the SL would not be exceeded with the as-found setting of the protection channel. Therefore, the channel would still be OPERABLE since it would have performed its safety function. If the as-found condition of the channel is near the as-found tolerance, recalibration is considered appropriate to allow for drift during the next Surveillance interval.
During AOOs, which are those events expected to occur one or more times during the unit life, the acceptable limits are:
: 1. The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling (DNB);
: 2. Fuel centerline melt shall not occur; and
: 3. The RCS pressure SL of 2750 psia shall not be exceeded.
Operation within the SLs of Specification 2.0, Safety Limits (SLs), also maintains the above values and assures that offsite doses are within the acceptance criteria during AOOs.
Design Basis Accidents (DBA) are events that are analyzed even though they are not expected to occur during the unit life. The acceptable limit during accidents is that the offsite dose shall be maintained within an acceptable fraction of the limits. Different accident categories are allowed a different fraction of these limits, based on the probability of occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.
AP1000 STS                             B 3.3.8-2                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES BACKGROUND (continued)
Protection and Safety Monitoring System (PMS)
The PMS cabinets contain the necessary equipment to (Ref. 1):
* Permit acquisition and analysis of the sensor inputs, including plant process sensors and nuclear instrumentation, required for reactor trip and ESF calculations;
* Perform computation or logic operations on variables based on these inputs;
* Provide trip signals to the reactor trip switchgear and ESF actuation data to the ESF coincidence logic as required;
* Permit manual trip or bypass of each individual reactor trip Function and permit manual actuation or bypass of each individual voted ESF Function;
* Provide data to other systems in the Instrumentation and Control (I&C) architecture;
* Provide additional redundancy (within a single division) for the reactor trips and ESF actuations; and
* Provide isolation circuitry for control Functions that require input from sensors that are also required for protection Functions.
PMS Overview The four divisions of PMS each consist of the following:
* Field Transmitters and Sensors (non-redundant)
* Nuclear Instrumentation System (NIS) - 1 per division (non-redundant)
* Bistable Processor Logic (BPL) System - 2 BPL subsystems per division (redundant)
* Local Coincidence Logic (LCL) System - 2 LCL subsystems per division (redundant)
AP1000 STS                             B 3.3.8-3                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES BACKGROUND (continued)
* ESF Actuation Subsystem Logic (Integrated Logic Cabinet (ILC))
with Integrated Logic Processor (ILP) System - 2 ILP subsystems per ILC (redundant)
* Division A - 3 ILCs
* Division B - 4 ILCs
* Division C - 2 ILCs
* Division D - 4 ILCs
* Component Interface Modules (CIMs) (non-redundant)
The vital buses that power each PMS division are backed up by the battery bank in the same division. See LCO 3.8.1, DC Sources -
Operating, for further discussion.
PMS equipment duplication within a division (redundancy) is generally provided for active equipment such as processors and communication hardware. Where provided, redundant sets of equipment within a division are not independent and can be subject to common cause failures. This redundancy is provided to increase plant availability and facilitate Surveillance testing. A division or channel is OPERABLE if it is capable of performing its specified safety function(s) and all the required supporting functions or systems are also capable of performing their related support functions.
Within each division, the sensor signals and setpoint bistables are processed in the BPL. The results of the bistable logic (partial ESF actuation signals) are communicated to the LCL subsystems in all divisions. The LCL subsystems perform the divisional ESF Coincidence Logic voting (e.g., two-out-of-four (2oo4) logic) and other associated logic.
ESF system-level actuation outputs from the LCL are inputs to the ESF Actuation Subsystem logic performed in the ILC for generation of logic commands to the actuated components. Each ILC consists of redundant ILPs and non-redundant CIMs. The ILPs decode the system commands and actuate the final equipment through the CIM interlocking logic specific to each component (Ref. 1).
AP1000 STS                             B 3.3.8-4                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES BACKGROUND (continued)
The CIMs provide actuation signals to each of the actuated devices. The PMS boundary ends at the output terminals of the ClMs. The actuated devices are outside the scope of this Specification.
Engineered Safety Features (ESF) Channel An ESF channel extends from the sensor to the output of the associated BPL subsystem and shall include the sensor (or sensors), the signal conditioning, the BPL subsystem, and associated datalinks to the LCL subsystems. For ESF channels containing nuclear instrumentation (e.g., boron dilution block, CVS isolation), the ESF channel also includes the signal processing and power supplies for the neutron flux detectors provided by the NIS. In some cases, sensors provide inputs to more than one ESF actuation function. Thus, an inoperability of a shared sensor can affect the OPERABILITY of more than one ESF actuation function.
PMS Division The PMS consists of four redundant divisions, designated A, B, C, and D (with the exception of the Component Interface Modules). All safety system divisions are physically, functionally, and electrically separated from each other and from non-safety systems. Redundant divisions are provided to satisfy single failure criteria and improve plant availability.
PMS divisions A and C actuate one train of ESF equipment and divisions B and D actuate the other ESF train.
Field Transmitters and Sensors Normally, four redundant measurements using four separate sensors are made for each variable used for actuation of ESF. One measurement is processed by each division. The use of four channels for protection Functions is based on a minimum of two channels being required for an ESF actuation (two-out-of-four (2oo4) voting logic), with one channel in test or bypass, and a single failure on the remaining channel. Minimum requirements for protection are achieved only with three channels OPERABLE. The fourth channel is provided to increase plant availability, and permits the plant to run for an indefinite time with a single channel out of service. The circuit design is able to withstand both an input failure to the control system, which may then require the protection Function actuation, and a single failure in the other channels providing the protection Function actuation.
AP1000 STS                             B 3.3.8-5                                         Rev. 1

ESFAS Instrumentation B 3.3.8 BASES BACKGROUND (continued)
Analog measurements are converted to digital form by analog to digital (A/D) converters within the BPL subsystems. Signal conditioning may be applied to selected inputs following the conversion to digital form.
Except for selected dual element resistance temperature detectors (RTDs), the sensors within each division are non-redundant.
Nuclear Instrumentation System (NIS)
In each division the NIS cabinet provides signal processing and power supplies for the source range, intermediate range, and power range neutron flux detectors. The analog and digital pulse signals generated are sent to the BPL for processing. Within each division, each transmitter, sensor, and NIS signal is input in parallel to both BPLs.
Bistable Processor Logic (BPL) System Each PMS division contains two identical and redundant BPL subsystems receiving the same input signals and performing the same calculations and logic. The BPL subsystems receive data from field sensors and manual inputs (such as system-level blocks and resets) from the MCR to perform the protective Function calculations.
Within each division, the input from each sensor is provided in parallel to each of the two BPL subsystems' analog or digital input modules.
Analog transmitter and sensor measurements are converted from analog to digital form by analog to digital input modules within the BPL subsystems. Signal conditioning may be applied to selected inputs following the conversion to digital form. The subsystems provide signal outputs for MCR indications and, via the Plant Control System (PLS), for the non-safety related Remote Shutdown Workstation indications.
Following necessary calculations, processing, and logic, the measurements are compared against the applicable setpoints. The basis of the setpoints is described in References 2 and 3. The results of the required calculations and setpoint comparisons determine the partial actuation status for each ESF actuation function.
The partial ESF actuation signals are transmitted to all eight LCLs in the PMS for use in coincidence logic voting. The PMS uses datalinks to communicate the partial ESF actuation signals and related status information calculated in the BPL subsystems to the LCL subsystems.
These datalinks are used both locally within a division and externally AP1000 STS                             B 3.3.8-6                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES BACKGROUND (continued) across divisions. A partial actuation signal from either BPL subsystem in a division is interpreted by the LCL subsystem as a partial actuation signal.
During periodic tests and maintenance performed using the Maintenance and Test Panel and Interface and Test Processor, each BPL subsystem is tested individually. During testing, the LCL processors use the redundant BPL subsystem for actuation status. This permits the division being tested to remain OPERABLE while the testing is being conducted.
In combination with manual tests required by Surveillance Requirements, the BPLs are tested via continuous system self-checking features.
ESF Coincidence Logic (Local Coincidence Logic (LCL) System)
Each PMS division contains two identical and redundant LCL subsystems receiving the same input signals and performing the same logic. The LCL subsystems perform the logic to combine the partial ESF actuation signals from the BPL subsystems, along with permissives, blocks, and resets, and generate an actuation output signal to the ESF Actuation Subsystem Logic (Integrated Logic Cabinet (ILC)).
Eight LCL subsystems are provided in the PMS architecture. Each of the LCL subsystems receives partial ESF actuation signals and status signals from each of the eight BPL subsystems. In normal operation, the LCL subsystem logic is programmed to assume that a partial ESF actuation signal in either BPL subsystem in a given division is equivalent to a partial ESF actuation signal.
In the event of a single BPL processor or associated datalink failure in a division is detected by diagnostics, the LCL subsystem logic will reject the input from the failed component and use the input from the other BPL subsystem from the affected division as the source of actuation information. This allows the ESF actuation Function logic to remain in a 2oo4 logic configuration.
LCL processors will only permit bypass of both BPL inputs of a given ESF actuation Function from one division (such as due to a failed sensor). In the event of a division bypass, the LCL reverts to 2oo3 logic in the affected ESF actuation Function.
The LCL subsystems act to initiate an ESF actuation when the required number of divisions reaches a partial ESF actuation state (e.g., 2oo4, 1oo2).
AP1000 STS                              B 3.3.8-7                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES BACKGROUND (continued)
The LCL also provides for the bypass of ESF actuation Functions to accommodate periodic tests and maintenance. During LCL subsystem testing, each LCL subsystem is tested individually. During testing, the redundant LCL subsystem is available to provide output signals to the ILCs. This permits the division being tested to remain OPERABLE while the testing is being conducted. In combination with manual tests required by Surveillance Requirements, the LCLs are tested via continuous system self-checking features.
Within each division, datalinks transfer the ESF system-level actuations and related status information calculated in the LCL controllers to the ESF Actuation Subsystem. Actuation signals from both LCL subsystems are transmitted to the redundant ILPs in each ILC.
MCR ESF Manual Controls Each of the manual system-level actuations is implemented using switches wired to digital input modules included in the LCL. The switch inputs to the LCL produce the ESF system-level actuation signals that are communicated to the ESF Actuation Subsystem.
ESF Actuation Subsystem (Integrated Logic Cabinet (ILC))
Within each division, ESF system-level actuation outputs from the LCLs are inputs to the ESF Actuation Subsystem for generation of logic commands to the actuated components. The ESF Actuation Subsystem consists of internally redundant ILPs and non-redundant CIMs. The ILPs decode the system commands and actuate the final equipment through the CIM logic specific to each component.
Each of the two processors in an ILP (or ILP processors) receives inputs from both ESF coincidence logic processors (LCL subsystems) in a division. The ILPs perform the component fan-out for each ESF system-level actuation command. As long as the outputs from both ESF coincidence logic processors (LCL subsystems) agree that an actuation should occur (i.e., 2oo2 logic), the ILPs will generate actuation signals to the CIMs. For each ESF system level actuation Function, if one of the LCL subsystems has no output signal, provides a bad quality signal, or is in test, a good quality signal input to the ILP processors from the other LCL subsystem is sufficient to maintain OPERABILITY. With a good quality signal from only one LCL subsystem, the ILP logic becomes 1oo1.
AP1000 STS                              B 3.3.8-8                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES BACKGROUND (continued)
Each CIM provides an actuation signal to its associated actuated device.
Each CIM receives inputs from both processors in an ILP and produces component actuation signals if the input signals agree (i.e., 2oo2 logic). If one of the ILP processors has no output signal or provides a bad quality signal, a good quality signal input to the CIM from the other ILP processor is sufficient to maintain OPERABILITY. With a good quality signal from only one ILP processor, the CIM logic becomes 1oo1.
The PMS boundary ends at the output terminals of the CIMs. In lieu of manual tests required by a Surveillance Requirement, the ILPs and CIMs are tested via continuous system self-checking features. The output of the CIMs up to, but not including the component, are tested via a combination of manual Surveillance tests and continuous self-checking features.
ADS and IRWST Injection Blocking Device The ADS and IRWST injection blocking device is a Class 1E module physically located within each of the PMS divisions. The blocking device is diverse from the PMS hardware and software that is used to create the automatic ADS and IRWST injection ESF actuation signals. There are no inter-divisional connections between the blocking devices nor is there any coincidence voting among the blocking devices. The ADS and IRWST injection blocking device uses core makeup tank (CMT) level. The ADS and IRWST injection block in each division receives an input from a level sensor on each CMT that removes the block if the water level in either CMT is below a predetermined setpoint. Additionally, one switch for each division is provided in the Main Control Room (MCR) to allow the operators to manually clear the ADS and IRWST blocks.
The ADS and IRWST injection blocking device design uses conventional analog components that do not rely on software. The ADS and IRWST injection blocking device outputs provide CIM inputs for ADS Stage 1, 2, and 3 MOVs, and the ADS Stage 4 and IRWST injection squib valves.
The ADS and IRWST injection blocking device outputs block any attempt to open the ADS and IRWST injection valves from the PMS Integrated Logic Processors.
AP1000 STS                             B 3.3.8-9                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES BACKGROUND (continued)
Nominal Trip Setpoints (NTSs)
The NTS is the nominal value at which the trip output is set (trip setpoint).
Any trip output is considered to be properly adjusted when the as-left value is within the band for CHANNEL CALIBRATION, i.e., +/- rack calibration accuracy.
The NTSs used in the trip output are based on the Safety Analysis Limits stated in Reference 2. The determination of these NTSs is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 4), the NTSs specified in the SP are conservative with respect to the Safety Analysis Limits. A detailed description of the methodology used to calculate the NTSs, including their explicit uncertainties, is provided in the Westinghouse Setpoint Methodology for Protection Systems (Ref. 3). The as-left tolerance and as-found tolerance band methodology is provided in the SP.
The NTSs listed in the SP are based on the methodology described in Reference 3, which incorporates all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each NTS. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes. Transmitter and signal processing equipment calibration tolerances and drift allowances must be specified in plant calibration procedures, and must be consistent with the values used in the setpoint methodology.
The OPERABILITY of each transmitter or sensor can be evaluated when its as-found calibration data are compared against the as-left data and are shown to be within the setpoint methodology assumptions. The basis of the setpoints is described in References 2 and 3. Trending of calibration results is required by the program description in Technical Specification 5.5.14.d.
Note that the as-left and as-found tolerances listed in the SP define the OPERABILITY limits for a channel during a periodic CHANNEL CALIBRATION or a TRIP ACTUATING DEVICE OPERATIONAL TEST.
Trip setpoints are continuously and automatically verified by PMS self-checking features between performances of CHANNEL CALIBRATIONS. Before unit startup, the CHANNEL CALIBRATION AP1000 STS                             B 3.3.8-10                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES BACKGROUND (continued) verifies that the trip setpoint values in the Maintenance and Test Panel (MTP) match the SP specified NTS values.
The PMS testing features are designed to allow for complete testing by using a combination of system self-checking and manual tests.
Successful testing consists of verifying that the capability of the system to perform the safety function has not failed or degraded. For hardware functions this would involve verifying that the hardware components and connections have not failed or degraded. Since software does not degrade, software testing involves verifying that the software code has not changed and that the software code is executing. To the extent possible, PMS testing will be accomplished with continuous system self-checking features in lieu of manual Surveillance tests. As a result, some Functions do not have manual Surveillance Requirements.
The PMS incorporates continuous system self-checking features wherever practical. Self-checking features include on-line diagnostics for the computer system and the hardware and communications tests.
Faults detected by the self-checking features are alarmed in the main control room to alert the operator. These self-checking tests do not interfere with normal system operation.
Manual tests are included for those parts of the system which are not tested with self-checking features. This includes manual functional checks, calibration verification, response time testing, and component testing.
All of the tests are designed so that the duration of the testing is as short as possible. The manual tests are designed so that the actual logic is not modified. To prevent unwanted actuation, the tests are designed with either the capability to bypass a Function during testing and/or limit the number of signals allowed to be placed in test at one time.
APPLICABLE        Each of the analyzed accidents can be detected by one or more ESFAS SAFETY            Functions. One of the ESFAS Functions is the primary actuation signal ANALYSES, LCO,    for that accident. An ESFAS Function may be the primary actuation and APPLICABILITY signal for more than one type of accident. An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents. For example, Pressurizer Pressure  Low 3 is a primary actuation signal for small loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) outside containment. Functions such as manual initiation not specifically credited AP1000 STS                               B 3.3.8-11                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) in the accident safety analysis are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the plant. These Functions may provide protection for conditions which do not require dynamic transient analysis to demonstrate Function performance. These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 2).
Permissive and interlock Functions are based upon the associated protection Function instrumentation. Because they do not have to operate in adverse environmental conditions, the trip settings of the permissive and interlock Functions use the normal environment, steady-state instrument uncertainties of the associated protection Function instrumentation. This results in OPERABILITY criteria (i.e., as-found tolerance and as-left tolerance) that are the same as the associated protection Function sensor and process rack modules. The NTSs for permissives and interlocks are based on the associated protection Function OPERABILITY requirements; i.e., permissives and interlocks performing enabling functions must be set to occur prior to the specified trip setting of the associated protection Function.
The LCO requires all instrumentation performing an ESFAS Function, listed in Table 3.3.8-1, to be OPERABLE. The as-left and as-found tolerances specified in the SP define the OPERABILITY limits for a channel during the CHANNEL CALIBRATION. As such, the as-left and as-found tolerances differ from the NTS by plus or minus the PMS rack calibration accuracy and envelope the expected calibration accuracy and drift. In this manner, the actual setting of the channel (NTS) prevents exceeding an SL at any given point in time as long as the channel has not drifted beyond the expected tolerances during the Surveillance interval. Note that the as-left and as-found recorded values must be confirmed to be within the assumptions of the statistical uncertainty calculations.
If the actual trip setting of the channel is found outside the as-found tolerance, the channel is considered inoperable. This condition of the channel will be further evaluated during performance of the Surveillance.
This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance) and evaluating the channels response. If the channel is functioning as required and expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.
AP1000 STS                               B 3.3.8-12                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
A channel trip setting may be adjusted to be more conservative than the NTS as necessary in response to plant conditions. However, in this case, the OPERABILITY of this instrument must be verified based on the actual field setting and not the NTS. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
ESFAS Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlocks backup manual actions to ensure bypassable Functions are in operation under the conditions assumed in the safety analyses. Proper operation of these interlocks supports OPERABILITY of the associated ESFAS Functions and/or the requirement for actuation logic OPERABILITY. Interlocks must be in the required state, as appropriate, to support OPERABILITY of ESFAS.
Reactor Trip Breaker Open, P-3 The P-3 interlock is provided to permit the block of automatic Safeguards Actuation after a predetermined time interval following automatic Safeguards Actuation.
The reactor trip breaker (RTB) position switches that provide input to the P-3 interlock only function to energize or de-energize (open or close) contacts. Therefore, the RTB position switch function of the P-3 interlock does not have an adjustable trip setpoint.
Reactor Trip, P-4 There are eight reactor trip breakers with two breakers in each division.
The P-4 interlock is enabled when the breakers in two-out-of-four divisions are open. The P-4 interlock is addressed by LCO 3.3.12, ESFAS Reactor Trip Initiation. Additionally, the P-4 interlock is enabled by all Automatic Reactor Trip Actuations. Once enabled, the P-4 interlock initiates the following protective functions:
* Main turbine trip (closes turbine stop valves, control valves, reheat stop valves, intercept valves, extraction steam shutoff and non-return valves, and opens automatic steam line drain valves)
AP1000 STS                             B 3.3.8-13                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
* Boron dilution block (closes the two isolation valves in the demineralized water system supply line to the makeup pump suction control valve and aligns the boric acid tank to the suction of the makeup pumps)
* CVS makeup isolation (closes the two makeup line containment isolation motor-operated valves) if coincident with a Steam Generator (SG) Narrow Range Water Level  High voting logic output signal (LCO 3.3.8, Function 22) for either SG to limit primary-to-secondary leakage to the affected SG following a SGTR event
* Startup feedwater isolation (closes control and isolation valves and trips startup feedwater pump) if coincident with a SG Narrow Range Water Level  High voting logic output signal (LCO 3.3.8, Function 22) for either SG
* Main feedwater isolation (closes main feedwater isolation valves if coincident with a Reactor Coolant System Average Temperature Low 2 voting logic output signal (LCO 3.3.8, Function 13); and closes main feedwater control valves if coincident with Reactor Coolant Average Temperature  Low voting logic output signal (LCO 3.3.8, Function 12). (Even though these instrument Functions are not assumed in safety analysis, they are included in the Technical Specifications.)
The reactor trip breaker (RTB) position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. Therefore, the RTB position switch function of the P-4 interlock has no adjustable trip setpoint.
Intermediate Range Neutron Flux, P-6 The Intermediate Range Neutron Flux, P-6 interlock is automatically enabled when the respective PMS division Intermediate Range Neutron Flux channel increases to approximately one decade above the channel lower range limit. Above the setpoint, the P-6 interlock allows manual block of the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation protective functions, and deenergization of the source range neutron flux detectors. As intermediate range flux decreases from above the setpoint to below the setpoint, the P-6 interlock automatically resets the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation protective functions, and automatically energizes the source range detectors.
AP1000 STS                              B 3.3.8-14                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Normally, the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation protective functions is blocked by the main control room operator during reactor startup.
Reactor Coolant Average Temperature, P-8 The P-8 interlock is used to permit manual blocking, and for the resetting of a manual block, of the automatic Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation protective functions. The automatic Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation protective functions may be manually blocked (disabled) to permit plant startup and normal power operation when above the P-8 reactor coolant average temperature Setpoint. The manual block to disable the automatic Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation protective functions is automatically reset upon decreasing reactor coolant average temperature to below the P-8 setpoint.
Once reactor coolant average temperature is below the P-8 setpoint and after the operator isolates unborated water source flow paths, the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation protective functions may also be manually blocked to prevent inadvertent actuation during refueling operations and post-refueling rod testing.
When the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation protective functions is manually blocked below the P-8 setpoint, an automatic close signal is also sent to the CVS demineralized water system isolation valves to prevent inadvertent boron dilution.
Reactor Coolant Average Temperature (Tavg), P-9 The P-9 interlock permits routine maintenance without core makeup tank actuation, reactor coolant pump trip, PRHR heat exchanger actuation, and SG blowdown isolation. The P-9 interlock also serves to permit the steam generators to be flooded for wet-layup in MODES 5 and 6 without automatic startup feedwater isolation, CVS isolation, main feedwater isolation, or actuation of turbine trip signal. With Tavg channels less than the P-9 setpoint, the operator can manually block the Steam Generator AP1000 STS                             B 3.3.8-15                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Wide Range Water Level  Low 2 coincident with Hot Leg Temperature High, Steam Generator Wide Range Water Level  Low 2, and Steam Generator Narrow Range Water Level  Low 2 signals. Utilizing a separate block control with RCS Tavg below the P-9 setpoint, the operator can also manually block startup feedwater isolation and CVS isolation on High steam generator narrow range water level coincident with reactor trip (P-4), as well as startup feedwater isolation, main feedwater isolation, CVS isolation, and turbine trip on High-3 steam generator narrow range water level. These Functions are automatically enabled above P-9. With Tavg channels greater than the P-9 setpoint, the Steam Generator Wide Range Water Level  Low 2 coincident with Hot Leg Temperature  High, Steam Generator Wide Range Water Level  Low 2, and Steam Generator Narrow Range Water Level  Low 2 signals are automatically enabled.
The P-9 interlock also permits the draining of the IRWST to support refueling operations. With Tavg channels less than the P-9 setpoint, the operator can manually block the IRWST Wide Range Level  Low isolation signal. With Tavg channels greater than the P-9 setpoint, the IRWST Wide Range Level  Low isolation signal is automatically enabled. This block is necessary to permit IRWST volume to be transferred to and from the refueling cavity during MODE 6 with the refueling cavity and spent fuel pool volumes not in communication.
Power Range Neutron Flux, P-10 The Power Range Neutron Flux, P-10 interlock is actuated at approximately 10% RATED THERMAL POWER as determined by the respective PMS divisions power range neutron flux detector. Below the setpoint, the P-10 interlock allows manual energization of the source range neutron flux detectors and reset of the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation protective functions. Above the setpoint, the P-10 interlock automatically blocks the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation, and de-energizes the source range neutron flux detectors. Normally, the Source Range Neutron Flux Doubling actuation of the Boron Dilution Block and CVS Isolation protective functions is blocked by the main control room operator during reactor startup.
AP1000 STS                             B 3.3.8-16                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Pressurizer Pressure, P-11 The P-11 interlock permits a normal unit cooldown and depressurization without Safeguards Actuation or main steam line and feedwater isolation.
With pressurizer pressure channels less than the P-11 setpoint, the operator can manually block the following listed ESFAS instrument Functions, which initiate these ESFAS actuation and isolation protective functions, by manually blocking the initiation signal from the ESFAS instrument channel in three PMS divisions:
* Safeguards Actuation on
                      -     Pressurizer Pressure  Low 3 (LCO 3.3.8, Function 5),
                      -     Steam Line Pressure  Low 2 (LCO 3.3.8, Function 24), or
                      -     Tcold  Low 2 (LCO 3.3.8, Function 11).
* Steam Line Isolation on
                      -     Steam Line Pressure  Low 2 (LCO 3.3.8, Function 24), or
                      -     Tcold  Low 2 (LCO 3.3.8, Function 11).
Manually blocking the Steam Line Pressure  Low 2 ESFAS instrument channels enables the ESFAS protective function of Main Steam Isolation on Steam Line Pressure-Negative Rate  High (LCO 3.3.8, Function 25). This provides protection for an SLB by closure of the main steam isolation valves.
* Feedwater Isolation on
                      -     Tavg  Low (LCO 3.3.8, Function 12),
                      -     Tavg  Low 2 (LCO 3.3.8, Function 13), and
                      -     Tcold  Low 2 (LCO 3.3.8, Function 11).
With pressurizer pressure channels greater than or equal to the P-11 setpoint, the Safeguards Actuation signals on Pressurizer Pressure Low 3, Steam Line Pressure  Low 2, and Tcold  Low 2, the Steam Line Isolation signals on Steam Line Pressure  Low 2 and Tcold  Low 2, and Feedwater Isolation signals on Tcold  Low 2, Tavg  Low, and Tavg  Low 2 are automatically enabled. The operator can also manually enable these signals by use of the respective PMS division manual reset buttons for these ESFAS instrument Functions. With pressurizer pressure channels greater than or equal to the P-11 setpoint, the Steam Line Isolation signal on Steam Line Pressure  Negative Rate  High is automatically blocked.
AP1000 STS                             B 3.3.8-17                                    Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
When the Steam Line Pressure  Low 2 and Tcold  Low 2 steam line isolation signals are enabled, the main steam isolation on Steam Line Pressure  Negative Rate  High is disabled. RNS isolation provided by Containment Radioactivity  High 2 channels and Safeguards Actuation are automatically unblocked above the P-11 setpoint, with manual block permitted below the P-11 setpoint. The P-11 setpoint reflects only steady state instrument uncertainties.
Pressurizer Level, P-12 The P-12 interlock is provided to permit midloop operation without core makeup tank actuation, reactor coolant pump trip, CVS letdown isolation, or purification line isolation. With pressurizer level channels less than the P-12 setpoint, the operator can manually block the Pressurizer Water Level  Low and Pressurizer Water Level  Low 2 signals used for these actuations. Concurrent with blocking CMT actuation on Pressurizer Water Level  Low 2, ADS 4th Stage actuation on Low 4 RCS hot leg level is enabled. Also, CVS letdown isolation on Low 2 RCS hot leg level is enabled. Requirements for these instrument Functions are specified in LCO 3.3.10, ESFAS RCS Hot Leg Level Instrumentation. When the pressurizer level is above the P-12 setpoint, the Pressurizer Water Level Low 2 signal is automatically enabled and a confirmatory open signal is issued to the isolation valves on the CMT cold leg balance lines.
RCS Pressure, P-19 The P-19 interlock is provided to permit water solid conditions (i.e., when the pressurizer water level is > 92%) in lower MODES without automatic isolation of the CVS makeup pumps. With RCS pressure below the P-19 setpoint, the PMS allows the operator to manually block CVS isolation on Pressurizer Water Level  High 2 (LCO 3.3.8, Function 9), and block PRHR actuation and Pressurizer Heater Trip on Pressurizer Water Level High 3 (LCO 3.3.8, Function 10). The operator can manually block these ESFAS protective functions once they are no longer required to be OPERABLE when at least one RCS cold leg temperature is  275&deg;F.
When RCS pressure is above the P-19 setpoint, these protective functions are automatically unblocked. When the RCS is cooled by the RNS, the RNS suction relief valve provides the required overpressure protection of the RCS (LCO 3.4.14).
AP1000 STS                              B 3.3.8-18                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The LCO generally requires OPERABILITY of four channels in each instrumentation/logic Function and two devices for each manual initiation Function. The two-out-of-four configurations allow one channel to be bypassed during maintenance or testing without causing an ESFAS initiation. Two manual initiation channels are required to ensure no single random failure disables the ESFAS.
The required channels of ESFAS instrumentation provide plant protection in the event of any of the analyzed accidents. ESFAS protective functions are as follows:
Safeguards Actuation The Safeguards Actuation signal actuates the alignment of the Core Makeup Tank (CMT) valves for passive injection to the RCS. The Safeguards Actuation signal provides two primary protective functions:
* Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal and clad integrity, peak clad temperature < 2200&deg;F); and
* Boration to ensure recovery and maintenance of SHUTDOWN MARGIN (keff < 1.0).
These protective functions are necessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment. The Safeguards Actuation signal is also used to initiate other protective functions such as:
* Containment Isolation;
* Reactor Trip;
* Close Main Feedwater Control Valves;
* Trip Main Feedwater Pumps and Closure of Isolation and Crossover Valves; and
* Reactor Coolant Pump Trip.
AP1000 STS                            B 3.3.8-19                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
These other protective functions ensure:
* Isolation of nonessential systems through containment penetrations;
* Trip of the turbine and reactor to limit power generation;
* Isolation of main feedwater to limit secondary side mass losses;
* Trip of the reactor coolant pumps to ensure proper CMT actuation; and
* Enabling automatic depressurization of the RCS on CMT Level Low 3 to ensure continued safeguards actuated injection.
Safeguards Actuation is initiated by the following signals:
* Containment Pressure  High 2 (LCO 3.3.8, Function 2);
* Pressurizer Pressure  Low 3 (LCO 3.3.8, Function 5);
* RCS Cold Leg Temperature (Tcold)  Low 2 (LCO 3.3.8, Function 11);
* Steam Line Pressure  Low 2 (LCO 3.3.8, Function 24); and
* Safeguards Actuation  Manual Initiation (LCO 3.3.9, Function 1).
Core Makeup Tank (CMT) Actuation CMT Actuation provides the passive injection of borated water into the RCS. Injection provides RCS makeup water and boration during transients or accidents when the normal makeup supply from the Chemical and Volume Control System (CVS) is lost or insufficient. Two tanks are available to provide passive injection of borated water. CMT injection mitigates the effects of high energy line breaks by adding primary side water to ensure maintenance or recovery of reactor vessel water level following a LOCA, and by borating to ensure recovery or maintenance of SHUTDOWN MARGIN following a steam line break.
AP1000 STS                             B 3.3.8-20                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
CMT Actuation is initiated by the following signals:
* Safeguards Actuation;
* Pressurizer Water Level  Low 2 (LCO 3.3.8, Function 7);
* ADS Stages 1, 2, and 3 Actuation; and
* CMT Actuation  Manual Initiation (LCO 3.3.9, Function 2).
Containment Vacuum Relief Valve Actuation The purpose of the vacuum relief lines is to protect the containment vessel against damage due to a negative pressure (i.e., a lower pressure inside than outside). Containment Vacuum Relief Valve Actuation is actuated by the following signals:
* Containment Pressure  Low 2 (LCO 3.3.8, Function 1); and
* Containment Vacuum Relief Valve Actuation  Manual Initiation (LCO 3.3.9, Function 15) coincident with Containment Pressure Low (LCO 3.3.8, Function 1.a).
Containment Isolation (T signal)
Containment Isolation provides isolation of the containment atmosphere and selected process systems which penetrate containment from the environment. This protective function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.
Containment Isolation is actuated by the following signals:
* Safeguards Actuation;
* Passive Containment Cooling Actuation  Manual Initiation (LCO 3.3.9, Function 8); and
* Containment Isolation  Manual Initiation (LCO 3.3.9, Function 3).
AP1000 STS                            B 3.3.8-21                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Containment Air Filtration System Isolation Some DBAs such as a LOCA may release radioactivity into the containment where the potential would exist for the radioactivity to be released to the atmosphere and exceed the acceptable site dose limits.
Isolation of the Containment Air Filtration System provides protection to prevent radioactivity inside containment from being released to the atmosphere.
The Containment Air Filtration System Isolation protective function is actuated by the following signals:
* Containment Radioactivity  High (LCO 3.3.8, Function 3); and
* Containment Isolation Actuation.
Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment. Rapid isolation of the steam lines will limit the steam line break accident to the blowdown from one steam generator (SG) at most. For an SLB upstream of the isolation valves, inside or outside of containment, closure of the isolation valves limits the accident to the blowdown from only the affected SG. For an SLB downstream of the isolation valves, closure of the isolation valves terminates the accident as soon as the steam lines depressurize.
Closure of the turbine stop and control valves and the main steam branch isolation valves is initiated by this protective function. Closure of these valves limits the accidental depressurization of the main steam system associated with an inadvertent opening of a single steam dump, relief, or safety valve, or a rupture of a main steam line. Closure of these valves also supports mitigating a steam generator tube rupture event by isolating the faulted steam generator.
Steam Line Isolation is actuated by the following signals:
* Containment Pressure  High 2 (LCO 3.3.8, Function 2);
* RCS Cold Leg Temperature (Tcold)  Low 2 (LCO 3.3.8, Function 11);
AP1000 STS                             B 3.3.8-22                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
* Steam Line Pressure  Low 2 (LCO 3.3.8, Function 24);
* Steam Line Pressure  Negative Rate  High (LCO 3.3.8, Function 25); and
* Steam Line Isolation  Manual Initiation (LCO 3.3.9, Function 4).
SG Power Operated Relief Valve and Block Valve Isolation The purpose of the SG Power Operated Relief Valve (PORV) and Block Valve Isolation protective function is to ensure that the SG PORV flow paths can be isolated during a SG tube rupture (SGTR) event. The PORV flow paths must be isolated following a SGTR to minimize radiological releases from the ruptured steam generator into the atmosphere. The PORV flow path is assumed to open due to high secondary side pressure, during the SGTR. Dose analyses take credit for subsequent isolation of the PORV flow path by the PORV and/or the block valve, which receive a close signal on Low-2 steam line pressure.
Additionally, the PORV flow path can be isolated manually.
SG Power Operated Relief Valve and Block Valve Isolation is actuated by the following signals:
* Steam Line Pressure  Low 2 (LCO 3.3.8, Function 24); and
* SG Power Operated Relief Valve and Block Valve Isolation Manual Initiation (LCO 3.3.9, Function 14).
Steam Generator Blowdown Isolation The primary purpose of the Steam Generator Blowdown isolation protective function is to preserve water inventory in the SGs to support removing the excess heat being generated until the decay heat has decreased to within the PRHR HX capability.
Steam Generator Blowdown Isolation is actuated by the following signals:
* PRHR HX Actuation; and
* SG Narrow Range Water Level  Low 2 (LCO 3.3.8, Function 20);
and
* Containment Isolation Actuation.
AP1000 STS                             B 3.3.8-23                                    Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Steam Generator Blowdown Isolation on SG Narrow Range Water Level Low 2 can be manually blocked by the main control room operator when below the P-9 setpoint (Tavg interlock) and is automatically unblocked when above the P-9 setpoint. This block is necessary to permit routine maintenance without actuation of this ESFAS protective function.
Turbine Trip The primary purpose of the Turbine Trip protective function is to prevent damage to the turbine due to water in the steam lines. Closure of the turbine stop and control valves is initiated by this protective function.
This protective function is necessary in MODES 1 and 2, and in MODE 3 above the P-11 pressurizer pressure interlock setpoint to mitigate the effects of a large SLB or a large Feedline Break (FLB). Failure to trip the turbine following a SLB or FLB can lead to additional mass and energy being delivered to the SGs, resulting in excessive cooldown and additional mass and energy release in containment.
The Turbine Trip protective function is actuated by the following signals:
* SG Narrow Range Water Level  High 3 (LCO 3.3.8, Function 23);
* Reactor Trip Signal (P-4) (LCO 3.3.12); and
* Feedwater Isolation  Manual Initiation (LCO 3.3.9, Function 5).
Main Feedwater Control Valve Isolation The primary purpose of Main Feedwater Control Valve Isolation protective function is to prevent damage to the turbine due to water in the steam lines and to stop the excessive flow of feedwater into the SGs.
The Main Feedwater Control Valve Isolation protective function is actuated by the following signals:
* SG Narrow Range Water Level  High 3 (LCO 3.3.8, Function 23);
* Safeguards Actuation;
* Reactor Coolant Average Temperature (Tavg)  Low (LCO 3.3.8, Function 12) coincident with Reactor Trip Signal (P-4) (LCO 3.3.12);
and AP1000 STS                             B 3.3.8-24                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
* Feedwater Isolation  Manual Initiation (LCO 3.3.9, Function 5).
Main Feedwater Pump Trip and Valve Isolation The primary purpose of the Main Feedwater Pump Trip and Isolation protective function is to prevent damage to the turbine due to water in the steam lines and to stop the excessive flow of feedwater into the SGs.
Valve isolation includes closing the main feedwater isolation and crossover valves. Isolation of main feedwater is necessary to prevent an increase in heat removal from the reactor coolant system in the event of a feedwater system malfunction. Addition of excessive feedwater causes an increase in core power by decreasing reactor coolant temperature.
The Main Feedwater Pump Trip and Valve Isolation protective function is actuated by the following signals:
* SG Narrow Range Water Level  High 3 (LCO 3.3.8, Function 23);
* Safeguards Actuation;
* Reactor Coolant Average Temperature (Tavg)  Low 2 (LCO 3.3.8, Function 13) coincident with Reactor Trip Signal (P-4) (LCO 3.3.12);
and
* Feedwater Isolation  Manual Initiation (LCO 3.3.9, Function 5).
Startup Feedwater Isolation The primary purpose of the Startup Feedwater Isolation protective function is to stop the excessive flow of feedwater into the SGs. This protective function is necessary in MODES 1, 2, 3, and 4 to mitigate the effects of a large SLB or a large FLB. Failure to isolate the startup feedwater system following an SLB or FLB can lead to additional mass and energy being delivered to the steam generators, resulting in excessive cooldown and additional mass and energy release in containment.
Startup Feedwater Isolation is actuated by the following signals:
* SG Narrow Range Water Level  High 3 (LCO 3.3.8, Function 23);
* RCS Cold Leg Temperature (Tcold)  Low 2 (LCO 3.3.8, Function 11);
AP1000 STS                            B 3.3.8-25                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
* SG Narrow Range Water Level  High (LCO 3.3.8, Function 22) coincident with Reactor Trip Signal (P-4) (LCO 3.3.12); and
* Feedwater Isolation  Manual Initiation (LCO 3.3.9, Function 5).
ADS Stages 1, 2, and 3 Actuation The Automatic Depressurization System (ADS) provides a sequenced depressurization of the reactor coolant system to allow passive injection from the CMTs, accumulators, and the in-containment refueling water storage tank (IRWST) to mitigate the effects of a LOCA. The depressurization is accomplished in four stages, with the first three stages discharging into the IRWST and the last stage discharging into containment. Each of the first three stages consists of two parallel paths with each path containing an isolation valve and a depressurization valve.
The first stage isolation valves open on any ADS Stages 1, 2, and 3 actuation. The first stage depressurization valves are opened following a preset time delay after the actuation of the isolation valves. The second stage isolation valves are opened following a preset time delay after actuation of the first stage depressurization valves open. The second stage depressurization valves are opened following a preset time delay after the second stage isolation valves are actuated, similar to stage one.
Similar to the second stage, the third stage isolation valves are opened following a preset time delay after the actuation of the second stage depressurization valves. The third stage depressurization valves are opened following a preset time delay after the third stage isolation valves are actuated.
ADS Stages 1, 2, and 3 Actuation is initiated on the following signals:
* CMT Level  Low 3 (LCO 3.3.8, Function 15) coincident with CMT Actuation; and
* ADS Stages 1, 2, and 3 Actuation  Manual Initiation (LCO 3.3.9, Function 6).
AP1000 STS                              B 3.3.8-26                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
ADS Stage 4 Actuation The ADS provides a sequenced depressurization of the reactor coolant system to allow passive injection from the CMTs, accumulators, and the IRWST to mitigate the effects of a LOCA. The depressurization is accomplished in four stages, with the first three stages discharging into the IRWST and the fourth stage discharging into containment.
The fourth stage of the ADS consists of four parallel paths. Each of these paths consists of a normally open isolation valve and a depressurization valve. The four paths are divided into two groups with two paths in each group. Within each group, one path is designated to be substage A and the second path is designated to be substage B.
The substage A depressurization valves are opened upon receipt of a system level ADS Stage 4 actuation signal. The substage B depressurization valves are opened following a preset time delay after the substage A depressurization valves receive their open signal.
ADS Stage 4 Actuation is initiated on the following signals:
* CMT Level  Low 6 (LCO 3.3.8, Function 16) coincident with both ADS Stages 1, 2, and 3 Actuation and RCS Wide Range Pressure Low (LCO 3.3.8, Function 14);
* Hot Leg Loop 1 Level  Low 4 coincident with Hot Leg Loop 2 Level Low 4 (LCO 3.3.10, Function 1, Hot Leg Level  Low 2);
* ADS Stage 4 Actuation  Manual Initiation (LCO 3.3.9, Function 6) coincident with ADS Stages 1, 2, and 3 Actuation; and
* ADS Stage 4 Actuation  Manual Initiation (LCO 3.3.9, Function 6) coincident with RCS Wide Range Pressure  Low (LCO 3.3.8, Function 14).
Reactor Coolant Pump Trip Reactor Coolant Pump (RCP) Trip allows the passive injection of borated water into the RCS. Injection provides RCS makeup water and boration during transients or accidents when the normal makeup supply from the CVS is lost or insufficient. Two tanks provide passive injection of borated water by gravity when the reactor coolant pumps are tripped. CMT injection mitigates the effects of high energy line breaks by adding AP1000 STS                            B 3.3.8-27                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) primary side water to ensure maintenance or recovery of reactor vessel water level following a LOCA, and by borating to ensure recovery or maintenance of SHUTDOWN MARGIN following a steam line break.
RCP trip on High 2 bearing water temperature protects the RCP coast down.
RCP Trip is actuated on the following signals:
* Safeguards Actuation;
* ADS Stages 1, 2, and 3 Actuation;
* Reactor Coolant Pump Bearing Water Temperature  High 2 (LCO 3.3.8, Function 19);
* Pressurizer Water Level  Low 2 (LCO 3.3.8, Function 7); and
* CMT Injection Actuation  Manual Initiation (LCO 3.3.9, Function 2).
Component Cooling Water System Containment Isolation Valve Closure The function of the Component Cooling Water System (CCS) containment isolation valve closure is to ensure that the CCS flow paths can be isolated during an RCP heat exchanger tube rupture event. The CCS flow paths must be isolated following an RCP heat exchanger tube rupture event to minimize radiological releases from the ruptured tube into the turbine building. CCS Containment Isolation Valve Closure is actuated by Reactor Coolant Pump Bearing Water Temperature  High 2 (LCO 3.3.8, Function 19) and Safeguards Actuation.
Passive Containment Cooling Actuation The Passive Containment Cooling System (PCS) transfers heat from the reactor containment to the environment. This Function is necessary to prevent the containment design pressure and temperature from being exceeded following any postulated DBA (such as LOCA or SLB).
A Passive Containment Cooling Actuation signal initiates water flow by gravity by opening the isolation valves. The water flows onto the containment dome, wetting the outer surface. The path for natural circulation of air along the outside walls of the containment structure is always open.
AP1000 STS                             B 3.3.8-28                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Passive Containment Cooling Actuation is initiated by the following signals:
* Containment Pressure  High 2 (LCO 3.3.8, Function 2); and
* Passive Containment Cooling Actuation  Manual Initiation (LCO 3.3.9, Function 8).
Passive Residual Heat Removal (PRHR) Heat Exchanger Actuation The PRHR Heat Exchanger (HX) provides emergency core decay heat removal when the Startup Feedwater System is not available to provide a heat sink.
PRHR HX Actuation is initiated by the following signals:
* SG Narrow Range Water Level  Low 2 (LCO 3.3.8, Function 20) coincident with Startup Feedwater Flow  Low 2 (LCO 3.3.11);
* SG Wide Range Water Level  Low 2 (LCO 3.3.8, Function 21);
* ADS Stages 1, 2, and 3 Actuation;
* CMT Actuation;
* Pressurizer Water Level  High 3 (LCO 3.3.8, Function 10); and
* PRHR Heat Exchanger Actuation  Manual Initiation (LCO 3.3.9, Function 9).
PRHR heat exchanger actuation from SG Narrow Range Water Level Low 2 and from SG Wide Range Water Level  Low 2 can be manually blocked by the main control room operator when below the P-9 setpoint (Tavg interlock) and is automatically unblocked when above the P-9 setpoint. This block is necessary to permit routine maintenance without these ESFAS actuations.
Boron Dilution Block The block of boron dilution is accomplished by closing the CVS makeup line isolation valves or closing the demineralized water system isolation valves to the CVS.
AP1000 STS                             B 3.3.8-29                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Boron Dilution Block is actuated on the following signals:
* Source Range Neutron Flux Doubling (LCO 3.3.8, Function 17); and
* Reactor Trip Signal (P-4) (LCO 3.3.12).
Chemical and Volume Control System Makeup Line Isolation The CVS makeup line is isolated following certain events to prevent overfilling of the RCS. In addition, this line is isolated on High 2 containment radioactivity to provide containment isolation following an accident. This line is not isolated on a containment isolation signal, to allow the CVS makeup pumps to perform their defense-in-depth functions. However, if very high containment radioactivity exists (above the High 2 setpoint) this line is isolated.
Chemical and Volume Control System Makeup Line Isolation is actuated on the following signals:
* Containment Radioactivity  High 2 (LCO 3.3.8, Function 4);
* Pressurizer Water Level  High 2 (LCO 3.3.8, Function 9);
* Pressurizer Water Level  High (LCO 3.3.8, Function 8) coincident with unlatched Safeguards Actuation;
* Source Range Neutron Flux Doubling (LCO 3.3.8, Function 17);
* SG Narrow Range Water Level  High 3 (LCO 3.3.8, Function 23);
* SG Narrow Range Water Level  High (LCO 3.3.8, Function 22) coincident with Reactor Trip Signal (P-4) (LCO 3.3.12); and
* Chemical and Volume Control System Makeup Isolation  Manual Initiation (LCO 3.3.9, Function 10).
Chemical and Volume Control System Letdown Isolation The CVS provides letdown to the liquid radwaste system to maintain the pressurizer level. To help maintain RCS inventory in the event of a LOCA, the CVS Letdown Isolation is actuated on Hot Leg Level  Low 2 (LCO 3.3.10, Function 2).
AP1000 STS                            B 3.3.8-30                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Auxiliary Spray and Purification Line and Zinc/Hydrogen Addition Isolation The CVS maintains the RCS fluid purity and activity level within acceptable limits. The CVS purification line receives flow from the discharge of the RCPs. The CVS also provides auxiliary spray to the pressurizer. To preserve the reactor coolant pressure in the event of a break in the CVS loop piping, the auxiliary spray line, purification line, zinc addition line, and hydrogen addition line are isolated to help maintain reactor coolant system inventory.
Auxiliary Spray and Purification Line and Zinc/Hydrogen Addition Isolation is actuated on the following signals:
* Pressurizer Water Level  Low (LCO 3.3.8, Function 6); and
* Chemical and Volume Control System Makeup Isolation  Manual Initiation (LCO 3.3.9, Function 10).
Additionally, Zinc/Hydrogen Addition Isolation is actuated by the Containment Isolation actuation signal.
Pressurizer Heater Trip Pressurizer heaters are automatically tripped upon receipt of a core makeup tank operation signal or a Pressurizer Water Level  High 3 signal. This pressurizer heater trip reduces the potential for SG overfill and automatic ADS Stages 1, 2, and 3 actuation for a SG tube rupture event. Automatically tripping the pressurizer heaters reduces the pressurizer level swell for certain non-LOCA events such as loss of normal feedwater, inadvertent CMT operation, and CVS malfunction resulting in an increase in RCS inventory. For small break LOCA analysis, tripping the pressurizer heaters supports depressurization of the RCS following actuation of the CMTs.
Pressurizer Heater Trip is actuated on the following signals:
* CMT Actuation; and
* Pressurizer Water Level  High 3 (LCO 3.3.8, Function 10).
AP1000 STS                             B 3.3.8-31                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Normal Residual Heat Removal System (RNS) Isolation The RNS suction line is isolated by closing the containment isolation valves on High 2 containment radioactivity to provide containment isolation following an accident. This line is isolated on a safeguards actuation signal. However, the valves may be reset to permit the RNS pumps to perform their defense-in-depth functions post accident. Should a high containment radiation signal (above the High 2 setpoint) develop following the containment isolation signal, the RNS valves would re-close. A high containment radiation signal is indicative of a high RCS source term and the valves would re-close to assure offsite doses do not exceed regulatory limits.
RNS Isolation is actuated on the following signals:
* Containment Radioactivity  High 2 (LCO 3.3.8, Function 4);
* Safeguards Actuation; and
* Normal Residual Heat Removal System Isolation  Manual Initiation (LCO 3.3.9, Function 11).
IRWST Injection Line Valve Actuation The PXS provides core cooling by gravity injection and recirculation for decay heat removal following an accident. The IRWST has two injection flow paths. Each injection path includes a normally open motor operated isolation valve and two parallel lines, each isolated by one check valve and one squib valve in series.
IRWST Injection Line Valve Actuation is actuated on the following signals:
* ADS Stage 4 Actuation; and
* IRWST Injection Line Valve Actuation  Manual Initiation (LCO 3.3.9, Function 12).
IRWST Containment Recirculation Valve Actuation The PXS provides core cooling by gravity injection and recirculation for decay heat removal following an accident. The PXS has two containment recirculation flow paths. Each path contains two parallel AP1000 STS                            B 3.3.8-32                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) flow paths, one path is isolated by a motor operated valve in series with a squib valve and one path is isolated by a check valve in series with a squib valve.
IRWST Containment Recirculation Valve Actuation is initiated by the following signals:
* ADS Stage 4 Actuation coincident with IRWST Lower Narrow Range Level  Low 3 (LCO 3.3.8, Function 18); and
* IRWST Containment Recirculation Valve Actuation  Manual Initiation (LCO 3.3.9, Function 13).
Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization Isolation of the main control room and initiation of the VES air supply provides a breathable air supply for the operators following an uncontrolled release of radiation. De-energizing non-essential main control room electrical loads maintains the room temperature within habitable limits. Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization is actuated on any one of the following signals:
* Main Control Room Air Supply Iodine or Particulate Radiation  High 2 (LCO 3.3.13, Function 1);
* Main Control Room Differential Pressure  Low (LCO 3.3.13, Function 2); and
* Class 1E 24-hour Battery Charger Undervoltage (LCO 3.3.13, Function 13).
The main control room air supply radiation monitor sample pumps are de-energized by PMS on Class 1E 24-hour battery charger undervoltage signal as shown on FSAR Figure 7.2-1, Sheet 13. The main control room air supply radiation monitor sample pumps are de-energized to conserve battery capacity, maintain room temperature below the equipment qualification limitation, and maintain the assumed heat load for main control room habitability.
AP1000 STS                            B 3.3.8-33                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Refueling Cavity and Spent Fuel Pool Cooling System (SFS) Isolation The SFS can be connected to the spent fuel pool, the fuel transfer canal, the refueling cavity, and the IRWST to clarify and purify the water. It can also connect the IRWST and refueling cavity to transfer water in preparation for refueling activities, and to return to normal operations from refueling activities. In the event of a leak in the non-safety related SFS, Refueling Cavity and SFS Isolation is actuated on the following signals:
* Spent Fuel Pool Level  Low 2 (LCO 3.3.14, Function 1); and
* IRWST Wide Range Level  Low (LCO 3.3.14, Function 2).
The IRWST Wide Range Level  Low isolation signal can be manually blocked by the main control room operator when below the P-9 (Tavg) interlock setpoint, and is automatically unblocked when above the P-9 setpoint. This block is necessary to permit IRWST volume to be transferred to and from the refueling cavity during MODE 6 with refueling cavity and spent fuel pool volumes not in communication.
ESF Logic LCO 3.3.15 and LCO 3.3.16 require four sets of ESF coincidence logic, each set with one battery backed logic group OPERABLE to support automatic actuation. These logic groups are implemented as processor based actuation subsystems. The ESF coincidence logic provides the system level logic interfaces for the divisions. The ESF coincidence logic includes both the voting logic for the divisional signals from each ESF instrument Function, and the coincidence logic of ESF actuation and ESF instrument Function divisional signals needed to generate an ESF actuation signal for some ESFAS protective functions.
ESF Actuation LCO 3.3.15 and LCO 3.3.16 require that for each division of ESF actuation, one battery backed logic group be OPERABLE to support both automatic and manual actuation. The ESF actuation subsystems provide the logic and power interfaces for the actuated components.
The following are descriptions of the individual instrument Functions required by this LCO as presented in Table 3.3.8-1. Each Function AP1000 STS                              B 3.3.8-34                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) description also provides the ESFAS protective functions actuated by the instrumentation Function.
1.a Containment Pressure  Low The Containment Pressure  Low provides an interlock to block opening of the Containment Vacuum Relief Valves above the Low setpoint to prevent inadvertent opening of these valves. The Containment Pressure  Low also provides an automatic reset of the Containment Vacuum Relief manual initiation Function to ensure the Containment Vacuum Relief Valves are allowed to close when the Containment Vacuum Relief protective function is no longer needed.
The OPERABILITY of the Containment Pressure  Low Function is necessary for the manual actuation function for the Containment Vacuum Relief Valves. The Containment Pressure  Low actuation Function must be OPERABLE in MODES 1, 2, 3, and 4 and in MODES 5 and 6 when there is no open containment air flow path 6 inches in diameter. With a 6 inch diameter or equivalent containment air flow path, the vacuum relief function that the Containment Pressure  Low signal supports is not needed to prevent inadvertent opening of these valves.
1.b Containment Pressure  Low 2 This signal provides protection against a negative pressure in containment due to loss of ac power or inadvertent actuation of containment cooling and a low outside ambient air temperature in combination with limited containment heating that reduces the atmospheric temperature (and hence pressure) inside containment.
Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function.
The Containment Vacuum Relief Valve Actuation ESFAS protective function is actuated by Containment Pressure  Low 2.
Automatic Containment Vacuum Relief Valve actuation must be OPERABLE in MODES 1 through 4 and in MODES 5 and 6 without an open containment air flow path  6 inches in diameter. With a AP1000 STS                             B 3.3.8-35                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 6 inch diameter or equivalent containment air flow path, the vacuum relief function is not needed to mitigate a low pressure event.
: 2. Containment Pressure  High 2 This signal provides protection against the following accidents:
* SLB inside containment;
* LOCA; and
* Feedwater line break inside containment.
The ESFAS protective functions actuated by Containment Pressure  High 2 are:
* Safeguards Actuation;
* Steam Line Isolation; and
* Passive Containment Cooling Actuation.
The transmitters (d/p cells) and electronics are located outside of containment. Since the transmitters and electronics are located outside of containment, they will not experience adverse environmental conditions. The Containment Pressure  High 2 NTS has been specified as low as reasonable, without creating potential for spurious trips during normal operations, consistent with the TMI action item (NUREG-0933, Item II.E.4.2) guidance.
The LCO requires four channels of Containment Pressure  High 2 to be OPERABLE in MODES 1, 2, 3, and 4. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function. In MODES 5 and 6, there is not enough energy in the primary and secondary sides to pressurize the containment to the Containment Pressure  High 2 setpoint.
: 3. Containment Radioactivity  High This signal to isolate the Containment Air Filtration System results from the coincidence of containment radioactivity above the High setpoint in any two of the four divisions.
AP1000 STS                            B 3.3.8-36                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The Containment Air Filtration System Isolation ESFAS protective function is actuated by Containment Radioactivity  High.
Four channels of Containment Radioactivity  High are required to be OPERABLE in MODES 1, 2, and 3, and MODE 4 with the RCS not being cooled by the RNS, when the potential exists for a LOCA, to protect against radioactivity inside containment being released to the atmosphere. This Function is not required to be OPERABLE in MODE 4 with the RCS being cooled by the RNS, because, if required, the Containment Air Filtration System is isolated by the Containment Isolation Actuation. This Function is not required to be OPERABLE in MODE 5 and MODE 6, because any DBA release of radioactivity into the containment in these conditions would not require the Containment Air Filtration System Isolation ESFAS protective function.
: 4. Containment Radioactivity  High 2 This signal to isolate CVS makeup and to isolate the normal residual heat removal system results from the coincidence of containment radioactivity above the High 2 setpoint in any two of the four divisions.
The ESFAS protective functions actuated by Containment Radioactivity - High 2 are:
* Chemical and Volume Control System Makeup Isolation; and
* Normal Residual Heat Removal System Isolation.
Four channels of Containment Radioactivity  High 2 are required to be OPERABLE in MODES 1, 2, and 3 when the potential exists for a LOCA, to ensure that the radioactivity inside containment is not released to the atmosphere. This signal for RNS isolation may be manually blocked by the operator below the P-11 setpoint. This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is no credible release of radioactivity into the containment in these MODES that would result in a High 2 actuation.
AP1000 STS                           B 3.3.8-37                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 5. Pressurizer Pressure  Low 3 This signal provides protection against the following accidents:
* Inadvertent opening of a steam generator safety valve;
* SLB;
* A spectrum of rod cluster control assembly ejection accidents (rod ejection);
* Inadvertent opening of a pressurizer safety valve;
* LOCAs; and
* Steam Generator Tube Rupture (SGTR).
The Safeguards Actuation ESFAS protective function is actuated by Pressurizer Pressure  Low 3. The transmitters are located inside containment, with the taps in the vapor space region of the pressurizer, and thus possibly experiencing adverse environmental conditions (LOCA, SLB inside containment). Therefore, the NTS reflects the inclusion of both steady state and adverse environmental instrument uncertainties.
The LCO requires four channels of Pressurizer Pressure  Low 3 to be OPERABLE in MODES 1 and 2. Additionally, they are required to be OPERABLE in MODE 3 above P-11or in a condition below P-11 where the RCS boron concentration is below that necessary to meet the SDM requirements at an RCS temperature of 200&deg;F, to mitigate the consequences of a high energy line rupture inside containment.
Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function. This signal may be manually blocked by the operator below the P-11 setpoint. Automatic actuation below this pressure is then performed by the Containment Pressure  High 2 signal.
This Function is not required to be OPERABLE in MODE 3 below the P-11 setpoint (as long as the boron concentration is greater than that necessary to meet the SDM requirements at an RCS temperature of 200&deg;F). Other ESF Functions are used to detect accident conditions AP1000 STS                            B 3.3.8-38                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.
: 6. Pressurizer Water Level  Low A signal to isolate the purification line, the auxiliary spray line, the zinc addition line, and the hydrogen addition line is generated upon the coincidence of pressurizer level below the Low setpoint in any two-out-of-four divisions. Each water level signal is compensated using pressurizer reference leg temperature, pressurizer pressure and RCS wide range pressure.
The Auxiliary Spray and Purification Line and Zinc/Hydrogen Addition Isolation ESFAS protective function is actuated by Pressurizer Water Level  Low.
This Function can be manually blocked when the pressurizer water level is below the P-12 setpoint to permit operations during shutdown conditions that require the operation of the lines isolated by this Function. This Function is automatically unblocked when the pressurizer water level is above the P-12 Setpoint.
Four channels of Pressurizer Water Level  Low are required to be OPERABLE in MODES 1 and 2 to help maintain RCS inventory. In MODES 3, 4, 5, and 6, this instrument Function is not needed for accident detection and mitigation.
: 7. Pressurizer Water Level  Low 2 This instrument Function initiates CMT Actuation and tripping of the RCPs from the coincidence of pressurizer level below the Low 2 setpoint in any two of the four divisions. Each water level signal is compensated using pressurizer reference leg temperature, pressurizer pressure and RCS wide range pressure.
The ESFAS protective functions actuated by Pressurizer Water Level  Low 2 are:
* CMT Actuation; and
* Reactor Coolant Pump Trip.
AP1000 STS                           B 3.3.8-39                                          Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
This Function can be manually blocked when the pressurizer water level is below the P-12 setpoint to prevent spurious CMT actuations on Pressurizer Water Level  Low 2. This Function is automatically unblocked when the pressurizer water level is above the P-12 setpoint. The Pressurizer Water Level  Low 2 NTS reflects both steady state and adverse environmental instrument uncertainties as the detectors provide protection for an event that results in a harsh environment.
This Function is required to be OPERABLE in MODES 1, 2, 3, and 4. This Function is also required to be OPERABLE in MODE 5 with RCS not VENTED and CMT actuation on Pressurizer Water Level  Low 2 not blocked.
: 8. Pressurizer Water Level  High Four channels of pressurizer level are provided on the pressurizer.
Two-out-of-four channels on indicating level greater than the High Setpoint coincident with a Safeguards Actuation signal will close the containment isolation valves for the CVS. This instrument Function prevents the pressurizer level from reaching a level that could lead to water relief through the pressurizer safety valves during some DBAs. Each water level signal is compensated using pressurizer reference leg temperature, pressurizer pressure and RCS wide range pressure.
The Chemical and Volume Control System Makeup Isolation ESFAS protective function is actuated by Pressurizer Water Level  High coincident with a Safeguards Actuation signal.
This Function is required to be OPERABLE in MODES 1, 2, and 3.
This Function is not required to be OPERABLE in MODES 4, 5, and 6, because it is not required to mitigate a DBA in these MODES.
: 9. Pressurizer Water Level  High 2 A signal to close the CVS isolation valves is generated on Pressurizer Water Level  High 2. This instrument Function results from the coincidence of pressurizer level above the High 2 setpoint in any two of the four divisions. The PMS allows this Function to be manually blocked when the pressurizer pressure is below the P-19 (RCS Pressure) setpoint. The operator can manually block this Function once it is no longer required to be OPERABLE when at AP1000 STS                           B 3.3.8-40                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) least one RCS cold leg temperature is  275&deg;F to permit pressurizer water solid conditions with the plant cold and to permit level makeup during plant cooldowns. This Function is automatically unblocked when RCS pressure is above the P-19 setpoint. Each water level signal is compensated using pressurizer reference leg temperature, pressurizer pressure and RCS wide range pressure.
The Chemical and Volume Control System Makeup Isolation ESFAS protective function is actuated by Pressurizer Water Level  High 2.
This instrument Function is required to be OPERABLE in MODES 1, 2, and 3, and in MODE 4 when all four cold leg temperatures are
                     > 275&deg;F. This instrument Function is not required to be OPERABLE in MODE 4 with at least one cold leg temperature  275&deg;F or MODES 5 and 6 because it is not required to mitigate a DBA in these conditions.
: 10. Pressurizer Water Level  High 3 PRHR is actuated and the pressurizer heaters are tripped when the pressurizer water level reaches its High 3 setpoint. This signal provides protection against a pressurizer overfill following an inadvertent core makeup tank actuation with consequential loss of offsite power. This instrument Function is automatically unblocked when RCS pressure is above the P-19 (RCS pressure) setpoint.
Each water level signal is compensated using pressurizer reference leg temperature, pressurizer pressure and RCS wide range pressure.
The ESFAS protective functions actuated by Pressurizer Water Level  High 3 are:
* PRHR Heat Exchanger Actuation; and
* Pressurizer Heater Trip.
This Function is required to be OPERABLE in MODES 1, 2, and 3, and in MODE 4 when all four cold leg temperatures are > 275&deg;F.
This Function is not required to be OPERABLE in MODE 4 with at least one cold leg temperature  275&deg;F or in MODES 5 and 6 because it is not required to mitigate a DBA in these conditions.
AP1000 STS                           B 3.3.8-41                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 11. RCS Cold Leg Temperature (Tcold)  Low 2 This signal provides protection against the following accidents:
* Steam line break (SLB);
* Feed line break (FLB); and
* Inadvertent opening of an SG relief valve or an SG safety valve.
The ESFAS protective functions actuated by RCS Cold Leg Temperature (Tcold)  Low 2 are:
* Safeguards Actuation;
* Steam Line Isolation; and
* Startup Feedwater Isolation.
This Function provides closure of the MSIVs during a SLB or inadvertent opening of an SG relief or a safety valve to maintain at least one unfaulted SG as a heat sink for the reactor and to limit the mass and energy release to containment. This Function also closes the startup feedwater control and isolation valves and trips the startup feedwater pumps if RCS cold leg temperature is below the Tcold  Low 2 setpoint in any loop.
The LCO requires four channels of Tcold  Low 2 to be OPERABLE in MODES 1 and 2. Additionally, they are required to be OPERABLE in MODE 3 with any main steam isolation valve open and above P-11 or in a condition below P-11 where the RCS boron concentration is below that necessary to meet the SDM requirements at an RCS temperature of 200&deg;F. At these conditions, a secondary side break or stuck open valve could result in the rapid cooldown of the primary side. Four channels are provided in each loop to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function.
In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation because the cold leg temperature is reduced below the actuation setpoint.
AP1000 STS                           B 3.3.8-42                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 12. Tavg  Low 1 This signal provides protection against excessive feedwater flow by closing the main feedwater control valves. This signal results from a coincidence of two of the four divisions of reactor loop average temperature below the Low 1 setpoint coincident with the Reactor Trip (P-4) permissive. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure that no single random failure will disable this instrument Function.
The Main Feedwater Control Valve Isolation ESFAS protective function is actuated by Tavg  Low 1 provided a P-4 signal is present indicating that a reactor trip has occurred or has been initiated.
Closing the Main Feedwater Control Valves on Tavg  Low 1 coincident with P-4 is required to be OPERABLE in MODES 1 and 2. Failure to close the main feedwater control valves following an SLB or FLB can lead to additional mass and energy being delivered to the steam generators, resulting in excessive cooldown and additional mass and energy release in containment.
: 13. Tavg  Low 2 This signal provides protection against excessive feedwater flow by closing the main feedwater isolation and crossover leg valves, and tripping of the main feedwater pumps. This signal results from a coincidence of two out of four divisions of reactor loop average temperature below the Low 2 setpoint coincident with the P-4 permissive (which initiates main turbine trip).
Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure that no single random failure will disable this instrument Function. This Function may be manually blocked when the pressurizer pressure is below the P-11 setpoint.
The block is automatically removed when the pressurizer pressure is above the P-11 setpoint.
The Main Feedwater Pump Trip and Valve Isolation ESFAS protective function is actuated by Tavg  Low 2 provided a P-4 signal is present indicating that a reactor trip has occurred or has been initiated.
AP1000 STS                            B 3.3.8-43                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
This Function is required to be OPERABLE in MODES 1 and 2 to mitigate the effects of a large SLB or a large FLB. Failure to trip the turbine or isolate the main feedwater system following an SLB or FLB can lead to additional mass and energy being delivered to the steam generators, resulting in excessive cooldown and additional mass and energy release in containment.
: 14. RCS Wide Range Pressure  Low The fourth stage depressurization valves open on manual actuation, but are interlocked to actuate coincident with the presence of either a Low RCS wide range pressure signal or an actuation signal for ADS Stages 1, 2, and 3. These interlocks minimize the potential for inadvertent opening of the ADS Stage 4 depressurization valves.
This consideration is important in PRA modeling to improve the reliability of reducing the RCS pressure following a small-break LOCA or transient event.
The ADS Stage 4 Actuation ESFAS protective function is actuated by RCS Wide Range Pressure  Low. The RCS Wide Range Pressure  Low signal, the ADS Stages 1, 2, and 3 initiation following a preset time delay (timeout) to open ADS Stage 4 signal, and a CMT Level  Low 6 signal (in either CMT) must be present to produce a signal to automatically open ADS Stage 4 valves.
The presence of a Low RCS wide range pressure signal or an ADS Stages 1, 2, and 3 initiation timeout to open ADS Stage 4 signal permits generating a manual ADS Stage 4 actuation signal.
For both automatic and manual ADS Stage 4 actuations, for the associated CIMs to cause ADS Stage 4 squib isolation valves to open, CMT level must be below the analog unblock setting (LCO 3.3.20) or the manual ADS and IRWST injection actuation unblock control must be in the unblock position.
This Function must be OPERABLE in MODES 1, 2, 3, 4, and 5. This Function must also be OPERABLE in MODE 6 with the upper internals in place.
: 15. CMT Level  Low 3 This Function ensures continued passive injection of borated water to the RCS following a small break LOCA. ADS Stages 1, 2, and 3 AP1000 STS                             B 3.3.8-44                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) actuation is initiated when the CMT Level reaches its Low 3 setpoint coincident with any CMT Actuation signal. Four channels are provided in each CMT to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function.
The ADS Stages 1, 2, and 3 Actuation ESFAS protective function is actuated by CMT Level  Low 3.
This Function must be OPERABLE in MODES 1, 2, 3, and 4. This Function must also be OPERABLE in MODE 5 with the RCS not VENTED. In MODE 4 with the RCS being cooled by the RNS and in MODE 5 with the RCS not VENTED only one CMT is required to be OPERABLE in accordance with LCO 3.5.3, CMTs  Shutdown, RCS Intact; therefore, CMT level channels are only required on an OPERABLE CMT.
: 16. CMT Level  Low 6 The ADS fourth stage isolation valves receive a confirmatory open signal (non-safety related function) following a preset time delay after the first stage depressurization valves are sent a signal to open. The fourth stage depressurization valves open on CMT Level Low 6 in two-out-of-four channels in either CMT. Actuation of the fourth stage depressurization valves is interlocked with the third stage depressurization signal such that the fourth stage is not actuated unless the third stage has been previously actuated following a preset time delay. Actuation of the fourth stage ADS valves is further interlocked with a Low RCS pressure signal such that the ADS Stage 4 actuation is not initiated unless RCS pressure is below a predetermined setpoint.
Four channels of CMT level instrumentation are provided per tank to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function.
The ADS Stage 4 Actuation ESFAS protective function is actuated by CMT Level  Low 6.
This Function must be OPERABLE in MODES 1, 2, 3, 4, and in MODE 5 with the RCS not VENTED. In MODE 4 with the RCS being cooled by the RNS and in MODE 5 with the RCS not VENTED, only one CMT is required to be OPERABLE in accordance with AP1000 STS                             B 3.3.8-45                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
LCO 3.5.3, CMTs  Shutdown, RCS Intact; therefore, CMT level channels are only required on an OPERABLE CMT.
: 17. Source Range Neutron Flux Doubling The source range neutron detectors are used for this instrument Function. A signal to block boron dilution is derived from source range neutron flux increasing at an excessive rate (source range neutron flux doubling). The LCO requires four divisions to be OPERABLE. There are four divisions and two-out-of-four logic is used. On a coincidence of excessively increasing source range neutron flux in two of the four divisions, demineralized water is isolated (CVS demineralized water system isolation valves closed) from the makeup pumps and reactor coolant makeup is isolated (CVS makeup line isolation valves closed) from the reactor coolant system to preclude a boron dilution event.
The Boron Dilution Block ESFAS protective function is actuated by Source Range Neutron Flux Doubling.
The signal to block boron dilution on source range neutron flux increasing at an excessive rate (source range neutron flux doubling) must be OPERABLE in MODE 2 and MODE 3 if unborated water source flow paths are not isolated. However, the signal to block boron dilution on source range neutron flux doubling is not required in MODE 2 or MODE 3 when the reactor is critical or when an intentional approach to criticality is in progress. It must also be OPERABLE in MODES 4 and 5 if unborated water flow paths are not isolated. In MODE 6, a dilution event is precluded by the requirement in LCO 3.9.2 to close, lock and secure at least one valve in each unborated water source flow path.
Above the P-6 setpoint the source range detectors can be manually deenergized and above the P-10 setpoint they are automatically deenergized. OPERABILITY of the Source Range Neutron Flux Doubling Function requires the source range neutron flux detectors to be energized.
When the Source Range Flux Doubling feature is blocked below P-8, an automatic close signal is sent to both valves in the CVS demineralized water flow path to ensure a single failure does not reestablish this potential dilution flow path.
AP1000 STS                           B 3.3.8-46                                         Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 18. IRWST Lower Narrow Range Level  Low 3 A Low 3 IRWST lower narrow range level coincident with an ADS Stage 4 Actuation signal will open the containment recirculation valves. Four channels of IRWST Lower Narrow Range Level  Low 3 instrumentation are provided to permit one channel to be in trip or bypass indefinitely and still ensure that no single random failure will disable this instrument Function.
The IRWST Containment Recirculation Valve Actuation ESFAS protective function is actuated by IRWST Lower Narrow Range Level Low 3.
Four channels of IRWST Lower Narrow Range Level  Low 3 are required to be OPERABLE in MODES 1, 2, 3, 4, and 5, and MODE 6 with the upper internals in place.
: 19. Reactor Coolant Pump Bearing Water Temperature  High 2 The Component Cooling Water System (CCS) containment isolation valves are closed and the RCPs are tripped if two-out-of-four sensors on any RCP indicate High 2 bearing water temperature.
This instrument Function is lead-lag compensated.
The ESFAS protective functions actuated by Reactor Coolant Pump Bearing Water Temperature  High 2 are:
* Reactor Coolant Pump Trip; and
* CCS Component Cooling Water System Containment Isolation Valve Closure.
This Function is required to be OPERABLE in MODES 1, 2, 3, and 4.
Four channels are provided for each RCP to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function.
AP1000 STS                            B 3.3.8-47                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 20. SG Narrow Range Water Level  Low 2 PRHR is actuated when the SG Narrow Range Water Level reaches its Low-2 setpoint coincident with an indication of a Startup Feedwater Flow  Low 2 signal. The LCO requires four channels per steam generator to be OPERABLE to satisfy the requirements with a two-out-of-four logic. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function. Each water level signal is compensated using steam line pressure. The NTS reflects both steady state and adverse environmental instrument uncertainties as the detectors provide protection for an event that results in a harsh environment.
The ESFAS protective functions actuated by SG Narrow Range Water Level  Low 2 are:
* PRHR Heat Exchanger Actuation; and
* SG Blowdown Isolation.
The SG Narrow Range Water Level  Low 2 Function is required to be OPERABLE in MODES 1, 2, and 3 and in MODE 4 when the RCS is not being cooled by the Normal Residual Heat Removal System (RNS). This ensures that PRHR can be actuated in the event of a loss of the normal heat removal systems. In MODE 4 when the RCS is being cooled by the RNS, and in MODES 5 and 6, the SGs are not required to provide the normal RCS heat sink.
Therefore, startup feedwater flow is not required, and PRHR actuation on Low-2 SG narrow range water level is not required.
These ESFAS protective functions can be manually blocked by the main control room operator when below the P-9 setpoint (Tavg interlock) and is automatically unblocked when above the P-9 setpoint. This block is necessary to permit routine maintenance without PRHR heat exchanger actuation or SG blowdown isolation.
AP1000 STS                            B 3.3.8-48                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 21. SG Wide Range Water Level  Low 2 PRHR is also actuated when the SG Wide Range Water Level reaches its Low-2 setpoint. There are four wide range level channels for each SG and a two-out-of-four logic is used. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function. Each water level signal is compensated using steam line pressure.
The PRHR Heat Exchanger Actuation ESFAS protective function is actuated by SG Wide Range Water Level  Low 2.
This Function is required to be OPERABLE in MODES 1, 2, and 3, and in MODE 4 when the RCS is not being cooled by the RNS. This ensures that PRHR can be actuated in the event of a loss of the normal heat removal systems. In MODE 4 when the RCS is being cooled by the RNS, and in MODES 5 and 6, the SGs are not required to provide the normal RCS heat sink. Therefore, SG Wide Range Water Level  Low 2 is not required, and PRHR actuation on SG Wide Range Water Level  Low 2 is not required.
This ESFAS protective function can be manually blocked by the main control room operator when below the P-9 setpoint (Tavg interlock) and is automatically unblocked when above the P-9 setpoint. This block is necessary to permit routine maintenance without PRHR heat exchanger actuation.
: 22. SG Narrow Range Water Level  High If SG narrow range water level reaches the High setpoint in either SG coincident with a Reactor Trip (P-4) signal, then all startup feedwater control and isolation valves are closed, the startup feedwater pumps are tripped, and the isolation valves for the CVS are closed. This instrument Function prevents adding makeup water to the RCS during an SGTR. Four channels are provided in each SG to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this Function. Each water level signal is compensated using steam line pressure.
AP1000 STS                            B 3.3.8-49                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The ESFAS protective functions actuated by SG Narrow Range Water Level  High are:
* Startup Feedwater Isolation; and
* Chemical and Volume Control System Makeup Isolation.
This Function is required to be OPERABLE in MODES 1, 2, 3, and 4. In MODE 4 with an RCS temperature < 350&deg;F and in MODES 5 and 6, the RCS pressure and temperature are reduced and an SGTR is not credible. However, the Applicability conservatively requires OPERABILITY of this Function in MODE 4 with RCS temperature < 350&deg;F (i.e., all of MODE 4). Therefore, startup feedwater isolation and CVS makeup isolation actuations on High SG narrow range water level coincident with a Reactor Trip (P-4) signal are not required in MODES 5 and 6.
These ESFAS protective functions can be manually blocked by the main control room operator when below the P-9 setpoint (Tavg interlock) and are automatically unblocked when above the P-9 setpoint. This block is necessary to permit the SGs to be flooded for wet-layup without startup feedwater isolation and CVS makeup isolation.
: 23. SG Narrow Range Water Level  High 3 This signal provides protection against excessive feedwater flow by closing the main feedwater control, isolation and crossover valves, tripping of the main feedwater pumps, and tripping the turbine. The signal also prevents adding makeup water to the RCS during a SGTR by closing the isolation valves for the CVS. Four channels are provided to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function. Each SG narrow range water level signal is compensated using steam line pressure.
The ESFAS protective functions actuated by SG Narrow Range Water Level  High 3 are:
* Turbine Trip;
* Main Feedwater Control Valve Isolation; AP1000 STS                            B 3.3.8-50                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
* Main Feedwater Pump Trip and Valve Isolation;
* Startup Feedwater Isolation; and
* Chemical and Volume Control System Makeup Isolation.
The transmitters (d/p cells) are located inside containment.
However, the events which this Function protect against cannot cause severe environment in containment. Therefore, the Actuation Setpoint reflects only steady state instrument uncertainties. The LCO requires four channels of SG Narrow Range Water Level High 3 instrumentation per SG to be OPERABLE in MODES 1, 2, 3, and 4 when there is significant mass and energy in the RCS and the SGs. In MODES 5 and 6, the energy in the RCS and the SGs is low; therefore, startup feedwater isolation, main feedwater isolation, CVS makeup isolation, and turbine trip on High-3 SG narrow range water level are not required to be OPERABLE.
These ESFAS protective functions can be manually blocked by the main control room operator when below the P-9 setpoint (Tavg interlock) and are automatically unblocked when above the P-9 setpoint. This block is necessary to permit the SGs to be flooded for wet-layup without startup feedwater isolation, main feedwater isolation, CVS makeup isolation, or actuation of turbine trip.
: 24. Steam Line Pressure  Low 2 Steam Line Pressure  Low 2 provides protection against the following accidents:
* Steam line break (SLB);
* Feedwater line break (FLB); and
* Inadvertent opening of an SG relief valve or an SG safety valve.
Steam Line Pressure  Low 2 provides closure of the PORV flow paths in the event of an SGTR in which the PORV(s) open, to limit the radiological releases from the ruptured SG into the atmosphere.
Steam Line Pressure  Low 2 also provides closure of the MSIVs in the event of an SLB to limit the mass and energy release to containment and limit blowdown to a single SG.
AP1000 STS                            B 3.3.8-51                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Four channels are provided in each steam line to permit one channel to be in trip or bypass indefinitely and still ensure that no single random failure will disable this instrument Function.
This instrument Function is anticipatory in nature and has a typical leading/lag ratio of 50/5. It is possible for the transmitters to experience adverse environmental conditions during a secondary side break. Therefore, the NTS reflects both steady state and adverse environmental instrument uncertainties.
The ESFAS protective functions actuated by Steam Line Pressure Low 2 are:
* Safeguards Actuation;
* Steam Line Isolation; and
* SG Power Operated Relief Valve and Block Valve Isolation.
The LCO requires four channels per steam line of the Steam Line Pressure  Low 2 Function to be OPERABLE in MODES 1 and 2.
Additionally, these channels are required to be OPERABLE in MODE 3 above P-11 or in a condition below P-11 where the RCS boron concentration is below that necessary to meet the SDM requirements at an RCS temperature of 200&deg;F, or in a condition below P-11 where Steam Line Pressure  Low 2 is not blocked. This instrument Function is not required to be OPERABLE in MODE 3 below the P-11 setpoint as long as the boron concentration is greater than that necessary to meet the SDM requirements at an RCS temperature of 200&deg;F and the Function is blocked.
: 25. Steam Line Pressure  Negative Rate  High The Steam Line Pressure  Negative Rate  High instrument Function provides closure of the MSIVs for an SLB, when pressurizer pressure is less than the P-11 setpoint, to maintain at least one unfaulted SG as a heat sink for the reactor and to limit the mass and energy release to containment. When the operator manually blocks the Steam Line Pressure  Low 2 Function when pressurizer pressure is less than the P-11 setpoint, the Steam Line Pressure  Negative Rate  High Function is automatically enabled.
AP1000 STS                           B 3.3.8-52                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The Steam Line Isolation ESFAS protective function is actuated by Steam Line Pressure  Negative Rate  High.
The LCO requires four channels of Steam Line Pressure  Negative Rate  High instrumentation per steam line to be OPERABLE in MODE 3 when pressurizer pressure is less than the P-11 setpoint and Steam Line Pressure  Low 2 is blocked, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). Four channels are provided in each steam line to permit one channel to be in trip or bypass indefinitely and still ensure no single random failure will disable this instrument Function. In MODES 1 and 2, and in MODE 3 when pressurizer pressure is above the P-11 setpoint, this instrument Function is automatically disabled and the Steam Line Pressure Low 2 instrument Function is automatically enabled.
In MODES 4, 5, and 6, the Steam Line Pressure  Negative Rate High instrument Function is not needed for accident detection and mitigation.
While the transmitters may experience elevated ambient temperatures due to a steam line break, the instrument Function is on rate of change, not the absolute accuracy of the indicated steam pressure. Therefore, the NTS reflects only steady state instrument uncertainties.
ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS          A Note has been added to the ACTIONS table to clarify the application of Completion Time rules. The ACTIONS Conditions of this Specification may be entered independently for each ESFAS Function listed in Table 3.3.8-1. The Required Action Completion Time(s) of the inoperable equipment of a Function will be tracked separately for each Function starting from the time the ACTIONS Condition was entered for that Function.
In the event a channels as-found condition is outside the as-found tolerance described in the SP, or the channel is not functioning as required, or the transmitter, or the Protection and Safety Monitoring System (PMS) Division, associated with a specific Function is found inoperable, then that channel must be declared operable for each ESFAS Function supported by or dependent on that channel and the applicable AP1000 STS                            B 3.3.8-53                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES ACTIONS (continued)
ACTIONS Condition(s) entered for all affected ESFAS Functions. When the number of Required Channels for an ESFAS Function in Table 3.3.8-1 is specified on a per steam line, per loop, per SG, basis, then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.
A.1 Condition A is applicable to the ESFAS protection Functions listed in Table 3.3.8-1. Condition A addresses the situation where one channel for one or more Functions is inoperable. With one channel inoperable, the affected channel must be placed in a bypass or trip condition within 6 hours. If one channel is bypassed, the coincidence logic becomes two-out-of-three, while still meeting the single failure criterion. (A failure in one of the three remaining channels will not prevent the ESF actuation on any of the associated ESFAS Functions.) If one channel is tripped, the coincidence logic becomes one-out-of-three, while still meeting the single failure criterion. (A failure in one of the three remaining channels will not prevent the ESF actuation on any of the associated ESFAS Functions.)
The 6 hours allowed to place the inoperable channel(s) in the bypassed or tripped condition is justified in Reference 5.
B.1 and B.2 Condition B addresses the situation where one or more ESFAS Functions have two channels inoperable. With two channels for an ESFAS Function inoperable, one inoperable channel must be placed in bypass and one inoperable channel must be placed in trip within 6 hours.
If one channel is bypassed and one channel is tripped, the coincidence logic becomes one-out-of-two, while still meeting the single failure criterion. The 6 hours allowed to place one inoperable channel in bypass and one inoperable channel in trip for each affected ESFAS Function is justified in Reference 5.
C.1 Required Action C.1 directs entry into the appropriate ACTIONS Condition referenced in Table 3.3.8-1. The applicable Condition referenced in the table is Function and MODE dependent. If the Required Action and the associated Completion Time of Condition A or B are not met or if three or more channels for one or more Functions are inoperable Condition C is entered to provide for immediate entry into the appropriate subsequent ACTIONS Condition.
AP1000 STS                                 B 3.3.8-54                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES ACTIONS (continued)
D.1 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for a referenced Function are inoperable, the plant must be placed in a MODE in which the LCO for affected Function 6, 12, 13, or 23 does not apply. This is accomplished by placing the plant in MODE 3 within 6 hours. The allowed time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
E.1, E.2, and E.3 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for a referenced Function are inoperable, the plant must be placed in a MODE in which the LCO for affected Function 5 or 11 does not apply. This is accomplished by placing the plant in MODE 3 within 6 hours and by reducing reactor pressure below the P-11 (Pressurizer Pressure) interlock and establishing RCS boron concentration greater than or equal to that necessary to meet the SDM requirements at an RCS temperature of 200&deg;F within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
F.1 and F.2 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for a referenced Function are inoperable, the plant must be placed in a MODE in which the LCO for Function 7, 15, 16, 18, 20, or 21 does not apply. This is accomplished by placing the plant in MODE 3 within 6 hours and in MODE 4 with the RCS being cooled by the RNS within 24 hours. The allowed time is reasonable, based on operating experience, to reach the required plant conditions in an orderly manner without challenging plant systems.
G.1, G.2, and G.3 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for the referenced Function are inoperable, the plant must be placed in a MODE in which the LCO for Function 24 does not apply. This is accomplished by placing the plant in MODE 3 within 6 hours, and establishing RCS boron concentration AP1000 STS                                B 3.3.8-55                                    Rev. 1

ESFAS Instrumentation B 3.3.8 BASES ACTIONS (continued) greater than or equal to that necessary to meet the SDM requirements at an RCS temperature of 200&deg;F within 12 hours. The Required Action G.3 requirement to block Steamline/Feedwater isolation and Safeguards actuations is not required until 1 hour from discovery of RCS boron concentration greater than or equal to that necessary to meet SDM at an RCS temperature of 200&deg;F while in MODE 3. Establishing SDM prior to reducing pressurizer pressure and cooling down the RCS maintains the necessary margins assumed for the SLB. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
H.1 and H.2 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for a referenced Function are inoperable, the plant must be placed in a MODE in which the LCO for Function 2 or 14 does not apply. This is accomplished by placing the plant in MODE 3 within 6 hours and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
I.1 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for a referenced Function are inoperable, the affected isolation valve(s) actuated by Function 3, 4, 8, 9, 17, 22, 23, or 25 must be declared inoperable immediately. Declaring the affected isolation valve inoperable allows the supported system Required Actions (i.e., for inoperable valves) to dictate the required measures. The respective isolation valve LCO provides appropriate actions for the inoperable components. This action is in accordance with LCO 3.0.6, which requires that the applicable Conditions and Required Actions for the isolation valves declared inoperable shall be entered in accordance with LCO 3.0.2.
AP1000 STS                                B 3.3.8-56                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES ACTIONS (continued)
J.1 and J.2 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for a referenced Function are inoperable, the plant must be placed in a MODE or other specified condition in which the LCO for Function 7, 15, or 16 does not apply.
Required Action J.1 requires that the plant shall be placed in a condition in which the likelihood and consequences of an event are minimized.
This is accomplished by placing the plant in MODE 5. Once in MODE 5, action shall be initiated to establish RCS VENTED. Establishing RCS VENTED assures that the required ADS Stage 1, 2, and 3 flow paths, or equivalent prescribed by LCO 3.4.13, are open providing sufficient steam venting such that, in combination with required ADS Stage 4 actuation, lowers RCS pressure to allow IRWST injection.
With three or more channels for an affected referenced Function inoperable, the Completion Time to be in MODE 5 (Required Action J.1) is 37 hours. With two channels inoperable, the time is based on the time provided in LCO 3.0.3 to reach MODE 5. With two channels inoperable, the 180 hour Completion Time is based on the ability of the two remaining OPERABLE channels to provide the ESF protective Function.
K.1 and K.2 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for referenced Function 14 in MODE 5 are inoperable, the plant must be placed in a condition in which the likelihood and consequences of an event are minimized. This is accomplished by immediately initiating action to open the RCS pressure boundary and establish  20% pressurizer level. Additionally, action is required to immediately suspend positive reactivity additions. These requirements minimize the consequences of the loss of decay heat removal by maximizing RCS inventory and maintaining RCS temperature as low as practical. Additionally, the potential for a criticality event is minimized by suspension of positive reactivity additions.
L.1 and L.2 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for referenced Function 14 in MODE 6, with upper internals in place, are inoperable, the plant must be placed in a condition in which the likelihood and consequences of an event are minimized. This is accomplished by immediately initiating AP1000 STS                                 B 3.3.8-57                                        Rev. 1

ESFAS Instrumentation B 3.3.8 BASES ACTIONS (continued) action to suspend positive reactivity additions. This requirement minimizes the consequences of the loss of decay heat removal by maximizing RCS inventory and maintaining RCS temperature as low as practical. The potential for a criticality event is also minimized by suspension of positive reactivity additions. Additionally, Required Action L.2 requires that action be immediately initiated to remove the upper internals.
M.1, M.2, and M.3 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for referenced Function 18 in MODE 4 with the RCS being cooled by the RNS, or in MODE 5, are inoperable, the plant must be placed in a condition in which the likelihood and consequences of an event are minimized. This is accomplished by placing the plant in MODE 5 within 12 hours. The 12 hours is a reasonable time to reach MODE 5 from MODE 4 with RCS cooling provided by the RNS (an RCS temperature at or below approximately 350&deg;F) in an orderly manner without challenging plant systems.
Required Action M.3 requires initiation of action within 12 hours to close the RCS pressure boundary (intact) and establish  20% pressurizer level. The 12 hour Completion Time allows transition to MODE 5 in accordance with M.2, if needed, while maintaining the RCS pressure boundary intact.
Required Action M.1 minimizes the potential for a criticality event by suspension of positive reactivity additions. Required Actions M.2 and M.3 minimize the consequences of a loss of decay heat removal event by optimizing conditions for RCS cooling in MODE 5 using the PRHR HX. Additionally, maximizing RCS inventory and maintaining RCS temperature as low as practical further minimize the consequences of a loss of decay heat removal event. Maintaining the RCS pressure boundary closed (intact) in MODE 5 assures that PRHR HX cooling is available.
N.1 and N.2 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for the referenced Function 18 in MODE 6, with the upper internals in place, are inoperable, the plant must be placed in a condition in which the likelihood and consequences of an event are minimized. This is accomplished by immediately initiating action to establish the reactor cavity water level  23 feet above the top AP1000 STS                                B 3.3.8-58                                      Rev. 1

ESFAS Instrumentation B 3.3.8 BASES ACTIONS (continued) of the reactor vessel flange and immediately suspending positive reactivity additions.
Required Action N.2 minimizes the consequences of a loss of decay heat removal event by maximizing RCS inventory, and maintaining RCS temperature as low as practical further minimizes the consequences of a loss of decay heat removal event. Additionally, the potential for a criticality event is minimized by suspension of positive reactivity additions in accordance with Required Action N.1.
O.1 and O.2 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for referenced Function 19 in MODE 1, 2, 3, or 4, are inoperable, the affected isolation valve(s) must be declared inoperable immediately. Declaring the affected isolation valves inoperable allows the supported system Actions (i.e., LCO 3.6.3 for inoperable containment isolation valves in the CCS lines to and from the RCP heat exchangers) to dictate the required measures. The respective isolation valve LCO provides appropriate actions for the inoperable components. This action is in accordance with LCO 3.0.6, which requires that the applicable Conditions and Required Actions for the isolation valves declared inoperable shall be entered in accordance with LCO 3.0.2. Additionally, Required Action O.2 requires that the plant must be brought to MODE 3 within 6 hours. The allowed time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
P.1, P.2, and P.3 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for the referenced Function 1.a or 1.b in MODE 1, 2, 3, or 4, or on MODE 5 or 6 without an open containment air flow path  6 inches in diameter, are inoperable, the plant must be placed in a condition in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
AP1000 STS                                 B 3.3.8-59                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES ACTIONS (continued)
A containment air flow path  6 inches in diameter shall be opened within 44 hours from Condition entry. Opening any flow path (or paths) with an area equivalent to 6 inches in diameter provides the required vacuum relief path in the event of a low pressure event.
The primary means of opening a containment air flow path is by establishing a Containment Air Filtration System (VFS) air flow path into containment. Manual actuation and maintenance as necessary to open a purge supply, purge exhaust, or vacuum relief flow path are available means to open a containment air flow path. In addition, opening of a spare penetration is an acceptable means to provide the necessary flow path. Opening of an equipment hatch or a containment airlock is acceptable. Containment air flow paths opened must comply with LCO 3.6.7, Containment Penetrations.
The 44 hour Completion Time is reasonable for opening a containment air flow path in an orderly manner.
Q.1 and Q.2 If a Required Action and associated Completion Time of Condition A or B are not met or if three or more channels for referenced Function 10 in MODE 1, 2, or 3, or in MODE 4 with all four cold leg temperatures
                    > 275&deg;F, are inoperable, the plant must be placed in a MODE in which the LCO does not apply. This is accomplished by placing the plant in MODE 3 within 6 hours and in MODE 4 with at least one cold leg temperature  275&deg;F within 24 hours. The allowed time is reasonable, based on operating experience, to reach the required plant conditions in an orderly manner without challenging plant systems.
SURVEILLANCE        The following SRs apply to each ESFAS Instrumentation Function in REQUIREMENTS        Table 3.3.8-1, except where noted below.
SR 3.3.8.1 Performance of the CHANNEL CHECK once every 12 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two AP1000 STS                                B 3.3.8-60                                   Rev. 1

ESFAS Instrumentation B 3.3.8 BASES SURVEILLANCE REQUIREMENTS (continued) instrument channels could be an indication of excessive instrument drift in one of the channels or even something more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the match criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside their corresponding limits.
The Surveillance Requirement is modified by a Note. The Note states that this SR is only required for Source Range Neutron Flux Doubling.
The OPERABILITY for the other Functions is verified by self-checking features in lieu of performing a CHANNEL CHECK.
The Surveillance Frequency is based on operating experience that demonstrates that channel failure is rare. Automated operator aids may be used to facilitate performance of the CHANNEL CHECK.
SR 3.3.8.2 This SR is the performance of a CHANNEL CALIBRATION every 24 months or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor and the integrated protection cabinets (IPCs). The test is performed in accordance with the SP. If the actual setting of the channel is found to be outside the as-found tolerance, the channel is considered inoperable. This condition of the channel will be further evaluated during performance of the Surveillance. This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance),
and evaluating the channels response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation. Transmitter calibration must be performed consistent with the assumptions of the setpoint methodology. The difference between the current as-found values and the previous as-left values must be consistent with the transmitter drift allowance used in the setpoint methodology.
AP1000 STS                            B 3.3.8-61                                       Rev. 1

ESFAS Instrumentation B 3.3.8 BASES SURVEILLANCE REQUIREMENTS (continued)
Interlocks implicitly required to support the Function's OPERABILITY are also addressed by this CHANNEL CALIBRATION. This portion of the CHANNEL CALIBRATION ensures the associated Function is not bypassed when required to be enabled. This can be accomplished by ensuring the interlocks are calibrated properly in accordance with the SP.
If the interlock is not automatically functioning as designed, the condition is entered into the Corrective Action Program and appropriate OPERABILITY evaluations performed for the affected Function. The affected Functions OPERABILITY can be met if the interlock is manually enforced to properly enable the affected Function. When an interlock is not supporting the associated Functions OPERABILITY at the existing plant conditions, the affected Function's channels must be declared inoperable and appropriate ACTIONS taken.
The setpoint methodology requires that 30 months drift be used (1.25 times the Surveillance calibration interval, 24 months).
The Frequency is based on operating experience and consistency with the refueling cycle.
This Surveillance Requirement is modified by two Notes. Note 1 states that this test should include verification that the time constants are adjusted to the prescribed values where applicable. Note 2 states that neutron detectors are excluded from the CHANNEL CALIBRATION. The CHANNEL CALIBRATION for the source range neutron flux monitors consists of obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturers data.
SR 3.3.8.3 This SR ensures the individual channel ESF RESPONSE TIME is less than or equal to the maximum value assumed in the accident analysis.
Individual component response times are not modeled in the analyses.
The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the NTS value at the sensor, to the point at which the equipment reaches the required functional state (e.g., valves in full open or closed position).
In lieu of measurement, the response time for the Protection and Safety Monitoring System equipment is based on allocated values (Ref. 7). The overall response time may be determined by a series of overlapping tests and allocated values such that the entire response time is verified, with AP1000 STS                              B 3.3.8-62                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES SURVEILLANCE REQUIREMENTS (continued) the resulting verified response time compared to the appropriate FSAR Chapter 7 (Ref. 6) response time.
Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the allocated sensor, signal processing and actuation logic response times, where approved, with actual response time tests on the remainder of the channel. Allocations for signal processing and actuation logic response times may be obtained from the Protection and Safety Monitoring System Functional Requirements document.
ESF RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS. Testing of the devices is included in the testing of each channel. The final actuation device in one train is tested with each channel. Therefore, staggered testing results in response time verification of these devices every 24 months. The 24 month Frequency is consistent with the typical refueling cycle and is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.
The Surveillance Requirement is modified by two Notes: Note 1 states that it is not applicable to Function 1.a for Containment Pressure - Low.
The exception is appropriate because the Containment Pressure - Low signal provides an interlock function for the containment vacuum relief valves manual initiation function and does not directly actuate any ESF.
Note 2 exempts neutron detectors from ESF RESPONSE TIME testing.
This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response.
AP1000 STS                             B 3.3.8-63                                     Rev. 1

ESFAS Instrumentation B 3.3.8 BASES REFERENCES 1. WCAP-16675-P, AP1000 Protection and Safety Monitoring System Architecture Technical Report.
: 2. FSAR Chapter 15, Accident Analyses.
: 3. WCAP-16361-P, Westinghouse Setpoint Methodology for Protection Systems - AP1000, February 2011 (proprietary).
: 4. 10 CFR 50.49, Environmental Qualification of Electric Equipment Important to Safety for Nuclear Power Plants.
: 5. APP-GW-GSC-020, Technical Specification Completion Time and Surveillance Frequency Justification.
: 6. FSAR Chapter 7, Instrumentation and Controls.
: 7. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos. 168 and 166 to the Combined License Nos. NPF-91 and NPF-92, respectively, Vogtle Electric Generating Plant Units 3 and 4, Docket Nos. 52-025 and 52-026, dated November 21, 2019 [ML19297C988 (Proprietary) and ML19297D159 (non proprietary)].
AP1000 STS                   B 3.3.8-64                                     Rev. 1

ESFAS Manual Initiation B 3.3.9 B 3.3 INSTRUMENTATION B 3.3.9 Engineered Safety Feature Actuation System (ESFAS) Manual Initiation BASES BACKGROUND           A description of the ESFAS Instrumentation is provided in the Bases for LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS)
Instrumentation.
APPLICABLE           A description of the following ESFAS protective functions is provided in SAFETY               the Bases for LCO 3.3.8:
ANALYSES, LCO, and APPLICABILITY
* Safeguards Actuation
* Core Makeup Tank (CMT) Actuation
* Containment Isolation (T Signal)
* Steam Line Isolation
* Feedwater Isolation Main Feedwater Control Valve Isolation Main Feedwater Pump Trip and Valve Isolation Startup Feedwater Isolation
* Automatic Depressurization System (ADS) Stages 1, 2, and 3 Actuation
* ADS Stage 4 Actuation
* Passive Containment Cooling Actuation
* Passive Residual Heat Removal Heat Exchanger Actuation
* Chemical and Volume Control System Makeup Isolation
* Normal Residual Heat Removal System Isolation AP1000 STS                                 B 3.3.9-1                                     Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
* In-Containment Refueling Water Storage Tank (IRWST) Injection Line Valve Actuation
* IRWST Containment Recirculation Valve Actuation
* Steam Generator (SG) Power Operated Relief Valve and Block Valve Isolation
* Containment Vacuum Relief Valve Actuation The LCO requires OPERABILITY of two devices for each Manual Initiation Function listed in Table 3.3.9-1. Two Manual Initiation channels are required to ensure no single random failure disables the ESFAS.
The required channels of ESFAS instrumentation provide plant protection in the event of any of the analyzed accidents (Ref. 1). ESFAS Manual Initiation Functions are as follows:
: 1. Safeguards Actuation  Manual Initiation The LCO requires that two Manual Initiation devices be OPERABLE.
The operator can initiate the Safeguards Actuation signal at any time by using either of two switches in the main control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.
The LCO on Safeguards Actuation  Manual Initiation ensures the proper amount of redundancy is maintained in the manual Safeguards actuation circuitry to ensure the operator has the capability of manually initiating Safeguards Actuation.
Each device consists of one switch and the interconnecting wiring to all four divisions. Each Manual Initiation device actuates all four divisions. This configuration does not allow testing at power.
Manual Initiation of Safeguards Actuation must be OPERABLE in MODES 1, 2, 3, and 4.
Manual Initiation of Safeguards Actuation is required in MODE 5 to support system level initiation.
AP1000 STS                               B 3.3.9-2                                       Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
This Safeguards Actuation Manual Initiation Function is not required to be OPERABLE in MODE 6 because there is adequate time for the operator to evaluate plant conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. Plant pressure and temperature are very low and many Engineered Safety Features (ESF) components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of plant systems.
: 2. Core Makeup Tank (CMT) Actuation  Manual Initiation CMT Actuation provides the passive injection of borated water into the RCS. Injection provides RCS makeup water and boration during transients or accidents when the normal makeup supply from the Chemical and Volume Control System (CVS) is lost or insufficient.
Manual CMT Actuation is accomplished by either of two switches in the main control room. Either switch activates all four divisions.
Manual CMT Actuation must be OPERABLE in MODES 1 through 3, and MODE 4 with the Reactor Coolant System (RCS) not cooled by the Normal Residual Heat Removal System (RNS). Manual Actuation of the CMTs is additionally required in MODE 4 when the RCS is being cooled by the RNS, and MODE 5 with the RCS not VENTED. Actuation of this Function is not required in MODE 5 with the RCS VENTED, or MODE 6 because the CMTs are not required to be OPERABLE in these MODES.
: 3. Containment Isolation  Manual Initiation Containment isolation is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.
Manual Initiation of Containment Isolation is accomplished by either of two switches in the main control room. Either switch actuates all four ESFAS divisions. Manual Initiation of Containment Isolation must be OPERABLE in MODES 1, 2, 3, and 4, when containment integrity is required.
AP1000 STS                            B 3.3.9-3                                      Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 4. Steam Line Isolation  Manual Initiation Isolation of the main steam lines provides protection in the event of a Steam Line Break (SLB) inside or outside containment.
Manual Initiation of Steam Line Isolation can be accomplished from the main control room. There are two switches in the main control room and either switch can initiate action to immediately close all main steam isolation valves (MSIVs).
The LCO requires two OPERABLE channels in MODES 1, 2, 3, and 4. In MODES 5 and 6, this Function is not required to be OPERABLE because there is insufficient energy in the secondary side of the unit to cause an accident.
: 5. Feedwater Isolation  Manual Initiation The primary Function of Feedwater Isolation is to prevent damage to the turbine due to water in the steam lines and to stop the excessive flow of feedwater into the SGs.
Manual Initiation of Feedwater Isolation can be accomplished from the main control room. There are two switches in the main control room and either switch can initiate action in both divisions to close all main and startup feedwater control, isolation and crossover valves, trip all main and startup feedwater pumps, and trip the turbine.
Feedwater Isolation is necessary in MODES 1, 2, 3, and 4 to mitigate the effects of a large SLB or feedwater line break (FLB). In MODES 5 and 6, the energy in the RCS and the steam generators is low and this Manual Initiation Function is not required to be OPERABLE.
: 6. ADS Stages 1, 2, and 3 Actuation  Manual Initiation The Automatic Depressurization System (ADS) provides a sequenced depressurization of the reactor coolant system to allow passive injection from the CMTs, accumulators, and the in-containment refueling water storage tank (IRWST) to mitigate the effects of a LOCA.
AP1000 STS                            B 3.3.9-4                                      Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The operator can initiate an ADS Stages 1, 2, and 3 actuation from the main control room by simultaneously actuating two ADS actuation devices in the same set. There are two sets of two switches each in the main control room. Simultaneously actuating the two devices in either set will actuate ADS Stages 1, 2, and 3.
This Function must be OPERABLE in MODES 1 through 4, and MODE 5 with the RCS not VENTED. In MODE 5 with the RCS VENTED and in MODE 6 with upper internals in place, LCO 3.4.13, ADS  Shutdown, RCS Open, requires the ADS Stages 1, 2, and 3 valves to be open. Thus, Manual Initiation is not required.
: 7. ADS Stage 4 Actuation  Manual Initiation The ADS provides a sequenced depressurization of the reactor coolant system to allow passive injection from the CMTs, accumulators, and the IRWST to mitigate the effects of a LOCA.
The fourth stage depressurization valves open on manual actuation.
The operator can initiate Stage 4 of ADS from the main control room. There are two sets of two switches each in the main control room. Actuating the two switches in either set will actuate all 4th Stage ADS valves. This manual actuation is interlocked to actuate with either the Low RCS wide range pressure signal or with the ADS Stages 1, 2, and 3 actuation. These interlocks minimize the potential for inadvertent actuation of this Manual Initiation Function.
This interlock with the ADS Stages 1, 2, and 3 actuation protective function allows Manual Initiation of this Function if automatic or manual actuation of the ADS Stages 1, 2, and 3 valves fails to depressurize the RCS due to common-mode failure. This consideration is important in PRA modeling to improve the reliability of reducing the RCS pressure following a small LOCA or transient event. This Manual Initiation Function must be OPERABLE in MODES 1 through 5, and MODE 6 with the upper internals in place.
In MODE 6 with the upper internals not in place, the Stage 4 ADS valves are not required to be OPERABLE by LCO 3.4.13; thus Manual Initiation of the valves is not required.
AP1000 STS                           B 3.3.9-5                                       Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 8. Passive Containment Cooling Actuation  Manual Initiation The Passive Containment Cooling System (PCS) transfers heat from the reactor containment to the environment. This Function is necessary to prevent the containment design pressure and temperature from being exceeded following any postulated DBA (such as LOCA or SLB).
The operator can initiate Containment Cooling at any time from the main control room by actuating either of the two containment cooling actuation switches. There are two switches in the main control room, either of which will actuate containment cooling in all divisions.
Manual Initiation of containment cooling also actuates containment isolation.
The LCO requires this Function to be OPERABLE in MODES 1, 2, 3, and 4 when the potential exists for a DBA that could require the operation of the Passive Containment Cooling System. In MODES 5 and 6, with decay heat greater than 7.0 MWt, manual initiation of the PCS provides containment heat removal. The Applicability section of Bases Subsection B 3.6.6 provides the basis for the decay heat limit.
: 9. Passive Residual Heat Removal Heat Exchanger Actuation Manual Initiation The PRHR Heat Exchanger (HX) provides emergency core decay heat removal when the Startup Feedwater System is not available to provide a heat sink.
Manual PRHR actuation is accomplished by either of two switches in the main control room. Either switch actuates all four ESFAS Divisions.
This Function is required to be OPERABLE in MODES 1, 2, 3, and 4, and MODE 5 with the RCS pressure boundary intact. This ensures that PRHR can be actuated in the event of a loss of the normal heat removal systems.
AP1000 STS                           B 3.3.9-6                                         Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 10. Chemical and Volume Control System Makeup Isolation  Manual Initiation The CVS makeup line, auxiliary spray line, zinc addition line, hydrogen addition line, and letdown purification line are isolated following certain events to prevent overfilling of the RCS.
Manual Chemical and Volume Control System Makeup Isolation is actuated by either of two switches in the main control room. Either switch closes Chemical and Volume Control System makeup line, auxiliary spray line, zinc addition line, hydrogen addition line, and letdown purification line isolation valves. The LCO requires two switches to be OPERABLE.
This Function is required to be OPERABLE in MODES 1 through 3, and MODE 4 with all four cold leg temperatures > 275&deg;F. This Function is not required to be OPERABLE in MODE 4 with at least one cold leg temperature  275&deg;F or in MODES 5 and 6 because it is not required to mitigate a DBA in these MODES.
: 11. Normal Residual Heat Removal System Isolation  Manual Initiation The RNS suction line is isolated by closing the containment isolation valves to provide containment isolation following an accident The operator can initiate RNS isolation at any time from the control room by simultaneously actuating two switches in the same actuation set. Because an inadvertent actuation of RNS isolation could have serious consequences, two switches must be actuated simultaneously to initiate isolation. There are two sets of two switches in the control room. Simultaneously actuating the two switches in either set will isolate the RNS in the same manner as the automatic actuation signal. Two Manual Initiation switches in each set are required to be OPERABLE to ensure no single failure disables the Manual Initiation Function.
This Function is required to be OPERABLE in MODES 1, 2, and 3.
AP1000 STS                             B 3.3.9-7                                        Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 12. In-Containment Refueling Water Storage Tank (IRWST) Injection Line Valve Actuation  Manual Initiation The Passive Core Cooling System (PXS) provides core cooling by gravity injection and recirculation for decay heat removal following an accident. Manual initiation will generate a signal to open the IRWST injection line and actuate IRWST injection.
The operator can open IRWST injection line valves at any time from the main control room by actuating two IRWST injection actuation switches in the same actuation set. There are two sets of two switches each in the main control room.
This Function is required to be OPERABLE in MODES 1 through 3, and MODE 4 with the Reactor Coolant System (RCS) not cooled by the Normal Residual Heat Removal System (RNS). Manual actuation of the IRWST injection line valves is additionally required to be OPERABLE in MODE 4 when the RCS is being cooled by the RNS, MODE 5, and MODE 6.
: 13. IRWST Containment Recirculation Valve Actuation  Manual Initiation The PXS provides core cooling by gravity injection and recirculation for decay heat removal following an accident. Manual initiation will open these valves.
The operator can open the containment recirculation valves at any time from the main control room by actuating two containment recirculation actuation switches in the same actuation set. There are two sets of two switches each in the main control room.
This Function is required to be OPERABLE in MODES 1 through 3, and MODE 4 with the Reactor Coolant System (RCS) not cooled by the Normal Residual Heat Removal System (RNS). Manual actuation of the IRWST containment recirculation valves is additionally required to be OPERABLE in MODE 4 when the RCS is being cooled by the RNS, MODE 5, and MODE 6.
AP1000 STS                            B 3.3.9-8                                       Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 14. SG Power Operated Relief Valve and Block Valve Isolation  Manual Initiation The Function of the SG Power Operated Relief Valve (PORV) and Block Valve Isolation is to ensure that the SG PORV flow paths can be isolated during a SG tube rupture (SGTR) event.
Manual initiation of SG PORV and Block Valve Isolation can be accomplished from the control room. There are two switches in the control room and either switch can close the SG PORVs and PORV block valves. The LCO requires two switches to be OPERABLE.
This Function is required to be OPERABLE in MODES 1, 2, and 3, and in MODE 4 with the RCS cooling not being provided by the RNS. In MODE 4 with an RCS temperature < 350&deg;F and in MODES 5 and 6, the RCS pressure and temperature are reduced and an SGTR is not credible. However, the Applicability conservatively requires OPERABILITY of this Function in MODE 4 with RCS temperature < 350&deg;F until the RCS is being cooled by RNS.
: 15. Containment Vacuum Relief Valve Actuation  Manual Initiation The purpose of the vacuum relief lines is to protect the containment vessel against damage due to a negative pressure (i.e., a lower pressure inside than outside).
The operator can open the vacuum relief valves from the main control room by actuating either of the two vacuum relief actuation switches. There are two switches in the main control room, either of which will actuate vacuum relief in all divisions. Manual Containment Vacuum Relief Actuation is interlocked to prevent actuation until the Containment Pressure  Low setpoint is reached. After the operator initiates Manual Containment Vacuum Relief Actuation, the actuation signal is automatically reset when containment pressure rises above the Low setpoint due to the interlock condition no longer being satisfied. Following actuation signal reset, the valves will remain open until closed by a different manual or automatic signal.
Manual Containment Vacuum Relief Valve actuation must be OPERABLE in MODES 1 through 4 and in MODES 5 and 6 without an open containment air flow path  6 inches in diameter. With a AP1000 STS                           B 3.3.9-9                                       Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 6 inch diameter or equivalent containment air flow path, the vacuum relief function is not needed to mitigate a low pressure event.
ESFAS Manual Initiation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS          A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this specification may be entered independently for each Function listed on Table 3.3.9-1. The Completion Time(s) of the inoperable equipment of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
A.1 Condition A addresses the inoperability of the system level manual initiation capability for the ESF Functions listed in Table 3.3.9-1. With one channel inoperable for one or more Functions, the system level manual initiation capability is reduced below that required to meet single failure criterion. Required Action A.1 requires the manual initiation channel to be restored to OPERABLE status within 48 hours. The specified Completion Time is reasonable considering that the remaining switch or switch set is capable of performing the safety function.
Condition A is modified by a Note stating that this Condition is not applicable to Functions 1, 6, 7, 8, 12, and 13 in MODE 5 or 6.
B.1 As noted, Condition B addresses the inoperability of one channel of one or more of Functions 1, 6, 7, 8, 12, and 13 when in MODE 5 or 6. With one channel inoperable for one or more of these Functions, the system level initiation capability is reduced below that required to meet single failure criterion. Therefore, the required channel must be returned to OPERABLE status within 72 hours. The specified Completion Time is reasonable considering the remaining switch or switch set is capable of performing manual initiation.
C.1 Required Action C.1 directs entry into the appropriate Condition referenced in Table 3.3.9-1. If the Required Action and the associated AP1000 STS                               B 3.3.9-10                                     Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES ACTIONS (continued)
Completion Time of Condition A or B are not met or if two channels for one or more Functions are inoperable, Condition C is entered to provide for transfer to the appropriate subsequent Condition.
D.1 and D.2 If the Required Action and associated Completion Time of Condition A are not met or if two channels for one or more Functions are inoperable for one or more of Functions 2, 12, 13, and 14 in MODE 1, 2, or 3, or MODE 4 with the RCS not being cooled by the RNS, the plant must be placed in a MODE in which the likelihood and consequences of an event are minimized. This is accomplished by placing the plant in MODE 3 within 6 hours and in MODE 4 with the RCS being cooled by the RNS within 24 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
E.1 and E.2 If the Required Action and associated Completion Time of Condition A are not met or if two channels for one or more Functions are inoperable, the plant must be placed in a MODE in which the likelihood and consequences of an event are minimized. This is accomplished by placing the plant in MODE 3 within 6 hours and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
F.1 If the Required Action and associated Completion Time of Condition A are not met or if two channels for one or more Functions are inoperable, the plant must be placed in a MODE in which the likelihood and consequences of an event are minimized. Under these circumstances, the affected isolation valves(s) must be declared inoperable immediately.
Declaring the affected isolation valve inoperable allows the supported system Actions (i.e., for inoperable valves) to dictate the required measures. The respective isolation valve LCO provides appropriate actions for the inoperable components. This action is in accordance with LCO 3.0.6, which requires that the applicable Conditions and Required Actions for the isolation valves declared inoperable shall be entered in accordance with LCO 3.0.2.
AP1000 STS                               B 3.3.9-11                                    Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES ACTIONS (continued)
G.1 and G.2 If the Required Action and the associated Completion Time of Condition A are not met, or if two channels for one or more Functions are inoperable for Function 2 in MODE 4 with the RCS being cooled by the RNS, or Function 2 in MODE 5 with the RCS not VENTED, or Function 9 in MODE 5 with the RCS pressure boundary intact, the plant must be placed in a condition in which the likelihood and consequences of an event are minimized. This is accomplished by placing the plant in MODE 5 within 12 hours. Once in MODE 5, action shall be immediately initiated to establish RCS VENTED. The 12 hour Completion Time is a reasonable time to reach MODE 5 from MODE 4 with RCS cooling provided by the RNS (approximately 350&deg;F) in an orderly manner without challenging plant systems. Establishing RCS VENTED assures that the required ADS Stages 1, 2 and 3 flow paths, or equivalent prescribed by LCO 3.4.13, are open providing sufficient steam venting, in combination with required ADS Stage 4 actuation, to lower RCS pressure to allow IRWST injection.
For Function 9, once the RCS pressure boundary is open, the Applicability is exited and completion of Required Action G.2 is no longer required.
H.1 and H.2 If the Required Action and associated Completion Time of Condition B are not met or if two channels for one or more Functions are inoperable for one or both of Function 6 in MODE 5 with the RCS not VENTED, and Function 7 in MODE 5, the plant must be placed in a MODE in which the likelihood and consequences of an event are minimized. This is accomplished by immediately initiating action to establish RCS VENTED, establish  20% pressurizer level, and suspend positive reactivity additions. Establishing RCS VENTED assures that the required ADS Stages 1, 2 and 3 flow paths, or equivalent, prescribed by LCO 3.4.13, are open providing sufficient steam venting such that, in combination with required ADS Stage 4 actuation, lowers RCS pressure to allow IRWST injection. The requirement to establish  20% pressurizer level minimizes the consequences of the loss of decay heat removal by maximizing RCS inventory. Additionally, the potential for a criticality event is minimized by the immediate suspension of positive reactivity additions.
AP1000 STS                               B 3.3.9-12                                         Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES ACTIONS (continued)
I.1 and I.2 If the Required Action and associated Completion Time of Condition B are not met or if two channels for Function 7 in MODE 6 with upper internals in place are inoperable, the plant must be placed in a MODE in which the likelihood and consequences of an event are minimized. This is accomplished by immediately initiating action to remove the upper internals and suspend positive reactivity additions. The requirement to initiate action to remove the upper internals minimizes the consequences of the loss of decay heat removal by maximizing RCS inventory and maintaining RCS temperature as low as practical. Additionally, the potential for a criticality event is minimized by the immediate suspension of positive reactivity additions.
J.1, J.2, and J.3 If the Required Action and associated Completion Time of Condition B are not met or if two channels are inoperable for one or more of Functions 12 and 13 in MODE 4 with the RCS being cooled by the RNS, Functions 1, 12, and 13 in MODE 5, and Function 8 in MODE 5 with decay heat > 7.0 MWt, the plant must be placed in a MODE in which the likelihood and consequences of an event are minimized. This is accomplished by placing the plant in MODE 5 within 12 hours (Required Action J.2). The 12 hours is a reasonable time to reach MODE 5 with RCS cooling provided by the RNS (approximately 350&deg;F) in an orderly manner without challenging plant systems.
Required Action J.3 requires initiation of action within 12 hours to close the RCS pressure boundary and establish  20% pressurizer level. The 12 hour Completion Time allows transition to MODE 5 in accordance with J.2, if needed, while maintaining the RCS pressure boundary intact.
Required Action J.1 minimizes the potential for a criticality event by suspension of positive reactivity additions. Required Actions J.2 and J.3 minimize the consequences of a loss of decay heat removal event by optimizing conditions for RCS cooling in MODE 5 using the PRHR HX.
Additionally, maximizing RCS inventory and maintaining RCS temperature as low as practical further minimize the consequences of a loss of decay heat removal event. Maintaining the RCS pressure boundary intact in MODE 5 assures that PRHR HX cooling is available.
AP1000 STS                                B 3.3.9-13                                     Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES ACTIONS (continued)
K.1 and K.2 If the Required Action and associated Completion Time of Condition B are not met or if two channels are inoperable for one or more of Functions 12 and 13 in MODE 6, and Function 8 in MODE 6 with decay heat
                  > 7.0 MWt, the plant must be placed in a condition in which the likelihood and consequences of an event are minimized. This is accomplished by immediately initiating action to establish the reactor cavity water level 23 feet above the top of the reactor vessel flange (Required Action K.2) and to suspend positive reactivity additions (Required Action K.1).
Required Action K.2 minimizes the consequences of a loss of decay heat removal event by optimizing conditions for RCS cooling in MODE 6 using IRWST injection.
Additionally, maximizing RCS inventory and maintaining RCS temperature as low as practical further minimize the consequences of a loss of decay heat removal event. Additionally, the potential for a criticality event is minimized by suspension of positive reactivity additions.
L.1, L.2, and L.3 If the Required Action and associated Completion Time of Condition A are not met or if more than two channels are inoperable for Function 15, the plant must be placed in a MODE in which the likelihood and consequences of an event are minimized. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
In addition, a containment air flow path  6 inches in diameter shall be opened within 44 hours from Condition entry. Opening any flow path (or paths) with an area equivalent to 6 inches in diameter provides the required vacuum relief path in the event of a low pressure event.
The primary means of opening a containment air flow path is by establishing a Containment Air Filtration System (VFS) air flow path into containment. Manual actuation and maintenance as necessary to open a purge supply, purge exhaust, or vacuum relief flow path are available means to open a containment air flow path. In addition, opening of a AP1000 STS                              B 3.3.9-14                                       Rev. 1

ESFAS Manual Initiation B 3.3.9 BASES ACTIONS (continued) spare penetration is an acceptable means to provide the necessary flow path. Opening of an equipment hatch or a containment airlock is also acceptable. Containment air flow paths opened must comply with LCO 3.6.7, Containment Penetrations.
The 44 hour Completion Time is reasonable for opening a containment air flow path in an orderly manner.
SURVEILLANCE       SR 3.3.9.1 REQUIREMENTS SR 3.3.9.1 is the performance of a TADOT of the manual initiation for the various ESF Functions. This TADOT is performed every 24 months.
The Frequency is based on the known reliability of the ESF Functions and the multichannel redundancy available, and has been shown to be acceptable through operating experience.
The SR is modified by a Note that states verification of setpoint is not required, since these Manual Initiation Functions have no setpoint associated with them.
REFERENCES         1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                               B 3.3.9-15                                      Rev. 1

ESFAS RCS Hot Leg Level Instrumentation B 3.3.10 B 3.3 INSTRUMENTATION B 3.3.10 Engineered Safety Feature Actuation System (ESFAS) Reactor Coolant System (RCS) Hot Leg Level Instrumentation BASES BACKGROUND          A description of the ESFAS Instrumentation is provided in the Bases for LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS)
Instrumentation.
APPLICABLE          The required channels of ESFAS instrumentation provide plant protection SAFETY              in the event of any of the analyzed accidents (Ref. 1). A description of the ANALYSES, LCO,      ESFAS P-12 (Pressurizer Level) interlock is provided in the Bases for and APPLICABILITY   LCO 3.3.8. ESFAS protective functions include:
ADS Stage 4 Actuation A description of the Automatic Depressurization System (ADS) Stage 4 Actuation is provided in the Bases for LCO 3.3.8.
Chemical and Volume Control System (CVS) Letdown Isolation A description of the Chemical and Volume Control System (CVS)
Letdown Isolation is provided in the Bases for LCO 3.3.8.
The following are descriptions of the individual instrument Functions required by this LCO as presented in Table 3.3.10-1. Each Function also provides the ESFAS protective functions actuated by the instrumentation.
: 1. Hot Leg Level  Low 4 A signal to automatically open the ADS Stage 4 depressurization valves is generated when coincident loop 1 and 2 Reactor Coolant System (RCS) hot leg level indications decrease and stay below an established setpoint for a duration exceeding a preset time delay.
The normally open ADS Stage 4 isolation valves also receive a confirmatory open signal. The ADS provides a sequenced depressurization of the RCS to allow passive injection from the Core Makeup Tanks (CMTs), accumulators, and the In-containment Refueling Water Storage Tank (IRWST) to mitigate the effects of a LOCA. This Function is required to be OPERABLE in MODE 5 with CMT actuation on Pressurizer Water Level - Low 2 blocked, and in MODE 6 with the upper internals in place and with CMT actuation on Pressurizer Water Level - Low 2 blocked.
AP1000 STS                               B 3.3.10-1                                      Rev. 1

ESFAS RCS Hot Leg Level Instrumentation B 3.3.10 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 2. Hot Leg Level  Low 2 A signal to isolate the Chemical and Volume Control System (CVS) letdown valves is generated upon the occurrence of a Low 2 hot leg level in either of the two RCS hot leg loops. This helps to maintain RCS inventory in the event of a LOCA. This Function can be blocked in MODES 1, 2, and 3 and is automatically reset when P-12 is first activated. It may be manually reset as well. This Function is required to be OPERABLE in MODE 5 below the P-12 (Pressurizer Level) interlock, and in MODE 6 with the water level < 23 feet above the top of the reactor vessel flange.
ESFAS RCS Hot Leg Level Instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS          A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this specification may be entered independently for each Function listed on Table 3.3.10-1. The Completion Time(s) of the inoperable equipment of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function. Where the required channels are specified on a per loop basis, separate Condition entry is allowed for each loop.
In the event a channels as-found condition is outside the as-found tolerance described in the Setpoint Program (SP), or the channel is not functioning as required, or the transmitter, or the Protection and Safety Monitoring System (PMS) Division, associated with a specific Function is found inoperable, then all affected protection Functions supported by or dependent on that channel must be declared inoperable and the LCO Condition(s) entered for the particular protection Function(s) affected.
A.1 and A.2 With one channel inoperable, the affected channel must be placed in a bypass condition within 6 hours. For Function 1, if one channel is placed in bypass, automatic actuation will not occur. For Function 2, the 6 hours allowed to place the inoperable channel in the bypass condition is justified in Reference 2. If one CVS isolation channel is bypassed, the logic becomes one-out-of-one. A single failure in the remaining channel could cause a spurious CVS isolation. Spurious CVS isolation, while undesirable, would not cause an upset plant condition. Therefore, AP1000 STS                               B 3.3.10-2                                      Rev. 1

ESFAS RCS Hot Leg Level Instrumentation B 3.3.10 BASES ACTIONS (continued)
Required Action A.2 requires continuous monitoring of the hot leg level.
This provides sufficient information to permit timely operator action to ensure that ADS Stage 4 actuation can occur, if needed to mitigate events requiring RCS makeup, boration, or core cooling. Operator action to manually initiate ADS Stage 4 actuation is assumed in the analysis of shutdown events (Ref. 3). It is also credited in the shutdown PRA (Ref. 4) when automatic actuation is not available.
Required Action A.2 is modified by a Note stating that the action is only applicable to Function 1 in Table 3.3.10-1.
B.1 Condition B addresses the situation where a Required Action and associated Completion Time of Condition A are not met. The Required Action is to refer to Table 3.3.10-1 and to take the Required Actions for the protection Functions affected. The Completion Times are those from the referenced Conditions and Required Actions.
C.1 and C.2 If the Required Action and associated Completion Time of Condition A are not met for Function 1 in Table 3.3.10-1, the plant must be placed in a MODE in which the likelihood and consequences of an event are minimized. This is accomplished by immediately initiating action to suspend positive reactivity additions (Required Action C.1).
Required Action C.2 requires immediate initiation of action to establish pressurizer level above the P-12 (Pressurizer Level) interlock. Actions minimize the consequences of a loss of decay heat removal event by optimizing conditions for RCS cooling.
D.1.1, D.1.2.1, D.1.2.2, and D.2 If the Required Action and associated Completion Time of Condition A are not met for Function 2 in Table 3.3.10-1, the plant must be placed in a condition where the instrumentation Function for valve isolation is no longer needed. This is accomplished by isolating the affected flow path within 24 hours. By isolating the CVS letdown flow path from the RCS, the need for automatic isolation is eliminated.
AP1000 STS                                B 3.3.10-3                                      Rev. 1

ESFAS RCS Hot Leg Level Instrumentation B 3.3.10 BASES ACTIONS (continued)
To ensure that the flow path remains closed, the flow path shall be isolated by the use of one of the specified means (Required Action D.1.2.1) or the flow path shall be verified to be isolated (Required Action D.1.2.2). A means of isolating the affected flow path includes one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured, within 7 days. If one of the Required Action D.1.2.1 specified isolation means is not used, Required Action D.1.2.2 requires verifying the affected flow path is isolated once per 7 days.
These Required Actions are modified by a Note allowing the affected flow path to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way the flow path can be rapidly isolated when a need for flow path isolation is indicated.
If the flow path cannot be isolated in accordance with Required Actions D.1.1, D.1.2.1 and D.1.2.2, the plant must be placed in a MODE in which the likelihood and consequences of an event are minimized.
Required Action D.2 requires initiation of action, within 12 hours, to establish a pressurizer level above the P-12 (Pressurizer Level) interlock.
This helps maintain RCS inventory in the event of a LOCA. The 12 hour Completion Time is a reasonable time to prepare activities in an orderly manner without challenging plant systems.
E.1 If the Required Action and associated Completion Time of Condition A are not met for Function 2 in Table 3.3.10-1, the plant must be placed in a condition where the instrumentation Function for valve isolation is no longer needed. This is accomplished by immediately initiating action to establish the reactor cavity water level  23 feet above the top of the reactor vessel flange.
Required Action E.1 minimizes the consequences of an event by providing additional inventory.
AP1000 STS                                B 3.3.10-4                                       Rev. 1

ESFAS RCS Hot Leg Level Instrumentation B 3.3.10 BASES SURVEILLANCE SR 3.3.10.1 REQUIREMENTS This SR is the performance of a CHANNEL CALIBRATION every 24 months or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor and the integrated protection cabinets (IPCs). The test is performed in accordance with the SP. If the actual setting of the channel is found to be outside the as-found tolerance, the channel is considered inoperable.
This condition of the channel will be further evaluated during performance of the SR. This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance), and evaluating the channels response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.
Transmitter calibration must be performed consistent with the assumptions of the setpoint methodology. The difference between the current as-found values and the previous as-left values must be consistent with the transmitter drift allowance used in the setpoint methodology.
Interlocks implicitly required to support the Function's OPERABILITY are also addressed by this CHANNEL CALIBRATION. This portion of the CHANNEL CALIBRATION ensures the associated Function is not bypassed when required to be enabled. This can be accomplished by ensuring the interlocks are calibrated properly in accordance with the SP.
If the interlock is not automatically functioning as designed, the condition is entered into the Corrective Action Program and appropriate OPERABILITY evaluations performed for the affected Function. The affected Functions OPERABILITY can be met if the interlock is manually enforced to properly enable the affected Function. When an interlock is not supporting the associated Functions OPERABILITY at the existing plant conditions, the affected Function's channels must be declared inoperable and appropriate ACTIONS taken.
The setpoint methodology requires that 30 months drift be used (1.25 times the Surveillance calibration interval, 24 months).
The Frequency is based on operating experience and consistency with the refueling cycle.
This Surveillance Requirement is modified by a Note. The Note states that this test should include verification that the time constants are adjusted to within limits.
AP1000 STS                           B 3.3.10-5                                      Rev. 1

ESFAS RCS Hot Leg Level Instrumentation B 3.3.10 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.10.2 This SR ensures the individual channel ESF RESPONSE TIME is less than or equal to the maximum value assumed in the accident analysis.
Individual component response times are not modeled in the analyses.
The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the NTS value at the sensor, to the point at which the equipment reaches the required functional state (e.g., valves in full open or closed position).
In lieu of measurement, the response time for the protection and safety monitoring system equipment is based on allocated values (Ref. 6). The overall response time may be determined by a series of overlapping tests and allocated values such that the entire response time is verified, with the resulting verified response time compared to the appropriate FSAR Chapter 7 (Ref. 5) response time.
Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the allocated sensor, signal processing and actuation logic response times, where approved, with actual response time tests on the remainder of the channel. Allocations for signal processing and actuation logic response times may be obtained from the Protection and Safety Monitoring System Functional Requirements document.
ESF RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS. Testing of the devices is included in the testing of each channel. The final actuation device in one train is tested with each channel. Therefore, staggered testing results in response time verification of these devices every 24 months. The 24 month Frequency is consistent with the typical refueling cycle and is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.
AP1000 STS                             B 3.3.10-6                                     Rev. 1

ESFAS RCS Hot Leg Level Instrumentation B 3.3.10 BASES REFERENCES 1. FSAR Chapter 15, Accident Analyses.
: 2. APP-GW-GSC-020, Technical Specification Completion Time and Surveillance Frequency Justification.
: 3. APP-GW-GLR-004, Rev. 0, AP1000 Shutdown Evaluation Report, July 2002.
: 4. FSAR Chapter 19, Probabilistic Risk Assessment, Appendix 19E, Shutdown Evaluation.
: 5. FSAR Chapter 7, Instrumentation and Controls.
: 6. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos. 168 and 166 to the Combined License Nos. NPF 91 and NPF-92, respectively, Vogtle Electric Generating Plant Units 3 and 4, Docket Nos. 52-025 and 52-026, dated November 21, 2019 [ML19297C988 (Proprietary) and ML19297D159 (non proprietary)].
AP1000 STS                    B 3.3.10-7                                    Rev. 1

ESFAS Startup Feedwater Flow Instrumentation B 3.3.11 B 3.3 INSTRUMENTATION B 3.3.11 Engineered Safety Feature Actuation System (ESFAS) Startup Feedwater Flow Instrumentation BASES BACKGROUND            A description of the ESFAS Instrumentation is provided in the Bases for LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS)
Instrumentation.
APPLICABLE            The required channels of ESFAS instrumentation provide plant protection SAFETY                in the event of any of the analyzed accidents (Ref. 1). ESFAS protective ANALYSES, LCO,        functions include Passive Residual Heat Removal (PRHR) Heat and APPLICABILITY     Exchanger (HX) Actuation. A description of the PRHR HX Actuation ESFAS protective function is provided in the Bases for LCO 3.3.8.
PRHR is actuated when the Steam Generator (SG) Narrow Range Water Level reaches its Low 2 setpoint (LCO 3.3.8, Function 20) coincident with an indication of low Startup Feedwater Flow.
Startup Feedwater Flow  Low 2 uses a one-out-of-two logic on each of the two startup feedwater lines. These two startup feedwater line Functions are required to be OPERABLE in MODES 1, 2, and 3 and in MODE 4 when the Reactor Coolant System (RCS) is not being cooled by the Normal Residual Heat Removal System (RNS). This ensures that PRHR can be actuated in the event of a loss of the normal heat removal systems. In MODE 4 when the RCS is being cooled by the RNS, and in MODES 5 and 6, the steam generators (SGs) are not required to provide the normal RCS heat sink. Therefore, startup feedwater flow is not required, and PRHR actuation on Low 2 startup feedwater flow coincident with an SG Narrow Range Water Level  Low 2 signal is not required.
ESFAS Startup Feedwater Flow instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS               A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each startup feedwater line. The Completion Time(s) of the inoperable equipment of each startup feedwater line Function will be tracked separately for each Function starting from the time the Condition was entered for that Function. Because the required channels are specified on a per startup feedwater line basis, separate Condition entry is allowed for each startup feedwater line.
AP1000 STS                                  B 3.3.11-1                                     Rev. 1

ESFAS Startup Feedwater Flow Instrumentation B 3.3.11 BASES ACTIONS (continued)
In the event a channels as-found condition is outside the as-found tolerance described in the Setpoint Program (SP), or the channel is not functioning as required, or the transmitter, or the Protection and Safety Monitoring System Division, associated with a specific Function is found inoperable, then all affected protection Functions supported by or dependent on that channel must be declared inoperable and the LCO Condition(s) entered for the particular protection Function(s) affected.
A.1 With one or more startup feedwater lines with one startup feedwater channel inoperable, the inoperable channel must be placed in a trip condition within 6 hours. If one channel is tripped, the coincidence logic condition is satisfied so that PRHR actuation will occur on a SG Narrow Range Water Level  Low signal. The specified Completion Time is reasonable considering the time required to complete this action.
B.1 and B.2 If the Required Action and associated Completion Time of Condition A are not met or if one or more startup feedwater lines has two channels inoperable, the plant must be placed in a MODE in which the LCO does not apply. This is accomplished by placing the plant in MODE 3 within 6 hours and in MODE 4 with the RCS being cooled by the RNS within 24 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
SURVEILLANCE       SR 3.3.11.1 REQUIREMENTS This SR is the performance of a CHANNEL CALIBRATION every 24 months or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor and the integrated protection cabinets (IPCs). The test is performed in accordance with the SP. If the actual setting of the channel is found to be outside the as-found tolerance, the channel is considered inoperable.
This condition of the channel will be further evaluated during performance of the SR. This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance), and evaluating the channels response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance.
AP1000 STS                               B 3.3.11-2                                      Rev. 1

ESFAS Startup Feedwater Flow Instrumentation B 3.3.11 BASES SURVEILLANCE REQUIREMENTS (continued)
After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.
Transmitter calibration must be performed consistent with the assumptions of the setpoint methodology. The difference between the current as-found values and the previous as-left values must be consistent with the transmitter drift allowance used in the setpoint methodology.
The setpoint methodology requires that 30 months drift be used (1.25 times the Surveillance calibration interval, 24 months).
The Frequency is based on operating experience and consistency with the refueling cycle.
This Surveillance Requirement is modified by a Note. The Note states that this test should include verification that the time constants are adjusted to within limits where applicable.
SR 3.3.11.2 This SR ensures the individual channel ESF RESPONSE TIME is less than or equal to the maximum value assumed in the accident analysis.
Individual component response times are not modeled in the analyses.
The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the NTS value at the sensor, to the point at which the equipment reaches the required functional state (e.g., valves in full open or closed position).
In lieu of measurement, the response time for the protection and safety monitoring system equipment is based on allocated values (Ref. 4). The overall response time may be determined by a series of overlapping tests and allocated values such that the entire response time is verified, with the resulting verified response time compared to the appropriate FSAR Chapter 7 (Ref. 3) response time.
Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the allocated sensor, signal processing and actuation logic response times, where approved, with actual response time tests on the remainder of the channel.
AP1000 STS                            B 3.3.11-3                                       Rev. 1

ESFAS Startup Feedwater Flow Instrumentation B 3.3.11 BASES SURVEILLANCE REQUIREMENTS (continued)
ESF RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS. Testing of the devices is included in the testing of each channel. The final actuation device in one train is tested with each channel. Therefore, staggered testing results in response time verification of these devices every 24 months. The 24 month Frequency is consistent with the typical refueling cycle and is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.
REFERENCES      1. FSAR Chapter 15, Accident Analyses.
: 2. APP-GW-GSC-020, Technical Specification Completion Time and Surveillance Frequency Justification.
: 3. FSAR Chapter 7, Instrumentation and Controls.
: 4. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos. 168 and 166 to the Combined License Nos. NPF 91 and NPF-92, respectively, Vogtle Electric Generating Plant Units 3 and 4, Docket Nos. 52-025 and 52-026, dated November 21, 2019 [ML19297C988 (Proprietary) and ML19297D159 (non proprietary)].
AP1000 STS                            B 3.3.11-4                                      Rev. 1

ESFAS Reactor Trip Initiation B 3.3.12 B 3.3 INSTRUMENTATION B 3.3.12 Engineered Safety Feature Actuation System (ESFAS) Reactor Trip Initiation BASES BACKGROUND          A description of the ESFAS Instrumentation is provided in the Bases for LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS)
Instrumentation.
APPLICABLE          The required channels of ESFAS instrumentation provide plant protection SAFETY              in the event of any of the analyzed accidents (Ref. 1). ESFAS protective ANALYSES, LCO,      Functions include the ESFAS Reactor Trip Initiation (P-4) Function.
and APPLICABILITY There are eight reactor trip breakers (RTBs) with two breakers in each of four divisions. The P-4 interlock is enabled when the breakers in two-out-of-four divisions are open. Additionally, the P-4 interlock is enabled by all Automatic Reactor Trip Actuations. Additional discussion of P-4 interlock support for ESFAS systems is in the Bases for LCO 3.3.8.
Once enabled, the P-4 interlock initiates the following actions:
* Main turbine trip
* Boron dilution block (closes the two isolation valves in the demineralized water system supply line to the makeup pump suction control valve)
* CVS makeup isolation (closes the two makeup line containment isolation motor-operated valves) if coincident with a Steam Generator (SG) Narrow Range Water Level  High voting logic output signal (LCO 3.3.8 Function 22) for either SG to limit primary-to-secondary leakage to the affected SG following an SGTR event
* Startup feedwater isolation (closes control and isolation valves and trips startup feedwater pump) if coincident with a SG Narrow Range Water Level  High voting logic output signal (LCO 3.3.8 Function 22) for either SG
* Main feedwater isolation if coincident with a Reactor Coolant System (RCS) Average Temperature (Tavg)  Low 2 voting logic output signal (LCO 3.3.8 Function 13) (Even though this function is not assumed in the safety analysis, it is included in the technical specifications.)
AP1000 STS                                B 3.3.12-1                                         Rev. 1

ESFAS Reactor Trip Initiation B 3.3.12 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. Therefore, this RTB position switch interlock has no adjustable trip setpoint.
Three divisions of this interlock must be OPERABLE and in the correct (disabled) state in MODES 1, 2, 3, and 4 when the reactor may be critical or approaching criticality. This ensures that a single failure will not prevent the protective function, nor will it cause the protective function (with the exception of a limited number of PMS component failures). These MODES (MODES 1, 2, 3, and 4) are also consistent with the Applicability of the various ESFAS Instrument Functions to which the P-4 interlock provides input.
The P-4 Function to trip the main turbine supports the required alternate downstream isolation of each main steam line flow path into the high pressure turbine as required by LCO 3.7.2, Main Steam Line Flow Path Isolation Valves, in MODES 1, 2, 3, and 4.
The P-4 Function does not have to be OPERABLE in MODE 4 or 5 to block boron dilution, because LCO 3.3.8 Function 17, Source Range Neutron Flux Doubling, provides the required block. In MODE 6, the P-4 interlock with the Boron Dilution Block Function is not required, since the unborated water source flow path isolation valves are locked closed in accordance with LCO 3.9.2, Unborated Water Source Flow Paths.
ESFAS Reactor Trip Initiation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS         A.1 With one required division inoperable, the affected division must be restored to OPERABLE status within 6 hours.
Condition A applies to one inoperable required division of the P-4 Interlock. With one required division inoperable, the two remaining OPERABLE divisions are capable of providing the required interlock function, but without a single failure. The P-4 Interlock is enabled when RTBs in two divisions are detected as open. The status of the other inoperable, non-required P-4 division is not significant, since P-4 divisions cannot be tripped or bypassed. In order to provide single failure tolerance, three required divisions must be OPERABLE.
AP1000 STS                            B 3.3.12-2                                         Rev. 1

ESFAS Reactor Trip Initiation B 3.3.12 BASES ACTIONS (continued)
The 6 hours allowed to restore the inoperable division is reasonable based on the capability of the remaining OPERABLE divisions to mitigate all DBAs and the low probability of an event occurring during this interval.
B.1, B.2, and B.3 If the Required Action and associated Completion Time Condition A are not met, or if two or three required divisions are inoperable, the plant must be placed in a MODE in which the likelihood and consequences of an event are minimized.
Under these circumstances, the affected isolation valve(s) must be declared inoperable immediately, per Required Action B.1.
Declaring the affected isolation valve inoperable allows the supported systems LCO ACTIONS (i.e., for inoperable valves) to dictate the required measures. The respective isolation valve LCO provides appropriate ACTIONS for the inoperable components.
Required Action B.1 is in accordance with LCO 3.0.6, which requires that the applicable Conditions and Required Actions for the isolation valves declared inoperable shall be entered in accordance with LCO 3.0.2. Additionally, Required Action B.2 requires that the plant must be brought to MODE 3 within 6 hours and Required Action B.3 requires that the plant be brought to MODE 4 in 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
SURVEILLANCE      SR 3.3.12.1 REQUIREMENTS SR 3.3.12.1 is the performance of a TADOT of the blocks for the reactor trip (P-4) input from the integrated protection cabinets (IPCs). This TADOT is performed every 24 months.
The Frequency is based on the known reliability of the Engineered Safety Features (ESF) Function and the multichannel redundancy available, and has been shown to be acceptable through operating experience.
REFERENCES        1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                               B 3.3.12-3                                      Rev. 1

ESFAS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization B 3.3.13 B 3.3 INSTRUMENTATION B 3.3.13 Engineered Safety Feature Actuation System (ESFAS) Main Control Room Isolation and Air Supply Initiation, and Electrical Load De-energization BASES BACKGROUND           A description of the ESFAS Instrumentation is provided in the Bases for LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS)
Instrumentation.
APPLICABLE           A description of the Main Control Room (MCR) Isolation and Air Supply SAFETY               Initiation, and Electrical Load De-energization is also provided in the ANALYSES, LCO,       Bases for LCO 3.3.8. The ESFAS instrumentation Functions required by and APPLICABILITY    this LCO, as presented in Table 3.3.13-1, include:
: 1. Main Control Room Air Supply Iodine or Particulate Radiation High 2 Two radiation monitoring channels are provided on the main control room (MCR) air intake. Each MCR Air Supply Iodine or Particulate Radiation monitoring channel requires both the iodine radiation monitor and the particulate radiation monitor to be OPERABLE for the MCR Air Supply Iodine or Particulate Radiation channel to be OPERABLE. If either MCR Air Supply Iodine or Particulate Radiation channel exceeds the High 2 setpoint, main control room isolation, air supply initiation, and electrical load de-energization are actuated. Two channels of the Main Control Room Air Supply Iodine or Particulate Radiation  High 2 Function (each with both the iodine and particulate monitors) are required to be OPERABLE in MODES 1, 2, 3, and 4, and during movement of irradiated fuel because of the potential for a fission product release following a fuel handling accident, or other DBA (Ref. 1).
The MCR Air Supply Iodine or Particulate Radiation  High 2 channels are not required to be OPERABLE if the Main Control Room Envelope (MCRE) is isolated and the Main Control Room Emergency Habitability System (VES) is in operation. In the event of a Class 1E 24-hour battery charger undervoltage signal, the MCRE is isolated, the VES is initiated, and the MCR air supply radiation monitor sample pumps are de-energized to conserve battery capacity. With the MCR air supply radiation monitor sample pumps de-energized, the MCR Air Supply Iodine or Particulate Radiation High 2 function would be inoperable. Whenever both the MCRE has been isolated (VBS cannot supply air flow to the MCR) and the VES AP1000 STS                                   B 3.3.13-1                                        Rev. 1

ESFAS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization B 3.3.13 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) is providing pressurization and breathing air to the MCRE, the safety function of the MCR Air Supply Iodine or Particulate Radiation High 2 channels is not required.
: 2. Main Control Room Differential Pressure  Low Two differential pressure sensors monitors are provided for the MCR pressure boundary. If either sensor exceeds the Low setpoint for greater than 10 minutes, MCR isolation, air supply initiation, and electrical load de-energization are actuated. Two channels of the MCR Differential Pressure  Low Function are required to be OPERABLE in MODES 1, 2, 3, and 4, and during movement of irradiated fuel because of the potential for a fission product release following a fuel handling accident, or other DBA.
: 3. Class 1E 24-hour Battery Charger Undervoltage Two undervoltage sensors are provided on the input to each of the four 24-hour battery charger inputs. The MCR isolation, air supply initiation, and electrical load de-energization is actuated by an undervoltage condition on the Class 1E 24-hour battery chargers for greater than 10 minutes. The logic is based on a two-out-of-two undervoltage to the 24-hour battery charger for division A or C coincident with an undervoltage to the 24-hour battery chargers for division B or D. When the undervoltage to Class 1E 24-hour battery chargers signal is present the MCR air supply radiation monitor sample pumps are de-energized.
Two channels per Class 1E 24-hour battery charger are required to be OPERABLE in MODES 1, 2, 3, 4, 5, and 6, and during movement of irradiated fuel assemblies because in the result of a loss of ac power event, the MCR air supply radiation monitor sample pumps are required to be de-energized to conserve battery capacity, maintain room temperature below the equipment qualification limitation, and maintain the assumed heat load for MCR habitability.
ESFAS MCR isolation, Air Supply Initiation, and Electrical Load De-energization instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS           In the event a channels as-found condition is outside the as-found tolerance described in the Setpoint Program (SP), or the channel is not AP1000 STS                               B 3.3.13-2                                      Rev. 1

ESFAS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization B 3.3.13 BASES ACTIONS (continued) functioning as required, or the transmitter, or the Protection and Safety Monitoring System (PMS) division, associated with a specific Function is found inoperable, then all affected protection Functions supported by or dependent on that channel must be declared inoperable and the LCO Condition(s) entered for the particular protection Function(s) affected.
A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function (i.e., Main Control Room Air Supply Iodine or Particulate Radiation  High 2, Main Control Room Differential Pressure  Low), and Class 1E 24-Hour Battery Charger Undervoltage). The Completion Time(s) of the inoperable Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
A.1 Condition A addresses one or more Functions with one or more channels inoperable. In this case, the Required Action is to enter the Condition referenced in Table 3.3.13-1 immediately.
B.1 and B.2 Required Action B.1 verifies that one channel in the affected Function is OPERABLE. The Completion Time for Required Action B.1 is immediately because if two channels are inoperable then the Required Actions of Condition D are also applicable. With one channel inoperable, in either or both of Functions 1 and 2, in MODE 1, 2, 3, or 4, the logic becomes one-out-of-one in the affected Function and is unable to meet the single failure criterion.
Required Action B.2 requires that the main control room isolation, air supply initiation, and electrical load de-energization manual controls must be verified to be functional within 72 hours. These provisions for operator action can replace one channel of radiation detection and system actuation. The 72 hour Completion Time is reasonable considering that there is one remaining OPERABLE channel and the low probability of an event occurring during this interval.
C.1 and C.2 Required Action C.1 verifies that one channel in the affected Function is OPERABLE. The Completion Time for Required Action C.1 is AP1000 STS                               B 3.3.13-3                                      Rev. 1

ESFAS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization B 3.3.13 BASES ACTIONS (continued) immediately because if two channels are inoperable then the Required Actions of Condition E are also applicable. With one channel inoperable during movement of irradiated fuel assemblies, the system level initiation capability is reduced below that required to meet the single failure criterion. The required channel must be returned to OPERABLE status within 72 hours. The specified Completion Time is reasonable considering the remaining channel is capable of performing the initiation.
D.1 and D.2 If the Required Action and associated Completion Time of Condition B are not met, the plant must be placed in a MODE in which the LCO does not apply. This is accomplished by placing the plant in MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
E.1 If the Required Action and associated Completion Time of Condition C are not met, the plant must be placed in a MODE in which the LCO does not apply. This is accomplished by immediately suspending movement of irradiated fuel assemblies. This Required Action suspends activities with potential for releasing radioactivity that might enter the Main Control Room. This action does not preclude the movement of fuel to a safe position.
F.1, F.2.1, and F.2.2 Required Action F.1 allows the inoperable channel to be placed in a trip condition within 6 hours. The Completion Time of 6 hours to place the inoperable channel in trip is reasonable considering the time required to complete this action. Once an inoperable channel is placed in trip, single failure capability of the action is restored and no additional action is required for the inoperable channel. If more than one channel is inoperable at a time, the configuration of inoperable channels in the trip condition may generate an undesirable Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization and de-energize the MCR air supply radiation monitor sample pumps. Therefore, one or more inoperable channels may be left untripped by optionally complying with Required Actions F.2.1 and F.2.2.
AP1000 STS                                 B 3.3.13-4                                       Rev. 1

ESFAS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization B 3.3.13 BASES ACTIONS (continued)
In place of Required Action F.1, the Required Actions F.2.1 and F.2.2 may be performed. Required Action F.2.1 is to verify that actuation capability is maintained. In order to verify actuation capability is maintained, the combination of channels either in trip or OPERABLE must be able to maintain the actuation capability with an undervoltage to the 24-hour battery chargers for divisions A or C coincident with an undervoltage to the 24-hour battery chargers for divisions B or D.
Performing the Required Action F.2.1 within the 6 hour Completion Time is a reasonable time to verify that actuation capability is maintained.
Required Action F.2.2 also requires restoring the channel to OPERABLE status within 7 days. This reflects a reasonable time to effect restoration of the single failure capability of the undervoltage actuation function.
Condition F is modified by a Note that states separate Condition entry is allowed for each channel. The Required Actions provide appropriate compensatory actions for each inoperable channel. Complying with the Required Actions may allow for continued operation, and subsequent inoperable channels are governed by subsequent Condition entry and application of associated Required Actions. The Completion Time(s) of the inoperable channel will be tracked separately for each channel starting from the time the Condition was entered for that channel.
G.1 If a Required Action and associated Completion Time of Condition F are not met, the plant must be placed in a Condition in which the likelihood and consequences of an event are minimized. This is accomplished by de-energizing both main control room air supply radiation monitor sample pumps within 6 hours. This allowed Completion Time is reasonable considering the time required to complete this action. Note that de-energizing main control room air supply radiation monitor sample pumps results in inoperability of the Main Control Room Air Supply Iodine or Particulate Radiation  High 2 channels and the need to enter other applicable Conditions.
SURVEILLANCE       The SRs for each ESFAS Main Control Room Isolation, Air Supply REQUIREMENTS       Initiation, and Electrical Load De-energization instrumentation Function are identified in the SRs column of Table 3.3.13-1 for that Function. A Note has been added to the SR table stating that Table 3.3.13-1 determines which SRs apply to which ESFAS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization instrumentation Function.
AP1000 STS                                B 3.3.13-5                                      Rev. 1

ESFAS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization B 3.3.13 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.13.1 This SR is the performance of a CHANNEL CALIBRATION every 24 months or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor and the integrated protection cabinets (IPCs). The test is performed in accordance with the SP. If the actual setting of the channel is found to be outside the as-found tolerance, the channel is considered inoperable.
This condition of the channel will be further evaluated during performance of the SR. This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance), and evaluating the channels response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.
Transmitter calibration must be performed consistent with the assumptions of the setpoint methodology. The difference between the current as-found values and the previous as-left values must be consistent with the transmitter drift allowance used in the setpoint methodology.
The setpoint methodology requires that 30 months drift be used (1.25 times the Surveillance calibration interval, 24 months).
The Frequency is based on operating experience and consistency with the refueling cycle.
This SR is modified by a Note. The Note states that this test should include verification that the time constants are adjusted to within limits where applicable.
SR 3.3.13.2 This SR ensures the individual channel ESF RESPONSE TIME is less than or equal to the maximum value assumed in the accident analysis.
Individual component response times are not modeled in the analyses.
The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the NTS value at the sensor, to the point at which the equipment reaches the required functional state (e.g., valves in full open or closed position).
AP1000 STS                               B 3.3.13-6                                       Rev. 1

ESFAS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization B 3.3.13 BASES SURVEILLANCE REQUIREMENTS (continued)
In lieu of measurement, the response time for the protection and safety monitoring system equipment is based on allocated values (Ref. 4). The overall response time may be determined by a series of overlapping tests and allocated values such that the entire response time is verified, with the resulting verified response time compared to the appropriate FSAR Chapter 7 (Ref. 3) response time.
Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the allocated sensor, signal processing and actuation logic response times, where approved, with actual response time tests on the remainder of the channel. Allocations for signal processing and actuation logic response times may be obtained from the Protection and Safety Monitoring System functional requirements.
ESF RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS. Testing of the devices is included in the testing of each channel. The final actuation device in one train is tested with each channel. Therefore, staggered testing results in response time verification of these devices every 24 months. The 24 month Frequency is consistent with the typical refueling cycle and is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.
REFERENCES        1. FSAR Chapter 15, Accident Analyses.
: 2. APP-GW-GSC-020, Technical Specification Completion Time and Surveillance Frequency Justification.
: 3. FSAR Chapter 7, Instrumentation and Controls.
: 4. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos. 168 and 166 to the Combined License Nos. NPF-91 and NPF-92, respectively, Vogtle Electric Generating Plant Units 3 and 4, Docket Nos. 52-025 and 52-026, dated November 21, 2019 [ML19297C988 (Proprietary) and ML19297D159 (non-proprietary)].
AP1000 STS                              B 3.3.13-7                                       Rev. 1

ESFAS IRWST and Spent Fuel Pool Level Instrumentation B 3.3.14 B 3.3 INSTRUMENTATION B 3.3.14 Engineered Safety Feature Actuation System (ESFAS) In-containment Refueling Water Storage Tank (IRWST) and Spent Fuel Pool Level Instrumentation BASES BACKGROUND          A description of the ESFAS Instrumentation is provided in the Bases for LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS)
Instrumentation.
APPLICABLE          The required channels of ESFAS IRWST and Spent Fuel Pool Level SAFETY              Instrumentation provide plant protection in the event of a leak in the ANALYSES, LCO,      non-safety related Spent Fuel Pool Cooling System (SFS). A description and APPLICABILITY   of the ESFAS P-9 (Tavg) interlock is provided in the Bases for TS 3.3.8. A description of the two SFS penetration flow paths is provided in the Bases for TS 3.7.13.
The following are descriptions of the individual instrument Functions required by this LCO as presented in Table 3.3.14-1.
: 1. Spent Fuel Pool Level  Low 2 Three spent fuel pool level channels are provided. If any two spent fuel pool level channels decrease to below the Low 2 setpoint, Refueling Cavity and SFS Isolation is actuated closing the SFS containment isolation valves to terminate draining of the refueling cavity before reducing the combined IRWST and refueling cavity water inventory below the minimum volume required to provide adequate decay heat removal in MODE 6. With refueling cavity and spent fuel pool volumes in communication in MODE 6, the spent fuel pool level is the same as the refueling cavity, so Refueling Cavity and SFS Isolation on Spent Fuel Pool Level  Low 2 also terminates draining of the spent fuel pool. In MODE 6 with refueling cavity and spent fuel pool volumes not in communication, SR 3.5.8.3 requires the SFS containment isolation valves to be maintained closed, except under administrative controls. With the SFS containment isolation valves closed, the non-safety related SFS is isolated from the IRWST and refueling cavity, and a leak in the SFS does not cause draining of the IRWST and refueling cavity. Three channels of ESFAS Spent Fuel Pool Level  Low 2 Function are required to be OPERABLE in MODE 6 with refueling cavity and spent fuel pool volumes in communication.
AP1000 STS                                B 3.3.14-1                                       Rev. 1

ESFAS IRWST and Spent Fuel Pool Level Instrumentation B 3.3.14 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: 2. IRWST Wide Range Level  Low Two IRWST wide range level channels are provided. If either IRWST wide range level channel decreases to below the Low setpoint, Refueling Cavity and SFS Isolation is actuated closing the SFS containment isolation valves to terminate draining of the IRWST before reducing the IRWST water inventory below the minimum volume required to mitigate the consequences of a design basis event in MODES 1, 2, 3, and 4. The IRWST Wide Range Level Low isolation signal can be manually blocked by the main control room operator when below the P-9 setpoint, and is automatically unblocked when above the P-9 setpoint. This block is necessary to permit IRWST volume to be transferred under administrative control to and from the refueling cavity during MODE 6 with refueling cavity and spent fuel pool volumes not in communication. In MODE 5 and in MODE 6 with refueling cavity and spent fuel pool volumes not in communication, the isolation valves are maintained closed, except under administrative controls as required by SR 3.5.7.1 and SR 3.5.8.3. In MODE 6 with refueling cavity and spent fuel pool volumes in communication, the Spent Fuel Pool Level  Low 2 isolation signal provides protection. Two channels of IRWST Wide Range Level  Low are required to be OPERABLE in MODES 1, 2, 3, and 4.
ESFAS IRWST and Spent Fuel Pool Level instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS         A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.14-1.
In the event a channels as-found condition is outside the as-found tolerance described in the Setpoint Program (SP), or the channel is not functioning as required, or the transmitter, or the Protection and Safety Monitoring System (PMS) division, associated with a specific Function is found inoperable, then all affected protection Functions supported by or dependent on that channel must be declared inoperable and the LCO Condition(s) entered for the particular protection Function(s) affected.
AP1000 STS                            B 3.3.14-2                                      Rev. 1

ESFAS IRWST and Spent Fuel Pool Level Instrumentation B 3.3.14 BASES ACTIONS (continued)
A.1 Condition A addresses the situation where one spent fuel pool level channel is inoperable. With one spent fuel pool level channel inoperable, the inoperable channel must be placed in a trip condition within 6 hours. If one of the three spent fuel pool level channels is tripped, the logic becomes one-out-of-two, while still meeting the single failure criterion.
The specified Completion Time is reasonable considering the time required to complete this action.
B.1, B.2.1 and B.2.2 If the Required Action and associated Completion Time of Condition A are not met, or one or more IRWST level channels are inoperable or two or more spent fuel pool level channels are inoperable, the plant must be placed in a condition where the instrumentation Function for valve isolation is no longer applicable. To achieve this, the affected flow path(s) must be isolated within 24 hours.
Additionally, to assure that the penetration flow paths remain closed, the penetration flow paths shall be isolated by the use of one of the specified means (Required Action B.2.1) or the penetration flow paths shall be verified to be isolated (Required Action B.2.2). A means of isolating the penetration flow paths includes one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured within 7 days. If one of the Required Action B.2.1 specified isolation means is not used, the penetration flow paths shall be verified to be isolated once per 7 days.
This action is modified by a Note allowing the penetration flow path(s) to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room.
In this way the penetration flow path(s) can be rapidly isolated when a need for flow path isolation is indicated.
C.1 If a Required Action and associated Completion Time of Condition B are not met, the IRWST must be declared inoperable immediately. Declaring the IRWST inoperable allows the supported system Required Actions (i.e., depending on the MODE, LCO 3.5.6, In-containment AP1000 STS                              B 3.3.14-3                                       Rev. 1

ESFAS IRWST and Spent Fuel Pool Level Instrumentation B 3.3.14 BASES ACTIONS (continued)
Refueling Water Storage Tank (IRWST)  Operating, or LCO 3.5.8, In-containment Refueling Water Storage Tank (IRWST)  Shutdown, MODE 6) to dictate the required measures. The IRWST LCO(s) provide appropriate Required Actions for the inoperability of the IRWST and Spent Fuel Pool Level Instrumentation. This action is in accordance with LCO 3.0.6, which requires entering the applicable Conditions and Required Actions for the IRWST declared inoperable in accordance with LCO 3.0.2.
SURVEILLANCE       SR 3.3.14.1 REQUIREMENTS This SR is the performance of a CHANNEL CALIBRATION every 24 months or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor and the integrated protection cabinets (IPCs). The test is performed in accordance with the SP. If the actual setting of the channel is found to be outside the as-found tolerance, the channel is considered inoperable.
This condition of the channel will be further evaluated during performance of the Surveillance. This evaluation will consist of adjusting the channel trip setting to the NTS (within the allowed as-left tolerance), and evaluating the channels response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation. Transmitter calibration must be performed consistent with the assumptions of the setpoint methodology. The difference between the current as-found values and the previous as-left values must be consistent with the transmitter drift allowance used in the setpoint methodology.
The setpoint methodology requires that 30 months drift be used (1.25 times the Surveillance calibration interval, 24 months).
The Frequency is based on operating experience and consistency with the refueling cycle.
This Surveillance Requirement is modified by a Note. The Note states that this test should include verification that the time constants are adjusted to within limits where applicable.
AP1000 STS                               B 3.3.14-4                                       Rev. 1

ESFAS IRWST and Spent Fuel Pool Level Instrumentation B 3.3.14 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.14.2 This SR ensures the individual channel ESF RESPONSE TIME is less than or equal to the maximum value assumed in the accident analysis.
Individual component response times are not modeled in the analyses.
The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the NTS value at the sensor, to the point at which the equipment reaches the required functional state (e.g., valves in full open or closed position).
In lieu of measurement, the response time for the Protection and Safety Monitoring System equipment is based on allocated values (Ref. 1). The overall response time may be determined by a series of overlapping tests and allocated values such that the entire response time is verified, with the resulting verified response time compared to the appropriate FSAR Chapter 7 (Ref. 2) response time.
Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the allocated sensor, signal processing and actuation logic response times, where approved, with actual response time tests on the remainder of the channel. Allocations for signal processing and actuation logic response times may be obtained from the Protection and Safety Monitoring System functional requirements.
ESF RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS. Testing of the devices is included in the testing of each channel. The final actuation device in one train is tested with each channel. Therefore, staggered testing results in response time verification of these devices every 24 months. The 24 month Frequency is consistent with the typical refueling cycle and is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.
AP1000 STS                             B 3.3.14-5                                     Rev. 1

ESFAS IRWST and Spent Fuel Pool Level Instrumentation B 3.3.14 BASES REFERENCES 1. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos. 168 and 166 to the Combined License Nos. NPF-91 and NPF-92, respectively, Vogtle Electric Generating Plant Units 3 and 4, Docket Nos. 52-025 and 52-026, dated November 21, 2019 [ML19297C988 (Proprietary) and ML19297D159 (non-proprietary)].
: 2. FSAR Chapter 7, Instrumentation and Controls.
AP1000 STS                   B 3.3.14-6                                     Rev. 1

ESFAS Actuation Logic - Operating B 3.3.15 B 3.3 INSTRUMENTATION B 3.3.15 Engineered Safety Feature Actuation System (ESFAS) Actuation Logic - Operating BASES BACKGROUND          A description of the ESFAS Instrumentation is provided in the Bases for LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS)
Instrumentation.
APPLICABLE          The required divisions of ESFAS actuation logic provide plant protection SAFETY              in the event of any of the analyzed accidents (Ref.1). ESFAS protective ANALYSES, LCO,      functions include:
and APPLICABILITY ESF Coincidence Logic A description of the Engineered Safety Features (ESF) Coincidence Logic is provided in the Bases for LCO 3.3.8.
ESF Actuation A description of the ESF Actuation Subsystem is provided in the Bases for LCO 3.3.8.
The following are descriptions of the ESFAS actuation logic Functions required by this LCO:
: a. ESF Coincidence Logic This LCO requires four divisions of the ESF coincidence logic Function to be OPERABLE to support automatic actuation. An OPERABLE division has one of its two coincidence logic group subsystems battery backed. If one battery backed coincidence logic group subsystem is OPERABLE in all four divisions, a single failure of one division will not prevent ESF actuations because three divisions will still be available to provide redundant actuation for all ESF Functions. This Function is required to be OPERABLE in MODES 1, 2, 3, and 4. The ESF coincidence logic Function requirements for MODES 5 and 6 are specified by, and discussed in the Bases for, LCO 3.3.16, ESFAS Actuation Logic  Shutdown.
AP1000 STS                                  B 3.3.15-1                                      Rev. 1

ESFAS Actuation Logic - Operating B 3.3.15 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
: b. ESF Actuation This LCO requires that four divisions of the ESF actuation Function be OPERABLE to support both automatic and manual actuation. An OPERABLE ESF actuation subsystem division has one battery backed logic group consisting of one of two integrated logic processor (ILP) subsystems in each integrated logic cabinet (ILC) in the division. If one battery backed logic group is OPERABLE for the ESF actuation subsystem in all four divisions, a single failure will not prevent ESF actuations because ESF actuation subsystems in the other three divisions are still available to provide redundant actuation for ESF Functions. The remaining ILCs in the division with a failed ESF actuation cabinet are still OPERABLE and will provide their ESF Functions. This Function is required to be OPERABLE in MODES 1, 2, 3, and 4. The ESF actuation Function requirements for MODES 5 and 6 are specified by, and discussed in the Bases for, LCO 3.3.16.
ESFAS Actuation Logic  Operating satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS         A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this specification may be entered independently for each Function (i.e., ESF Coincidence Logic and ESF Actuation). The Completion Time(s) of the inoperable equipment of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
A.1 Condition A addresses the situation i one or more ESFAS actuation logic Functions within one division are inoperable. The ESF Coincidence Logic and ESF Actuation subsystem divisions are inoperable when both of their associated battery backed subsystems are inoperable.
With one ESFAS actuation logic division inoperable, the inoperable division must be restored to OPERABLE status within 6 hours. With one division inoperable, the three remaining OPERABLE divisions are capable of mitigating all DBAs, but without a single failure.
The 6 hours allowed to restore the inoperable division is reasonable based on the capability of the remaining OPERABLE divisions to mitigate all DBAs and the low probability of an event occurring during this interval.
AP1000 STS                              B 3.3.15-2                                      Rev. 1

ESFAS Actuation Logic - Operating B 3.3.15 BASES ACTIONS (continued)
B.1 and B.2 If the Required Action and associated Completion Time of Condition A are not met, or one or more ESFAS actuation logic Functions within two or more divisions are inoperable, the plant must be placed in a condition in which the Function is no longer applicable. This is accomplished by placing the plant in MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
SURVEILLANCE       SR 3.3.15.1 REQUIREMENTS This SR demonstrates that the pressurizer heater circuit breakers trip open in response to an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the circuit breakers. The OPERABILITY of the motor control center breakers is checked by opening these breakers using the Plant Control System.
The Frequency of 24 months is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operation. This Frequency is adequate based on the use of multiple circuit breakers to prevent the failure of any single circuit breaker from disabling the function and that all circuit breakers are tested.
This SR is modified by a Note that states that the SR is required to be met only when all four cold leg temperatures are > 275&deg;F.
SR 3.3.15.2 This SR demonstrates that the reactor coolant pump breakers trip open in response to an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the circuit breakers.
AP1000 STS                               B 3.3.15-3                                        Rev. 1

ESFAS Actuation Logic - Operating B 3.3.15 BASES SURVEILLANCE REQUIREMENTS (continued)
The Frequency of 24 months is based on the need to perform this Surveillance during periods when the plant is shutdown for refueling to prevent any upsets of plant operation.
SR 3.3.15.3 This SR demonstrates that the main feedwater and startup feedwater pump breakers trip open in response to an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the circuit breakers.
The Frequency of 24 months is based on the need to perform this Surveillance during periods when the plant is shutdown for refueling to prevent any upsets of plant operation.
SR 3.3.15.4 This SR demonstrates that the auxiliary spray and purification line isolation valves actuate to the isolation position in response to an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves.
The Frequency of 24 months is based on the need to perform this Surveillance during periods when the plant is shutdown for refueling to prevent any upsets of plant operation.
This SR is modified by a Note that states the SR is required to be met only in MODES 1 and 2.
REFERENCES      1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                           B 3.3.15-4                                       Rev. 1

ESFAS Actuation Logic - Shutdown B 3.3.16 B 3.3 INSTRUMENTATION B 3.3.16 Engineered Safety Feature Actuation System (ESFAS) Actuation Logic - Shutdown BASES BACKGROUND          A description of the ESFAS Instrumentation is provided in the Bases for LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS)
Instrumentation.
APPLICABLE          The required divisions of ESFAS actuation logic provide plant protection SAFETY              in the event of any of the analyzed accidents (Ref. 1). ESFAS protective ANALYSES, LCO,      functions include:
and APPLICABILITY ESF Coincidence Logic A description of the Engineered Safety Features (ESF) Coincidence Logic is provided in the Bases for LCO 3.3.8.
ESF Actuation A description of the ESF Actuation Subsystem is provided in the Bases for LCO 3.3.8.
The following are descriptions of the ESFAS actuation logic Functions required by this LCO:
: a. ESF Coincidence Logic This LCO requires four divisions of the ESF coincidence logic Function to be OPERABLE to support automatic actuation. An OPERABLE division has one of its two coincidence logic group subsystems battery backed. If one battery backed coincidence logic group subsystem is OPERABLE in all four divisions, a single failure of one division will not prevent ESF actuations because three divisions will still be available to provide redundant actuation for all ESF Functions.
This Function is required to be OPERABLE in MODES 5 and 6, and during movement of irradiated fuel because of the potential for a fission product release following a fuel handling accident, or other design basis accident (DBA). The LCO is modified by a Note stating that only the divisions necessary to support Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization are required to be OPERABLE during movement of irradiated fuel AP1000 STS                                  B 3.3.16-1                                      Rev. 1

ESFAS Actuation Logic - Shutdown B 3.3.16 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) assemblies when not in MODE 1, 2, 3, 4, 5, or 6. This supports LCO 3.3.13, Engineered Safety Feature Actuation System (ESFAS)
Control Room Air Supply Radiation Instrumentation, actuation of Main Control Room Emergency Habitability System (VES). The ESF coincidence logic Function requirements for MODES 1, 2, 3, and 4 are specified by, and discussed in the Bases for, LCO 3.3.15, ESFAS Actuation Logic  Operating.
: b. ESF Actuation This LCO requires that four divisions of the ESF actuation Function be OPERABLE to support both automatic and manual actuation. An OPERABLE ESF actuation subsystem division has one battery backed logic group consisting of one of two integrated logic processor (ILP) subsystems in each integrated logic cabinet (ILC) in the division. If one battery backed logic group is OPERABLE for the ESF actuation subsystem in all four divisions, a single failure will not prevent ESF actuations because ESF actuation subsystems in the other three divisions are still available to provide redundant actuation for ESF Functions. The remaining ILCs in the division with a failed ESF actuation ILC are still OPERABLE and will provide their ESF Functions.
This Function is required to be OPERABLE in MODES 5 and 6, and during movement of irradiated fuel because of the potential for a fission product release following a fuel handling accident, or other DBA. The LCO is modified by a Note stating that only the divisions necessary to support Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization are required to be OPERABLE during movement of irradiated fuel assemblies when not in MODE 1, 2, 3, 4, 5, or 6. This supports LCO 3.3.13, Engineered Safety Feature Actuation System (ESFAS) Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization, actuation of Main Control Room Emergency Habitability System (VES). The ESF actuation Function requirements for MODES 1, 2, 3, and 4 are specified by, and discussed in the Bases for, LCO 3.3.15.
ESFAS Actuation Logic  Shutdown satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                            B 3.3.16-2                                      Rev. 1

ESFAS Actuation Logic - Shutdown B 3.3.16 BASES ACTIONS    A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function (i.e., ESF Coincidence Logic and ESF Actuation). The Completion Time(s) of the inoperable equipment of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
A.1 Condition A addresses the situation in which one or more ESFAS actuation logic Functions within one division are inoperable. The ESF Coincidence Logic and ESF Actuation subsystem divisions are inoperable when both of their associated battery backed subsystems are inoperable.
With one ESFAS actuation logic division inoperable, the initiation capability is reduced below that required to meet the single failure criterion. Therefore, the required division must be returned to OPERABLE status within 72 hours. The specified Completion Time is reasonable considering that the remaining divisions are capable of performing the associated safety function.
B.1, B.2, and B.3 If the Required Action and associated Completion Time of Condition A are not met in MODE 5, or one or more ESFAS actuation logic Functions within two divisions are inoperable, the plant must be placed in a condition in which the likelihood and consequences of an event are minimized. This is accomplished by immediately suspending positive reactivity additions and initiating action to open the Reactor Coolant System (RCS) pressure boundary and establish  20% pressurizer level (Required Actions B.1 and B.2).
Action must also be immediately initiated to isolate the flow path from the demineralized water storage tank to the RCS by use of one closed and de-activated automatic valve or closed manual valve (Required Action B.3). These requirements minimize the consequences of the loss of decay heat removal by maximizing RCS inventory and maintaining RCS temperature as low as practical. Additionally, the potential for a criticality event is minimized by isolation of the demineralized water storage tank and by suspension of positive reactivity additions.
C.1 and C.2 If the Required Action and associated Completion Time of Condition A are not met in MODE 6, or one or more ESFAS actuation logic Functions AP1000 STS                        B 3.3.16-3                                      Rev. 1

ESFAS Actuation Logic - Shutdown B 3.3.16 BASES ACTIONS (continued) within two or more divisions are inoperable, the plant must be placed in a condition in which the likelihood and consequences of an event are minimized. This is accomplished by immediately initiating action to establish reactor cavity water level  23 feet above the top of the reactor vessel flange and suspending positive reactivity additions. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions in an orderly manner without challenging plant systems.
Required Action C.2 minimizes the consequences of a loss of decay heat removal event by optimizing conditions for RCS cooling in MODE 6 using In Containment Refueling Water Storage Tank injection. Additionally, the potential for a criticality event is minimized by suspension of positive reactivity additions.
D.1 If the Required Action and associated Completion Time of Condition A are not met during movement of irradiated fuel assemblies, or one or more ESFAS actuation logic Functions within two or more divisions are inoperable, the plant must be placed in a condition in which the likelihood and consequences of an event are minimized. Required Action D.1 requires immediately suspending movement of irradiated fuel assemblies.
This required action suspends activities with a potential for releasing radioactivity that might enter the Main Control Room. This action does not preclude the movement of fuel to a safe position.
SURVEILLANCE      SR 3.3.16.1 REQUIREMENTS This SR demonstrates that the reactor coolant pump breakers trip open in response to an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the circuit breakers.
The Frequency of 24 months is based on the need to perform this Surveillance during periods when the plant is shutdown for refueling to prevent any upsets of plant operation.
AP1000 STS                                B 3.3.16-4                                      Rev. 1

ESFAS Actuation Logic - Shutdown B 3.3.16 BASES SURVEILLANCE REQUIREMENTS (continued)
The SR is modified by a Note stating that the SR is required to be met only in MODE 5.
SR 3.3.16.2 This SR demonstrates that the letdown isolation valves in the Chemical and Volume Control System actuate to the isolation position in response to an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the circuit breakers.
The Frequency of 24 months is based on the need to perform this Surveillance during periods when the plant is shutdown for refueling to prevent any upsets of plant operation.
This SR is modified by a Note that states the SR is not required to be met in MODE 5 above the P-12 (Pressurizer Level) interlock. A second Note states that the SR is not required to be met in MODE 6 with water level 23 feet above the top of the reactor vessel flange REFERENCES      1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                            B 3.3.16-5                                     Rev. 1

PAM Instrumentation B 3.3.17 B 3.3 INSTRUMENTATION B 3.3.17 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND          The primary purpose of the PAM Instrumentation is to display unit variables that provide information required by the main control room operators during accident situations. These plant variables provide the necessary information to assess the process of accomplishing or maintaining critical safety functions. The instruments that monitor these variables are designated in accordance with Regulatory Guide 1.97 (Ref. 1).
The OPERABILITY of the PAM instrumentation ensures that sufficient information is available on selected plant parameters to monitor and assess plant status and behavior following an accident. This capability is consistent with the recommendations of Reference 1.
A PAM channel shall extend from the sensor up to the display device, and shall include the sensor (or sensors), the signal conditioning, any associated datalinks, the display device, any signal gathering or processing subsystems, and any data processing subsystems. Note that for digital PAM channels, the information may be displayed on multiple display devices. For this case, the PAM channel shall extend to any available qualified display device. The two OPERABLE channels must be from Protection and Safety Monitoring System (PMS) Divisions B and C, except for valves and electrical breakers powered from the 24 hour battery supplies of the Class 1E DC and Uninterruptible Power Supply System. Once the 24 hour battery supply associated with the actuation signal for these valves and electrical breakers has been exhausted, remote capability for changing the position of these components is lost, and there is no need for further position monitoring.
The instrument channels required to be OPERABLE by this LCO include two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97 as Type A and Category 1 variables. The unit specific implementation of Regulatory Guide 1.97 has not identified any Type A variables; therefore, only Category 1 variables are specified.
AP1000 STS                                B 3.3.17-1                                      Rev. 1

PAM Instrumentation B 3.3.17 BASES BACKGROUND (continued)
Category 1 variables are the key variables deemed risk significant because they are needed to:
* Determine whether other systems important to safety are performing their intended functions; and
* Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release.
APPLICABLE      The PAM Instrumentation ensures that the main control room operating SAFETY          staff can:
ANALYSES
* Determine whether systems important to safety are performing their intended functions;
* Determine the likelihood of a gross breach of the barriers to radioactivity release;
* Determine if a gross breach of a barrier has occurred; and
* Initiate action necessary to protect the public and to estimate the magnitude of any impending threat.
PAM Instrumentation that is required in accordance with Regulatory Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO             The PAM instrumentation LCO provides OPERABILITY requirements for those monitors that provide information required by the main control room operators to assess the process of accomplishing or maintaining critical safety functions. This LCO addresses those Regulatory Guide 1.97 instruments which are listed in Table 3.3.17-1.
The OPERABILITY of the PAM Instrumentation ensures that sufficient information is available on selected plant parameters to monitor and assess plant status following an accident. This capability is consistent with the recommendations of Regulatory Guide 1.97.
AP1000 STS                              B 3.3.17-2                                     Rev. 1

PAM Instrumentation B 3.3.17 BASES LCO (continued)
Category 1 non-type A variables are required to meet Regulatory Guide 1.97, Category 1 (Ref. 1) design and qualification requirements for seismic and environmental qualification, single failure criterion, utilization of emergency standby power, immediately accessible display, continuous readout, and recording of display.
The instrument functions specified in Table 3.3.17-1 are discussed below.
Each of these is a Category 1 variable.
: 1. Intermediate Range Neutron Flux Neutron Flux indication is provided to verify reactor shutdown. The neutron flux intermediate range is sufficient to cover the full range of flux that may occur post accident.
Neutron flux is used for accident diagnosis, verification of subcriticality, and diagnosis of positive reactivity insertion.
2, 3. Reactor Coolant System (RCS) Wide Range Hot and Cold Leg Temperature RCS Hot and Cold Leg Temperatures are provided for verification of core cooling and long term Surveillance. The channels provide indication over a range of 50&deg;F to 700&deg;F.
In addition, RCS cold leg temperature is used in conjunction with RCS hot leg temperature to verify the plant conditions necessary to establish natural circulation in the RCS.
: 4. RCS Pressure RCS wide range pressure is provided for verification of core cooling and RCS integrity long term Surveillance.
: 5. RCS Subcooling RCS Subcooling is calculated from core exit temperature and RCS wide range pressure. RCS Subcooling is provided for verification of core cooling. Subcooling margin is available when the RCS pressure is greater than the saturation pressure corresponding to the core exit temperature.
AP1000 STS                              B 3.3.17-3                                       Rev. 1

PAM Instrumentation B 3.3.17 BASES LCO (continued)
: 6. Containment Water Level Containment Water Level is used to monitor the containment environment during accident conditions. The containment water level can also provide information to the operators that the various stages of safety injection along with system depressurization are progressing.
: 7. Containment Pressure The containment pressure transmitters monitor the containment pressure over the range of -5 to 10 psig. This provides information on post accident containment pressure and containment integrity.
: 8. Containment Pressure (Extended Range)
The extended range containment pressure transmitters are instruments that operators use for monitoring the potential for breach of containment, a fission product barrier. The extended range sensors monitor containment pressure over the range of 0 psig to 240 psig.
: 9. Containment Area Radiation (High Range)
Containment Area Radiation is provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans.
: 10. Pressurizer Level and Associated Reference Leg Temperature Pressurizer level is provided to monitor the RCS coolant inventory.
During an accident, operation of the safeguards systems can be verified based on coolant inventory indicators.
The reference leg temperature is included in the Technical Specification since it is used to compensate the level signal. The pressurizer instruments for RCS wide range pressure and pressurizer pressure also provide input to compensate the level signal.
AP1000 STS                           B 3.3.17-4                                      Rev. 1

PAM Instrumentation B 3.3.17 BASES LCO (continued)
: 11. In-Containment Refueling Water Storage Tank (IRWST) Wide Range Water Level The IRWST provides a long term heat sink for non-loss-of-coolant accident (non-LOCA) events and is a source of injection flow for LOCA events. When the IRWST is a heat sink, the level will change due to increased volume associated with the temperature increase.
When saturation temperature is reached, the IRWST will begin steaming and initially lose mass to the containment atmosphere until condensation occurs on the steel containment shell which is cooled by the Passive Containment Cooling System (PCS). The condensate is returned to the IRWST via a gutter and downspouts.
During a LOCA, the IRWST is available for injection. Depending on the severity of the event, when a fully depressurized RCS has been achieved, the IRWST will inject by gravity flow and downspouts.
: 12. Passive Residual Heat Removal (PRHR) Heat Removal Two channels of PRHR Flow are provided to monitor primary system heat removal during accident conditions when the steam generators are not available. PRHR Heat Removal provides primary protection for non-LOCA events when the normal heat sink is lost.
Alternatively, two channels of not closed position indication for the PRHR heat exchanger (HX) control valves are also provided to monitor primary system heat removal during accident conditions when the steam generators are not available.
These two channels, along with the confirmation that the PRHR HX inlet isolation valve is open per SR 3.5.4.2, are sufficient to verify that PRHR heat removal is fulfilled.
The PRHR HX control valves are redundant to each other; they are located in parallel flow paths and only one valve is required to open to satisfy the heat sink function.
Note also that the flow channels and valve position channels cannot be mixed.
AP1000 STS                            B 3.3.17-5                                       Rev. 1

PAM Instrumentation B 3.3.17 BASES LCO (continued) 13, 14, 15, 16. Core Exit Temperature Core Exit Temperature is provided for verification and long term Surveillance of core cooling.
An evaluation was made of the minimum number of valid core exit thermocouples necessary for in-core cooling (ICC) detection. The evaluation determined the reduced complement of core exit thermocouples necessary to detect initial core recovery and trend the ensuing core heatup. The evaluations account for core nonuniformities including incore effects of the radial decay power distribution and excore effects of condensate runback in the hot legs and nonuniform inlet temperatures. Based on these evaluations, adequate ICC detection is assured with two valid core exit thermocouples per quadrant. Core Exit Temperature is also used for plant stabilization and cooldown monitoring.
Two OPERABLE channels of Core Exit Temperature are required in each quadrant (defined below) to provide indication of radial distribution of the coolant temperature rise across representative regions of the core. Power distribution symmetry was considered in determining the specific number and locations provided for diagnosis of local core problems. Two thermocouples in each of the two divisions ensure that a single failure will not disable the ability to determine the temperature at two locations within a quadrant.
Core Exit Temperature quadrants are defined as shown in Figures B 3.3.17-1 and B 3.3.17-2. Either the normal or alternate quadrant definitions and associated core exit thermocouple assignments can be used to determine OPERABILITY.
: 17. Passive Containment Cooling System (PCS) Heat Removal The PCS Heat Removal must be capable of removing the heat from the containment following a postulated LOCA or steam line break (SLB). Two tank level instruments provide indication that sufficient water is available to meet this requirement. The PCS flow instrument on the lowest standpipe, which is also an input to the summation representing total PCS flow, provides a diverse indication of the PCS heat removal capability. The lowest standpipe indication can be used to satisfy one of the two required channels when the PCS level channel in the same electrical division is inoperable.
When available, the flow from the other three standpipes is AP1000 STS                             B 3.3.17-6                                         Rev. 1

PAM Instrumentation B 3.3.17 BASES LCO (continued) combined with the lowest standpipe to provide a total flow measurement. However, these other standpipe instruments are not required.
: 18. Penetration Flow Path Remotely Operated Containment Isolation Valve Position The Penetration Flow Path Remotely Operated Containment Isolation Valve Position is provided to support verification of containment integrity by confirming that flow paths, which have no accident mitigation function to be open (non-essential), are closed.
Table 3.3.17-1 Note (d) states that the Function is limited to components that receive an ESF containment isolation signal. Only nonessential systems are isolated automatically by the containment isolation signal. SGS-PL-V075A/B are not containment isolation valves, but are conservatively included because they receive the T signal. SGS-PL-V075A/B are in series with and are functionally equivalent to containment isolation valves SGS-PL-V074A/B, which also receive the T signal. The LCO requires one channel of valve position indication in the control room to be OPERABLE for each valve in a containment penetration flow path actuated on a containment isolation signal (i.e., two total channels of valve position indication for a penetration flow path with two active valves). For containment penetrations with only one active valve having post-accident monitoring control room indication, Note (c) requires a single channel of valve position indication to be OPERABLE. This is sufficient to redundantly verify the isolation status of each nonessential, isolable penetration either via indicated status of the active valve, as applicable, and prior knowledge of a passive valve, or via system boundary status. If a normally active valve is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE. Note (b) to the Required Channels states that the Function is not required for isolation valves whose associated penetration is isolated by one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured. Each penetration is treated separately and each penetration flow path is considered a separate function. Therefore, separate Condition entry is allowed for each penetration flow path with one or more inoperable position indicators.
AP1000 STS                            B 3.3.17-7                                      Rev. 1

PAM Instrumentation B 3.3.17 BASES LCO (continued)
: 19. IRWST to Normal Residual Heat Removal System (RNS) Suction Valve Status The position of the two motor-operated valves in the line from the IRWST to the RNS pump suction header is monitored to verify that the flow path is isolated following postulated events. The flow path must be isolated to prevent loss of IRWST inventory into the RNS.
Valve position indication is provided from the external stem-mounted limit switch on the motor-operated valve in the line from the IRWST to the RNS pump suction header located inside reactor containment.
Valve position indication is provided from the internal limit switch on the motor-operated valve in the line from the IRWST to the RNS pump suction header located outside reactor containment.
: 20. Pressurizer Pressure Pressurizer pressure is used to provide the main control room operating staff with information to assess RCS inventory control.
APPLICABILITY   The PAM instrumentation LCO is applicable in MODES 1, 2, and 3.
These variables provide the information necessary to assess the process of accomplishing or maintaining critical safety functions following Design Basis Accidents (DBAs). The applicable DBAs are assumed to occur in MODES 1, 2, and 3. In MODES 4, 5, and 6, plant conditions are such that the likelihood of an event that would require PAM instrumentation is low; therefore, the PAM instrumentation is not required to be OPERABLE in these MODES.
ACTIONS         The ACTIONS table has been modified by two Notes. The first Note excludes the MODE change restriction of LCO 3.0.4. This exception allows entry into an applicable MODE while relying on the ACTIONS even though the ACTIONS may eventually require a plant shutdown. This exception is acceptable due to the passive function of the instruments, the operators ability to respond to an accident using alternate instruments and methods, and the low probability of an event requiring these instruments.
The second Note in the ACTIONS clarifies the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.17-1. The AP1000 STS                             B 3.3.17-8                                        Rev. 1

PAM Instrumentation B 3.3.17 BASES ACTIONS (continued)
Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
A.1 When one or more Functions have one required channel that is inoperable, the inoperable required channel must be restored to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel (or in the case of a Function that has only one required channel, other non-Regulatory Guide 1.97 instrument channels to monitor the Functions associated variable), the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.
B.1 The Required Action directs actions to be taken immediately in accordance with Specification 5.6.5. Each time an inoperable channel has not met Required Action A.1 and the associated Completion Time has expired, Condition B is entered.
C.1 When one or more Functions have two required channels that are inoperable, (two channels inoperable in the same Function), one required channel for the Function should be restored to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information.
Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM function will be in a degraded condition should an accident occur.
AP1000 STS                               B 3.3.17-9                                      Rev. 1

PAM Instrumentation B 3.3.17 BASES ACTIONS (continued)
D.1 This Required Action directs entry into the appropriate Condition referenced in Table 3.3.17-1. The applicable Condition referenced in the table is Function dependent.
Each time an inoperable channel has not met any Required Action of Condition C, and the associated Completion Time has expired, Condition D is entered for that channel and provides for transfer to the appropriate subsequent Condition.
E.1 and E.2 If the Required Action and associated Completion Time of Condition C are not met for the Functions in Table 3.3.17-1, the plant must be placed in a MODE in which the LCO does not apply. This is done by placing the plant in MODE 3 within 6 hours and MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE      A Note has been added to the SRs table stating that SR 3.3.17.1 applies REQUIREMENTS      only to Functions 1, 12, 17, 18, and 19, and SR 3.3.17.2 applies to all Functions in Table 3.3.17-1.
SR 3.3.17.1 Performance of the CHANNEL CHECK once every 31 days verifies that a gross instrumentation failure has not occurred. A CHANNEL CHECK is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared to similar instruments located throughout the plant.
AP1000 STS                             B 3.3.17-10                                       Rev. 1

PAM Instrumentation B 3.3.17 BASES SURVEILLANCE REQUIREMENTS (continued)
Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the match criteria, it may be an indication that the sensor or the signal-processing equipment has drifted outside its limit. If the channels are within the match criteria, it is an indication that the channels are OPERABLE.
As specified in the SR, a CHANNEL CHECK is required only for those channels that are normally energized.
The Surveillance Requirement is modified by a Note. The Note states that this SR is not required for Neutron Flux (Intermediate Range) in MODE 1.
In MODE 1, the OPERABILITY of the Intermediate Range Neutron Instrumentation is verified by self-checking features in lieu of performing a CHANNEL CHECK.
The Frequency of 31 days is based on operating experience with channel OPERABILITY and drift, which demonstrates that failure of more than one channel of a given function in any 31 day interval is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of those displays associated with the required channels of this LCO.
SR 3.3.17.2 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop including the sensor. The test verifies that the channel responds to the measured parameter with the necessary range and accuracy. This SR is modified by a Note that excludes neutron detectors. The calibration method for neutron detectors is specified in the Bases of LCO 3.3.3, "Reactor Trip System (RTS)
Intermediate Range. Resistance temperature detector (RTD) and Thermocouple channels are to be calibrated in place using cross-calibration techniques. The Frequency is based on operating experience and consistency with the typical industry refueling cycle.
REFERENCES      1. Regulatory Guide 1.97, Instrumentation for Light-Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident, Rev. 3, U.S. Nuclear Regulatory Commission, May 1983.
AP1000 STS                              B 3.3.17-11                                       Rev. 1

PAM Instrumentation B 3.3.17 Figure B 3.3.17-1 (page 1 of 1)
Normal Core Exit Temperature Quadrant Definition AP1000 STS                   B 3.3.17-12                                 Rev. 1

PAM Instrumentation B 3.3.17 Figure B 3.3.17-2 (page 1 of 1)
Alternate Core Exit Temperature Quadrant Definition AP1000 STS                      B 3.3.17-13                                 Rev. 1

RSW B 3.3.18 B 3.3 INSTRUMENTATION B 3.3.18 Remote Shutdown Workstation (RSW)
BASES BACKGROUND          The RSW provides the control room operator with sufficient displays and controls to place and maintain the unit in a safe shutdown condition from a location other than the control room (Ref. 1). This capability is necessary to protect against the possibility that the control room becomes inaccessible. Passive residual heat removal (PRHR), the core makeup tanks (CMTs), and the in-containment refueling water storage tank (IRWST) can be used to remove core decay heat. The use of passive safety systems allows extended operation in MODE 4.
If the control room becomes inaccessible, the operators can establish control at the RSW and place and maintain the unit in MODE 4 with Tavg < 350&deg;F. The unit can be maintained safely in MODE 4 with Tavg < 350&deg;F for an extended period of time.
The OPERABILITY of the remote shutdown control and display functions ensures there is sufficient information available on selected unit parameters to place and maintain the unit in MODE 4 with Tavg < 350&deg;F should the main control room become inaccessible.
APPLICABLE          The RSW is required to provide equipment at appropriate locations SAFETY              outside the control room with a capability to promptly shut down and ANALYSES            maintain the unit in a safe condition in MODE 4 with Tavg < 350&deg;F.
The criteria governing the design and the specific system requirements of the RSW are located in 10 CFR 50, Appendix A, GDC 19 (Ref. 2).
Since the passive safety systems alone can establish and maintain safe shutdown conditions for the unit, non-safety systems are not required for safe shutdown of the unit. Therefore, no credit is taken in the safety analysis for non-safety systems.
The RSW satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
LCO                 The RSW LCO provides the OPERABILITY requirements of the displays and controls necessary to place and maintain the unit in MODE 4 from a location other than the main control room. The RSW is OPERABLE if the display instrument and control functions needed to support the RSW are OPERABLE.
AP1000 STS                               B 3.3.18-1                                       Rev. 1

RSW B 3.3.18 BASES LCO (continued)
The RSW covered by this LCO does not need to be energized to be considered OPERABLE. This LCO is intended to ensure the RSW will be OPERABLE if unit conditions require the RSW to be placed in operation.
APPLICABILITY   The RSW LCO is applicable in MODES 1, 2, and 3 and in MODE 4 with Tavg  350&deg;F. This is required so that the facility can be placed and maintained in MODE 4 for an extended period of time from a location other than the control room.
This LCO is not applicable in MODE 4 with Tavg < 350&deg;F or in MODE 5 or 6. In these MODES, the unit is already subcritical and in a condition of reduced Reactor Coolant System energy. Under these conditions, considerable time is available to restore necessary instrument control functions if control room instruments or controls become unavailable.
ACTIONS         The Note excludes the MODE change restriction of LCO 3.0.4. This exception allows entry into an applicable MODE while relying on the ACTIONS even though the ACTIONS may eventually require a unit shutdown. This exception is acceptable due to the low probability of an event requiring the RSW and because the equipment can generally be repaired during operation without significant risk of a spurious trip.
A.1 Condition A addresses the situation in which the RSW is inoperable. The Required Action is to restore the RSW to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.
B.1 and B.2 If the Required Action and associated Completion Time of Condition A are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours and to MODE 4 with Tavg < 350&deg;F within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
AP1000 STS                            B 3.3.18-2                                       Rev. 1

RSW B 3.3.18 BASES SURVEILLANCE SR 3.3.18.1 REQUIREMENTS SR 3.3.18.1 verifies that each required RSW transfer switch performs the required functions. This ensures that if the control room becomes inaccessible, the unit can be placed and maintained in MODE 4 with Tavg < 350&deg;F from the RSW. This Surveillance also demonstrates that the Automatic Depressurization System (ADS) and IRWST injection block is unblocked by the RSW transfer switch.
The 24 month Frequency was developed considering it is prudent that these types of Surveillances be performed during a unit outage.
However, this Surveillance is not required to be performed only during a unit outage. This is due to the unit conditions needed to perform the Surveillance and the potential for unplanned transients if the Surveillance is performed with the reactor at power. Operating experience demonstrates that RSW transfer switches usually pass the Surveillance test when performed on the 24 month Frequency.
SR 3.3.18.2 This Surveillance verifies that the RSW communicates controls and indications with Divisions A, B, C, and D of the Protection and Safety Monitoring System (PMS). The operator can select the controls and indications available through each PMS division.
The Frequency is based on the known reliability of the Functions and the redundancy available, and has been shown to be acceptable through operating experience.
SR 3.3.18.3 SR 3.3.18.3 verifies the OPERABILITY of the RSW hardware and software by performing diagnostics to show that operator displays are capable of being called up and displayed to an operator at the RSW.
The RSW has several video display units that the operator can use. The video display units are identical to the video display units in the main control room, and the operator can display information on the video display units in a manner identical to the way the information is displayed in the control room. The operator normally selects an appropriate set of displays based on the particular operational goals being controlled by the operator at the time. Each display consists of static graphical and legend information which is contained within the display processor associated with each video display unit and dynamic data that are updated by the data display system.
AP1000 STS                        B 3.3.18-3                                        Rev. 1

RSW B 3.3.18 BASES SURVEILLANCE REQUIREMENTS (continued)
The Frequency of 24 months is based on the use of the data display capability in the control room as part of the normal unit operation and the availability of multiple video display units at the RSW. The Frequency of 24 months is based on operating experience and consistency with control room hardware and software.
SR 3.3.18.4 SR 3.3.18.4 is the performance of a TRIP ACTUATING DEVICE OPERATIONAL TEST (TADOT) every 24 months. This test should verify the OPERABILITY of the reactor trip breakers (RTBs) open and closed indication on the RSW by actuating the RTBs. The Frequency of 24 months was chosen because the RTBs may not be exercised while the facility is at power and is based on operating experience and consistency with the refueling outage.
REFERENCES      1. FSAR Section 7.4.1, Safe Shutdown.
: 2. 10 CFR 50, Appendix A, GDC 19.
AP1000 STS                             B 3.3.18-4                                     Rev. 1

DAS Manual Controls B 3.3.19 B 3.3 INSTRUMENTATION B 3.3.19 Diverse Actuation System (DAS) Manual Controls BASES BACKGROUND           The Diverse Actuation System (DAS) manual controls provide non-Class 1E backup controls in case of common-mode failure of the Protection and Safety Monitoring System (PMS) automatic and manual actuations evaluated in the probabilistic risk assessment (PRA). These DAS manual controls are not credited for mitigating accidents in the FSAR Chapter 15 analyses.
The specific DAS controls were selected based on PRA risk importance as discussed in Reference 1. As noted in Reference 1, electrical power for these controls and instrument indications need not be covered by Technical Specifications. The rationale is that these controls use the same non-safety related power supply used by the plant control system.
This power is required to be available to support normal operation of the plant. With offsite power available, there are several sources to provide this power including AC power to non-Class 1E battery chargers, AC power to rectifiers, and non-Class 1E batteries. As a result, with offsite power available it is very likely that power will be available for these DAS controls. If offsite power is not available, then there is still the likelihood that the non-1E batteries or the non-1E diesel generators will be available. Even if these sources are unavailable, the desired actions will occur without operator action for the more probable events. The rods will insert automatically on loss of offsite power. The passive residual heat removal heat exchanger (PRHR HX), core makeup tanks (CMTs),
passive containment cooling system (PCS), and containment isolation features are initiated by operation of fail-safe, air-operated valves. If all offsite and onsite AC power is lost, the instrument air system will depressurize by the time these functions are needed in the 1 hour time frame.
Instrument readouts are expected to be available even in case of complete failure of the PMS due to common cause failure. These instruments include both DAS and PLS instruments. They are powered by DC sources for 24 or 72 hours following a loss of AC power, as described in FSAR Section 8.3.2. As discussed above, it is expected that AC power will be available to power the instruments. Even if the operators have no instrument indications, they are expected to actuate the controls most likely to be needed (PRHR HX, CMTs, PCS, and containment isolation). If all AC power fails, then the rods will drop and the air-operated valves will go to their fail-safe positions.
AP1000 STS                                 B 3.3.19-1                                           Rev. 1

DAS Manual Controls B 3.3.19 BASES BACKGROUND (continued)
The DAS uses equipment from sensor output to the final actuated device that is diverse from the PMS to automatically initiate a reactor trip, or to manually actuate the identified safety related equipment. FSAR Section 7.7.1.11 (Ref. 2) describes the DAS.
APPLICABLE       The DAS manual controls are required to provide a diverse capability to SAFETY           manually trip the reactor and actuate the specified safety related ANALYSES         equipment, based on risk importance in the PRA.
The DAS manual controls are not credited for mitigating accidents in the FSAR Chapter 15 safety analyses.
The PRA, Appendix A, provides additional information, including the thermal and hydraulic analyses of success sequences used in the PRA.
The DAS manual controls satisfy Criterion 4 of 10 CFR 50.36(c)(2)(ii).
LCO              The DAS LCO provides the requirements for the OPERABILITY of the DAS manual trip and actuation controls necessary to place the reactor in a shutdown condition and to remove decay heat in the event that the PMS automatic actuation and manual controls are inoperable.
Two switches are required for each of the DAS Manual Control Functions. These switches correspond to the available switches on the Main Control Room DAS Panel. For the Function of containment recirculation valves, the required switches can be met by either the two switches for Containment Recirculation or the two switches for Containment Recirculation / In-Containment Refueling Water Storage Tank drain.
APPLICABILITY    The DAS manual controls are required to be OPERABLE in the MODES specified in Table 3.3.19-1.
The manual DAS reactor trip control is required to be OPERABLE in MODES 1 and 2 to mitigate the effects of an anticipated transient without scram (ATWS) event during power operation.
The other manual DAS actuation controls are required to be available in the plant MODES specified, based on the need for operator action to actuate the specified components during events that may occur in these various plant conditions, as identified in the PRA.
AP1000 STS                             B 3.3.19-2                                       Rev. 1

DAS Manual Controls B 3.3.19 BASES ACTIONS    A.1 Condition A applies when one or more DAS manual controls are inoperable.
The Required Action A.1 to restore the inoperable DAS manual control(s) to OPERABLE status within 30 days is reasonable because the DAS is a separate and diverse non-safety backup system for the manual reactor trip and manual safety related equipment actuation controls. The 30 day Completion Time allows sufficient time to repair an inoperable manual DAS control but ensures the control is repaired to provide backup protection.
B.1 and B.2 Condition B applies when Required Action A cannot be completed for the DAS manual reactor trip control within the required Completion Time of 30 days.
Required Action B.1 requires SR 3.3.7.1, Perform TADOT, for the reactor trip breakers (RTBs), to be performed once per 31 days, instead of once every 92 days. Condition A of Example 1.3-6 illustrates the use of the Completion Time for Required Action B.1. The initial performance of SR 3.3.7.1 on the first division (since it is performed on a STAGGERED TEST BASIS) must be completed within 31 days of entering Condition B. The normal Surveillance test Frequency requirements for SR 3.3.7.1 must still be satisfied while performing SR 3.3.7.1 for Required Action B.1. The predominant failure requiring the DAS manual reactor trip control is common-mode failure of the RTBs.
This change in Surveillance Frequency for testing the RTBs increases the likelihood that a common-mode failure of the RTBs would be detected while the DAS manual reactor trip control is inoperable. This reduces the likelihood that a diverse manual reactor trip is required. It is not required to perform a TADOT for the manual actuation control. The manual reactor trip control is very simple, highly reliable, and does not use software in the circuitry. Although the DAS manual controls are non-Class 1E, they have been shown to be PRA risk important as discussed in Reference 1. The impact of an inoperable DAS manual control is compensated for by increasing the RTB Surveillance Frequency from once every 92 days to once every 31 days.
Required Action B.2 requires that the inoperable DAS manual reactor trip control be restored to OPERABLE status prior to entering MODE 2 following any plant shutdown to MODE 5 while the control is inoperable.
This ACTION is provided to ensure that all DAS manual controls are restored to OPERABLE status following the next plant shutdown.
AP1000 STS                       B 3.3.19-3                                      Rev. 1

DAS Manual Controls B 3.3.19 BASES ACTIONS (continued)
C.1 Condition C applies when Required Action A.1 cannot be completed for any DAS manual actuation control (other than reactor trip) within the required Completion Time of 30 days.
Required Action C.1 requires that the inoperable DAS manual actuation control(s) be restored to OPERABLE status prior to entering MODE 2 following any plant shutdown to MODE 5 while the control is inoperable.
This ACTION is provided to ensure that all DAS manual controls are restored to OPERABLE status following the next plant shutdown.
D.1 and D.2 Condition D is entered if a Required Action and associated Completion Time of Condition B or C are not met.
Required Actions D.1 and D.2 ensure that the plant is placed in a condition where the probability and consequences of an event are minimized. The allowed Completion Times are reasonable based on plant operating experience, for reaching the required plant conditions from full power conditions in an orderly manner, without challenging plant systems.
SURVEILLANCE        SR 3.3.19.1 REQUIREMENTS SR 3.3.19.1 is the performance of a TADOT of the DAS manual trip and actuation controls for the specified safety related equipment. This TADOT is performed every 24 months.
The Frequency is based on the known reliability of the DAS Functions and has been shown to be acceptable through operating experience.
The SR is modified by a Note that excludes verification of setpoints from the TADOT. The DAS Functions have no associated setpoints.
AP1000 STS                               B 3.3.19-4                                     Rev. 1

DAS Manual Controls B 3.3.19 BASES REFERENCES 1. WCAP-15985, AP1000 Implementation of the Regulatory Treatment of Nonsafety-Related Systems Process, Revi. 2, August 2003.
: 2. FSAR Section 7.7.1.11.
AP1000 STS                  B 3.3.19-5                                    Rev. 1

ADS and IRWST Injection Blocking Device B 3.3.20 B 3.3 INSTRUMENTATION B 3.3.20 Automatic Depressurization System (ADS) and In-containment Refueling Water Storage Tank (IRWST) Injection Blocking Device BASES BACKGROUND           The ADS and IRWST Injection Blocking Device is provided to minimize the likelihood of spurious ADS and IRWST injection valve actuation. The ADS and IRWST injection block function logic is performed by devices, one in each Protection and Safety Monitoring System (PMS) division, that provide an input to the ADS and IRWST injection valve component interface module (CIM) in the same division. The devices provide an independent block of the ADS and IRWST injection valves actuations, such that the valves can be opened only when both the software-based PMS logic and the analog ADS and IRWST Injection Blocking Device both agree that an actuation is needed. Each ADS and IRWST Injection Blocking Device division is supplied with one Core Makeup Tank (CMT) level instrumentation channel from each CMT to automatically unblock ADS and IRWST injection actuation during event scenarios requiring actuation of ADS or the IRWST injection valves, based on low level in one or both CMTs. The operator can also manually unblock each division by placing the main control room (MCR) ADS and IRWST Injection Block switch in the respective division in the unblock position.
While not required to be OPERABLE, two additional signals result in ADS and IRWST injection unblock via the blocking device: (1) low battery charger input voltage; and (2) transfer of control from the MCR to the remote shutdown workstation.
The ADS and IRWST Injection Blocking Device logic is implemented in hardware using conventional analog components and does not use or rely on software.
Failure of a single ADS and IRWST Injection Blocking Device will, at most, prevent the opening of one ADS Stage 1 path and one ADS Stage 3 path, or an ADS Stage 2 path. Since each of these stages has two paths, failure of one division (path) does not defeat the ADS function.
Each ADS Stage 4 path (valve) is operated by two divisions; therefore, failure of a single ADS and IRWST Injection Blocking Device will not defeat any Stage 4 path. Each IRWST injection path (valve) is also operated by two divisions, and therefore, the failure of a single blocking device will not defeat any injection path. Loss of power to the ADS blocking device removes the block from the CIM.
AP1000 STS                                 B 3.3.20-1                                      Rev. 1

ADS and IRWST Injection Blocking Device B 3.3.20 BASES APPLICABLE        Four divisions of ADS and IRWST Injection Blocking Devices for SAFETY            automatic unblocking with two level instrumentation channels (one from ANALYSES, LCO,    each CMT) per division provide plant protection in the event of any and APPLICABILITY analyzed accident.
Four divisions of ADS and IRWST Injection Blocking Devices (with one manual switch per division) for manual unblocking, with MCR ADS and IRWST Injection Block manual switches in the unblock position, provide plant protection in the event of any analyzed accident. ADS and IRWST Injection Block manual switches in the unblock position is required for manual ADS and IRWST injection actuation.
The ADS provides a sequenced depressurization of the Reactor Coolant System (RCS) to allow passive injection from the CMTs, accumulators, and the IRWST to mitigate the effects of a loss of coolant acciden. The depressurization is accomplished in four stages, with the first three stages discharging into the IRWST and the fourth stage discharging into containment.
OPERABILITY of the ADS and IRWST Injection Blocking Device is required to ensure ADS and IRWST injection actuation, as assumed in the safety analysis. When the blocking device is not unblocked, a low level in either one or both CMTs will unblock the ADS and IRWST injection actuation in the respective division. Each OPERABLE ADS and IRWST Injection Blocking Device division requires one upper narrow range level transmitter on each of the two CMTs. Additionally, both CMTs must be capable of injecting to assure appropriate redundancy for the unblocking function. The CMT low level setpoint for the ADS and IRWST Injection Blocking Device is set above the ADS Stages 1, 2, and 3 CMT Level  Low 1 actuation setpoint. Thus on decreasing level, the CMT low level unblocks ADS actuation prior to reaching the ADS Stages 1, 2, and 3 CMT Level  Low 1 setpoint. OPERABILITY of the CMT low level unblock is required from each CMT.
The ADS and IRWST Injection Blocking Device is required to be OPERABLE for automatic unblocking in MODES 1, 2, and 3, and in MODE 4 with the RCS not being cooled by the Normal Residual Heat Removal System (RNS). This aligns with the Applicability for the CMTs in LCO 3.5.2, Core Makeup Tanks (CMTs)  Operating.
The ADS and IRWST Injection Blocking Device is required to be OPERABLE for manual unblocking in MODES 1, 2, 3, 4, 5, and 6. This aligns with the Applicability for the manual actuation functions for ADS and IRWST injection required by LCO 3.3.9, Engineered Safety Feature Actuation System (ESFAS) Manual Initiation.
AP1000 STS                              B 3.3.20-2                                      Rev. 1

ADS and IRWST Injection Blocking Device B 3.3.20 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
In MODE 4 with the RCS cooling provided by the RNS, and in MODES 5 and 6, less than two CMTs are required to be OPERABLE, and therefore, may not be available to support the required automatic unblocking to ensure ADS and IRWST injection actuation. Therefore, ADS and IRWST Injection Block manual switches are required to be in the unblock position to support automatic ADS and IRWST injection actuation OPERABILITY.
For postulated shutdown events in MODE 6, the IRWST provides the RCS heat removal by IRWST injection and containment sump recirculation. In MODE 6 with the reactor vessel internals removed, IRWST manual actuation continues to be required by LCO 3.3.9, Engineered Safety Feature Actuation System (ESFAS) Manual Initiation. As such, the ADS and IRWST Injection Block manual switches in the unblock position support IRWST OPERABILITY.
The CMT level OPERABILITY requirement is provided with a Note stating that ADS and IRWST Injection Blocking Device OPERABILITY for automatic unblocking from CMT level is not required with ADS and IRWST Injection Block switch in the unblock position. This supports unblocking prior to the Applicability transition of establishing RNS cooling, by establishing the unblocked state that is credited in the safety analysis.
ADS and IRWST Injection Blocking Device satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ACTIONS         The ACTIONS are modified by a Note to clarify the application of Completion Time rules. Condition A may be entered independently for each division with an inoperable ADS and IRWST Injection Blocking Device. The Completion Time(s) of the inoperable division will be tracked separately for each division starting from the time the Condition was entered for that division.
A.1 Condition A addresses the situation in which one or more divisions of the ADS and IRWST Injection Blocking Device(s) are inoperable (e.g., one or both CMT level channels in one or more divisions inoperable when required, or ADS and IRWST Injection Block in one or more divisions not unblocked when required). In this condition, the component interface module (CIM) in the affected division is required to be unblocked in the AP1000 STS                             B 3.3.20-3                                     Rev. 1

ADS and IRWST Injection Blocking Device B 3.3.20 BASES ACTIONS (continued) affected division within 8 hours. The ADS and IRWST Injection Block manual switches may be utilized to implement the unblock. The Completion Time of 8 hours is reasonable based on the low probability of an event occurring during this interval.
B.1 If the Required Action and associated Completion Time of Condition A are not met, the affected ADS and IRWST injection valves must immediately be declared inoperable. Declaring the affected valves inoperable allows the supported system Actions (i.e., for ADS and IRWST inoperable valves) to dictate the required measures. The ADS and/or IRWST LCO(s) provide appropriate actions for the inoperable components. This action is in accordance with LCO 3.0.6, which requires that the applicable Conditions and Required Actions for valves declared inoperable shall be entered in accordance with LCO 3.0.2.
SURVEILLANCE       The SRs for each ADS and IRWST Injection Blocking Device Function REQUIREMENTS       are identified in the SRs column of Table 3.3.20-1 for that Function.
A Note has been added to the SR table stating that Table 3.3.20-1 determines which SRs apply to which ADS and IRWST Injection Blocking Device Function.
SR 3.3.20.1 Verification that the position of each ADS and IRWST Injection Block switch is in the unblock position is required when fewer than two CMTs are required to be OPERABLE. This ensures that the actuation of ADS and IRWST injection is not blocked when there may be reduced or no capability for automatic unblocking from CMT level. The 7 day Frequency is adequate considering the availability of MCR status monitoring of the block signal.
SR 3.3.20.2 This SR is the performance of a CHANNEL CALIBRATION every 24 months or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop. The test is performed in accordance with the Setpoint Program. If the actual setting of the channel is found to be outside the as-found tolerance, the channel is considered inoperable.
AP1000 STS                               B 3.3.20-4                                     Rev. 1

ADS and IRWST Injection Blocking Device B 3.3.20 BASES SURVEILLANCE REQUIREMENTS (continued)
This condition of the channel will be further evaluated during performance of the SR. This evaluation will consist of adjusting the channel setpoint to the nominal trip setpoint (NTS) (within the allowed as-left tolerance), and evaluating the channels response. If the channel is functioning as required and is expected to pass the next Surveillance, then the channel is OPERABLE and can be restored to service at the completion of the Surveillance. After the Surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation. Transmitter calibration must be performed consistent with the assumptions of the setpoint methodology. The difference between the current as-found values and the previous as-left values must be consistent with the transmitter drift allowance used in the setpoint methodology.
The setpoint methodology requires that 30 months drift be used (1.25 times the Surveillance calibration interval of 24 months).
The Frequency is based on operating experience and consistency with the refueling cycle.
SR 3.3.20.3 This SR is the performance of an ACTUATION LOGIC TEST for unblocking. This test overlaps the ADS and IRWST injection functional tests (i.e., SR 3.4.11.4, SR 3.4.11.5, and SR 3.5.6.9) that verify actuation on an actual or simulated actuation signal.
The Frequency of 24 months is based on the need to perform this SR during periods when the plant is shut down for refueling to prevent any additional risks associated with inadvertent operation of the ADS and IRWST injection valves.
SR 3.3.20.4 This SR is the performance of a TADOT of the required ADS and IRWST Injection Block manual switch. This TADOT is performed every 24 months.
The Frequency is based on the known reliability of manual switch Functions and has been shown to be acceptable through operating experience AP1000 STS                            B 3.3.20-5                                      Rev. 1

ADS and IRWST Injection Blocking Device B 3.3.20 BASES SURVEILLANCE REQUIREMENTS (continued)
The SR is modified by a Note that states verification of setpoint is not required, since these manual Functions have no associated setpoint.
SR 3.3.20.5 This SR requires performance of LCO 3.5.2 Surveillances associated with ensuring that CMTs are capable of injecting to the RCS. CMT injection supports OPERABILITY of the ADS and IRWST Injection Blocking Devices for automatic unblocking. If one or both CMTs are inoperable for injection, all four divisions of ADS and IRWST Injection Blocking Devices are inoperable. Therefore, SRs 3.5.2.2, 3.5.2.5, and 3.5.2.6 are required to be met. See the corresponding Bases for LCO 3.5.2 for a discussion of each Surveillance and its Frequency.
REFERENCES      1. FSAR Chapter 15, Accident Analysis.
: 2. FSAR Chapter 7, Instrumentation and Controls.
: 3. WCAP-10271, Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System, June 1996 Supplement 2.
AP1000 STS                            B 3.3.20-6                                      Rev. 1

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits BASES BACKGROUND          These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within the limits assumed in the safety analyses. The safety analyses (Ref. 1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the normal steady state envelope of operating conditions. The limits placed on RCS pressure, temperature, and flow rate ensure that the minimum departure from nucleate boiling ratio (DNBR) will be met for each of the transients analyzed.
The RCS pressure limit is consistent with operation within the nominal operational envelope. Pressurizer pressure indications are averaged to come up with a value for comparison to the limit. A lower pressure will cause the reactor core to approach DNB limits.
The RCS coolant average temperature limit is consistent with full power operation within the nominal operational envelope. Indications of temperature are averaged to determine a value for comparison to the limit. A higher average temperature will cause the core to approach DNB limits.
The RCS flow rate normally remains constant during an operational fuel cycle with all pumps running. The minimum RCS flow limit corresponds to that assumed for DNB analyses. At the beginning of the first fuel cycle, precision (calorimetric) flow measurements, augmented by hydraulic measurements in the reactor coolant loop and pump performance, provide a value for comparison to the limit, and to determine the calibration coefficients for future use with differential pressure measurements. The reactor coolant flow rate channels are normalized to these test measurements for 100% indication using these calibration coefficients and are frequently monitored to determine flow degradation. A lower RCS flow will cause the core to approach DNB limits.
Operation for significant periods of time outside these DNB limits increases the likelihood of a fuel cladding failure in a DNB limited event.
APPLICABLE          The requirements of this LCO represent the initial conditions for DNB SAFETY              limited transients analyzed in the plant safety analyses (Ref. 1). The ANALYSES            safety analyses have shown transients initiated within the requirements AP1000 STS                                B 3.4.1-1                                         Rev. 1

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABLE SAFETY ANALYSES continued) of this LCO will result in meeting the DNBR criterion. This is the acceptance limit for the RCS DNB parameters. Changes to the unit that could impact these parameters must be assessed for their impact on the DNBR criterion. The transients analyzed include loss of coolant flow events and dropped or stuck rod events. An assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.1.6, Control Bank Insertion Limits, as well as within the limits of either LCO 3.2.3, AXIAL FLUX DIFFERENCE (AFD),and LCO 3.2.4, QUADRANT POWER TILT RATIO (QPTR), or within the limits of LCO 3.2.5, On-Line Power Distribution Monitoring System (OPDMS)
Monitored Parameters.
The pressurizer pressure limit and the RCS average temperature limit specified in the COLR correspond to analytical limits, with an allowance for steady state fluctuations and measurement errors. The RCS average temperature limit corresponds to the analytical limit with allowance for controller deadband and measurement uncertainty.
The RCS DNB parameters satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              This LCO specifies limits on the monitored process variables, pressurizer pressure, RCS average temperature, and RCS total flow rate to ensure the core operates within the limits assumed in the safety analyses.
These variables are contained in the COLR to provide operating and analysis flexibility from cycle to cycle. However, the minimum RCS flow, usually based on maximum analyzed steam generator tube plugging, is retained in the LCO. Operating within these limits will result in meeting DNBR criterion in the event of a DNB limited transient.
The COLR RCS total flow rate limit is equal to or more restrictive than the  301,670 gpm limit specified in the LCO. The COLR limit reflects the cycle-specific core design and plant conditions as well as added margin.
Separate minimum RCS total flow rate limits are specified in the COLR for measurement by precision heat balance or by differential pressure instrumentation. Different flow limits may apply for each measurement method since the two methods have unique measurement errors and instrument allowances that are included in the COLR RCS flow rate limits.
AP1000 STS                               B 3.4.1-2                                       Rev. 1

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES LCO (continued)
The calibration coefficients for the differential pressure (hot-leg elbow and cold-leg bend) RCS total flow rate indication channels are established based on the comprehensive RCS flow measurements taken at the beginning of the first fuel cycle. These measurements include precision (calorimetric) flow, differential temperature, reactor coolant loop hydraulic tests, and pump performance. The differential pressure calibration coefficients are not expected to change during plant life.
Measurement errors associated with the method used to determine the calibration coefficients are included in the differential pressure COLR RCS flow rate limit.
The numerical values for pressure, temperature, and flow rate specified in the COLR are given for the measurement location but have been adjusted for instrument error.
APPLICABILITY   In MODE 1, the limits on pressurizer pressure, RCS coolant average temperature, and RCS flow rate must be maintained during steady state plant operation to ensure that the DNBR criterion will be met in the event of an unplanned loss of forced coolant flow or other DNB-limiting transient. In all other MODES, the power level is low enough that DNB is not a concern.
A Note has been added to indicate the limit on pressurizer pressure is not applicable during short term operational transients such as a THERMAL POWER ramp increase > 5% RTP per minute or a THERMAL POWER step increase > 10% RTP. These conditions represent short term perturbations where actions to control pressure variations might be counterproductive. Also, since they represent transients initiated from power levels < 100% RTP, an increased DNBR margin exists to offset the temporary pressure variations.
Safety Limit (SL) 2.1.1, Reactor Core SLs, specifies the DNBR limit.
The conditions which define the DNBR limit are less restrictive than the limits of this LCO, but violation of a SL merits a stricter, more severe Required Action. Should a violation of this LCO occur, the operator must check whether an SL may have been exceeded.
AP1000 STS                            B 3.4.1-3                                         Rev. 1

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES ACTIONS      A.1 RCS pressure and RCS average temperature are controllable and measurable parameters. With one or both of these parameters not within LCO limits, action must be taken to restore parameter(s).
RCS total flow rate is not a controllable parameter and is not expected to vary during steady state operation. If the indicated RCS total flow rate is below the LCO limit, power must be reduced, as required by Required Action B.1, to restore DNB margin and eliminate the potential for violation of the accident analysis bounds.
The 2 hour Completion Time for restoration of the parameters provides sufficient time to adjust plant parameters, to determine the cause for the off normal condition, and to restore the readings within limits, and is based on plant operating experience.
B.1 If Required Action A.1 is not met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply.
To achieve this status, the plant must be brought to MODE 2 within 6 hours. In MODE 2, the reduced power condition eliminates the potential for violation of the accident analysis bounds. The Completion Time of 6 hours is reasonable to reach the required plant conditions in an orderly manner.
SURVEILLANCE SR 3.4.1.1 REQUIREMENTS This Surveillance demonstrates that the pressurizer pressure remains greater than or equal to the limit specified in the COLR. Pressurizer pressure indications are averaged to come up with a value for comparison to the limit. Since Required Action A.1 allows a Completion Time of 2 hours to restore parameters that are not within limits, the 12 hour Surveillance Frequency for pressurizer pressure is sufficient to ensure the pressure can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.
AP1000 STS                          B 3.4.1-4                                      Rev. 1

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.4.1.2 This Surveillance demonstrates that the average RCS temperature remains less than or equal to the limit specified in the COLR. Indications of temperature are averaged to determine a value for comparison to the limit. Since Required Action A.1 allows a Completion Time of 2 hours to restore parameters that are not within limits, the 12 hour Surveillance Frequency for RCS average temperature is sufficient to ensure the temperature can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour Frequency has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.
SR 3.4.1.3 This Surveillance demonstrates that the RCS total flow rate remains  301,670 gpm and greater than or equal to the limit specified in the COLR. The 12 hour Surveillance Frequency for RCS total flow rate is performed using the installed differential pressure flow instrumentation.
The 12 hour interval has been shown by operating practice to be sufficient to regularly assess potential degradation and to verify operation within safety analysis assumptions.
SR 3.4.1.4 A CHANNEL CALIBRATION of the differential pressure RCS total flow rate indication channels is performed every 24 months, at the beginning of each fuel cycle.
CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter with the necessary range and accuracy.
The Frequency is based on consistency with the refueling cycle.
SR 3.4.1.5 Measurement of RCS total flow rate by performance of precision test measurements once every 24 months, at the beginning of each fuel cycle, allows the installed RCS flow instrumentation to be normalized and verifies that the actual RCS flow is greater than or equal to the minimum required RCS flow rate. These test measurements may be based on a AP1000 STS                             B 3.4.1-5                                      Rev. 1

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE REQUIREMENTS (continued) precision heat balance, or by differential pressure measurements of static elements in the RCS piping (such as elbows) that have been calibrated by previous precision tests, or by a combination of those two methods.
In all cases, the measured flow, less allowance for error, must exceed the corresponding value used in the safety analysis and specified in the COLR.
The Frequency of 24 months reflects the importance of verifying flow after a refueling outage when the core has been altered, which may have caused an alteration of flow resistance.
This SR is modified by a Note that allows entry into MODE 1, without having performed the SR, and placement of the unit in the best condition for performing the SR. The Note states that the SR is not required to be performed until after 24 hours after  90% RTP. This exception is appropriate since the heat balance requires the plant to be at a minimum of 90% RTP to obtain the stated RCS flow accuracies. The Surveillance shall be performed within 24 hours after reaching 90% RTP.
REFERENCES      1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                            B 3.4.1-6                                     Rev. 1

RCS Minimum Temperature for Criticality B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.2 RCS Minimum Temperature for Criticality BASES BACKGROUND         This LCO is based upon meeting several major considerations before the reactor can be made critical and while the reactor is critical.
The first consideration is moderator temperature coefficient, LCO 3.1.3, Moderator Temperature Coefficient (MTC). In the transient and accident analyses, the MTC is assumed to be in a range from zero to negative and the operating temperature is assumed to be within the nominal operating envelope while the reactor is critical. The LCO on minimum temperature for criticality helps ensure the plant is operated consistent with these assumptions.
The second consideration is the protective instrumentation. Because certain protective instrumentation (e.g., excore neutron detectors) can be affected by moderator temperature, a temperature value within the nominal operating envelope is chosen to ensure proper indication and response while the reactor is critical.
The third consideration is the pressurizer operating characteristics. The transient and accident analyses assume that the pressurizer is within its normal startup and operating range (i.e., saturated conditions and steam bubble present). It is also assumed that the RCS temperature is within its normal expected range for startup and power operation. Since the density of the water, and hence the response of the pressurizer to transients, depends upon the initial temperature of the moderator, a minimum value for moderator temperature within the nominal operating envelope is chosen.
The fourth consideration is that the reactor vessel is above its minimum nil-ductility reference temperature when the reactor is critical.
APPLICABLE         Although the RCS minimum temperature for criticality is not itself an SAFETY             initial condition assumed in Design Basis Accidents (DBAs), the closely ANALYSES           aligned temperature for hot zero power (HZP) is a process variable that is an initial condition of DBAs, such as the rod cluster control assembly (RCCA) withdrawal, RCCA ejection, and main steam line break accidents performed at zero power that either assume the failure of, or present a challenge to, the integrity of a fission product barrier.
AP1000 STS                                 B 3.4.2-1                                    Rev. 1

RCS Minimum Temperature for Criticality B 3.4.2 BASES APPLICABLE SAFETY ANALYSES (continued)
All low power safety analyses assume initial RCS loop temperatures are greater than or equal to the HZP temperature of 557&deg;F (Ref. 1). The minimum temperature for criticality limitation provides a small band, 6&deg;F, for critical operation below HZP. This band allows critical operation below HZP during plant startup and does not adversely affect any safety analyses since the MTC is not significantly affected by the small temperature difference between HZP and the minimum temperature for criticality.
The RCS minimum temperature for criticality parameter satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              Compliance with the LCO ensures that the reactor will not be made or maintained critical (keff  1.0) at a temperature less than a small band below the HZP temperature, which is assumed in the safety analysis.
Failure to meet the requirements of this LCO may produce initial conditions inconsistent with the initial conditions assumed in the safety analysis.
APPLICABILITY    In MODE 1 and MODE 2 with keff  1.0, LCO 3.4.2 is applicable since the reactor can only be critical (keff  1.0) in these MODES.
The special test exception of LCO 3.1.8, MODE 2 PHYSICS TEST Exceptions, permits PHYSICS TESTS to be performed at  5.0% RTP with RCS loop average temperatures slightly lower than normally allowed so that fundamental nuclear characteristics of the core can be verified. In order for nuclear characteristics to be accurately measured, it may be necessary to operate outside the normal restrictions of this LCO. For example, to measure the MTC at beginning of cycle, it is necessary to allow RCS loop average temperatures to fall below Tno load, which may cause RCS loop average temperatures to fall below the temperature limit of this LCO.
ACTIONS          A.1 If the parameters that are outside the limit cannot be restored, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 2 with keff < 1.0 within 30 minutes. Rapid reactor shutdown can be readily and practically achieved within a 30 minute period. The allowed time is reasonable, AP1000 STS                              B 3.4.2-2                                      Rev. 1

RCS Minimum Temperature for Criticality B 3.4.2 BASES ACTIONS (continued) based on operating experience, to reach MODE 2 with keff < 1.0 in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.4.2.1 REQUIREMENTS RCS loop average temperature is required to be verified at or above 551&deg;F every 12 hours. The SR to verify RCS loop average temperatures every 12 hours takes into account indications and alarms that are continuously available to the operator in the control room and is consistent with other routine Surveillances which are typically performed once per shift. In addition, operators are trained to be sensitive to RCS temperature during approach to criticality and will ensure that the minimum temperature for criticality is met as criticality is approached.
REFERENCES          1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                               B 3.4.2-3                                        Rev. 1

RCS P/T Limits B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.3 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND          All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.
The PTLR contains P/T limit curves for heatup, cooldown, RCS inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature.
Each P/T limit curve defines an acceptable region for normal operation.
The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.
The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer and the pressurizer surge line, which have different design characteristics and operating functions.
10 CFR 50, Appendix G (Ref. 1) requires the establishment of P/T limits for specific material fracture toughness requirements of the RCPB materials. An adequate margin to brittle failure must be provided during normal operation, anticipated operational occurrences, and system hydrostatic tests. Reference 1 mandates the use of the ASME Code, Section III, Appendix G (Ref. 2).
The neutron embrittlement effect on the material toughness is reflected by increasing the nil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.
The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3) and Appendix H of 10 CFR 50 (Ref. 4). The operating P/T limit curves will be AP1000 STS                                 B 3.4.3-1                                      Rev. 1

RCS P/T Limits B 3.4.3 BASES BACKGROUND (continued) adjusted, as necessary, based on the evaluation findings and the recommendations of Regulatory Guide 1.99 (Ref. 5).
The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of the most restrictive portions of the reactor vessel and head. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the P/T span of the limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.
The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.
The criticality limit curve includes the requirement to be  40&deg;F above the heatup curve or the cooldown curve, and not less than the minimum permissible temperature for RCS ISLH testing per Reference 1.
However, the criticality curve is not operationally limiting; a more restrictive limit exists in LCO 3.4.2, RCS Minimum Temperature for Criticality.
The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components.
ASME Code, Section XI, Appendix E (Ref. 6) provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.
APPLICABLE       The P/T limits are not derived from Design Basis Accident (DBA)
SAFETY           analyses. They are prescribed during normal operation to avoid ANALYSES         encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and result in nonductile failure of the RCPB, an unanalyzed condition. Reference 7 establishes the methodology for determining the P/T limits. Although the P/T limits are not derived from any DBA, the P/T limits are acceptance limits since they preclude operation in an unanalyzed condition.
RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                               B 3.4.3-2                                      Rev. 1

RCS P/T Limits B 3.4.3 BASES LCO        The two elements of this LCO are:
: a. The limit curves for heatup, cooldown, and RCS ISLH testing; and
: b. Limits on the rate of change of temperature.
The LCO limits apply to all components of the RCS, except the pressurizer. These limits define allowable operating regions and permit a large number of operating cycles while providing a wide margin to nonductile failure.
The limits for the rate of change of temperature control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and RCS ISLH testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.
Violating the LCO limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follow:
: a. The severity of the departure from the allowable operating P/T regime or the severity of the rate of change of temperature;
: b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and
: c. The existences, sizes, and orientations of flaws in the vessel material.
The LCO is modified by a Note that requires the secondary side water temperature of each SG to be  50&deg;F above each of the RCS cold leg temperatures before the start of an RCP with at least one RCS cold leg temperature  350&deg;F, and the RCP must be started at  25% of rated RCP speed. This limitation helps to ensure that the RNS system pressure remains below both the piping design pressure and the acceptable RNS relief valve inlet pressure. This restraint also assures the thermal transient when an RCP is started is within the bounds of the low temperature overpressure event analysis.
AP1000 STS                        B 3.4.3-3                                       Rev. 1

RCS P/T Limits B 3.4.3 BASES APPLICABILITY The RCS P/T limits LCO provides a definition of acceptable operation for prevention of nonductile (brittle) failure in accordance with 10 CFR 50, Appendix G (Ref. 1). Although the P/T limits were developed to provide guidance for operation during heatup or cooldown (MODES 3, 4, and 5) or RCS ISLH testing, they are applicable at all times in keeping with the concern for nonductile failure. The limits do not apply to the pressurizer.
During MODES 1 and 2, other Technical Specifications provide limits for operation that can be more restrictive than or can supplement these P/T limits. LCO 3.4.1, RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits; LCO 3.4.2, RCS Minimum Temperature for Criticality; and Safety Limit 2.1, Safety Limits, also provide operational restrictions for pressure and temperature and maximum pressure. Furthermore, MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or descent.
ACTIONS       A.1 and A.2 Operation outside the limits of the LCO must be restored to within the limits. The RCPB must be returned to a condition that has been verified by stress analyses.
The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.
Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.
ASME Code, Section XI, Appendix E (Ref. 6) may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.
The 72 hour Completion Time is reasonable to accomplish the evaluation. The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed before continuing to operate.
AP1000 STS                         B 3.4.3-4                                         Rev. 1

RCS P/T Limits B 3.4.3 BASES ACTIONS (continued)
Condition A is modified by a Note requiring that Required Action A.2 be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration per Required Action A.1 alone is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress, or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased.
If the required restoration activity cannot be accomplished in 30 minutes, Required Action B.1 and Required Action B.2 must be implemented to reduce pressure and temperature.
If the required evaluation for continued operation cannot be accomplished within 72 hours or the results are indeterminate or unfavorable, action must proceed to reduce pressure and temperature as specified in Required Action B.1 and Required Action B.2. A favorable evaluation must be completed and documented before returning to operating pressure and temperature conditions.
Pressure and temperature are reduced by bringing the plant to MODE 3 within 6 hours and to MODE 5 within 36 hours.
The allowed Completion Times are reasonable based on operating experience, to reach the required plant conditions from full power condition in an orderly manner without challenging plant systems.
C.1 and C.2 Actions must be initiated immediately to correct operation outside of the limits of the LCO at times other than when in MODE 1, 2, 3, or 4, so that the RCPB is returned to a condition that has been verified by stress analysis.
AP1000 STS                                B 3.4.3-5                                      Rev. 1

RCS P/T Limits B 3.4.3 BASES ACTIONS (continued)
The immediate Completion Time reflects the urgency of initiating action to restore the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.
Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify that the RCPB integrity remains acceptable and must be completed prior to entry into MODE 4. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, or inspection of the components.
ASME Code, Section XI, Appendix E (Ref. 6), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.
Condition C is modified by a Note requiring that Required Action C.2 be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
SURVEILLANCE        SR 3.4.3.1 REQUIREMENTS Verification that operation is within PTLR limits is required every 30 minutes when RCS P/T conditions are undergoing planned changes.
This Frequency is considered reasonable in view of the control room indication available to monitor RCS status. Also, since temperature rate of change limits are specified in hourly increments, 30 minutes permits assessment and correction for minor deviations within a reasonable time.
Surveillance for heatup, cooldown, or RCS ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.
This SR is modified by a Note that only requires this Surveillance to be performed during system heatup, cooldown, and RCS ISLH testing. No SR is given for criticality operations because LCO 3.4.2, RCS Minimum Temperature for Criticality, contains a more restrictive requirement.
AP1000 STS                                 B 3.4.3-6                                      Rev. 1

RCS P/T Limits B 3.4.3 BASES REFERENCES 1. 10 CFR 50, Appendix G, Fracture Toughness Requirements.
: 2. ASME Boiler and Pressure Vessel Code, Section III, Appendix G, Protection Against Non-Ductile Failure.
: 3. ASTM E 185-82, Standard Practice for Conducting Surveillance Tests for Light-Water Cooled Nuclear Power Reactor Vessels, July 1982.
: 4. 10 CFR 50, Appendix H, Reactor Vessel Material Surveillance Program Requirements.
: 5. Regulatory Guide 1.99, Radiation Embrittlement of Reactor Vessel Materials, May 1988.
: 6. ASME Boiler and Pressure Vessel Code, Section XI, Appendix E, Evaluation of Unanticipated Operating Events.
: 7. WCAP-14040-A, Methodology Used to Develop Cold Overpressure Mitigating System Setpoints and RCS Heatup and Cooldown Limit Curves, May 2004.
AP1000 STS                    B 3.4.3-7                                   Rev. 1

RCS Loops B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.4 RCS Loops BASES BACKGROUND        The primary function of the RCS is removal of the heat generated in the fuel due to the fission process, and transfer of this heat, via the steam generators (SGs) to the secondary plant.
The secondary functions of the RCS include:
: a. Moderating the neutron energy level to the thermal state, to increase the probability of fission;
: b. Improving the neutron economy by acting as a reflector;
: c. Carrying the soluble neutron poison, boric acid;
: d. Providing a second barrier against fission-product release to the environment; and
: e. Removal of the heat generated in the fuel due to fission-product decay following a unit shutdown.
The reactor coolant is circulated through two loops connected in parallel to the reactor vessel, each containing an SG, two reactor coolant pumps (RCPs), and appropriate flow and temperature instrumentation for both control and protection. The reactor vessel contains the fuel. The SGs provide the heat sink to the isolated secondary coolant. The RCPs circulate the primary coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage.
This forced circulation of the reactor coolant ensures mixing of the coolant for proper boration and chemistry control.
The RCPs must be started using the variable speed controller with the Plant Control System (PLS) incapable of rod withdrawal and all rods fully inserted. The controller shall be bypassed prior to making the PLS capable of rod withdrawal or withdrawing one or more rods.
APPLICABLE        MODES 1 and 2 SAFETY ANALYSES          Safety analyses contain various assumptions for the design basis accident initial conditions including RCS pressure, RCS temperature, reactor power level, core parameters, and safety system setpoints. The AP1000 STS                               B 3.4.4-1                                       Rev. 1

RCS Loops B 3.4.4 BASES APPLICABLE SAFETY ANALYSES (continued) important aspect for this LCO is the reactor coolant forced flow rate, which is represented by the number of RCS loops and RCPs in service.
Both transient and steady state analyses have been performed to establish the effect of flow on the departure from nucleate boiling (DNB).
The transient and accident analyses for the plant have been performed assuming two RCS loops are initially in operation. The majority of the plant safety analyses is based on initial conditions at high core power or zero power. The accident analyses, where RCP operation is most important are the four pump coastdown, single pump locked rotor, single pump broken shaft or coastdown, and rod withdrawal events (Ref. 1).
Steady state DNB analysis has been performed for the two RCS loop operation. For two RCS loop operation, the steady state DNB analysis, which generates the pressure and temperature Safety Limit (SL) (i.e., the departure from nucleate boiling ratio (DNBR) limit) assumes a maximum power level of 100% RATED THERMAL POWER (RTP). The DNBR limit defines a locus of pressure and temperature points that results in a minimum DNBR greater than or equal to the critical heat flux correlation limit.
The plant is designed to operate with both RCS loops in operation to maintain DNBR above the SL during all normal operations and anticipated transients. By ensuring heat transfer in the nucleate boiling region, adequate heat transfer is provided between the fuel cladding and the reactor coolant.
MODES 3, 4, and 5 Whenever the PLS is capable of rod withdrawal or one or more rods are not fully inserted, there is the possibility of an inadvertent rod withdrawal from subcritical, resulting in a power excursion in the area of the withdrawn rod. Such a transient could be caused by a malfunction of the PLS. In addition, the possibility of a power excursion due to the ejection of an inserted control rod is possible. Such a transient could be caused by the mechanical failure of a CRDM. The initial power rise is terminated by doppler broadening in the fuel pins, followed by rod insertion. During this event, if there is not adequate coolant flow along the clad surface of the fuel, there is a potential to exceed the departure from nucleate boiling ratio (DNBR) limit. Therefore, the required coolant flow is an initial condition of a design basis event that presents a challenge to the integrity of a fission product barrier.
AP1000 STS                              B 3.4.4-2                                        Rev. 1

RCS Loops B 3.4.4 BASES APPLICABLE SAFETY ANALYSES (continued)
Therefore, in MODE 3, 4 or 5 with the PLS capable of rod withdrawal or one or more rods not fully inserted, accidental control rod withdrawal from subcritical is postulated and requires the RCPs to be OPERABLE and in operation to ensure that the accident analysis limits are met.
RCS Loops satisfy Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
LCO              The purpose of this LCO is to require an adequate forced flow rate for core heat removal. Flow is represented by the number of RCPs in operation for removal of heat by the SGs. To meet safety analysis acceptance criteria for DNB, four pumps are required in MODES 1 and 2.
The requirement that four RCPs must be operating in MODES 3, 4, and 5 when the PLS is capable of rod withdrawal or one or more rods are not fully inserted provides assurance that, in the event of a rod withdrawal accident, there will be adequate flow in the core to avoid exceeding the DNBR limit. Bypass of the RCP variable speed control ensures that the pumps are operating at full flow.
This LCO is modified by a Note that permits all RCPs to be removed from operation in MODE 3, 4, or 5 for  1 hour per 8 hour period. The purpose of the Note is to permit tests that are designed to validate various accident analysis values. One of these tests is for the validation of the pump coastdown curve, used as input to a number of accident analyses including a loss of flow accident. This test is generally performed in MODE 3 during the initial startup testing program, and as such should only be performed once. If, however, changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values of the coastdown curve may need to be revalidated by conducting the test again.
No-flow testing may be performed in MODE 3, 4, or 5, and requires that the pumps be stopped for a short period of time. The Note permits removing all RCPs from operation in order to perform this testing and validate the assumed analysis values. The 1 hour time period specified is adequate to perform the desired tests and experience has shown that boron stratification is not a problem during this short period with no forced flow.
Utilization of the Note is permitted provided the following conditions are met along with any other conditions imposed by initial startup test procedures:
AP1000 STS                              B 3.4.4-3                                       Rev. 1

RCS Loops B 3.4.4 BASES LCO (continued)
: a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to ensure the SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to ensure that SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and
: b. Core outlet temperature is maintained 10&deg;F below saturation temperature, so that no vapor bubble may form and possibly cause natural circulation flow obstruction.
An OPERABLE RCS loop is composed of two OPERABLE RCPs in operation providing forced flow for heat transport and an OPERABLE SG.
APPLICABILITY   In MODES 1 and 2, the reactor is critical and thus has the potential to produce maximum THERMAL POWER. Thus, to ensure that the assumptions of the accident analyses remain valid, both RCS loops are required to be OPERABLE and in operation in these MODES to prevent DNB and core damage.
In MODES 3, 4 and 5, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. For these purposes and because the PLS is capable of rod withdrawal or one or more rods are not fully inserted, there is the possibility of an inadvertent rod withdrawal event. Four RCPs are required to be operating in MODES 3, 4 and 5, whenever the PLS is capable of rod withdrawal or one or more rods are not fully inserted.
Control rods are capable of withdrawal when one or more control rod drive mechanisms (CRDMs) is energized such that an automatic or manual signal could power the coils to withdraw the rod(s).
ACTIONS         Conditions A and B are modified by Notes that require completion of all Required Actions whenever the Condition is entered. This ensures that no attempt is made to restart a pump when all rods are not fully inserted, or when the PLS is capable of rod withdrawal, thus precluding events that are unanalyzed.
AP1000 STS                            B 3.4.4-4                                     Rev. 1

RCS Loops B 3.4.4 BASES ACTIONS (continued)
A.1, A.2, A.3, and A.4 If the requirements of the LCO are not met while in MODE 1 or 2, the Required Actions are to suspend the start of any RCP, reduce power and bring the plant to MODE 3 , initiate action to fully insert all rods, and place the PLS in a condition incapable of rod withdrawal. These actions prevent startup of an RCP and the resulting circulation of cold and/or unborated water from an inactive loop into the core, precluding reactivity excursion events that are unanalyzed, and lowers power level; thus reducing the core heat removal needs and minimizing the possibility of violating DNB limits.
When all four reactor coolant pumps are operating, a loss of a single reactor coolant pump above power level P-10 will result in an automatic reactor trip.
The Completion Time of 6 hours is reasonable to allow for an orderly transition to MODE 3. The applicable safety analyses described above bound Design Basis Accidents initiated with three RCPs operating at power levels below P-10.
B.1, B.2, and B.3 If the requirements of the LCO are not met while in MODE 3, 4 or 5, the Required Actions are to suspend the start of any RCP, initiate action to fully insert all rods, and place the PLS in a condition incapable of rod withdrawal. These actions prevent startup of an RCP and the resulting circulation of cold and/or unborated water from an inactive loop into the core, precluding reactivity excursion events that are unanalyzed, and eliminate the possibility of a rod withdrawal event with one or more pumps not operating, thus minimizing the possibility of violating DNB limits.
The Completion Time of 1 hour is reasonable to allow for making the PLS incapable of rod withdrawal and fully inserting all control rods, since plant cool down is not required.
AP1000 STS                                  B 3.4.4-5                                       Rev. 1

RCS Loops B 3.4.4 BASES SURVEILLANCE SR 3.4.4.1 REQUIREMENTS This SR requires verification every 12 hours that each RCS loop is in operation with the pump variable speed control bypassed. Verification includes flow rate and temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal while maintaining the margin to DNB. The Frequency of 12 hours is sufficient considering other indications and alarms available to the operator in the main control room to monitor RCS loop performance.
REFERENCES   1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                        B 3.4.4-6                                      Rev. 1

Pressurizer B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.5 Pressurizer BASES BACKGROUND          The pressurizer provides a point in the RCS where liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primary system pressure during steady state operation, and limiting the pressure changes caused by reactor coolant thermal expansion and contraction during normal load transients.
The normal level and pressure control components addressed by this LCO include the pressurizer water level, the heaters, their controls, and power supplies. Pressurizer safety valves (PSVs) and automatic depressurization valves are addressed by LCO 3.4.6, Pressurizer Safety Valves, and LCO 3.4.11, Automatic Depressurization System (ADS)  Operating, respectively.
The intent of the LCO is to ensure that a steam bubble exists in the pressurizer prior to power operation to minimize the consequences of potential overpressure transients. The presence of a steam bubble is consistent with analytical assumptions. Relatively small amounts of noncondensible gases can inhibit the condensation heat transfer between the pressurizer spray and the steam, and diminish the spray effectiveness for pressure control.
Electrical immersion heaters, located in the lower section of the pressurizer vessel, keep the water in the pressurizer at saturation temperature and maintain a constant operating pressure.
APPLICABLE          In MODES 1, 2, and 3, and MODE 4 with all four cold leg temperatures SAFETY              > 270&deg;F, the LCO requirement for a steam bubble is reflected implicitly in ANALYSES            the accident analyses. A steam bubble is credited in the safety analyses whenever the PSVs provide overpressure protection of the RCS. All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer.
In making this assumption, the analyses neglect the small fraction of noncondensible gases normally present.
Safety analyses presented in FSAR Chapter 15 (Ref. 1) do not take credit for pressurizer heater operation, however, an implicit initial AP1000 STS                                B 3.4.5-1                                       Rev. 1

Pressurizer B 3.4.5 BASES APPLICABLE SAFETY ANALYSES (continued) condition assumption of the safety analyses is that the RCS is operating at normal pressure.
The maximum pressurizer water level limit satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              The LCO requirement for the pressurizer water volume  92% of span ensures that an adequate steam bubble exists. Limiting the LCO maximum operating water level preserves the steam space for pressure control. This LCO Ensures the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure transients. Requiring the presence of a steam bubble is also consistent with analytical assumptions.
APPLICABILITY    The need for pressure control is most pertinent when core heat can cause the greatest effect on RCS temperature, resulting in the greatest effect on pressurizer level and RCS pressure control. Thus, Applicability has been designated for MODES 1 and 2. The Applicability is also provided for MODE 3 and for MODE 4 with all four cold leg temperatures
                 > 275&deg;F. The purpose is to prevent solid water RCS operation during heatup and cooldown to avoid rapid pressure rises caused by normal operational perturbation, such as reactor coolant pump startup. With at least one cold leg temperature  275&deg;F, overpressure protection is provided by LCO 3.4.14, Low Temperature Overpressure Protection (LTOP), and a steam bubble is not required.
ACTIONS          A.1, A.2, A.3, and A.4 Pressurizer water level control malfunctions or other plant evolutions may result in a pressurizer water level above the nominal upper limit, even with the plant at steady state conditions.
If the pressurizer water level is above the limit, action must be taken to restore the plant to operation within the bounds of the safety analyses.
This is done by placing the unit in MODE 3 with the Plant Control System in a condition incapable of rod withdrawal and action initiated to fully insert all control rods within 6 hours, and placing the unit in MODE 4 with at least one cold leg temperature  275&deg;F within 24 hours. This takes the AP1000 STS                              B 3.4.5-2                                       Rev. 1

Pressurizer B 3.4.5 BASES ACTIONS (continued) unit out of the applicable MODES and restores the unit to operation within the bounds of the safety analyses. Control rods are capable of withdrawal when one or more control rod drive mechanisms (CRDMs) is energized such that an automatic or manual signal could power the coils to withdraw the rod(s).
Pressurizer water level control malfunctions or other plant evolutions may result in a pressurizer water level above the nominal upper limit, even with the plant at steady state conditions.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
SURVEILLANCE        SR 3.4.5.1 REQUIREMENTS This SR requires that during steady state operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The Surveillance is performed by observing the indicated level. The Frequency of 12 hours corresponds to verifying the parameter each shift. The 12 hour interval has been shown by operating practice to be sufficient to regularly assess the level for any deviation and verify that operation is within safety analyses assumptions. Alarms are also available for early detection of abnormal level indications.
REFERENCES          1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                                 B 3.4.5-3                                       Rev. 1

Pressurizer Safety Valves B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.6 Pressurizer Safety Valves BASES BACKGROUND            The two pressurizer safety valves provide, in conjunction with the Protection and Safety Monitoring System (PMS), overpressure protection for the RCS. The pressurizer safety valves are totally enclosed, spring loaded, self-actuated valves with backpressure compensation. The safety valves are designed to prevent the system pressure from exceeding the system Safety Limit (SL), 2733.5 psig, which is 110% of the design pressure.
Because the safety valves are totally enclosed and self actuating, they are considered independent components. The minimum relief capacity for each valve, 750,000 lb/hr, is based on postulated overpressure transient conditions resulting from a complete loss of steam flow to the turbine. This event results in the maximum surge rate into the pressurizer, which specifies the minimum relief capacity for the safety valves. The pressurizer safety valves discharge into the containment atmosphere. This discharge flow is indicated by an increase in temperature downstream of the pressurizer safety valves.
Overpressure protection is required in MODES 1, 2, 3, 4, 5, and 6 when the reactor vessel head is on; however, in MODE 4 with at least one RCS cold leg temperature  275&deg;F, MODE 5, and MODE 6 with the reactor vessel head on, overpressure protection is provided by operating procedures and by meeting the requirements of LCO 3.4.14, Low Temperature Overpressure Protection (LTOP).
The upper and lower pressure limits are based on the +/- 1% tolerance requirement (Ref. 1) for lifting pressures above 1000 psig. The lift setting is for the ambient conditions associated with MODES 1, 2, and 3. This requires either that the valves be set hot or that a correlation between hot and cold settings be established.
The pressurizer safety valves are part of the primary success path and mitigate the effects of postulated accidents. OPERABILITY of the safety valves ensures that the RCS pressure will be limited to 110% of design pressure.
The consequences of exceeding the ASME Code, Section III pressure limit (Ref. 1) could include damage to RCS components, increased LEAKAGE, or a requirement to perform additional stress analyses prior to resumption of reactor operation.
AP1000 STS                                   B 3.4.6-1                                      Rev. 1

Pressurizer Safety Valves B 3.4.6 BASES APPLICABLE    All accident and safety analyses in FSAR Chapter 15 (Ref. 2) that require SAFETY        safety valve actuation assume operation of two pressurizer safety valves ANALYSES      to limit increases in the RCS pressure. The overpressure protection analysis (Ref. 3) is also based on operation of the two safety valves.
Accidents that could result in overpressurization if not properly terminated include:
: a. Uncontrolled rod withdrawal from full power;
: b. Loss of reactor coolant flow;
: c. Loss of external electrical load;
: d. Locked rotor; and
: e. Loss of AC power/loss of normal feedwater.
Detailed analyses of the above transients are contained in Reference 2.
Compliance with this LCO is consistent with the design bases and accident analyses assumptions.
Pressurizer safety valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO           The two pressurizer safety valves are set to open at the RCS design pressure (2500 psia), and within the ASME specified tolerance, to avoid exceeding the maximum design pressure SL, to maintain accident analyses assumptions, and to comply with ASME requirements. The upper and lower pressure tolerance limits are based on the +/- 1%
tolerance requirements (Ref. 1) for lifting pressures above 1000 psig.
The limit protected by this Specification is the Reactor Coolant Pressure Boundary (RCPB) SL of 110% of design pressure. Inoperability of one or more valves could result in exceeding the SL if a transient were to occur.
The consequences of exceeding the ASME pressure limit could include damage to one or more RCS components, increased LEAKAGE, or additional stress analysis being required prior to resumption of reactor operation.
APPLICABILITY In MODES 1, 2, and 3, and MODE 4 with all four cold leg temperatures
              > 275&deg;F, OPERABILITY of two valves is required because the combined capacity is required to keep reactor coolant pressure below 110% of its design value during certain accidents. MODE 3 and portions of MODE 4 are conservatively included although the listed accidents may not require the safety valves for protection.
AP1000 STS                           B 3.4.6-2                                     Rev. 1

Pressurizer Safety Valves B 3.4.6 BASES APPLICABILITY (continued)
The LCO is not applicable in MODE 4 with any cold leg temperature 275&deg;F, and in MODE 5, because overpressure protection is provided by LCO 3.4.14, Low Temperature Overpressure Protection (LTOP).
Overpressure protection is not required in MODE 6 with the reactor vessel head removed, or overpressure protection is provided by meeting the LTOP requirements of LCO 3.4.14.
The Note allows entry into MODES 3 and 4 with the lift setpoints outside the LCO limits. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition. Only one valve at a time may be made inoperable for hot lift setting adjustment. The 36 hour exception is based on an 18 hour outage time for each of the two valves. This period is derived from operating experience that has shown hot testing can be performed within 18 hours.
ACTIONS            A.1 With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS Overpressure Protection System. An inoperable safety valve coincident with an RCS overpressure event could challenge the integrity of the pressure boundary.
B.1 and B.2 If the Required Action of A.1 cannot be met within the required Completion Time or if two pressurizer safety valves are inoperable, the plant must be placed in a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 4 with at least one cold leg temperature 275&deg;F within 24 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
With at least one cold leg temperature  275&deg;F, overpressure protection is provided by the LTOP System. The change from MODE 1, 2, or 3 to MODE 4 with at least one cold leg temperature  275&deg;F reduces the RCS AP1000 STS                               B 3.4.6-3                                     Rev. 1

Pressurizer Safety Valves B 3.4.6 BASES ACTIONS (continued) energy (core power and pressure), lowers the potential for large pressurizer insurges, and thereby removes the need for overpressure protection by two pressurizer safety valves.
SURVEILLANCE        SR 3.4.6.1 REQUIREMENTS SRs are specified in the Inservice Testing Program. Pressurizer safety valves are to be tested one at a time and in accordance with the requirements of ASME OM Code (Ref. 4), which provides the activities and Frequency necessary to satisfy the SRs. No additional requirements are specified.
The pressurizer safety valve setpoint is +/- 1% for OPERABILITY, and the values are reset to remain within +/- 1% during the Surveillance to allow for drift.
REFERENCES          1. ASME Boiler and Pressure Vessel Code, Section III, NB 7500.
: 2. FSAR Chapter 15, Accident Analyses.
: 3. WCAP-16779, AP1000 Overpressure Protection Report, April 2007.
: 4. ASME OM Code, Code for Operation and Maintenance of Nuclear Power Plants.
AP1000 STS                                B 3.4.6-4                                     Rev. 1

RCS Operational LEAKAGE B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.7 RCS Operational LEAKAGE BASES BACKGROUND          Components that contain or transport the coolant to or from the reactor core comprise the RCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.
During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.
10 CFR 50, Appendix A, GDC 30 (Ref. 1), requires means for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting LEAKAGE detection systems.
The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area are necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur that is detrimental to the safety of the facility and the public.
A limited amount of LEAKAGE inside containment is expected from auxiliary systems that cannot be made 100% leaktight. LEAKAGE from these systems should be detected, located, and isolated from the containment atmosphere, if possible, so it does not interfere with RCS LEAKAGE detection.
This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).
AP1000 STS                                 B 3.4.7-1                                      Rev. 1

RCS Operational LEAKAGE B 3.4.7 BASES BACKGROUND (continued)
LCO 3.4.15, RCS Pressure Isolation Valve (PIV) Integrity, measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.
APPLICABLE       Except for primary to secondary LEAKAGE, the safety analyses do not SAFETY           address operational LEAKAGE. However, other operational LEAKAGE is ANALYSES         related to LOCA safety analyses. The amount of LEAKAGE can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes a 300 gpd primary to secondary LEAKAGE as the initial condition.
Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a steam line break (SLB) accident. To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR). The leak contaminates the secondary fluid.
The FSAR Chapter 15 (Ref. 3) analyses for the accidents involving secondary side releases assume 150 gpd primary to secondary LEAKAGE in each generator as an initial condition. The design basis radiological consequences resulting from a postulated SLB accident and SGTR are provided in Sections 15.1.5 and 15.6.3 of FSAR Chapter 15, respectively.
The RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              RCS operational LEAKAGE shall be limited to:
: a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.
AP1000 STS                              B 3.4.7-2                                        Rev. 1

RCS Operational LEAKAGE B 3.4.7 BASES LCO (continued)
: b. Unidentified LEAKAGE The LCO allows 0.5 gpm of unidentified LEAKAGE as a reasonable minimum detectable amount that the containment air F18 particulate radioactivity monitoring and containment sump level monitoring equipment, can detect within a reasonable time period. This leak rate supports leak before break (LBB) criteria. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.
: c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of unidentified LEAKAGE and is well within the capability of the RCS Makeup System. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include pressure boundary LEAKAGE.
Violation of this LCO could result in continued degradation of a component or system.
: d. Primary to Secondary LEAKAGE through One SG The limit of 150 gallons per day (gpd) per SG is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines (Ref. 4). The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, The RCS operational primary to secondary leakage through any one SG shall be limited to 150 gallons per day. The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational leakage rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.
: e. Primary to In-Containment Refueling Water Storage Tank (IRWST)
LEAKAGE through the Passive Residual Heat Removal Heat Exchanger (PRHR HX)
The 500 gpd limit from the PRHR HX is based on the assumption that a single crack leaking this amount would not lead to a PRHR HX tube rupture under the stress condition of an RCS pressure increase event. If the leakage is through many cracks, and the cracks are AP1000 STS                           B 3.4.7-3                                      Rev. 1

RCS Operational LEAKAGE B 3.4.7 BASES LCO (continued) very small, then the above assumption is conservative. This is conservative because the thickness of the PRHR HX tubes is approximately 60% greater than the thickness of the SG tubes.
Furthermore, a PRHR HX tube rupture would result in an isolable leak and would not lead to a direct release of radioactivity to the atmosphere.
APPLICABILITY   In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.
In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.
ACTIONS         A.1 Unidentified LEAKAGE or identified LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.
B.1 and B.2 If any pressure boundary LEAKAGE exists, or primary to secondary LEAKAGE is not within limits, or if unidentified or identified LEAKAGE cannot be reduced to within limits within 4 hours, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.
The reactor must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without ACTIONS challenging plant systems. In MODE 5, the pressure stresses acting on the RCPB are much lower, and further deterioration is much less likely.
AP1000 STS                            B 3.4.7-4                                         Rev. 1

RCS Operational LEAKAGE B 3.4.7 BASES SURVEILLANCE SR 3.4.7.1 REQUIREMENTS Verifying RCS LEAKAGE within the LCO limits ensures that the integrity of the RCPB is maintained. Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection.
Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory balance.
The RCS water inventory balance must be met with the reactor at steady state operating conditions. The Surveillance is modified by two Notes.
Note 1 states that this SR is not required to be performed until 12 hours after establishing steady state operation. The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established.
Steady state operation is required to perform a proper inventory balance since calculations during maneuvering are not useful. For RCS operational LEAKAGE determination by inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer level, and reactor coolant drain tank and in-containment refueling water storage tank (IRWST) levels.
RCS inventory monitoring via pressurizer level changes is valid in MODES 1, 2, 3, and 4 only when RCS conditions are stable (i.e., temperature is constant, pressure is constant, there is no makeup, and no letdown).
An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere F18 particulate radioactivity and the containment sump level. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. These LEAKAGE detection systems are specified in LCO 3.4.9, RCS LEAKAGE Detection Instrumentation.
Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 150 gpd cannot be measured accurately by an RCS water inventory balance.
The 72 hour Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early LEAKAGE detection in the prevention of accidents.
AP1000 STS                           B 3.4.7-5                                      Rev. 1

RCS Operational LEAKAGE B 3.4.7 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.4.7.2 This SR verifies that primary to secondary LEAKAGE is less than or equal to 150 gpd through any one SG. Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCO 3.4.17, Steam Generator Tube Integrity, should be evaluated. The 150 gpd limit is measured at room temperature as described in Reference 5. The operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.
The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours after establishment of steady state operation. For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer level, and reactor coolant drain tank and IRWST levels, and makeup and letdown flows.
The Surveillance Frequency of 72 hours is a reasonable interval to trend primary to secondary LEAKAGE and recognizes the importance of early LEAKAGE detection in the prevention of accidents. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Ref. 5).
REFERENCES      1. 10 CFR 50, Appendix A GDC 30.
: 2. Regulatory Guide 1.45, Revision 0, Reactor Coolant Pressure Boundary Leakage Detection Systems, May 1973.
: 3. FSAR Chapter 15, Accident Analyses.
: 4. Nuclear Energy Institute, NEI-97-06, Steam Generator Program Guidelines.
: 5. Electric Power Research Institute,(EPRI), Pressurized Water Reactor Primary-to-Secondary Leak Guidelines.
AP1000 STS                             B 3.4.7-6                                    Rev. 1

Minimum RCS Flow B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.8 Minimum RCS Flow BASES BACKGROUND         The RCS consists of the reactor vessel and two heat transfer loops, each containing a steam generator (SG), two reactor coolant pumps (RCPs), a single hot leg and two cold legs for circulating reactor coolant. Loop 1 also contains connections to the pressurizer and passive residual heat removal (PRHR).
The primary function of the reactor coolant is removal of decay heat and the transfer of this heat, via the SGs to the secondary plant fluid. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.
APPLICABLE         An initial condition in the Design Basis Accident (DBA) analysis of a SAFETY             possible Boron Dilution Event (BDE) in MODE 3, 4, or 5 is the ANALYSES           assumption of a minimum mixing flow in the RCS. In this scenario, dilute water is inadvertently introduced into the RCS, is uniformly mixed with the primary coolant, and flows to the core. The increase in reactivity is detected by the source range neutron flux instrumentation which provides a signal to terminate the inadvertent dilution before the available SDM is lost. If there is inadequate mixing in the RCS, the dilute water may stratify in the primary system, and there will be no indication by the source range neutron flux instrumentation that a dilution event is in progress. When primary flow is finally increased, the dilution event may have progressed to the point that mitigation by the source range neutron flux instrumentation is too late to prevent the loss of SDM.
Thus, a minimum mixing flow in the RCS is a process variable that is an initial condition in a DBA analysis.
Minimum RCS Flow satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                The requirement that one RCP be in operation with a minimum core flow of  3000 gpm provides assurance that in the event of an inadvertent BDE, the diluted water will be properly mixed with the primary system coolant, and the increase in core reactivity will be detected by the source range neutron flux instrumentation. A core flow of < 3000 gpm is considered equivalent to no RCP in operation.
AP1000 STS                                 B 3.4.8-1                                      Rev. 1

Minimum RCS Flow B 3.4.8 BASES LCO (continued)
The LCO is modified by a Note that permits all RCPs to be removed from operation for  1 hour per 8 hour period for the purpose of testing. This Note also permits an unborated water source through the chemical mixing tank to be temporarily unisolated under administrative controls with no RCPs in operation for the purpose of chemical addition to the pressurizer. The purpose of the testing allowance is to permit tests that are designed to validate various accident analysis values. One of these tests is for the validation of the pump coastdown curve, used as input to a number of accident analyses including a loss of flow accident. This test is generally performed in MODE 3 during the initial startup testing program, and as such should only be performed once. If, however, changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values of the coastdown curve may need to be revalidated by conducting the test again.
No-flow testing may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits removing all RCPs from operation in order to perform this testing and validate the assumed analysis values. The 1-hour time period specified is adequate to perform the desired tests and experience has shown that boron stratification is not a problem during this short period with no forced flow.
Additionally, the Note allows chemical additions to be performed and mixed with Chemical and Volume Control System (CVS) makeup operations using a blend of borated water and unborated water sources for the purpose of achieving proper RCS water quality. In this case, RCPs are not initially running; therefore, the allowance is made to permit chemical addition to the pressurizer under administrative controls so that the Applicability can be entered without violating the requirement for an RCP to be in operation during chemical addition. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with a dedicated operator in the control room. In this way, the flow path from the chemical mixing tank to the RCS can be rapidly isolated locally or from the control room after completion of the limited duration chemical addition, or if flow rates indicate the potential for inadequately borated blended flow.
AP1000 STS                             B 3.4.8-2                                       Rev. 1

Minimum RCS Flow B 3.4.8 BASES LCO (continued)
Utilization of the Note is permitted provided the following conditions are met along with any other conditions imposed by procedures:
: a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to ensure the SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to ensure that the required SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when RCS flow is by natural circulation; and
: b. Core outlet temperature is maintained 10&deg;F below saturation temperature, so that no vapor bubble may form and possibly cause natural circulation flow obstruction.
APPLICABILITY   Minimum RCS flow is required in MODES 3, 4, and 5 with unborated water sources not isolated from the RCS because an inadvertent BDE is considered possible in these MODES.
In MODES 1 and 2, and in MODES 3, 4, and 5 with the Plant Control System capable of rod withdrawal or one or more rods not fully inserted, LCO 3.4.4 requires all four RCPs to be in operation. Thus, in the event of an inadvertent boron dilution, adequate mixing will occur.
A minimum mixing flow is not required in MODE 6 because LCO 3.9.2 requires that all valves used to isolate unborated water sources shall be secured in the closed position. In this situation, an inadvertent BDE is not considered credible.
ACTIONS         A.1 If no RCP is in operation, all sources of unborated water must be isolated within 1 hour. This action ensures that no unborated water will be introduced into the RCS when proper mixing cannot be assured. The allowed Completion Time requires that prompt action be taken, and is based on the low probability of a DBA occurring during this time.
AP1000 STS                              B 3.4.8-3                                     Rev. 1

Minimum RCS Flow B 3.4.8 BASES ACTIONS (continued)
A.2 The Requirement to perform SR 3.1.1.1 (SDM verification) within 1 hour ensures that if the boron concentration in the RCS has been reduced and not detected by the source range neutron flux instrumentation, prompt action may be taken to restore the required SDM. The allowed Completion Time is consistent with that required by Action A.1 because the conditions and consequences are the same.
Condition A is modified by a Note that requires Required Action A.2 to be performed prior to starting any RCP whenever the Condition is entered.
This ensures that SR 3.1.1.1 will be performed prior to starting an RCP, even when Condition A is exited prior to performing Required Action A.2.
Performance of SR 3.1.1.1 is necessary to assure SDM is properly evaluated prior to starting an RCP.
SURVEILLANCE        SR 3.4.8.1 REQUIREMENTS This Surveillance requires verification every 12 hours that a minimum mixing flow is present in the RCS. A Frequency of 12 hours is adequate considering the low probability of an inadvertent BDE during this time, and the ease of verifying the required RCS flow.
REFERENCES          None.
AP1000 STS                                B 3.4.8-4                                      Rev. 1

RCS Leakage Detection Instrumentation B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.9 RCS Leakage Detection Instrumentation BASES BACKGROUND         GDC 30 of Appendix A to 10 CFR 50 (Ref. 1) requires means for detecting, and, to the extent practical, identifying the source of RCS LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting LEAKAGE detection systems.
LEAKAGE detection systems must have the capability to detect significant reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE.
The containment sump used to collect unidentified LEAKAGE, is instrumented to alarm for increases of 0.5 gpm in the normal flow rates.
Note that the containment sump level instruments are also used to identify leakage from the main steam lines inside containment. Since there is not another method to identify steam line leakage in a short time frame, two sump level sensors are required to be OPERABLE. The containment water level sensors (LCO 3.3.17, PAM Instrumentation) provide a diverse backup method for steam line leakage detection inside containment. However, this LCO does not require the containment water level sensors to be OPERABLE.
The reactor coolant contains radioactivity that, when released to the containment, can be detected by radiation monitoring instrumentation.
Reactor coolant radioactivity used for leak detection is the decay of F18.
The production of F18 is proportional to the reactor power level; and is not dependent on the presence of fuel defects or coolant impurities such as corrosion products. Due to its short half-life, F18 is not present in the reactor coolant after refueling. Its concentration in the reactor coolant only increases with increasing neutron flux. By the time THERMAL POWER has reached 20% RTP, the concentration of F18 in the reactor coolant is great enough that its presence in the containment atmosphere due to LEAKAGE would be detectable. F18 becomes a particulate after leaving the RCS; therefore, its particulate form is used for leak detection.
The Radiation Monitoring System includes monitoring F18 particulate activity to provide leak detection.
The containment sump level and F18 particulate leakage monitoring methods differ in sensitivity and response time.
AP1000 STS                                B 3.4.9-1                                       Rev. 1

RCS Leakage Detection Instrumentation B 3.4.9 BASES APPLICABLE The need to evaluate the severity of an alarm or an indication is SAFETY     important to the operators, and the ability to compare and verify with ANALYSES   indications from other systems is necessary. The LEAKAGE detection systems are described in FSAR Chapter 5 (Ref. 3).
The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leak occur.
RCS LEAKAGE detection instrumentation satisfies Criterion 1 of 10 CFR 50.36(c)(2)(ii).
LCO        This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide confidence that small amounts of unidentified LEAKAGE are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.
The LCO requires three instruments to be OPERABLE, subject to the exceptions and timing of plant evolutions in the Applicability Notes, as discussed below.
The containment sump is used to collect unidentified LEAKAGE. The monitors on the containment sump detect level and are instrumented to detect when there is an increase above the normal value by 0.5 gpm.
The identification of an increase in unidentified LEAKAGE will be delayed by the time required for the unidentified LEAKAGE to travel to the containment sump; and it may take longer than 1 hour to detect a 0.5 gpm increase in unidentified LEAKAGE because of this transit time.
This sensitivity is acceptable for containment sump monitor OPERABILITY.
The reactor coolant contains radioactivity that, when released to the containment, can be detected by the containment atmosphere F18 particulate monitor. The LCO requires the containment atmosphere F18 particulate monitor because of the sensitivity of the particulate monitor and its rapid response to RCS LEAKAGE. A gaseous radioactivity monitor is also available; but has recognized limitations. Reactor coolant radioactivity levels will be low during initial reactor startup, and for a few weeks thereafter, until activated corrosion products form, or in the event that fission products appear from fuel element cladding contamination or cladding defects. If there are few fuel element cladding defects and low AP1000 STS                        B 3.4.9-2                                          Rev. 1

RCS Leakage Detection Instrumentation B 3.4.9 BASES LCO (continued) levels of activation products, it might not be possible for the containment atmosphere gaseous radiation monitor to detect a 0.5 gpm increase within 1 hour during normal operation.
The containment atmosphere F18 particulate monitor has adequate sensitivity to detect LEAKAGE without the presence of fuel defects or activated cladding contamination or corrosion products. The containment atmosphere F18 particulate monitor is OPERABLE when it is capable of detecting a 0.5 gpm increase in unidentified LEAKAGE within 1 hour given nominal plant operating conditions (e.g., no containment purge operations) at full power and an RCS F18 activity consistent with industry experience in the absence of fuel defects or significant activated cladding contamination or corrosion products.
The LCO is satisfied when monitors of diverse measurement means are available. Thus, two containment sump level monitors, in combination with a containment atmosphere F18 particulate monitor, provide an acceptable minimum. Containment sump level monitoring is performed by two of the three redundant, seismically qualified level instruments.
APPLICABILITY   Because of elevated RCS temperature and pressure in MODES 1, 2, 3, and 4, RCS LEAKAGE detection instrumentation is required to be OPERABLE.
In MODE 5 or 6, the temperature is  200&deg;F and pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are lower than those for MODES 1, 2, 3, and 4, the likelihood of LEAKAGE and crack propagation are much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.
Containment sump level monitoring is required for detecting LEAKAGE in MODES 1, 2, 3, and 4.
The Applicability is modified by Note 1 in recognition of reductions in LEAKAGE detection capability caused by plant evolutions that divert potential LEAKAGE away from the containment sump (i.e., redirection from the containment sump to the in-containment refueling water storage tank (IRWST) by the IRWST gutter drain isolation valves or containment purge operation, which may add or remove moisture from the containment atmosphere) or the containment atmosphere F18 particulate monitor (i.e., containment purge operation, which removes airborne radiation from the containment atmosphere). Those evolutions include AP1000 STS                             B 3.4.9-3                                       Rev. 1

RCS Leakage Detection Instrumentation B 3.4.9 BASES APPLICABILITY (continued)
IRWST gutter drain isolation for testing or maintenance (during which closure of valves PXS-PL-130A/B redirects potential LEAKAGE to the IRWST) and containment purge operations during which none of the RCS LEAKAGE detection instrumentation is required to be OPERABLE.
As provided by Note 1, when plant evolutions that affect the RCS LEAKAGE detection instrumentation occur, the instrumentation is not required to be OPERABLE as long as the RCS water inventory balance prescribed in SR 3.4.7.1 of LCO 3.4.7, RCS Operational LEAKAGE, is performed once per 24 hours after 12 hours of steady state operation (stable RCS pressure, temperature, power level, pressurizer level, and reactor coolant drain tank (RCDT) and IRWST levels). The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established. The 24 hour Frequency required by Applicability Note 1 also applies during a 2 hour normalization period following the reopening of the IRWST gutter drain isolation valves and after closure of the containment purge flow path.
Applicability Note 2 states that containment atmosphere F18 particulate radioactivity LEAKAGE measurement during MODE 1 is only required when THERMAL POWER is > 20% RTP.
ACTIONS            The ACTIONS are modified by a Note that indicates that the provisions of LCO 3.0.4 are not applicable. As a result, a MODE change is allowed when required leakage detection channels are inoperable. This allowance is provided because in each ACTIONS Condition, other instrumentation is available to monitor for RCS LEAKAGE and for steam line leakage.
A.1 With one of the two required containment sump level channels inoperable, the one remaining required OPERABLE channel is sufficient for RCS leakage monitoring since the containment radiation provides a method to monitor RCS leakage. The remaining required OPERABLE sump level monitor is adequate for steam line leakage monitoring. The containment sump level instruments are capable of detecting a volume change of less than 2 gallons.
Restoration of two containment sump level channels to OPERABLE status is required to regain sump level indication redundancy in a Completion Time of 14 days after discovery of one sump level channel AP1000 STS                                B 3.4.9-4                                    Rev. 1

RCS Leakage Detection Instrumentation B 3.4.9 BASES ACTIONS (continued) failure. This time is acceptable, considering the Frequency of SR 3.4.9.1 and the available required channel.
B.1 and B.2 With both required containment sump level channels inoperable, no other form of sampling can provide the equivalent information; however, the containment atmosphere F18 particulate radioactivity monitor will provide indications of changes in LEAKAGE. The containment atmosphere F18 particulate monitor together with performance of an RCS inventory balance (SR 3.4.7.1) on an increased Frequency of every 24 hours provides information that is adequate to detect RCS LEAKAGE. The sensors monitoring containment water level provide information that is adequate for steam line leakage. A Note is provided for Required Action B.1 allowing that SR 3.4.7.1 is not required to be initially performed until 12 hours after establishing steady state operation (defined as stable RCS pressure, temperature, power level, pressurizer level, and RCDT and IRWST levels). The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established.
Restoration of one containment sump level channel to OPERABLE status is required to regain the sump level indication function in a Completion Time of 72 hours after discovery of the second sump level channel failure.
This time is acceptable, considering the leak detection diversity and the Frequency of performing SR 3.4.7.1.
C.1.1, C.1.2, and C.2 With the containment atmosphere F18 particulate monitoring instrumentation channel inoperable, action is required. Either grab samples of the containment atmosphere must be taken and analyzed or an RCS inventory balance must be performed, in accordance with SR 3.4.7.1, every 24 hours to provide alternative periodic information.
With a containment atmosphere sample obtained and analyzed or an RCS inventory balance performed every 24 hours, the reactor may be operated for up to 30 days to allow restoration of the F18 particulate monitor to OPERABLE status.
The 24 hour interval for grab samples or an RCS inventory balance provides periodic information that is adequate to detect LEAKAGE. A Note is provided for Required Action C.1.2 allowing that SR 3.4.7.1 is not AP1000 STS                               B 3.4.9-5                                        Rev. 1

RCS Leakage Detection Instrumentation B 3.4.9 BASES ACTIONS (continued) required to be initially performed until 12 hours after establishing steady state operation (defined as stable RCS pressure, temperature, power level, pressurizer level, and RCDT and IRWST levels). The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established. The 30 day Completion Time recognizes that one other form of leak detection is available.
D.1 and D.2 If a Required Action of Condition A, B or C cannot be met within the required Completion Time, the reactor must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
E.1 With all required monitors inoperable, no LCO required automatic means of monitoring LEAKAGE are available and shutting down the plant in accordance with LCO 3.0.3 is required.
SURVEILLANCE        SR 3.4.9.1 REQUIREMENTS SR 3.4.9.1 requires the performance of a CHANNEL CHECK of the containment atmosphere F18 particulate monitor and the required containment sump level channels. The check gives reasonable confidence that the required instrumentation and associated channels are operating properly. The Frequency of 12 hours is based on instrument reliability and risk and is reasonable for detecting off normal conditions.
SR 3.4.9.2 SR 3.4.9.2 requires the performance of a CHANNEL OPERATIONAL TEST (COT) on the containment atmosphere F18 particulate monitor.
The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string. The Frequency of 92 days considers risks and instrument reliability, and operating experience has shown that it is proper for detecting degradation.
AP1000 STS                                  B 3.4.9-6                                      Rev. 1

RCS Leakage Detection Instrumentation B 3.4.9 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.4.9.3 This SR requires the performance of a CHANNEL CALIBRATION for each of the required RCS Leakage detection instrumentation channels.
The calibration verifies the accuracy of the instrument strings, including the instruments located inside containment. The Frequency of 24 months is a typical refueling cycle and considers channel reliability.
Operating experience has shown that this Frequency is acceptable.
REFERENCES      1. 10 CFR 50, Appendix A, Section IV, GDC 30.
: 2. Regulatory Guide 1.45, Reactor Coolant Pressure Boundary Leakage Detection Systems, Rev. 0, May 1973.
: 3. FSAR Section 5.2.5, Detection of Leakage Through Reactor Coolant Pressure Boundary.
AP1000 STS                            B 3.4.9-7                                       Rev. 1

RCS Specific Activity B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.10 RCS Specific Activity BASES BACKGROUND           The limits on RCS specific activity ensure that the doses due to postulated accidents are within the doses reported in Chapter 15.
The RCS specific activity LCO limits the allowable concentration of iodines and noble gases in the reactor coolant. The LCO limits are established to be consistent with a fuel defect level of 0.25% and to ensure that plant operation remains within the conditions assumed for shielding and Design Basis Accident (DBA) release analyses.
The LCO contains specific activity limits for both DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133. The allowable levels are intended to limit the doses due to postulated accidents to within the values calculated in the radiological consequences analyses (as reported in FSAR Chapter 15).
APPLICABLE           The LCO limits on the reactor coolant specific activity are a factor in SAFETY               accident analyses that assume a release of primary coolant to the ANALYSES             environment.
The events which incorporate the LCO values for primary coolant specific activity in the radiological consequence analysis include the following:
Steam generator tube rupture (SGTR)
Steam line break (SLB)
Locked RCP rotor Rod ejection Small line break outside containment Loss of coolant accident (LOCA) (early stages)
The limiting event for release of primary coolant activity is the SLB. The SLB dose analysis considers the possibility of a pre-existing iodine spike (in which case the maximum LCO of 60 Ci/gm DOSE EQUIVALENT I-131 is assumed) as well as the more likely initiation of an iodine spike due to the reactor trip and depressurization. In the latter case, the LCO of 1.0 Ci/gm DOSE EQUIVALENT I-131 is assumed at the initiation of the accident, but the primary coolant specific activity is assumed to increase with time due to the elevated iodine appearance rate in the coolant. The reactor coolant noble gas specific activity for both cases is assumed to be the LCO of 280 Ci/gm DOSE EQUIVALENT XE-133.
AP1000 STS                                  B 3.4.10-1                                     Rev. 1

RCS Specific Activity B 3.4.10 BASES APPLICABLE SAFETY ANALYSES (continued)
The safety analysis assumes the specific activity of the secondary coolant at its limit of 0.01 Ci/gm DOSE EQUIVALENT I-131 from LCO 3.7.4, Secondary Specific Activity.
The LCO limits ensure that, in either case, the doses reported in FSAR Chapter 15 remain bounding.
The RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              The specific iodine activity is limited to 1.0 Ci/gm DOSE EQUIVALENT I-131, and the specific noble gas activity is limited to 280 Ci/gm DOSE EQUIVALENT XE-133. These limits ensure that the doses resulting from a DBA will be within the values reported in Chapter 15. Secondary coolant activities are addressed by LCO 3.7.4, Secondary Specific Activity.
The SLB and SGTR accident analyses (Refs. 1 and 2) show that the offsite doses are within acceptance limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SLB or SGTR accident, lead to doses that exceed those reported Chapter 15.
APPLICABILITY    In MODES 1 and 2, and in MODE 3 with RCS average temperature 500&deg;F, operation within the LCO limits for DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133 specific activity are necessary to contain the potential consequences of a SGTR to within the calculated site boundary dose values.
For operation in MODE 3 with RCS average temperature < 500&deg;F and in MODES 4 and 5, the release of radioactivity in the event of a SGTR is unlikely since the saturation pressure of the reactor coolant is below the lift pressure settings of the main steam safety valves. In MODES 5 and 6, the RCS pressure and temperature are reduced and an SGTR event is not credible.
ACTIONS          A.1 and A.2 With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of 4 hours must be taken to verify that DOSE EQUIVALENT AP1000 STS                              B 3.4.10-2                                       Rev. 1

RCS Specific Activity B 3.4.10 BASES ACTIONS I-131 is  60 Ci/gm. The Completion Time of 4 hours is required to obtain and analyze a sample. Sampling is to continue to provide a trend.
The DOSE EQUIVALENT I-131 must be restored to normal within 48 hours. If the concentration cannot be restored to within the LCO limit in 48 hours, it is assumed that the LCO violation is not the result of normal iodine spiking.
A Note to the Required Action of Condition A excludes the MODE change restriction of LCO 3.0.4. This exception allows entry into the applicable MODE(S) while relying on the ACTIONS even though the ACTIONS may eventually require plant shutdown. This exception is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to power operation.
B.1 With DOSE EQUIVALENT XE-133 in excess of the allowed limit, the plant must be placed in a MODE or condition in which the LCO requirements are not applicable. This is done by placing the plant in MODE 3 with RCS average temperature < 500F within 6 hours.
The change to MODE 3 and RCS average temperature < 500&deg;F lowers the saturation pressure of the reactor coolant below the set points of the main steam safety valves, and prevents venting the SG to the environment in a SGTR event. The allowed Completion Time of 6 hours is reasonable, based on operating experience to reach MODE 3 from full power conditions in an orderly manner, without challenging plant systems.
C.1 If a Required Action and the associated Completion Time of Condition A is not met or if the DOSE EQUIVALENT I-131 is > 60 Ci/gm., the reactor must be brought to MODE 3 with RCS average temperature
           < 500&deg;F within 6 hours. The Completion Time of 6 hours is reasonable, based on operation experience, to reach MODE 3 below 500&deg;F from full power conditions in an orderly manner and without challenging plant systems.
AP1000 STS                        B 3.4.10-3                                        Rev. 1

RCS Specific Activity B 3.4.10 BASES SURVEILLANCE SR 3.4.10.1 REQUIREMENTS SR 3.4.10.1 requires performing a measure of the noble gas specific activity of the reactor coolant once every 7 days. This is a quantitative measure of radionuclides with half lives longer than 15 minutes. This Surveillance provides an indication of any increase in the release of noble gas activity from fuel rods containing cladding defects.
Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The 7 day Frequency considers the unlikelihood of a significant increase in fuel defect level during the time.
SR 3.4.10.2 This Surveillance is performed in MODE 1 only to ensure iodine remains within limit during normal operation and following fast power changes when increased releases of iodine from the fuel (iodine spiking) is apt to occur. The 14 day Frequency is adequate to trend changes in the iodine activity level. The Frequency, between 2 and 6 hours after a power change of  15% RTP within a 1 hour period, is established because the iodine levels peak during this time following fuel failures; samples at other times would provide inaccurate results.
REFERENCES   1. FSAR Section 15.1.5, Steam System Piping Failure.
: 2. FSAR Section 15.6.3, Steam Generator Tube Rupture.
AP1000 STS                         B 3.4.10-4                                      Rev. 1

ADS - Operating B 3.4.11 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.11 Automatic Depressurization System (ADS) - Operating BASES BACKGROUND           The ADS is designed to assure that core cooling and injection can be achieved for Design Basis Accidents (DBA). The four stages of ADS valves are sequenced in coordination with the passive core cooling system injection performance characteristics. Actuation of the ADS Stage 1, 2, and 3 valves depressurizes the Reactor Coolant System (RCS) to a pressure below which the ADS Stage 4 valves may be actuated without exceeding allowed Stage 4 piping loads. Actuation of the Stage 4 valves opens flow paths from the hot legs into the associated steam generator compartment that facilitate gravity injection (draining) of the in-containment refueling water storage tank (IRWST) into the RCS.
The ADS consists of 10 flow paths arranged in four different stages that open sequentially (Ref. 1). Stages 1, 2, and 3 each include 2 flow paths.
Each of the Stage 1, 2, 3 flow paths has a common inlet header connected to the top of the pressurizer. The outlets of the Stage 1, 2, 3 flow paths combine into one of the two common discharge lines to the spargers located in the IRWST. The first stage valves are 4 inch valves with DC motor operators. The second and third stage valves are 8 inch valves with DC motor operators. An OPERABLE Stage 1, 2, or 3 automatic depressurization flow path consists of two OPERABLE normally closed motor operated valves, in series. A single failure of electrical division A or B affects one 4 inch Stage 1 flow path and one 8 inch Stage 3 flow path. A single failure of electrical division C or D affects one 8 inch Stage 2 flow path.
Stage 4 includes 4 flow paths. The fourth stage ADS valves are 14 inch squib valves. The four fourth stage flow paths connect directly to the top of the reactor coolant hot legs and vent directly into the associated steam generator compartment. An OPERABLE Stage 4 flow path consists of an open motor operated valve and an OPERABLE closed squib valve.
These motor operated valves are not required to be OPERABLE because they are open. Each Stage 4 squib valve is actuated by two divisions; A and C, or B and D. Therefore, loss of a single electrical division will not prevent any opening of any 14 inch flow path. ADS Stage 4 flow paths are also actuated by the Diverse Actuation System and a non-Class 1E battery.
The automatic depressurization valves are designed to open automatically when actuated, and to remain open for the duration of any automatic depressurization event. The valves are actuated sequentially.
AP1000 STS                                 B 3.4.11-1                                        Rev. 1

ADS - Operating B 3.4.11 BASES BACKGROUND (continued)
The Stage 1 valves are actuated on a Low-3 core makeup tank (CMT) level. Stages 2 and 3 are actuated on the Stage 1 signal plus time delays. Stage 4 is actuated on a Low 6 CMT level signal with a minimum time delay after Stage 3. Stage 4 is blocked from actuating at normal RCS pressure.
ADS blocking devices are provided to minimize the likelihood of spurious ADS actuation. The ADS injection blocking device in each PMS division provides an output to the ADS valve component interface module (CIM) to prevent the ADS actuation unless other plant parameters indicate that an actuation is necessary. A low level in either one or both CMTs will unblock the ADS actuation in each division.
In order to perform a controlled, manual depressurization of the RCS, the valves are opened starting with the first stage. The first stage valves can also be modulated to perform a partial RCS depressurization if required.
ADS Stages 1, 2, and 3 valves may be manually operated under controlled conditions for testing purposes.
ADS Stages 1, 2 and 3 valves are designed to open relatively slowly, from approximately 48 seconds for the first stage valves, to approximately 120 seconds for the second and third stage valves.
The ADS valves are powered by batteries. In the unlikely event that offsite and onsite AC power is lost for an extended period of time, a timer will actuate ADS within 24 hours of the time at which AC power is lost, before battery power has been degraded to the point where the valves cannot be opened.
The number and capacity of the ADS flow paths are selected so that adequate safety injection is provided from the accumulators, IRWST and containment recirculation for the limiting DBA loss of coolant accident (LOCA). For small break LOCAs the limiting single failure is the loss of one fourth stage flow path (Ref. 2). The probabilistic risk assessment (PRA) (Ref. 3) shows that adequate core cooling can be provided with the failure of up to seven (all ADS Stage 1 to 3 and one ADS Stage 4) flow paths. The ADS PRA success criteria following a LOCA or non-LOCA with failure of other decay heat removal features is for three of four ADS Stage 4 valves to open. All of the ADS Stages 1, 2, and 3 valves can fail to open. This ADS capacity is sufficient to support PXS gravity injection and containment recirculation operation.
AP1000 STS                             B 3.4.11-2                                      Rev. 1

ADS - Operating B 3.4.11 BASES APPLICABLE    For non-LOCA events, use of the ADS is not required and is not SAFETY        anticipated. For these events, injection of borated water into the core ANALYSES      from the CMTs may be required for makeup or boration. However, the amount of water necessary will not reduce the level in the CMTs to the point of ADS actuation.
For events which involve a loss of primary coolant inventory, such as a LOCA, the ADS will be actuated, allowing for injection from the accumulators, the IRWST, and the containment recirculation (Ref. 2).
The ADS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO           The requirement that ten ADS flow paths be OPERABLE ensures that upon actuation, the depressurization of the RCS will proceed smoothly and completely, as assumed in the DBA safety analyses.
For the ten ADS flow paths to be considered OPERABLE, the 16 ADS valves must be capable of opening on an actuation signal. In addition, the Stage 4 motor operated isolation valves must be open. These Stage 4 motor operated isolation valves are not required to be OPERABLE because they are maintained open per SR 3.4.11.1. Each Stage 4 squib valve is OPERABLE when capable of actuation by two igniters supplied by independent Class 1E electrical divisions.
APPLICABILITY In MODES 1, 2, 3 and 4 the ADS must be OPERABLE to mitigate the potential consequences of any event which causes a reduction in the RCS inventory, such as a LOCA.
The requirements for the ADS in MODES 5 and 6 are specified in LCO 3.4.12, Automatic Depressurization System (ADS)  Shutdown, RCS Intact, and LCO 3.4.13, Automatic Depressurization System Shutdown, RCS Open.
ACTIONS       A.1 If any one flow path in ADS Stage 1, 2, or 3 is determined to be inoperable, the remaining OPERABLE ADS flow paths are more than adequate to perform the required safety function as long as a single failure involving a flow path in ADS Stage 4 or two additional flow paths in ADS Stage 1, 2, or 3 does not also occur. A Completion Time of 7 days is reasonable based on the capability of the remaining ADS valves to AP1000 STS                           B 3.4.11-3                                    Rev. 1

ADS - Operating B 3.4.11 BASES ACTIONS (continued) perform the required safety functions assumed in the safety analyses and the low probability of a DBA during this time period.
If more than one flow path in ADS Stage 1, 2, or 3 is inoperable, Condition C or D is also applicable.
B.1 If any one flow path in ADS Stage 4 is determined to be inoperable, the remaining OPERABLE flow paths in ADS Stage 4 are adequate to perform the required safety function as long as a single failure does not also occur. A Completion Time of 72 hours is reasonable based on the capability of the remaining ADS valves to perform the required safety functions assumed in the safety analyses and the low probability of a DBA during this time period. This Completion Time is the same as is used for two train ECCS systems which are capable of performing their safety function without a single failure.
C.1 If one flow path in ADS Stage 1 and one flow path in ADS Stage 2 or 3, or two flow paths in ADS Stage 1 are determined to be inoperable, the remaining OPERABLE ADS flow paths are adequate to perform the required safety function as long as a single failure does not also occur.
This Condition is equivalent to the worst case single failure of electrical division A or B, which would render one 4 inch flow path in ADS Stage 1 and one 8 inch flow path in ADS stage 3 inoperable.
A Completion Time of 72 hours to restore one flow path to OPERABLE status is reasonable based on the capability of the remaining ADS valves to perform the required safety functions assumed in the safety analyses and the low probability of a DBA during this time period. This Completion Time is the same as is used for two train ECCS systems which are capable of performing their safety function without a single failure.
If three or more of the six flow paths in ADS Stages 1, 2, and 3 are inoperable, Condition D is applicable.
D.1 and D.2 If a Required Action and associated Completion Time of Condition A, B, or C are not met, or Condition A and Condition B are entered concurrently, or three or more of the six flow paths in ADS Stages 1, 2, AP1000 STS                                B 3.4.11-4                                      Rev. 1

ADS - Operating B 3.4.11 BASES ACTIONS (continued) and 3 are inoperable, or LCO 3.4.11 is not met for reasons other than Condition A, B, or C, the plant must be brought to MODE 5 where the probability and consequences of an event are minimized. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner, without challenging plant systems.
SURVEILLANCE        SR 3.4.11.1 REQUIREMENTS Each ADS Stage 4 isolation motor operated valve must be verified to be open every 12 hours. Note that these valves receive confirmatory open signals. The Surveillance Frequency is acceptable considering valve position is manually monitored in the control room.
SR 3.4.11.2 This Surveillance requires verification that each motor operated valve in ADS Stages 1, 2, and 3 strokes to its fully open position. Note that this Surveillance is performed during shutdown conditions.
The Surveillance Frequency for demonstrating valve OPERABILITY references the Inservice Testing Program (Ref. 4).
SR 3.4.11.3 This Surveillance requires verification that each ADS Stage 4 squib valve is OPERABLE in accordance with the Inservice Testing Program. The Surveillance Frequency for verifying valve OPERABILITY references the Inservice Testing Program.
The squib valves will be tested in accordance with the ASME OM Code (Ref. 5). The applicable ASME OM Code squib valve requirements are specified in paragraph ISTC-5260.
SR 3.4.11.4 This SR verifies that each Stage 1, 2, and 3 ADS valve actuates to the correct position on an actual or simulated actuation signal. The ADS and IRWST injection blocking device ACTUATION LOGIC TEST provides overlap with this Surveillance.
AP1000 STS                               B 3.4.11-5                                     Rev. 1

ADS - Operating B 3.4.11 BASES SURVEILLANCE REQUIREMENTS (continued)
The Frequency of 24 months is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operation.
SR 3.4.11.5 This SR verifies that each Stage 4 ADS valve actuates to the correct position on an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves. The ADS and IRWST injection blocking device ACTUATION LOGIC TEST provides overlap with this Surveillance. The OPERABILITY of the squib valves is checked by performing a continuity check of the circuit from the Protection Logic Cabinets to the squib valve.
This Surveillance is modified by a Note that excludes squib valve actuation as a requirement for this Surveillance to be met. This is acceptable because the design of the squib actuated valve was selected for this application because of its very high reliability. The OPERABILITY of squib actuated valves is verified by the Inservice Test Program for squib actuated valves.
The Frequency of 24 months is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operation.
REFERENCES      1. FSAR Section 6.3, Passive Core Cooling System.
: 2. FSAR Section 15.6, Decrease in Reactor Coolant Inventory.
: 3. AP1000 Probabilistic Risk Assessment.
: 4. FSAR Section 3.9.6, Inservice Testing of Pumps and Valves.
: 5. ASME OM Code, Code for Operation and Maintenance of Nuclear Power Plants.
AP1000 STS                            B 3.4.11-6                                      Rev. 1

ADS - Shutdown, RCS Intact B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.12 Automatic Depressurization System (ADS) - Shutdown, RCS Intact BASES BACKGROUND           A description of the ADS is provided in the Bases for LCO 3.4.11, Automatic Depressurization System (ADS)  Operating.
APPLICABLE           For postulated loss of normal decay heat removal events in MODE 5 with SAFETY               the RCS pressure boundary intact, the primary protection is the Passive ANALYSES             Residual Heat Removal Heat Exchanger (PRHR HX). For loss of RCS inventory, injection of borated water into the core from the core makeup tanks (CMTs) may be required for makeup or boration. However, the amount of water necessary may not reduce the level in the CMTs to the point of ADS actuation.
In MODE 5, the ADS, in conjunction with the in-containment refueling water storage tank (IRWST) injection, provides the primary protection for mitigation of events requiring RCS makeup, boration, or core cooling. To ensure sufficient steam venting area is provided to adequately depressurize the RCS, thus enabling IRWST injection and containment recirculation, the number of ADS flow paths required to be OPERABLE depends on the level of reactor decay heat. Single failures are assumed to render any one flow path in ADS Stage 1, 2, 3 or 4 inoperable. A single failure of electrical division A or B renders one 4 inch ADS Stage 1 flow path and one 8 inch ADS Stage 3 flow path inoperable. A single failure of electrical division C or D would render one 8 inch ADS Stage 2 flow path inoperable.
The minimum ADS flow path requirements applicable 28 hours after shutdown (i.e., subcriticality) are based on the conditions during containment recirculation, which exhibits the minimum driving head for injection flow. Additional driving head is available when the IRWST still contains sufficient inventory early in events.
No LOCAs are postulated during plant operation in MODE 5, however loss of primary coolant through LEAKAGE or inadvertent draining may occur. For such shutdown events occurring in MODE 5 it is anticipated that the ADS will be actuated, allowing injection from the IRWST and the containment recirculation if containment flooding occurs (Ref. 1).
The ADS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                                  B 3.4.12-1                                     Rev. 1

ADS - Shutdown, RCS Intact B 3.4.12 BASES LCO           The number of ADS flow paths required to be OPERABLE assures that upon actuation, the depressurization of the RCS will proceed smoothly and completely, as assumed in the DBA safety analyses.
An ADS Stage 1, 2, or 3 flow path is considered OPERABLE if both valves in the line are closed and OPERABLE (capable of opening on an actuation signal). In addition, an ADS Stage 4 flow path is OPERABLE if the motor operated isolation valve is open and the squib valve is closed and OPERABLE. Each Stage 4 squib valve is OPERABLE when capable of actuation by two igniters supplied by independent Class 1E electrical divisions.
If the reactor has been subcritical < 28 hours, five flow paths in ADS Stages 1, 2, and 3 and four flow paths in ADS Stage 4 are required OPERABLE. If the reactor has been subcritical for  28 hours, three flow paths in ADS Stages 1, 2, and 3, with a minimum of two flow paths in ADS Stage 2 or 3, and three flow paths in ADS Stage 4 are required OPERABLE. A minimum of two flow paths in ADS Stage 2 or 3 are required to ensure that sufficient steam venting area will be provided following the assumed single failure of an electrical division.
APPLICABILITY In MODE 5 with the reactor coolant pressure boundary (RCPB) intact and pressurizer level  20%, all required flow paths of the ADS must be OPERABLE to mitigate the potential consequences of any event which causes loss of decay heat removal or a reduction in the RCS inventory.
The requirements for the ADS in MODES 1 through 4 are specified in LCO 3.4.11, Automatic Depressurization System (ADS)  Operating; and in MODE 5 with the RCS pressure boundary open, MODE 5 with the pressurizer level < 20%, and MODE 6 with upper internals in place, in LCO 3.4.13, Automatic Depressurization System (ADS)  Shutdown, RCS Open.
ACTIONS       A.1 If any one required flow path in ADS Stage 1, 2, or 3 is determined to be inoperable, the remaining OPERABLE required flow paths in ADS Stages 1, 2, and 3 are more than adequate to perform the required safety function as long as a single failure involving a required flow path in ADS Stage 4 or two additional required flow paths in one or more stages of ADS Stages 1, 2, and 3 does not occur. A Completion Time of 7 days is based on the capability of the remaining required ADS flow paths to perform the required safety functions assumed in the safety analyses and the low probability of a DBA occurring during this time period.
AP1000 STS                          B 3.4.12-2                                       Rev. 1

ADS - Shutdown, RCS Intact B 3.4.12 BASES ACTIONS (continued)
If more than one required flow path in ADS Stage 1, 2, or 3 is inoperable, Condition C or D is also applicable.
B.1 If any one required flow path in ADS Stage 4 is determined to be inoperable, the remaining OPERABLE required flow paths in ADS Stage 4 are adequate to perform the required safety function as long as a single failure does not also occur. A Completion Time of 72 hours is reasonable based on the capability of the remaining required ADS valves to perform the required safety functions assumed in the safety analyses and the low probability of a DBA during this time period. This Completion Time is the same as is used for two train ECCS systems which are capable of performing their safety function without a single failure.
C.1 If one required flow path in ADS Stage 1 and one required flow path in ADS Stage 2 or 3, or two required flow paths in ADS Stage 1 are determined to be inoperable, the remaining OPERABLE required ADS flow paths are adequate to perform the required safety function as long as a single failure does not also occur. This Condition is equivalent to the worst case single failure of electrical division A or B, which would render one 4 inch required flow path in ADS Stage 1 and one 8 inch required flow path in ADS Stage 3 inoperable.
A Completion Time of 72 hours to restore one flow path to OPERABLE status is reasonable based on the capability of the remaining required ADS valves to perform the required safety functions assumed in the safety analyses and the low probability of a DBA during this time period.
This Completion Time is the same as is used for two train ECCS systems which are capable of performing their safety function without a single failure.
If three or more required flow paths in two or three stages of ADS Stages 1, 2, and 3 are inoperable, Condition D is applicable.
D.1 If a Required Action and associated Completion Time of Condition A, B, or C are not met, or Condition A and Condition B are entered concurrently, or three or more required flow paths in two or three stages of ADS AP1000 STS                              B 3.4.12-3                                       Rev. 1

ADS - Shutdown, RCS Intact B 3.4.12 BASES ACTIONS (continued)
Stages 1, 2, and 3 are inoperable, or LCO 3.4.12 is not met for reasons other than Condition A, B, or C, the plant must be placed in a MODE in which this LCO does not apply. Action must be initiated, immediately, to open the RCS pressure boundary.
SURVEILLANCE        SR 3.4.12.1 REQUIREMENTS The LCO 3.4.11 Surveillance Requirements are applicable to the ADS flow paths required to be OPERABLE. The Frequencies associated with each specified SR are applicable. Refer to the corresponding Bases for LCO 3.4.11 for a discussion of each SR.
REFERENCES          1. FSAR Section 19E.4, Safety Analyses and Evaluations.
AP1000 STS                               B 3.4.12-4                                     Rev. 1

ADS - Shutdown, RCS Open B 3.4.13 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.13 Automatic Depressurization System (ADS) - Shutdown, RCS Open BASES BACKGROUND           A description of the ADS is provided in the Bases for LCO 3.4.11, Automatic Depressurization System (ADS)  Operating.
When all required flow paths in ADS Stages 1, 2, and 3 are open, the RCS is considered VENTED. In this condition, the open flow paths in ADS Stages 1, 2, and 3 provide sufficient vent area that, when combined with the required ADS Stage 4 actuation, lower the RCS pressure to enable injection from the IRWST and containment recirculation.
During a normal Reactor Coolant System (RCS) cooldown from full power, MODE 5 is entered approximately 8 hours after reactor shutdown.
In MODE 5, the Normal Residual Heat Removal System (RNS) is used to cool the RCS with Reactor Coolant Pumps (RCPs) in operation. Once the RCS temperature reaches 160&deg;F, the RCPs may be stopped, the RCS pressure boundary may be opened and the pressurizer may be drained. During drain down to reduced RCS inventory conditions, automatic CMT actuation can be manually blocked when the pressurizer water level is below P-12 (approximately 16%) in order to prevent inadvertent CMT actuation on Pressurizer Water Level  Low 2 (approximately 10%) (LCO 3.3.8, Function 7).
APPLICABLE           Because the CMTs may be isolated to prevent inadvertent injection, or SAFETY               steam flow through open flow paths in ADS Stage 1, 2, or 3 may ANALYSES             preclude automatic CMT actuation on low pressurizer level due to pressurizer inventory hold up, manual operator actuation of ADS Stage 4 and IRWST injection may be required. This provides the primary protection for mitigation of events requiring RCS makeup, boration, or core cooling (Ref. 1).
The minimum ADS flow path requirements applicable 28 hours after shutdown (subcriticality) are based on the conditions during containment recirculation, which exhibits the minimum driving head for injection flow.
Additional driving head is available when the IRWST still contains sufficient inventory early in events.
In MODE 6, with the upper internals removed, IRWST injection and containment recirculation can occur without actuation of ADS Stage 4.
The ADS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                                 B 3.4.13-1                                     Rev. 1

ADS - Shutdown, RCS Open B 3.4.13 BASES LCO           When required flow paths in ADS Stages 1, 2, and 3 are open, from the pressurizer through the spargers into the IRWST, and required flow paths in ADS Stage 4 are OPERABLE sufficient vent area is available to support IRWST injection. Each Stage 4 squib valve is OPERABLE when capable of actuation by two igniters supplied by independent Class 1E electrical divisions.
With the reactor subcritical < 28 hours, five flow paths in ADS Stages 1, 2, and 3 are required to be open and four ADS Stage 4 flow paths are required to be OPERABLE. With the reactor subcritical for  28 hours, three flow paths in ADS Stages 1, 2, and 3 (maximum of one ADS Stage 1 flow path) are required to be open and three ADS Stage 4 flow paths are required OPERABLE. A maximum of one ADS Stage 1 flow path is allowed to satisfy the LCO requirement to ensure that sufficient steam venting area will be provided following the assumed failure of an electrical division. After 28 hours, the reduced number of flow paths in ADS Stages 1, 2, and 3 support vacuum fill operations when the discharge header of one train of flow paths in ADS Stages 1, 2, and 3 is blocked, rendering those flow paths unavailable to meet the LCO requirement.
An ADS Stage 4 flow path is OPERABLE if the motor operated isolation valve is open and the squib valve is OPERABLE. Each Stage 4 squib valve is OPERABLE when capable of actuation by two igniters supplied by independent Class 1E electrical divisions.
The LCO is modified by a Note that allows required flow paths in ADS Stages 1, 2, and 3 to be closed for two operational evolutions, provided their OPERABILITY meets LCO 3.4.12, ADS  Shutdown, RCS Intact.
The first is to facilitate vacuum refill operations until a pressurizer water level  20% is established, and the second is to facilitate compliance during transitions between LCO 3.4.12 and LCO 3.4.13.
APPLICABILITY In MODE 5 with pressurizer level < 20%, in MODE 5 with the reactor coolant system pressure boundary (RCPB) open, and in MODE 6 with the upper internals in place, the required flow paths in ADS Stages 1, 2, and 3 must be open and required flow paths in ADS Stage 4 must be OPERABLE to support IRWST injection and containment recirculation, if needed, in order to mitigate events requiring RCS makeup, boration, or core cooling (Ref 1).
The requirements for the ADS in MODES 1 through 4 are specified in LCO 3.4.11, Automatic Depressurization System (ADS)  Operating and in MODE 5 with the RCPB intact and pressurizer water level  20%
AP1000 STS                            B 3.4.13-2                                       Rev. 1

ADS - Shutdown, RCS Open B 3.4.13 BASES APPLICABILITY (ccontinued) in LCO 3.4.12, Automatic Depressurization System (ADS)  Shutdown, RCS Intact.
ACTIONS            A.1 and A.2 If one required flow path in ADS Stage 1, 2, or 3 is not open, action must be taken to open the required flow path or open alternative flow path(s) with an equivalent area within 72 hours. The removal of one pressurizer safety valve is an acceptable alternative flow path for a flow path in ADS Stage 1, 2, or 3. The removal of a pressurizer safety valve or the pressurizer manway is also an acceptable alternative.
A Completion Time of 72 hours is reasonable based on capability of the remaining required open flow paths in ADS Stages 1, 2, and 3 to provide the required vent area assumed in safety analyses, and the low probability of a DBA occurring during this time period. This Completion Time is the same as is used for two train ECCS systems which are capable of performing their safety function without an additional single failure.
B.1 and B.2 If one required flow path in ADS Stage 4 is inoperable, action must be taken to restore the required flow path in ADS Stage 4 to OPERABLE status or open an alternative flow path with an equivalent area within 36 hours. In this Condition the remaining required open flow paths in ADS Stages 1, 2, and 3 and the OPERABLE flow paths in ADS Stage 4 are adequate to perform the required safety function without an additional single failure. Required ADS Stage 4 flow paths may be restored to OPERABLE status, or the required vent area may be restored by opening alternate vent path(s) with an equivalent vent area.
An acceptable alternative ADS Stage 4 vent path is a manway cover on the hot leg side of the steam generator channel head. Note that the hot leg nozzle dam must not be installed to credit removal of the steam generator manway as an alternate flow path. pressurizer manway is not an acceptable alternate for ADS Stage 4 vent path as pressurizer surge line flooding phenomena can negate the IRWST elevation head necessary for successful gravity injection. Therefore, a Completion Time of 36 hours is considered acceptable.
AP1000 STS                               B 3.4.13-3                                      Rev. 1

ADS - Shutdown, RCS Open B 3.4.13 BASES ACTIONS (continued)
C.1, C.2, and C.3 While in MODE 5 if a Required Action and associated Completion Time of Condition A or B are not met, or Condition A and Condition B are entered concurrently, or LCO 3.4.13 is not met for reasons other than Condition A or B, the plant must be placed in a condition which minimizes the potential for requiring ADS venting and IRWST injection. The time to RCS boiling is maximized by increasing RCS inventory to  20%
pressurizer level and maintaining RCS temperature as low as practical.
Additionally, action to suspend positive reactivity additions is required to ensure that the SDM is maintained. Sources of positive reactivity addition include boron dilution, withdrawal of control rods, and excessive cooling of the RCS.
If the RCS pressure boundary is intact with pressurizer level < 20%,
action must be taken immediately to establish RCS VENTED condition.
Note that, if entered with the reactor subcritical < 28 hours, it is possible for Condition C to be exited once the reactor has been subcritical 28 hours, provided the applicable LCO requirements are met.
D.1 and D.2 While in MODE 6, if a Required Action and associated Completion Time of Condition A or B are not met, or Condition A and Condition B are entered concurrently, or LCO 3.4.13 is not met for reasons other than Condition A or B, the plant must be placed in a condition which precludes the need for the ADS vent paths. Action must be initiated immediately to remove the upper internals, which provides the required vent path. The time to RCS boiling is maximized by increasing RCS inventory and maintaining RCS temperature as low as practical.
Additionally, action to suspend positive reactivity additions is required to ensure that the SDM is maintained. Sources of positive reactivity addition include boron dilution, withdrawal of control rods, and excessive cooling of the RCS.
SURVEILLANCE        SR 3.4.13.1 REQUIREMENTS Each flow path in ADS Stages 1, 2, and 3 required to be open is verified to be open by verifying that each required open valve in ADS Stages 1, 2, and 3 is in its open position every 12 hours, as indicated in the control AP1000 STS                                B 3.4.13-4                                        Rev. 1

ADS - Shutdown, RCS Open B 3.4.13 BASES SURVEILLANCE REQUIREMENTS (continued) room. This Surveillance Frequency is acceptable based on administrative controls which preclude repositioning the valves.
SR 3.4.13.2 SR 3.4.11.1, SR 3.4.11.3, and SR 3.4.11.5 are applicable to the ADS Stage 4 valves required to be OPERABLE. The Frequencies associated with each specified SR are applicable. Refer to the corresponding Bases for LCO 3.4.11 for a discussion of each SR.
REFERENCES      1. FSAR Section 19E.4.8.3, Loss of Normal Residual Heat Removal System Cooling in MODE 5 with Reactor Coolant System Open.
AP1000 STS                          B 3.4.13-5                                     Rev. 1

LTOP B 3.4.14 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.14 Low Temperature Overpressure Protection (LTOP)
BASES BACKGROUND          LTOP limits RCS pressure at low temperatures so that the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting RCPB component for demonstrating such protection. The PTLR provides the limits which set the maximum allowable setpoints for the Normal Residual Heat Removal System (RNS) suction relief valves, RNS-PL-V020 (1 inch) and RNS-PL-V021 (3 inch). LCO 3.4.3 provides the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES.
The reactor vessel material is less tough at low temperatures than at normal operating temperature. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.
The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition.
Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3, RCS Pressure and Temperature (P/T) Limits, requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the PTLR limits.
This LCO provides RCS overpressure protection by having a maximum coolant input capability and having adequate pressure relief capacity.
Limiting coolant input capability requires isolating the accumulators and closing CVS makeup line containment isolation valve, CVS-PL-V091.
The pressure relief capacity requires the RNS suction relief valves or a depressurized RCS and an RCS vent of sufficient size. The RNS suction relief valves or the open RCS vent is the overpressure protection device that acts to terminate an increasing pressure event.
AP1000 STS                                B 3.4.14-1                                     Rev. 1

LTOP B 3.4.14 BASES BACKGROUND (continued)
RNS Suction Relief Valve Requirements During the LTOP MODES, the RNS system is operated for decay heat removal. Therefore, the RNS suction isolation valves are open in the piping from the RCS hot legs to the inlet of the RNS system. While these valves are open, the RNS suction relief valves are exposed to the RCS and able to relieve pressure transients in the RCS.
The RNS suction relief valves are spring loaded, water relief valves with a pressure tolerance and an accumulation limit established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 3) for Class 2 relief valves.
The RNS suction isolation valves must be open to make the RNS suction relief valves OPERABLE for RCS overpressure mitigation.
RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass or heat input transient, and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.
For an RCS vent to meet the flow capacity requirement, it may require removing one or more pressurizer safety valves or manually opening one or more Automatic Depressurization System (ADS) valves. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.
APPLICABLE       Safety analyses (Ref. 4) demonstrate that the reactor vessel is SAFETY           adequately protected against exceeding the Reference 1 P/T limits. In ANALYSES         MODES 1, 2, and 3, and in MODE 4 with all four cold legs temperatures 275&deg;F, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. When the RNS is aligned and open to the RCS, overpressure protection is provided by the RNS suction relief valve, or a depressurized RCS and a sufficiently sized open RCS vent.
AP1000 STS                             B 3.4.14-2                                     Rev. 1

LTOP B 3.4.14 BASES APPLICABLE SAFETY ANALYSES (continued)
The actual temperature at which the pressure in the P/T limit curve falls below the suction relief setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the PTLR curves are revised, LTOP must be re-evaluated to ensure its functional requirements can still be met using the RNS suction relief valve, or the depressurized and vented RCS condition.
The PTLR contains the acceptance limits that define the LTOP requirements. Any change to the RCS must be evaluated against the Reference 4 analyses to determine the impact of the change on the LTOP acceptance limits.
Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients. The events listed below were used in the analysis to size the RNS suction relief valve. Therefore, any events with a mass or heat input greater than the listed events cannot be accommodated and must be prevented.
Mass Input Makeup water flow rate to the RCS assuming both CVS makeup pumps are in operation and letdown is isolated.
Heat Input Restart of one reactor coolant pump (RCP) with water in the steam generator secondary side 50&deg;F hotter than the primary side water, and the RCS water solid.
RNS Suction Relief Valve Performance Since each of the RNS suction relief valves do not have a variable P/T lift setpoint, the analysis must show that with the chosen setpoint, the relief valves will pass flow greater than that required for the limiting LTOP transient while maintaining RCS pressure less than the lowest of the P/T limit curve pressure, 110% of the RNS design pressure, or the acceptable RNS relief valve inlet pressure.
When the RCS is aligned to the RNS with RNS suction relief valves OPERABLE, Chemical and Volume Control System (CVS) valve, CVS-PL-V091, is closed to limit the flow rate to the capacity of the smaller RNS suction relief valve by directing flow to CVS flow-restricting orifice, CVS-PY-R10. During a mass input transient, the smaller RNS suction AP1000 STS                            B 3.4.14-3                                       Rev. 1

LTOP B 3.4.14 BASES APPLICABLE SAFETY ANALYSES (continued) relief valve will lift at its lift setting and the larger RNS suction relief valve will remain closed. If the pressure exceeds the capacity of the smaller RNS suction relief valve, the larger RNS suction relief valve will open.
During a heat input transient, the larger RNS suction relief valve is relied upon for overpressure protection and the smaller RNS suction relief valve opens to provide reliability and reduce potential chattering in the larger valve. The heat input transient is limiting when the RNS suction relief valves are relied upon for overpressure protection.
To prevent the possibility of a heat input transient, and thereby limit the required flow rate of the RNS suction relief valve, administrative requirements in the Note for LCO 3.4.3, RCS Pressure and Temperature (P/T) Limits, have been imposed for starting an RCP.
RCS Vent Performance With the RCS depressurized, a vent size of 4.15 square inches is capable of mitigating a limiting overpressure transient. The area of the vent is equivalent to the area of the inlet pipe to the larger RNS suction relief valve so the capacity of the vent is greater than the flow possible with either the mass or heat input transient, while maintaining the RCS pressure less than the lower of either the maximum pressure on the P/T limit curve or 110% of the RNS design pressure. When an RCS vent of 4.15 square inches is established, CVS-PL-V091 may be opened.
The required vent area may be obtained by opening one ADS Stage 1, 2, or 3 flow path.
The RCS vent size will be reevaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material Surveillance.
The RCS vent is passive and is not subject to active failure.
LTOP satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              This LCO requires that LTOP is OPERABLE. LTOP is OPERABLE when the maximum coolant input and minimum pressure relief capabilities are OPERABLE. Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.
AP1000 STS                                B 3.4.14-4                                          Rev. 1

LTOP B 3.4.14 BASES LCO (continued)
To limit the coolant input capability, the LCO requires all accumulator discharge isolation valves closed and immobilized, when accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS temperature allowed in the PTLR.
The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are:
: a. Two OPERABLE RNS suction relief valves.
An RNS suction relief valve is OPERABLE for LTOP when both RNS suction isolation valves in one flow path are open, its setpoint is set within the Inservice Testing program limits, and testing has proven its ability to open at this setpoint. Additionally, CVS-PL-V091 is closed to limit the flow rate to within the relieving capacity of the smaller RNS suction relief valve when the RNS suction relief valves are OPERABLE; or
: b. A depressurized RCS and an OPERABLE RCS vent.
An RCS vent is OPERABLE when a vent path is open with a flow area of  4.15 square inches.
Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.
The LCO is modified by a Note that provides that accumulator isolation is only required when the accumulator pressure is more than or at the maximum RCS pressure for the existing temperature, as allowed by the P/T limit curves. This Note permits the accumulator discharge isolation valve closed position verification Surveillance to be performed only under these pressure and temperature conditions.
APPLICABILITY   This LCO is applicable in MODE 4 when any cold leg temperature is 275&deg;F, MODE 5, and in MODE 6 when the reactor vessel head is on.
The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits with all four leg temperatures above 275&deg;F. In MODE 6 with the reactor vessel head off, an overpressurization cannot occur.
LCO 3.4.3 provides the operational P/T limits for all MODES. LCO 3.4.6, Pressurizer Safety Valves, requires the OPERABILITY of the AP1000 STS                            B 3.4.14-5                                         Rev. 1

LTOP B 3.4.14 BASES APPLICABILITY (continued) pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 all four cold leg temperatures  275&deg;F.
Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure with little or no time for operator action to mitigate the event.
ACTIONS            A.1 An unisolated accumulator requires isolation within 1 hour. This is only required when the accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.
The Completion Time is based on operating experience that this activity can be accomplished in this time period and on engineering evaluations indicating than an event requiring LTOP is not likely in the allowed time.
B.1 CVS makeup line containment isolation valve, CVS-PL-V091, requires closure within 1 hour. Condition B is modified by a Note stating that the Action is applicable only when an RCS vent of  4.15 square inches is not established.
The Completion Time is based on operating experience that this activity can be accomplished in this time period and on engineering evaluations indicating than an event requiring LTOP is not likely in the allowed time.
C.1 and C.2 If isolation is needed and cannot be accomplished in 1 hour, Required Action C.1 and Required Action C.2 provide two options, either of which must be performed in the next 12 hours. By increasing the RCS temperature to > 275&deg;F, the accumulator pressure cannot result in exceeding the LTOP limits if the accumulators are fully injected.
Depressurizing the accumulators below the LTOP limit in the PTLR also gives this protection.
The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering AP1000 STS                               B 3.4.14-6                                      Rev. 1

LTOP B 3.4.14 BASES ACTIONS (continued) evaluations indicating that an event requiring LTOP is not likely in the allowed times.
D.1 and D.2 If the RNS suction relief valves are inoperable and the RCS is not depressurized, there is a potential to overpressurize the RCS and exceed the limits allowed in LCO 3.4.3. The suction relief valves are considered inoperable if the RNS isolation valves have isolated the RNS from the RCS in such a way that the suction relief valves cannot perform their intended safety function, or if the valve themselves will not operate to perform their intended safety function. If the RCS is depressurized but the RCS vent path does not provide a flow area sufficient to mitigate any of the design low temperature overpressure events and the RNS suction relief valves are inoperable, there is a potential to overpressurize the RCS and exceed the limits allowed in LCO 3.4.3. The RCS vent path is considered inoperable if the area of the vent is not equivalent to the area of the inlet pipe to the larger RNS suction relief valve.
Under these conditions, Required Actions D.1 and D.2 provide two options, either of which must be accomplished in 12 hours. If the RNS suction relief valve cannot be restored to OPERABLE status, the RCS must be depressurized and vented with an RCS vent which provides a flow area sufficient to mitigate any of the design low temperature overpressure events.
The 12 hour Completion Time represents a reasonable time to repair the relief valves, open the RNS isolation valves or otherwise restore the LTOP to OPERABLE status, or depressurize and vent the RCS, without imposing a lengthy period when no LTOP methods are available to mitigate a low temperature overpressure event.
SURVEILLANCE       SR 3.4.14.1 REQUIREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, the accumulator discharge isolation valves are verified closed and locked out. The Frequency of 12 hours is sufficient considering other indications and alarms available to the operator in the main control room to verify the required status of the equipment.
AP1000 STS                                B 3.4.14-7                                      Rev. 1

LTOP B 3.4.14 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.4.14.1 is modified by a Note stating that accumulator isolation is only required when the accumulator pressure is more than or at the maximum RCS pressure for the existing temperature, as allowed by the P/T limit curves. This Note requires the accumulator discharge isolation valve Surveillance to be met only under these pressure and temperature conditions.
SR 3.4.14.2 The RNS suction relief valves shall be demonstrated OPERABLE by verifying two RNS suction isolation valves in one flow path are open.
This Surveillance is only performed if the RNS suction relief valves are being used to satisfy this LCO.
The RNS suction isolation valves are verified to be opened every 12 hours. The Frequency is considered adequate in view of other administrative controls such as valve status indications available to the operator in the control room that verify the RNS suction isolation valves remain open. This Surveillance is required to be met if the RNS suction relief valves are being used to satisfy the pressure relief requirements of LCO 3.4.14.a.
SR 3.4.14.3 To minimize the potential for a low temperature overpressure event when the RNS suction relief valves are OPERABLE, the flow from the CVS is limited to the capacity of the smaller RNS suction relief valve.
The CVS makeup line containment isolation valve, CVS-PL-V091, is closed to limit CVS mass and heat injection flow to the CVS flow-restricting orifice, CVS-PY-R10. The Frequency of 12 hours is sufficient considering other indications and alarms available to the operator in the main control room to verify the required status of the equipment. This Surveillance is required to be met if the RNS suction relief valves are being used to satisfy the pressure relief requirements of LCO 3.4.14.a.
SR 3.4.14.4 The RCS vent of  4.15 square inches is verified open either:
: a. Once every 12 hours for a valve that is not locked (valves that are sealed or secured in the open position are considered locked in this context); or AP1000 STS                             B 3.4.14-8                                     Rev. 1

LTOP B 3.4.14 BASES SURVEILLANCE REQUIREMENTS (continued)
: b. Once every 31 days for other vent path(s) (e.g., a vent valve that is locked, sealed, or secured in position or a removed pressurizer safety valve or open manway also fits this category).
This Surveillance is modified by a Note that states it is only required to be met if the vent is being used to satisfy the pressure relief requirements of LCO 3.4.14.b.
SR 3.4.14.5 The RNS suction relief valve shall be demonstrated OPERABLE by verifying that two RNS suction isolation valves in one flow path are open and by testing them in accordance with the Inservice Testing Program.
(Refer to SR 3.4.14.2 for the RNS suction isolation valve Surveillance.)
The ASME OM Code (Ref. 6) test per Inservice Testing Program verifies OPERABILITY by proving proper relief valve mechanical motion and by measuring and, if required, adjusting the lift setpoint. This Surveillance is required to be met if the RNS suction relief valves are being used to satisfy the pressure relief requirements of LCO 3.4.14.a.
REFERENCES      1. Title 10, Code of Federal Regulations, Part 50, Appendix G, Fracture Toughness Requirements.
: 2. Generic Letter 88-11, NRC Position on Radiation Embrittlement of Reactor Vessel Materials and Its Impact on Plant Operation.
: 3. ASME Boiler and Pressure Vessel Code, Section III.
: 4. FSAR Section 5.2.2, Overpressure Protection.
: 5. APP-RXS-Z0R-001, Revision 3, AP1000 Generic Pressure Temperature Limits Report, April 2018.
: 6. ASME OM Code, Code for Operation and Maintenance of Nuclear Power Plants.
AP1000 STS                            B 3.4.14-9                                       Rev. 1

RCS PIV Integrity B 3.4.15 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.15 RCS Pressure Isolation Valve (PIV) Integrity BASES BACKGROUND         10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, and 3), define the RCS pressure boundary as all those pressure containing components such as pressure vessels, piping, pumps, and valves which are connected to the reactor coolant system, up to and including the outermost containment isolation valve in system piping which penetrates primary reactor containment, the second of two valves normally closed during normal reactor operation in system piping, which does not penetrate primary reactor containment, and the reactor coolant system safety and relief valves. This includes any two normally closed valves in series within the reactor coolant pressure boundary (RCPB), which separate the high pressure RCS from an attached low pressure system. During their lives, these valves can experience varying amounts of reactor coolant leakage through either normal operational wear or mechanical deterioration. The RCS PIVs are listed in FSAR Chapter 3, Table 3.9-18. The RCS PIV Leakage LCO allows RCS high pressure operation when PIV leakage has been verified to be within limits.
The purpose of this Specification is to prevent overpressure failure or degradation of low pressure portions of connecting systems. The following criteria were used in identifying RCS PIVs for inclusion in the Specification. A valve was included in this Specification if its failure may result in:
: 1. Failure of low pressure portions of connected systems, such as a Loss of Coolant Accident (LOCA) outside of containment, which could place the plant in an unanalyzed condition.
: 2. Degradation of low pressure portions of connected systems, such as damage to a core cooling system, which could degrade a safety related function that mitigates a DBA.
Valves considered for inclusion in this Specification are used to isolate the RCS from the following connected systems:
: a. Passive Core Cooling System (PXS) Accumulators;
: b. Normal Residual Heat Removal System (RNS); and
: c. Chemical and Volume Control System (CVS).
AP1000 STS                                B 3.4.15-1                                       Rev. 1

RCS PIV Integrity B 3.4.15 BASES BACKGROUND (continued)
The RNS pressure boundary isolation valves meet the first criterion for inclusion in this Specification. The PXS accumulator check valves were determined to meet the second PIV criterion for inclusion in this Specification. It is determined that the CVS PIVs do not meet either criterion for inclusion in this Specification.
The RCS PIVs that are addressed by this Specification are listed in FSAR Chapter 3, Table 3.9-18.
The CVS PIVs were not included in this Specification based on the defined criteria. The justification for excluding the CVS PIVs is discussed in the following paragraph.
The CVS contains five high pressure/low pressure connections with the RCS. Since the portion of the CVS which is located inside reactor containment is designed to full RCS pressure, the high pressure/low pressure interfaces with the RCS are the lines that penetrate the reactor containment. The CVS lines that penetrate containment include the makeup line, the letdown line to the Liquid Radwaste System, the hydrogen supply line, the zinc supply line, and the demineralizer resin sluice line used to transfer spent resins from the demineralizers to the Solid Radwaste System. These lines each contain two safety related containment isolation valves which are addressed by the Containment Isolation Specification (LCO 3.6.3). In addition to the containment isolation valves in each of the CVS lines that interface with the RCS, there are additional valves in each line that provide diverse isolation capability. Since more restrictive requirements are imposed by LCO 3.6.3, the CVS isolation valves are not included in this LCO.
Since the purpose of this LCO is to verify that the PIVs have not suffered gross failures, the valve leakage test in conjunction with tests specified in the IST program provide an acceptable method of determining valve integrity. The ability of the valves to transition from open to closed provides assurance that the valve can perform its pressure isolation function as required. A small amount leakage through these valves is allowed, provided that the integrity of the valve was demonstrated.
Violation of this LCO could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system or the failure of a safety related function to mitigate a DBA.
AP1000 STS                             B 3.4.15-2                                      Rev. 1

RCS PIV Integrity B 3.4.15 BASES APPLICABLE    RCS PIV integrity is not considered in any design basis accident SAFETY        analyses. This Specification provides for monitoring the condition of the ANALYSES      reactor coolant pressure boundary to detect degradation which could lead to accidents or which could impair a connected systems ability to mitigate DBAs.
RCS PIV integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO           RCS PIV leakage is identified LEAKAGE into closed systems connected to the RCS. Isolation valve leakage is usually small. Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken.
The LCO PIV leakage limit is 0.5 gpm per inch nominal valve size up to a maximum of 5 gpm per valve. This limit is well within the makeup capability of the CVS makeup pumps. This leak rate will not result in the overpressure of a connected low pressure system. Reference 5 permits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure of the connected system during RCS operation (the maximum pressure differential) in those types of valves in which the higher service pressure will tend to diminish the overall leakage of the valve. In such cases, the observed leakage rate at lower differential pressures shall be adjusted to the maximum pressure differential assuming leakage is directly proportional to the pressure differential to the one-half power..
APPLICABILITY In MODES 1, 2, and 3, and MODE 4 with RCS not being cooled by the RNS, this LCO applies when the RCS is pressurized.
In MODE 4 with RNS in operation, and in MODES 5 and 6, the RCS pressure is reduced and is not sufficient to overpressurize the connected low pressure systems.
ACTIONS       The ACTIONS are modified by two Notes. Note 1 provides clarification that each flow path allows separate entry into a Condition. This is allowed based upon the functional independence of the flow path.
Note 2 requires an evaluation of affected systems if a PIV is inoperable.
The pressurization may have affected system OPERABILITY, or isolation of an affected flow path with an alternate valve may have degraded the ability of the interconnected system to perform its safety function.
AP1000 STS                           B 3.4.15-3                                      Rev. 1

RCS PIV Integrity B 3.4.15 BASES ACTIONS (continued)
A.1 With one or more PIVs inoperable, the affected flow path(s) must be isolated. Required Action A.1 is modified by a Note that the valves used for isolation must meet the same integrity requirements as the PIVs and must be within the RCPB or the high pressure portion of the system.
Required Action A.1 requires that the isolation with one valve must be performed within 8 hours. Eight hours provides time to verify IST compliance for the alternate isolation valve and isolate the flow path.
The 8 hour Completion Time allows a reasonable time to perform the actions and appropriately restricts unit operation with inoperable RCS PIVs.
A.2 Required Action A.2 specifies verification that a second OPERABLE PIV can meet the leakage limits. This valve is required to be a check valve, or a closed valve, if it isolates a line that penetrates containment. For the accumulator valves, the normally open accumulator isolation valve is a suitable replacement PIV, but can remain open because leakage into the accumulator is continuously monitored. If leakage into an accumulator increased to the allowable operational leakage limit for the accumulator's check valve, then the accumulator isolation valve could be used to isolate its associated accumulator from the RCS.
The 72 hour Completion Time allows a reasonable time to perform the actions and appropriately restricts unit operation with inoperable RCS PIVs.
B.1 and B.2 If RCS PIV integrity cannot be restored, the connected system cannot be isolated, or the other Required Actions cannot be accomplished, the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. This action may reduce the leakage and reduces the potential for a LOCA outside containment.
AP1000 STS                                B 3.4.15-4                                       Rev. 1

RCS PIV Integrity B 3.4.15 BASES SURVEILLANCE SR 3.4.15.1 REQUIREMENTS Performance of leakage testing on each RCS PIV or isolation valve used to satisfy Required Action A.1 and Required Action A.2 is required to verify that leakage is below the specified limit and to identify each leaking valve. The leakage limit of 0.5 gpm per inch nominal valve size up to a minimum of 5 gpm applies to each valve. Leakage testing requires a stable pressure condition.
For the two PIVs in series, the leakage requirement applies to each valve individually and not to the combined leakage across both valves. If the PIVs are not individually leakage tested, one valve may have failed completely and not be detected if the other valve in series meets the leakage requirement. In this situation, the protection provided by redundant valves would be lost.
Testing shall be performed every 24 months, a typical refueling cycle.
The 24 month Frequency is consistent with 10 CFR 50.55a(g) (Ref. 4) as contained in the Inservice Testing Program and is within the Frequency allowed by the American Society of Mechanical Engineers (ASME) OM Code (Ref. 5).
REFERENCES   1. 10 CFR 50.2.
: 2. 10 CFR 50.55a(c).
: 3. 10 CFR 50, Appendix A, Section V, GDC 55.
: 4. 10 CFR 50.55a(g).
: 5. ASME OM Code, Code for Operation and Maintenance of Nuclear Power Plants.
AP1000 STS                         B 3.4.15-5                                       Rev. 1

RVHV B 3.4.16 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.16 Reactor Vessel Head Vent (RVHV)
BASES BACKGROUND           The reactor vessel head vent (RVHV) is designed to assure that long term operation of the Core Makeup Tanks (CMTs) does not result in overfilling of the pressurizer during Condition II Design Basis Accidents (DBAs). The RVHV can be manually actuated by the operators in the main control room to reduce the pressurizer water level during long-term operation of the CMTs.
The RVHV consists of two parallel flow paths each containing two RVHV isolation valves in series. The RVHV valves are connected to the reactor vessel head via a common line. The outlets of the RVHV flow paths combine into one common discharge line which connects to a single Automatic Depressurization System (ADS) discharge header that discharges to spargers located in the in-containment refueling water storage tank (IRWST). The RVHV valves are 1 inch valves with DC solenoid operators.
The RVHV valves are designed to open when actuated by the operator, and to reclose when actuated by the operator from the main control room.
The number and capacity of the RVHV flow paths are selected so that letdown flow from the Reactor Coolant System (RCS) is sufficient to prevent pressurizer overfill for events where extended operation of the CMTs causes the pressurizer water level to increase. Although realistic evaluations of the Condition II non-loss of coolant accident (non-LOCA) events does not result in pressurizer overfill, conservative analyses of some of these events can result in pressurizer overfill if no operator actions are assumed.
APPLICABLE           For Condition II non-LOCA events, such as inadvertent Passive Core SAFETY               Cooling System (PXS) operation and Chemical and Volume Control ANALYSES             System (CVS) malfunction, the use of the RVHV may be required to prevent long-term pressurizer overfill (Ref. 1).
For LOCA events, the RVHV is not required.
The RVHV satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                                 B 3.4.16-1                                      Rev. 1

RVHV B 3.4.16 BASES LCO           The requirement that all four RVHV valves be OPERABLE ensures that upon actuation, the RVHV can reduce the pressurizer water level as assumed in the DBA safety analyses.
For the RVHV to be considered OPERABLE, all four valves must be closed and OPERABLE (capable of opening from the main control room).
APPLICABILITY In MODES 1, 2, and 3, and MODE 4 with all four cold leg temperatures
              > 275&deg;F, the RVHV must be OPERABLE to mitigate the potential consequences of any event which causes an increase in the pressurizer water level that could otherwise result in overfilling the pressurizer.
In MODE 4 with any cold temperatures  275&deg;F, and in MODES 5 and 6, pressurizer overfill is not a concern since overpressure protection in these MODES is provided by LCO 3.4.14, Low Temperature Overpressure Protection (LTOP), and the credited valves are designed for water relief.
ACTIONS       A.1 If one or two RVHV valves in a single flow path are determined to be inoperable, the flow path is inoperable. The remaining OPERABLE RVHV flow path is adequate to perform the required safety function. A Completion Time of 72 hours is acceptable since the OPERABLE RVHV paths can mitigate DBAs without a single failure.
B.1 If both flow paths are determined to be inoperable, the RVHV is degraded such that the system is not available for some DBA non-LOCA analyses for which it may be required. A Completion Time of 6 hours is permitted to restore one flow path. This Completion Time is acceptable considering that the realistic analysis of these non-LOCA events do not result in pressurizer overfill.
C.1 and C.2 If the Required Actions and associated Completion Times are not met the plant must be brought to MODE 4 with at least one cold leg temperature 275&deg;F where the probability and consequences of an event are minimized. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 4 with at least one cold leg temperature 275&deg;F within 24 hours. The allowed Completion Times are reasonable, AP1000 STS                           B 3.4.16-2                                       Rev. 1

RVHV B 3.4.16 BASES ACTIONS (continued) based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner, without challenging plant systems.
SURVEILLANCE        SR 3.4.16.1 REQUIREMENTS The dedicated component level remote manual valve switches in the main control room shall be used to stroke each RVHV valve to demonstrate OPERABILITY of the controls.
This Surveillance requires verification that each RVHV valve strokes to its open position. The Surveillance Frequency for demonstrating valve OPERABILITY references the Inservice Testing Program.
REFERENCES          1. FSAR Section 15.5, Increase in Reactor Coolant System Inventory.
AP1000 STS                              B 3.4.16-3                                      Rev. 1

SG Tube Integrity B 3.4.17 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.17 Steam Generator (SG) Tube Integrity BASES BACKGROUND          Steam generator (SG) tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers.
The SG tubes have a number of important safety functions. Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary systems pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.4, RCS Loops.
SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements.
Steam generator tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively.
The SG performance criteria are used to manage SG tube degradation.
Specification 5.5.4, Steam Generator (SG) Program, requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 5.5.4, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 5.5.4. Meeting the SG performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions.
The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Ref. 1).
AP1000 STS                                B 3.4.17-1                                      Rev. 1

SG Tube Integrity B 3.4.17 BASES APPLICABLE The steam generator tube rupture (SGTR) accident is the limiting design SAFETY     basis event for SG tubes and avoiding an SGTR is the basis for this ANALYSES   Specification. The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate equal to the operational LEAKAGE rate limits in LCO 3.4.7, RCS Operational LEAKAGE, plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumes the contaminated secondary fluid is only briefly released to the atmosphere via safety valves and the majority is discharged to the main condenser.
The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture.) In these analyses, the steam discharge to the atmosphere includes primary to secondary SG tube LEAKAGE equivalent to the operational leakage limit of 150 gpd per SG. For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUIVALENT I-131 is assumed to be equal to the LCO 3.4.10, RCS Specific Activity, limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Ref. 2), 10 CFR 50.34 (Ref. 3) or the NRC approved licensing basis (e.g., a small fraction of these limits).
Steam generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO        The LCO requires that SG tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the repair criteria be plugged in accordance with the Steam Generator Program.
During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is removed from service by plugging. If a tube was determined to satisfy the repair criteria but was not plugged, the tube may still have tube integrity.
In the context of this Specification, a SG tube is defined as the entire length of the tube, including the tube wall, between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet.
The tube-to-tubesheet weld is not considered part of the tube.
A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 5.5.4, Steam Generator Program, and describe acceptable SG tube AP1000 STS                       B 3.4.17-2                                       Rev. 1

SG Tube Integrity B 3.4.17 BASES LCO (continued) performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria.
There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.
The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as, The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation.
Tube collapse is defined as, For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero. The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term significant is defined as An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established. For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis.
The division between primary and secondary classifications will be based on detailed analysis and/or testing.
Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included in the design specification.
This includes safety factors and applicable design basis loads based on ASME Code, Section III, Subsection NB (Ref. 4) and Regulatory Guide 1.121 (Ref. 5).
The accident induced leakage performance criterion ensures that the primary to secondary LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The AP1000 STS                             B 3.4.17-3                                      Rev. 1

SG Tube Integrity B 3.4.17 BASES LCO (continued) accident analysis assumes that accident induced leakage does not exceed 150 gpd per SG. The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.
The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in LCO 3.4.7, RCS Operational LEAKAGE, and limits primary to secondary LEAKAGE through any one SG to 150 gallons per day. This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative.
APPLICABILITY   Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced in MODE 1, 2, 3, or 4.
RCS conditions are far less challenging in MODES 5 and 6 than during MODES 1, 2, 3, and 4. In MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.
ACTIONS         The ACTIONS are modified by a Note clarifying that the Conditions may be entered independently for each SG tube. This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube. Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.
A.1 and A.2 Condition A applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube repair criteria but were not plugged in accordance with the Steam Generator Program as required by SR 3.4.17.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG repair criteria define limits on SG tube AP1000 STS                            B 3.4.17-4                                      Rev. 1

SG Tube Integrity B 3.4.17 BASES ACTIONS (continued) degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, Condition B applies.
A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity.
If the evaluation determines that the affected tube(s) have tube integrity, Required Action A.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tubes. However, the affected tube(s) must be plugged prior to entering MODE 4 following the next refueling outage or SG inspection.
This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.
B.1 and B.2 If the Required Actions and associated Completion Times of Condition A are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE      SR 3.4.17.1 REQUIREMENTS During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices.
AP1000 STS                              B 3.4.17-5                                       Rev. 1

SG Tube Integrity B 3.4.17 BASES SURVEILLANCE REQUIREMENTS (continued)
During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring assessment determines the as found condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.
The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube repair criteria. Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation.
Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations.
The Steam Generator Program defines the Frequency of SR 3.4.17.1.
The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Ref. 6). The Steam Generator Program uses information on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 5.5.4 contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections.
SR 3.4.17.2 During an SG inspection, any inspected tube that satisfies the Steam Generator Program repair criteria is removed from service by plugging.
The tube repair criteria delineated in Specification 5.5.4 are intended to ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube repair criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.
The Frequency of once prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all AP1000 STS                             B 3.4.17-6                                      Rev. 1

SG Tube Integrity B 3.4.17 BASES SURVEILLANCE REQUIREMENTS (continued) tubes meeting the repair criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential.
REFERENCES      1. NEI 97-06, Steam Generator Program Guidelines.
: 2. 10 CFR 50 Appendix A, GDC 19.
: 3. 10 CFR 50.34.
: 4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.
: 5. Regulatory Guide 1.121, Basis for Plugging Degraded Steam Generator Tubes, August 1976.
: 6. EPRI, Pressurized Water Reactor Steam Generator Examination Guidelines.
AP1000 STS                            B 3.4.17-7                                      Rev. 1

Accumulators B 3.5.1 B 3.5 PASSIVE CORE COOLING SYSTEM (PXS)
B 3.5.1 Accumulators BASES BACKGROUND           Two redundant PXS accumulators provide sufficient water to the reactor vessel during the blowdown phase of a large-break loss-of-coolant accident (LOCA), to provide inventory to help accomplish the refill phase that follows thereafter, to provide Reactor Coolant System (RCS) makeup for a small-break LOCA, and to provide RCS boration for steam line breaks (Ref. 1).
The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.
In the refill phase of a LOCA, which immediately follows the blowdown phase, reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heatup. The accumulator inventory is available to help fill voids in the lower plenum and reactor vessel downcomer so as to establish a recovery level at the bottom of the core and ongoing reflood of the core.
The accumulators are pressure vessels, partially filled with borated water and pressurized with nitrogen gas. The accumulators are passive components, since no operator or control actions are required for them to perform their function. Internal accumulator pressure is sufficient to discharge the accumulator contents to the RCS, if RCS pressure decreases below the static accumulator pressure.
Each accumulator is piped into the reactor vessel via an accumulator line and is isolated from the RCS by two check valves in series.
A normally open motor operated valve is arranged in series with the check valves. Upon initiation of a safeguards actuation signal, the normally open valves receive a confirmatory open signal.
Power lockout and position alarms ensure that the valves meet the requirements of the Institute of Electrical and Electronic Engineers (IEEE)
Standard 603-1991 (Ref. 2) for operating bypasses and that the accumulators will be available for injection without being subject to a single failure.
AP1000 STS                                  B 3.5.1-1                                      Rev. 1

Accumulators B 3.5.1 BASES BACKGROUND (continued)
The accumulator size, water volume, and nitrogen cover pressure are selected so that both of the accumulators are sufficient to recover the core cooling before significant clad melting or zirconium water reaction can occur following a large break LOCA. One accumulator is adequate during a small break LOCA where the entire contents of one accumulator can possibly be lost via the pipe break. This accumulator performance is based on design basis accident (DBA) assumptions and models (Ref. 3).
The probabilistic risk assessment (PRA) (Ref. 4) shows that one of the two accumulators is sufficient for a large break LOCA caused by spurious ADS actuation and that none of the accumulators are required for small break LOCAs, assuming that one core makeup tank (CMT) is available.
In addition, both accumulators are required for a large break LOCA caused by the break of a cold leg pipe; the probability of this break has been significantly reduced by incorporation of leak-before-break.
APPLICABLE       The accumulators are assumed to be OPERABLE in both the large and SAFETY           small break LOCA analyses at full power (Ref. 3) that establish the ANALYSES         acceptance limits for the accumulators. Reference to the analyses for these DBAs is used to assess changes in the accumulators as they relate to the acceptance limits.
For a small break LOCA, a large range of break sizes and locations were analyzed to verify the adequacy of the design. The cases analyzed include the rupture of one 8 inch direct vessel injection line and several smaller break sizes. Acceptable PXS performance was demonstrated.
For a larger LOCA, including a double ended RCS piping rupture, the PXS can provide a sufficiently large flow rate, assuming both accumulators are OPERABLE, to quickly fill the reactor vessel lower plenum and downcomer. Both accumulators, in conjunction with the CMTs, ensure rapid reflooding of the core. For a large break LOCA, both lines are available since an 8 inch line break would be a small break LOCA.
Following a non-LOCA event such as a steam line break, the RCS experiences a decrease in temperature and pressure due to an increase in energy removal by the secondary system. The cooldown results in a reduction of the core SHUTDOWN MARGIN with a potential for return to power. During such an event the accumulators provide injection of borated water to assist the boration by the CMTs to mitigate the reactivity transient and ensure the core remains shut down.
The accumulators satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                             B 3.5.1-2                                       Rev. 1

Accumulators B 3.5.1 BASES LCO           This LCO establishes the limits on accumulator parameters and conditions on accumulator component electrical power and alignment necessary to ensure that sufficient accumulator flow will be available to satisfy the acceptance criteria established for core cooling by 10 CFR 50.46 (Ref. 5). These criteria are:
: a. Maximum fuel element cladding temperature is  2200&deg;F;
: b. Maximum cladding oxidation is  0.17 times the total cladding thickness before oxidation;
: c. Maximum hydrogen generation from a zirconium-water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and
: d. The core is maintained in a coolable geometry.
Since the accumulators discharge during the blowdown phase of a LOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.
For an accumulator to be OPERABLE, the isolation valve must be fully open (and power removed when pressurizer pressure is  2000 psig),
and the limits established in the Surveillance Requirements for contained water, boron concentration, and nitrogen cover pressure must be met.
APPLICABILITY In MODES 1 and 2, and in MODES 3 and 4 with RCS pressure
              > 1000 psig, the accumulator OPERABILITY requirements are based on full power operation. Although cooling requirements decrease as power decreases, the accumulators are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.
This LCO is only applicable at pressures > 1000 psig. At pressures 1000 psig, the rate of RCS blowdown is such that adequate injection flow from other sources exists to retain peak clad temperatures below the 10 CFR 50.46 limit of 2200&deg;F.
In MODES 3 and 4 with RCS pressure  1000 psig, and in MODES 5 and 6, the accumulator motor operated isolation valves are closed to isolate the accumulators from the RCS. This allows the RCS cooldown and depressurization without discharging the accumulators into the RCS or requiring depressurization of the accumulators.
AP1000 STS                           B 3.5.1-3                                      Rev. 1

Accumulators B 3.5.1 BASES ACTIONS    A.1 If the boron concentration of one accumulator is not within limits, action must be taken to restore the parameter.
Deviations in boron concentration are expected to be slight, considering that the pressure and volume are verified once per 12 hours. For one accumulator, boron concentration not within limits will have an insignificant effect on the ability of the accumulators to perform their safety function. Therefore, a Completion Time of 72 hours is considered to be acceptable.
B.1 If one accumulator is inoperable for a reason other than boron concentration, the accumulator must be returned to OPERABLE status within 8 hours. With one accumulator inoperable, the remaining accumulator is capable of providing the required safety function, except for one low probability event (large cold leg break LOCA) discussed in the background section. The effectiveness of one accumulator is demonstrated in analysis performed to justify PRA success criteria (Ref. 4). The analysis contained in this reference shows that for a range of other events including small break LOCAs and large hot leg break LOCAs that with one accumulator unavailable the core is adequately cooled. The incremental conditional core damage probability with this 8 hour Completion Time is more than an order of magnitude less than the value indicated to have a small impact on plant risk (Ref. 6).
The 8 hour Completion Time to open the valve, remove power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to return the inoperable accumulator to OPERABLE status. The Completion Time is reasonable, since the CMTs are required to be available to provide small break LOCA mitigation. The effectiveness of backup CMT injection is demonstrated in analysis performed to justify PRA success criteria (Ref. 4). The analysis contained in this reference shows that for a small break LOCA, the injection from one CMT without any accumulator injection supports adequate core cooling. This analysis provides a high confidence that with the unavailability of one accumulator, the core can be cooled following design bases accidents.
If LCO 3.5.2 Condition C or E is also entered concurrent with this Condition, then a 1 hour Completion Time from discovery of LCO 3.5.1 Condition B entry concurrent with LCO 3.5.2 Condition C or E entry also applies. This 1 hour Completion Time requires very prompt actions to AP1000 STS                        B 3.5.1-4                                        Rev. 1

Accumulators B 3.5.1 BASES ACTIONS (continued) restore either the accumulator or the CMT (per LCO 3.5.2 Condition C or E) to OPERABLE status. This Completion Time is considered reasonable because of the low probability of simultaneously entering these multiple PXS Conditions and the very small likelihood of a LOCA occurring at the same time.
C.1 and C.2 If the Required Action and associated Completion Time of Condition A or B are not met, the plant must be placed in a MODE or condition in which the LCO does not apply. This is done by placing the plant in MODE 3 within 6 hours and with pressurizer pressure to  1000 psig within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1 If more than one accumulator is inoperable, the plant is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately.
SURVEILLANCE        SR 3.5.1.1 REQUIREMENTS Each accumulator valve should be verified to be fully open every 12 hours. This verification ensures each accumulator isolation valve is fully open, as indicated in the control room, and timely discovery if a valve should be less than fully open. If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power removed, a partially closed valve could result in not meeting DBA analyses assumptions (Ref. 3). A 12 hour Frequency is considered reasonable in view of the other administrative controls which ensure that a mispositioned isolation valve is unlikely.
SR 3.5.1.2 and 3.5.1.3 Verification every 12 hours of the borated water volume and nitrogen cover pressure in each accumulator is sufficient to ensure adequate injection during a LOCA. Because of the static design of the accumulator, a 12 hour Frequency usually allows the operator to identify AP1000 STS                                B 3.5.1-5                                        Rev. 1

Accumulators B 3.5.1 BASES SURVEILLANCE REQUIREMENTS (continued) changes before limits are reached. Considering that control room alarms are provided for both parameters these limits are effectively subject to continuous monitoring. The 12 hour Frequency is considered reasonable considering the availability of the control room alarms and the likelihood that, with any deviation which may occur, the accumulators will perform their safety function with slight deviations in these parameters.
SR 3.5.1.4 The boron concentration should be verified to be within required limits for each accumulator every 31 days, since the static design of the accumulators limits the ways in which the concentration can be changed.
The 31 day Frequency is adequate to identify changes that could occur from mechanisms such as in-leakage. Sampling the affected accumulator within 6 hours after a 51 cu ft (i.e., 3% of nominal required borated water volume of 1700 cu ft) volume increase will promptly identify whether the volume change has caused a reduction of boron concentration to below the required limit. It is not necessary to verify boron concentration if the added water inventory is from the in-containment refueling water storage tank (IRWST), because the water contained in the IRWST is within the accumulator boron concentration requirements. This is consistent with the recommendation of NUREG-1366 (Ref. 7).
SR 3.5.1.5 Verification every 31 days that power is removed from each accumulator isolation valve operator when the pressurizer pressure is  2000 psig ensures that an active failure could not result in the undetected closure of an accumulator motor operated isolation valve. If this were to occur, reduced accumulator capacity might be available for injection following a DBA that required operation of the accumulators. Since power is removed under administrative control, the 31 day Frequency will provide adequate assurance that power is removed.
This SR allows power to be supplied to the motor operated isolation valves when pressurizer pressure is < 2000 psig, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during unit startup or shutdowns.
Should closure of a valve occur, the safeguard actuation signal provided to the valve would open a closed valve, if required.
AP1000 STS                              B 3.5.1-6                                     Rev. 1

Accumulators B 3.5.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.5.1.6 This SR requires performance of a system performance test of each accumulator to verify flow capabilities. The system performance test demonstrates that the accumulator injection line resistance assumed in accident analyses is maintained. Although the likelihood that system performance would degrade with time is low, it is considered prudent to periodically verify system performance. The System Level Operability Testing Program provides specific test requirements and acceptance criteria.
REFERENCES      1. FSAR Section 6.3 Passive Core Cooling System.
: 2. IEEE Standard 603-1991, Criteria for Safety Systems for Nuclear Power Generating Stations.
: 3. FSAR Section 15.6 Decrease in Reactor Coolant Inventory.
: 4. AP1000 Probabilistic Risk Assessment.
: 5. 10 CFR 50.46.
: 6. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, August 1998.
: 7. NUREG-1366, Improvements to Technical Specifications Surveillance Requirements, December 1992.
AP1000 STS                            B 3.5.1-7                                    Rev. 1

CMTs - Operating B 3.5.2 B 3.5 PASSIVE CORE COOLING SYSTEM (PXS)
B 3.5.2 Core Makeup Tanks (CMTs) - Operating BASES BACKGROUND         Two redundant CMTs provide sufficient borated water to assure Reactor Coolant System (RCS) reactivity and inventory control for all design basis accidents (DBAs), including both loss of coolant accident (LOCA) events and non-LOCA events (Ref. 1).
The CMTs are cylindrical tanks with hemispherical upper and lower heads. They are made of carbon steel and clad on the internal surfaces with stainless steel. They are located in containment at an elevation slightly above the reactor coolant loops. Each tank is full of borated water at > 3400 ppm. During normal operation, the CMTs are maintained at RCS pressure through a normally open pressure balance line from the cold leg.
The outlet line from each CMT is connected to one of two direct vessel injection lines, which provides an injection path for the water supplied by the CMT. The outlet line from each CMT is isolated by parallel, normally closed, fail open valves. Upon receipt of a safeguards actuation signal, these four valves open to align the CMTs to the RCS.
The CMTs will inject to the RCS as inventory is lost and steam or reactor coolant is supplied to the CMT to displace the water that is injected.
Steam or reactor coolant is provided to the CMT through the cold leg balance line, depending upon the specific event that has occurred. The inlet line from the cold leg is sized for LOCA events, where the cold legs become voided and higher CMT injection flows are required.
The injection line from each CMT contains a flow tuning orifice that is used to provide a mechanism for the field adjustment of the injection line resistance. The orifice is used to establish the required flow rates for the associated plant conditions assumed in the CMT design. The CMT flow is based on providing injection for a minimum of 20 minutes after CMT actuation.
The CMT size and injection capability are selected to provide adequate RCS boration and safety injection for the limiting DBA. One CMT is adequate for this function during a small break LOCA where one CMT completely spills via the pipe break (Ref. 2). The probabilistic risk assessment (PRA) (Ref. 3) shows that none of the CMTs are required for small break LOCAs, assuming that one accumulator is available.
AP1000 STS                                B 3.5.2-1                                       Rev. 1

CMTs - Operating B 3.5.2 BASES APPLICABLE The CMTs are assumed to be OPERABLE to provide emergency SAFETY     boration and core makeup when the Chemical and Volume Control ANALYSES   System (CVS) is unavailable or insufficient, and to mitigate the consequences of any DBA which requires the safety injection of borated water (Ref. 2).
Following a non-LOCA event such as a steam line break, the RCS experiences a decrease in temperature and pressure due to an increase in energy removal by the secondary system. The cooldown results in a reduction of the core SHUTDOWN MARGIN due to the negative moderator temperature coefficient, with a potential for return to power.
The actuation of the CMTs following this event provides injection of borated water to mitigate the reactivity transient and ensure the core remains shut down.
In the case of a steam generator tube rupture (SGTR), CMT injection provides borated water to compensate for RCS LEAKAGE.
In the case of an RCS leak of 10 gallons per minute, the CMTs can delay depressurization for 10 hours, providing makeup to the RCS and remain able to provide the borated water to compensate for RCS shrinkage and to assure the RCS boration for a safe shutdown.
In the case of a LOCA, the CMTs provide a relatively large makeup flow rate for approximately 20 minutes, in conjunction with the accumulators to provide the initial core cooling.
In the case of small break LOCA, the borated water volume of one CMT is adequate for RCS safety injection, where one CMT completely spills via the pipe break.
CMTs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO        This LCO establishes the limits on CMT parameters and conditions on CMT components necessary to ensure that the CMT flow assumed in the safety analyses will be available. OPERABILITY is not expected to be challenged due to small gas accumulations in the high point, and rapid gas accumulations are not expected during plant operation. However, a relatively small gas volume was incorporated into the design for alerting operators to provide sufficient time to initiate venting operations before the gas volume would be expected to increase to a sufficient volume that might potentially challenge the OPERABILITY of natural circulation flow.
Therefore, noncondensible gas accumulation in the inlet line high point that causes the water level to drop below the sensor will require operator AP1000 STS                         B 3.5.2-2                                      Rev. 1

CMTs - Operating B 3.5.2 BASES LCO (continued) action to investigate the cause of the gas accumulation and to vent the associated high point(s).
Each CMT represents 100% of the total injected borated water assumed in LOCA analysis. If the injection line from a single CMT to the vessel breaks, no single active failure on the other CMT will prevent the injection of borated water into the vessel. Thus the assumptions of the LOCA analysis will be satisfied.
For non-LOCA analysis, two CMTs are assumed. Note that for non-LOCA analysis, the accident cannot disable a CMT.
APPLICABILITY   In MODES 1, 2, and 3, and in MODE 4 when the RCS is not being cooled by the Normal Residual Heat Removal System (RNS) the CMTs are required to be OPERABLE to provide borated water for RCS inventory makeup and reactivity control following a design basis event and subsequent cooldown.
The CMT requirements in MODE 5 with the RCS pressure boundary intact are specified in LCO 3.5.3, Core Makeup Tanks (CMTs)
Shutdown, RCS Intact.
The CMTs are not required to be OPERABLE while in MODE 5 with the RCS pressure boundary open or in MODE 6 because the RCS is depressurized and borated water can be supplied from the In-containment Refueling Water Storage Tank (IRWST), if needed.
In the unlikely event of a total loss of AC power sources, coupled with an inoperable Passive Residual Heat Removal Heat Exchanger (PRHR HX)
(beyond DBA), the CMTs may be used in a feed and bleed sequence to remove heat from the RCS.
ACTIONS         A.1 With one outlet isolation valve inoperable on one CMT, action must be taken to restore the valve. In this Condition, the CMT is capable of performing its safety function, provided a single failure of the remaining parallel isolation valve does not occur. A Completion Time of 72 hours is acceptable for a two train emergency core cooling system (ECCS) which is capable of performing its safety function without a single failure.
AP1000 STS                             B 3.5.2-3                                       Rev. 1

CMTs - Operating B 3.5.2 BASES ACTIONS (continued)
B.1 If the water temperature or boron concentration of one CMT is not within limits, it must be returned to within limits within 72 hours. The deviations in these parameters are expected to be slight, considering the frequent Surveillances and control room monitors. With the temperature above the limit, the full core cooling capability assumed in the safety analysis may not be available. With the boron concentration not within limits, the ability to maintain subcriticality following a DBA may be degraded. However, because only one of two CMTs is inoperable, and the deviations of these parameters are expected to be slight, it is probable that more than a required amount of boron and cooling capability will be available to meet the conditions assumed in the safety analysis.
Since the CMTs are redundant, safety class components, the 72 hour Completion Time is consistent with the times normally allowed for this type of component.
C.1 With two CMTs inoperable due to water temperature or boron concentration, one CMT must be restored to within limits in 8 hours. The deviations in these parameters are expected to be slight, considering the frequent Surveillances and control room monitors. A Completion Time of 8 hours is considered reasonable since the CMTs are expected to be capable of performing their safety function with slight deviations in these parameters and the accumulators are required to be available for LOCA mitigation (i.e., concurrent entry into Condition B of LCO 3.5.1 has not occurred). The effectiveness of accumulator injection is demonstrated in analysis performed to justify PRA success criteria (Ref. 3). The analysis contained in this reference shows that for a small break LOCA, the injection from one accumulator without any CMT injection supports adequate core cooling. This analysis provides a high confidence that with the unavailability of two CMTs due to water temperature or boron concentration deviations, the core can be cooled following design bases accidents.
If LCO 3.5.1 Condition B is entered concurrent with this Condition, then a 1 hour Completion Time from discovery of LCO 3.5.2 Condition C entry concurrent with LCO 3.5.1 Condition B entry also applies. This 1 hour Completion Time requires very prompt actions to restore either the CMT or the accumulator (per LCO 3.5.1 Condition B) to OPERABLE status.
This Completion Time is considered reasonable because of the low AP1000 STS                                B 3.5.2-4                                      Rev. 1

CMTs - Operating B 3.5.2 BASES ACTIONS (continued) probability of simultaneously entering these multiple PXS Conditions and the very small likelihood of a LOCA occurring at the same time.
D.1 Excessive amounts of noncondensible gases in a CMT inlet line may interfere with the natural circulation flow (hot water from the RCS through the balance line into the CMT and cold water from the CMT through the direct vessel injection line into the vessel) assumed in the safety analyses for some transients. For CMT injection following a LOCA (steam will enter the CMT through the balance line, displacing the CMT water), gases in the CMT inlet line are detrimental to the CMT function.
The presence of some noncondensible gases does not mean that the CMT natural circulation capability is immediately inoperable, but that gases are collecting and should be vented.
The level sensor location has been selected to permit additional gas accumulation prior to significantly affecting the natural circulation flow so that adequate time may be provided to permit containment entry for venting the gas. Anticipated noncondensible gas accumulation in this piping segment is expected to be relatively slow.
The venting of these gases requires containment entry to manually operate the vent valves. A Completion Time of 24 hours is permitted for venting noncondensible gases and is acceptable, since, for the transients, the natural circulation capability of one CMT is adequate to ensure mitigation assuming less conservative analysis assumptions regarding stuck rods and core characteristics.
E.1 With one CMT inoperable for reasons other than Condition A, B, or D, operation of the CMT may not be available. Action must be taken to restore the inoperable CMT to OPERABLE status within 8 hours. The remaining CMT is sufficient for DBAs except for a LOCA with a break in the OPERABLE CMT's direct vessel injection (DVI) line. The 8 hour Completion Time is based on the required availability of the accumulators to provide safety injection (that is, concurrent entry into Condition B of LCO 3.5.1 has not occurred). The effectiveness of accumulator injection is demonstrated in analysis performed to justify PRA success criteria (Ref. 3). The analysis contained in this reference shows that for a small break LOCA, the injection from one accumulator without any CMT supports adequate core cooling. This analysis provides a high AP1000 STS                                B 3.5.2-5                                         Rev. 1

CMTs - Operating B 3.5.2 BASES ACTIONS (continued) confidence that with the unavailability of one CMT, the core can be cooled following any DBA.
If LCO 3.5.1 Condition B is entered concurrent with this Condition, then a 1 hour Completion Time from discovery of LCO 3.5.2 Condition C entry concurrent with LCO 3.5.1 Condition B entry also applies. This 1 hour Completion Time requires very prompt actions to restore either the CMT or the accumulator (per LCO 3.5.1 Condition B) to OPERABLE status.
This Completion Time is considered reasonable because of the low probability of simultaneously entering these multiple PXS Conditions and the very small likelihood of a LOCA occurring at the same time.
F.1 and F.2 If a Required Action and associated Completion Time of Condition A, B, C, D, or E are not met or two CMTs are inoperable for reasons other than Condition C, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE      SR 3.5.2.1 REQUIREMENTS Verification every 24 hours that the temperature of the borated water in each CMT is within limits ensures that when a CMT is needed to inject water into the RCS, the injected water temperature will be within the limits assumed in the accident analysis. The 24 hour Frequency is adequate, based on the fact that no mechanism exists to rapidly change the temperature of a large tank of water such as a CMT. This parameter is normally monitored in the control room by indication and alarms. Also, there are provisions for monitoring the temperature of the inlet and outlet lines to detect in-leakage which may affect the CMT water temperature.
SR 3.5.2.2 Each CMT inlet isolation valve must be verified to be fully open each 12 hours. Frequent verification is considered to be important, since a CMT cannot perform its safety function if the valve is closed. Control room instrumentation is normally available for this verification.
AP1000 STS                               B 3.5.2-6                                     Rev. 1

CMTs - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.5.2.3 Verification that excessive amounts of noncondensible gases have not caused the water level to drop below the sensor in the inlet line is required every 24 hours. The inlet line of each CMT has a vertical section of pipe which serves as a high point collection point for noncondensible gases. Control room indication of the water level in the high point collection point is available to verify that noncondensible gases have collected to the extent that the water level is depressed below the allowable level. The thermal dispersion sensor locations on the vertical pipe sections have been selected to permit additional gas accumulation before injection flow is significantly affected so that adequate time may be provided to permit containment entry for venting the gas.
This level is well above the CMT level corresponding to that assumed in the safety analysis for CMT injected volume. Verifying the noncondensible gas volume is within the noncondensible gas limit confirms  2487 cu. ft. of borated water volume in the CMT.
The 24 hour Frequency is based on the expected low rate of gas accumulation and the availability of control room indication.
SR 3.5.2.4 The minimum boron concentration of 3400 ppm assures the CMT safety analysis minimum reactivity control requirements are met. The maximum boron concentration allowed within each CMT at any time shall be 4500 ppm to prevent overboration.
Verification every 31 days that the boron concentration in each CMT is within the required limits ensures that the reactivity control from each CMT, assumed in the safety analysis, will be available as required. The 31 day Frequency is adequate to identify changes which could occur from mechanisms such as in-leakage considering the provisions for monitoring temperature of the inlet line and top of the CMT. Additionally, the top of the CMT has control room indication and an alarm on increased temperature, which would be indicative of in-leakage.
SR 3.5.2.5 Verification that the redundant outlet isolation valves are OPERABLE by stroking the valves open ensures that each CMT will function as designed when these valves are actuated. Prior to opening the outlet.
AP1000 STS                              B 3.5.2-7                                      Rev. 1

CMTs - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued) isolation valves, the inlet isolation valve should be closed temporarily.
Closing the inlet isolation valve ensures that the CMT contents will not be diluted or heated by flow from the RCS. Upon completion of the test, the inlet isolation valves must be opened. The Surveillance Frequency references the inservice testing requirements.
SR 3.5.2.6 This SR verifies that CMT outlet isolation valve actuates to the correct position on an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valve. The Frequency of 24 months is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operation.
SR 3.5.2.7 This SR requires performance of a system performance test of each CMT to verify flow capabilities. The system performance test demonstrates that the CMT injection line resistance assumed in DBA analyses is maintained. Although the likelihood that system performance would degrade with time is low, it is considered prudent to periodically verify system performance. The System Level Operability Testing Program provides specific test requirements and acceptance criteria.
REFERENCES      1. FSAR Section 6.3, Passive Core Cooling System.
: 2. FSAR Chapter 15, Accident Analyses.
: 3. AP1000 Probabilistic Risk Assessment.
AP1000 STS                             B 3.5.2-8                                      Rev. 1

CMTs - Shutdown, RCS Intact B 3.5.3 B 3.5 PASSIVE CORE COOLING SYSTEM (PXS)
B 3.5.3 Core Makeup Tanks (CMTs) - Shutdown, Reactor Coolant System (RCS) Intact BASES BACKGROUND          A description of the CMTs is provided in the Bases for LCO 3.5.2, Core Makeup Tanks - Operating.
APPLICABLE          When the plant is shutdown with the Reactor Coolant System (RCS)
SAFETY              pressure boundary intact, the CMT and Passive Residual Heat Removal ANALYSES            (PRHR) are the preferred methods for mitigation of postulated events such as loss of normal decay heat removal capability (either loss of Startup Feedwater or loss of normal residual heat removal system). The CMT and PRHR are preferred because the RCS pressure boundary can remain intact, thus preserving one of the barriers to fission product release. For these events, the PRHR provides the safety related heat removal path and the CMT maintains RCS inventory control (Ref. 1).
These events can also be mitigated by In-containment Refueling Water Storage Tank (IRWST) injection; however, the RCS must be depressurized through actuation of the Automatic Depressurization System (ADS) in order to facilitate IRWST injection.
Since no loss of coolant accidents (LOCAs) are postulated within the applicability of this LCO, the possibility of a break in the direct vessel injection line is not considered. As a result, only one CMT is required to be available to provide core cooling in response to postulated events.
The two parallel CMT outlet isolation valves ensure that injection from one CMT occurs in the event of a single active failure. Note that a volume of noncondensible gases in the CMT inlet line does not affect the mechanism for draindown injection capability or required core cooling, and therefore does not affect the CMT OPERABILITY in MODE 5 with the RCS not VENTED.
CMTs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                 This LCO establishes the minimum conditions necessary to ensure that one CMT will be available for RCS inventory control in the event of the loss of normal decay heat removal capability. The two CMT outlet isolation valves must be OPERABLE to ensure that one valve will operate, assuming that the other valve is disabled by a single active failure.
AP1000 STS                                 B 3.5.3-1                                        Rev. 1

CMTs - Shutdown, RCS Intact B 3.5.3 BASES APPLICABILITY In MODE 4 without steam generator heat removal and in MODE 5 with the RCS not VENTED, one CMT is required to provide borated water to the RCS in the event the non-safety related chemical and volume control system makeup pumps are not available to provide RCS inventory control.
The RCS is considered VENTED when the ADS stage 1, 2, and 3 flow paths (or alternative flow path with equivalent area) required by LCO 3.4.13, Automatic Depressurization System (ADS)  Shutdown, RCS Open, are open, such that when combined with required ADS stage 4 actuation, sufficient steam venting area is provided to lower RCS pressure sufficiently to allow IRWST injection.
The CMT requirements in MODES 1, 2, 3, and 4 are specified in LCO 3.5.2, Core Makeup Tanks (CMTs)  Operating.
The CMTs are not required to be OPERABLE while in MODE 5 with the RCS VENTED or in MODE 6 because the RCS is depressurized and borated water can be supplied from the IRWST, if needed.
ACTIONS       A.1 With one outlet isolation valve inoperable action must be taken to restore the valve. In this Condition the CMT is capable of performing its safety function, provided a single failure of the remaining parallel isolation valve does not occur. A Completion Time of 72 hours is consistent with times normally applied to an emergency core cooling system (ECCS), which is capable of performing its safety function without a single failure.
B.1 If the water temperature or boron concentration in the required CMT is not within limits, it must be returned to within limits within 72 hours. With the temperature above the limit the makeup capability assumed in the safety analysis may not be available. With the boron concentration not within limits, the ability to maintain subcriticality may be degraded.
Because the mechanisms for significantly altering these parameters in the CMT are limited, it is probable that more than the required amount of boron and cooling capacity will be available to meet the conditions assumed in the safety analysis. Therefore, the 72 hour Completion Time is acceptable.
AP1000 STS                            B 3.5.3-2                                       Rev. 1

CMTs - Shutdown, RCS Intact B 3.5.3 BASES ACTIONS (continued)
C.1 and C.2 While in MODE 4, with the RCS being cooled by the RNS, excessive amounts of noncondensible gases in a required CMT inlet line might interfere with the natural circulation flow (hot water from the RCS through the balance line into the CMT and cold water from the CMT through the direct vessel injection line into the vessel) assumed in safety analyses for some transients. The presence of some noncondensible gases does not mean that the CMT natural circulation capability is immediately inoperable, but that gases are collecting and should be vented.
A Completion Time of 24 hours is required to either vent the required CMT inlet line to restore the CMT inlet line noncondensible gas volume to within limit or bring the plant to MODE 5, where SR 3.5.3.2 is not applicable. This Completion Time is permitted to allow containment entry and manual operation of vent valves. It is reasonable because the air void does not impact the ability of the CMT to maintain RCS inventory.
D.1 With the required CMT inoperable for reasons other than Condition A, B, or C operation of the CMT may not be available. Action must be taken to restore the inoperable CMT to OPERABLE status within 8 hours. The 8 hour Completion Time is based on the availability of injection from the IRWST to provide RCS makeup. The ability of the IRWST to provide RCS injection is demonstrated by analysis performed to show that IRWST injection together with ADS venting provides adequate core cooling.
Such analysis was performed for the loss of RNS cooling during midloop operations. The analysis was performed in support of the probabilistic risk assessment (PRA) (Ref. 2).
E.1 If the Required Action or associated Completion Time of Conditions A, B, or D are not met action must be initiated, immediately, to place the plant in a MODE where this LCO does not apply. Action must be initiated, immediately, to place the plant in MODE 5 with RCS VENTED. In this condition, core cooling and RCS makeup are provided by IRWST injection and sump recirculation. With the RCS VENTED, actuation of ADS Stage 4 sufficiently depressurizes the RCS to enable IRWST injection.
AP1000 STS                                B 3.5.3-3                                     Rev. 1

CMTs - Shutdown, RCS Intact B 3.5.3 BASES SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The LCO 3.5.2 Surveillance Requirements (SR 3.5.2.1 through 3.5.2.7, except SR 3.5.2.3) are applicable to the CMT required to be OPERABLE.
The Frequencies associated with each specified SR are applicable.
Refer to the corresponding Bases for LCO 3.5.2 for a discussion of each SR.
SR 3.5.3.2 The LCO 3.5.2 SR 3.5.2.3 is applicable to the CMT required to be OPERABLE in MODE 4, with RCS cooling provided by the RNS. It is not required to be met in MODE 5, with the RCS not VENTED, because a noncondensible gas volume in the CMT inlet line does not affect its draindown capability. This level is well above the CMT level corresponding to that assumed in the analysis for loss of RNS CMT volume. Verifying the noncondensible gas volume is within the noncondensible gas limit also confirms the required borated water volume in the CMT. The Frequency associated with the specified SR is applicable. Refer to the corresponding Bases for LCO 3.5.2 for a discussion of this SR.
SR 3.5.3.3 Verification every 7 days that the volume of the borated water is 2450 cu. ft. for the CMT required to be OPERABLE in MODE 5 with the RCS not VENTED verifies that when the OPERABLE CMT is needed to inject water into the RCS, the injected water volume will be within the limits assumed in the analyzed event. This parameter is normally monitored in the control room by indication and alarm. The 7 day Frequency is adequate, based on the fact that no mechanism exists which will drain water below the top nozzle of the CMT REFERENCES   1. FSAR Section 6.3, Passive Core Cooling System.
: 2. AP1000 Probabilistic Risk Assessment.
AP1000 STS                          B 3.5.3-4                                      Rev. 1

PRHR HX - Operating B 3.5.4 B 3.5 PASSIVE CORE COOLING SYSTEM (PXS)
B 3.5.4 Passive Residual Heat Removal Heat Exchanger (PRHR HX) - Operating BASES BACKGROUND           The normal heat removal mechanism is the steam generators, which are supplied by the startup feedwater system. However, this path utilizes non-safety related components and systems, so its failure must be considered. In the event the steam generators are not available to remove decay heat for any reason, including loss of startup feedwater, the heat removal path is the PRHR HX (Ref. 1).
The principal component of the PRHR HX is a 100% capacity heat exchanger mounted in the In-containment Refueling Water Storage Tank (IRWST). The heat exchanger is connected to the Reactor Coolant System (RCS) by a inlet line from one RCS hot leg, and an outlet line to the associated steam generator cold leg channel head. The inlet line to the passive heat exchanger contains a normally open, motor operated isolation valve. The outlet line is isolated by two parallel, normally closed air operated valves, which fail open on loss of air pressure or control signal. There is a vertical collection point at the top of the common inlet piping high point which serves as a gas collector. It is provided with level detectors that indicate when noncondensible gases have collected in this area. There are provisions to manually vent these gases to the IRWST.
In order to preserve the IRWST water for long term PRHR HX operation, downspouts and a gutter are provided to collect and return water to the IRWST that has condensed on the inside surface of the containment shell. During normal plant operation any water collected by the downspouts or gutter is directed to the normal containment sump. During PRHR HX operation, redundant series air operated valves are actuated to block the draining of condensate to the normal sump and to force the condensate into the IRWST. These valves fail closed on loss of air pressure or control signal.
The PRHR HX size and heat removal capability is selected to provide adequate core cooling for the limiting non-LOCA heatup Design Basis Accidents (DBAs) (Ref. 2). The probabilistic risk assessment (PRA)
(Ref. 3) shows that the PRHR HX is not required assuming that passive feed and bleed is available. Passive feed and bleed uses the Automatic Depressurization System (ADS) for bleed and the CMTs/accumulators/
IRWST for feed.
AP1000 STS                                 B 3.5.4-1                                         Rev. 1

PRHR HX - Operating B 3.5.4 BASES APPLICABLE In the event of a non-LOCA DBA during normal operation, the PRHR HX SAFETY     is automatically actuated to provide decay heat removal path in the event ANALYSES   the normal path through the steam generators is not available (Ref. 2).
The non-LOCA events which establish the PRHR HX parameters are those involving a decrease in heat removal by the secondary system, such as loss of main feedwater or other failure in the feedwater system.
Since the PRHR HX is passive, it will mitigate the consequences of these events with a complete loss of all AC power sources. The PRHR HX actuates when the CMTs are actuated during LOCA events.
The PRHR HX satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO        This LCO requires that the PRHR HX be OPERABLE so that it can respond appropriately to the DBAs which may require its operation.
Since this is a passive component, it does not require the actuation of active components such as pumps for its OPERABILITY and will be OPERABLE if the inlet valves are in their normally open position, and the normally closed, fail open outlet valves open on receipt of an actuation signal.
In addition to the appropriate valve configuration, OPERABILITY may be impaired by noncondensible gases collecting in the system.
OPERABILITY is not expected to be challenged due to small gas accumulations in the high point, and rapid gas accumulations are not expected during plant operation. However, a relatively small gas volume was incorporated into the design for alerting operators to provide sufficient time to initiate venting operations before the gas volume would be expected to increase to a sufficient volume that might potentially challenge the OPERABILITY of natural circulation flow. Therefore, noncondensible gas accumulation in the inlet line high point that causes the water level to drop below the sensor will require operator action to investigate the cause of the gas accumulation and to vent the associated high point(s).
A reactor coolant pump (RCP) is required to be operating in the loop with the PRHR HX, Loop 1, if any RCPs are operating. If RCPs are only operating in Loop 2 and no RCPs are operating in Loop 1, there is a possibility there may be reverse flow in the PRHR HX.
AP1000 STS                          B 3.5.4-2                                    Rev. 1

PRHR HX - Operating B 3.5.4 BASES APPLICABILITY The PRHR HX must be OPERABLE in MODES 1, 2, and 3, and in MODE 4 with the RCS not cooled by the Normal Residual Heat Removal System (RNS). Under these conditions, the PRHR HX may be actuated to provide core cooling and to mitigate the consequences of a DBA.
The PRHR HX requirements in MODE 4 with RCS cooling provided by the RNS and in MODE 5 with the RCS pressure boundary intact are specified in LCO 3.5.5, Passive Residual Heat Removal Heat Exchanger (PRHR HX)  Shutdown, RCS Intact.
The PRHR HX is not capable of natural circulation cooling of the RCS in MODE 5 with the RCS pressure boundary open or in MODE 6.
ACTIONS       A.1 The outlet line from the PRHR HX is controlled by a pair of normally closed, fail open, air operated valves, arranged in parallel. Thus they are redundant and, if either valve is OPERABLE, the system can function at 100% capacity, assuming other OPERABILITY conditions are met.
If one valve is inoperable, a Completion Time of 72 hours has been allowed to restore the inoperable valve(s) to OPERABLE status. This Completion Time is consistent with the Completion Times specified for other parallel redundant safety related systems.
B.1 With one air operated IRWST gutter isolation valve inoperable, the remaining isolation valve can function to drain the gutter to the IRWST.
Action must be taken to restore the inoperable gutter isolation valve to OPERABLE status within 72 hours. The 72 hour Completion Time is acceptable based on the capability of the remaining valve to perform 100% of the required safety function assumed in the safety analyses.
C.1 Excessive amounts of noncondensible gases in the PRHR HX inlet line may interfere with the natural circulation flow of reactor coolant through the PRHR HX. The presence of some noncondensible gases does not mean that the PRHR HX is immediately inoperable, but that gases are collecting and should be vented.
The level sensor location has been selected to permit additional gas accumulation before natural circulation flow is significantly affected so AP1000 STS                           B 3.5.4-3                                       Rev. 1

PRHR HX - Operating B 3.5.4 BASES ACTIONS (continued) that sufficient time may be provided to permit containment entry for venting the gas. Anticipated noncondensible gas accumulation in this piping segment is expected to be relatively slow.
The venting of these gases requires containment entry to manually operate the appropriate vent valves. A Completion Time of 24 hours is acceptable considering that passive feed and bleed cooling is available to remove heat from the RCS.
D.1 and D.2 If any of the above Required Actions have not been accomplished in the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 4, with the RCS cooled by the RNS, within 24 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
E.1 With the LCO not met for reasons other than Condition A, B, or C, the PRHR HX must be restored within 8 hours. The 8 hour Completion Time is based on the availability of passive feed and bleed cooling to provide RCS heat removal. The effectiveness of feed and bleed cooling has been demonstrated in analysis and evaluations performed to justify PRA success criteria (Ref. 3). The analysis contained in this reference shows that for a range of events including loss of main feedwater, SGTR, and small break LOCA (as small as 1/2) that feed and bleed cooling provides adequate core cooling.
These analyses and evaluations provide a high confidence that with the unavailability of the PRHR HX the core can be cooled following design bases accidents.
F.1 and F.2 If the PRHR HX is not restored in accordance with Action E.1 within 8 hours, the plant must be placed in a MODE in which the LCO does not apply. This is accomplished by placing the plant in MODE 3 within 6 hours and in MODE 5 within 36 hours.
AP1000 STS                               B 3.5.4-4                                     Rev. 1

PRHR HX - Operating B 3.5.4 BASES ACTIONS (continued)
Action F.1 is modified by a Note which requires that prior to initiating cooldown of the plant to MODE 3, redundant means of providing SG feedwater be verified as available. Possible means include two main feedwater pumps (with two condensate pumps), or startup feedwater pumps, or two startup feedwater pumps, or a combination of one main feedwater pump (with one condensate pump) and one startup feedwater pump. With the PRHR HX inoperable and redundant means of feeding the SGs not available, the unit is in a seriously degraded condition with no means for conducting a controlled cooldown. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. If redundant means of feeding the SGs are not available, the plant should be maintained in the current MODE until redundant means are restored. LCO 3.0.3 and all other Required Actions shall be suspended until the redundant means are restored, because they could force the unit into a less safe condition.
The Completion Time for Required Action F.1 is intended to allow the operator time to evaluate availability of redundant means. In this Required Action, the Completion Time only begins on discovery that redundant means of feeding the SGs are available.
Action F.2 is modified by a Note which requires that prior to stopping SG feedwater, redundant means of cooling the RCS to cold shutdown conditions must be verified as available. One redundant means of cooling the RCS to cold shutdown includes the normal residual heat removal system (RNS). Without availability of these redundant cooling means, the unit is in a seriously degraded condition with no means for continuing the controlled cooldown. Until the redundant cooling means are restored, heat removal using SG feedwater should be maintained.
LCO 3.0.3 and all other Required Actions shall be suspended until the systems and equipment required for further cooldown are restored, because they could force the unit into a less safe condition.
The Completion Time for Required Action F.2 is intended to allow the operator time to evaluate availability of redundant means. In this Required Action, the Completion Time only begins on discovery that redundant means of cooling the RCS to cold shutdown conditions are available.
Support equipment should be evaluated when assessing whether redundant means are available.
AP1000 STS                                 B 3.5.4-5                                       Rev. 1

PRHR HX - Operating B 3.5.4 BASES SURVEILLANCE SR 3.5.4.1 REQUIREMENTS Verification, using remote indication, that the common PRHR HX outlet manual isolation valve is fully open ensures that the flow path from the heat exchangers to the RCS is available. Misalignment of this valve could render the heat exchanger inoperable. A 12 hour Frequency is reasonable considering that the valve is manually positioned and has control room position indication and alarm.
SR 3.5.4.2 Verification that the motor operated PRHR HX inlet valve is fully open, as indicated in the main control room, ensures timely discovery if the valve is not fully open. The 12 hour Frequency is consistent with the ease of verification, confirmatory open signals, and redundant series valve controls that prevent spurious closure.
SR 3.5.4.3 Verification that excessive amounts of noncondensible gases have not caused the water level to drop below the sensor in the inlet line is required every 24 hours. The inlet line of the PRHR HX has a vertical section of pipe which serves as a high point collection point for noncondensible gases. The thermal dispersion sensor location on the vertical pipe section has have been selected to permit additional gas accumulation before natural circulation flow is significantly affected so that sufficient time may be provided to permit containment entry for venting the gas.
Control room indication of the water level in this high point collection point is available to verify that noncondensible gases have not collected to the extent that the water level is depressed below the allowable level.
The 24 hour Frequency is based on the expected low rate of gas accumulation and the availability of control room indication.
SR 3.5.4.4 Verification is required to confirm that one Loop 1 RCP is in operation, if any RCPs are operating. If RCPs are only operating in Loop 2 and no RCPs are operating in Loop 1, there is a possibility there may be reverse flow in the PRHR HX. The Frequency of 12 hours is sufficient considering other indications and alarms available to the operator in the main control room to monitor RCS loop performance.
AP1000 STS                          B 3.5.4-6                                       Rev. 1

PRHR HX - Operating B 3.5.4 BASES SURVEILLANCE REQUIREMENTS (continued)
The SR is modified by a Note which only requires that the Surveillance be met if one or more RCPs are in operation. If no RCPs are in operation, there is no need to verify one Loop 1 RCP is in operation.
SR 3.5.4.5 Verification is required to confirm that power is removed from the motor operated PRHR HX inlet isolation valve every 31 days. Removal of power from this valve reduces the likelihood that the valve will be inadvertently closed as a result of a fire. The 31 day Frequency is acceptable considering the frequent Surveillance of valve position and that the valve has a confirmatory open signal.
SR 3.5.4.6 Verification that both air operated PRHR HX outlet valves stroke open and both IRWST gutter isolation valves stroke closed ensures that the PRHR HX will actuate on command, with return flow from the gutter to the IRWST. Since these valves are redundant, if one valve is inoperable, the system can function at 100% capacity. Verification requires the actual operation of each valve to move to its safe position. The Surveillance Frequency is provided in the Inservice Testing Program.
SR 3.5.4.7 This Surveillance requires visual inspection of the IRWST gutter and downspout screens to verify that the return flow to the IRWST will not be restricted by debris. A Frequency of 24 months is adequate, since there are no known sources of debris with which the gutter or downspouts screens could become restricted.
SR 3.5.4.8 This SR verifies that both PRHR HX air operated outlet isolation valves and both IRWST gutter isolation valves actuate to the correct position on an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves. The Frequency of 24 months is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operation.
AP1000 STS                             B 3.5.4-7                                    Rev. 1

PRHR HX - Operating B 3.5.4 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.5.4.9 This SR requires performance of a system performance test of the PRHR HX to verify system heat transfer capabilities. The system performance test demonstrates that the PRHR HX heat transfer assumed in accident analyses is maintained. Although the likelihood that system performance would degrade with time is low, it is considered prudent to periodically verify system performance. The System Level Operability Testing Program provides specific test requirements and acceptance criteria.
REFERENCES      1. FSAR Section 6.3, Passive Core Cooling System.
: 2. FSAR Chapter 15, Safety Analyses.
: 3. AP1000 Probabilistic Risk Assessment.
AP1000 STS                            B 3.5.4-8                                     Rev. 1

PRHR HX - Shutdown, RCS Intact B 3.5.5 B 3.5 PASSIVE CORE COOLING SYSTEM (PXS)
B 3.5.5 Passive Residual Heat Removal Heat Exchanger (PRHR HX) - Shutdown, Reactor Coolant System (RCS) Intact BASES BACKGROUND           A description of the PRHR HX is provided in the Bases for LCO 3.5.4, Passive Residual Heat Removal Heat Exchanger (PRHR HX) - Operating.
APPLICABLE           In the event of a loss of normal decay heat removal capability during SAFETY               shutdown with the Reactor Coolant System (RCS) pressure boundary ANALYSES             intact, the PRHR HX provides the preferred safety related heat removal path. When required, the PRHR HX is manually actuated and can maintain the RCS < 420&deg;F. Alternatively, the heat removal function can be provided by depressurizing the RCS with the Automatic Depressurization System (ADS) and injection of the In-containment Refueling Water Storage Tank (IRWST) with containment closure capability provided. The PRHR HX is preferred because the RCS pressure boundary remains intact, thus preserving a barrier to fission product release.
The PRHR HX satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                  This LCO requires the PRHR HX to be OPERABLE so that it can be placed in service in the event normal decay heat removal capability is lost. Since this a passive component, it does not require the actuation of active components such as pumps for its OPERABILITY and will be OPERABLE if the inlet valves are in their normally open position, and the normally closed, fail open outlet valves open on receipt of an actuation signal.
OPERABILITY is not expected to be challenged due to small gas accumulations in the high point, and rapid gas accumulations are not expected during plant operation. However, a relatively small gas volume was incorporated into the design for alerting operators to provide sufficient time to initiate venting operations before the gas volume would be expected to increase to a sufficient volume that might potentially challenge the OPERABILITY of passive safety injection flow. Therefore, noncondensible gas accumulation in the injection line high point that causes the water level to drop below the sensor will require operator action to investigate the cause of the gas accumulation and to vent the associated high point(s).
AP1000 STS                                    B 3.5.5-1                                    Rev. 1

PRHR HX - Shutdown, RCS Intact B 3.5.5 BASES LCO (continued)
A reactor coolant pump (RCP) is required to be operating in the loop with the PRHR HX, Loop 1, if any RCPs are operating. If RCPs are only operating in loop 2 and no RCPs are operating in loop 1, there is a possibility there may be reverse flow in the PRHR HX.
APPLICABILITY   The PRHR HX must be OPERABLE in MODE 4 with RCS cooling provided by the Normal Residual Heat Removal System (RNS) and in MODE 5 with the RCS pressure boundary intact and pressurizer level 20% to provide decay heat removal in the event the normal residual heat removal system is not available.
The Applicability is modified by a Note that states that the PRHR is not required to be OPERABLE in MODE 5 during RCS vacuum fill operations.
In this scenario, the heat removal function is provided by the vent path through the ADS valves and the injection flow path from the IRWST with containment closure capability provided.
The PRHR HX requirements in MODES 1, 2, and 3, and in MODE 4 with RCS cooling not provided by the RNS are specified in LCO 3.5.4, Passive Residual Heat Removal Heat Exchanger (PRHR HX)
Operating.
The PRHR HX is not credited for natural circulation cooling of the RCS in MODE 5 with either the RCS pressure boundary open or with the RCS intact when pressurizer level < 20%, or in MODE 6. When in MODE 5 with either the RCS pressure boundary open, or RCS intact with pressurizer level < 20%, or in MODE 6 with the upper internals in place, OPERABILITY of the PRHR HX is not required because decay heat removal by IRWST injection and ADS steam venting is credited. Decay heat removal by RCS heat-up and refueling cavity steam venting is credited in MODE 6 with upper internals removed.
ACTIONS         A.1 The outlet line from the PRHR HX is isolated by a pair of normally closed, fail open, air operated valves, arranged in parallel. They are redundant, and if either valve is OPERABLE the system can function at 100%
capacity, assuming other OPERABILITY conditions are met.
Since these valves are redundant, if one valve is inoperable, a Completion Time of 72 hours has been allowed to restore the inoperable AP1000 STS                             B 3.5.5-2                                     Rev. 1

PRHR HX - Shutdown, RCS Intact B 3.5.5 BASES ACTIONS (continued) valve to OPERABLE status. This Completion Time is consistent with the Completion Times specified for other parallel redundant safety related systems.
B.1 With one air operated IRWST gutter isolation valve inoperable, the remaining isolation valve can function to drain the gutter to the IRWST.
Action must be taken to restore the inoperable gutter isolation valve to OPERABLE status within 72 hours. The 72 hour Completion Time is acceptable based on the capability of the remaining valve to perform 100% of the required safety function assumed in the safety analyses.
C.1 At the inlet piping high point there is a vertical chamber which serves as a collection point for noncondensible gases. This collection point is provided with detectors which alarm to indicate when gases have collected in this area. The presence of an alarm does not mean that PRHR HX is immediately inoperable, but that gases are collecting and should be vented. A Completion Time of 24 hours is acceptable, considering that passive feed and bleed cooling is available to remove heat from the RCS.
D.1 With the LCO not met for reasons other than Condition A, B, or C, the PRHR HX must be restored within 8 hours. The 8 hour Completion Time is acceptable based on the availability of passive feed and bleed cooling to provide RCS heat removal. The effectiveness of feed and bleed cooling is discussed in the bases for LCO 3.5.4, Action E.1.
E.1 If any of the above Required Actions have not been accomplished in the required Completion Time, action must be initiated, immediately, to be in MODE 5 with the RCS pressure boundary open. In this MODE with the RCS opened, safety related decay heat removal can be immediately initiated by actuation of the IRWST injection valve(s).
AP1000 STS                               B 3.5.5-3                                      Rev. 1

PRHR HX - Shutdown, RCS Intact B 3.5.5 BASES SURVEILLANCE SR 3.5.5.1 REQUIREMENTS The LCO 3.5.4 Surveillance Requirements are applicable to the PRHR HX required to be OPERABLE. The Frequencies associated with each specified SR are applicable. Refer to the corresponding Bases for LCO 3.5.4 for a discussion of each SR.
REFERENCES   None.
AP1000 STS                       B 3.5.5-4                                    Rev. 1

IRWST - Operating B 3.5.6 B 3.5 PASSIVE CORE COOLING SYSTEM (PXS)
B 3.5.6 In-containment Refueling Water Storage Tank (IRWST) - Operating BASES BACKGROUND           The IRWST is a large stainless steel lined tank filled with borated water (Ref. 1). It is located below the operating deck in containment. The tank is designed to meet seismic Category 1 requirements. The floor of the IRWST is elevated above the reactor coolant loop so that borated water can drain by gravity into the Reactor Coolant System (RCS). The IRWST is maintained at ambient containment pressure.
The IRWST has two injection flow paths. The injection paths are connected to the reactor vessel through two direct vessel injection lines which are also used by the accumulators and the core makeup tanks.
Each path includes an injection flow path and a containment recirculation flow path. Each injection path includes a normally open motor operated isolation valve and two parallel actuation lines each isolated by one check valve and one squib valve in series.
The IRWST has two containment recirculation flow paths. Each containment recirculation path contains two parallel actuation flow paths, one path is isolated by a normally open motor operated valve in series with a squib valve and one path is isolated by a check valve in series with a squib valve.
ADS and IRWST injection blocking devices are provided to minimize the likelihood of spurious IRWST injection. The ADS and IRWST injection blocking device in each PMS division provides an output to the IRWST injection valve component interface module (CIM) to prevent the IRWST injection actuation unless other plant parameters indicate that an actuation is necessary. A low level in either one or both CMTs will unblock the IRWST injection actuation in each division.
During refueling operations, the IRWST is used to flood the refueling cavity. During abnormal events, the IRWST serves as a heat sink for the passive residual heat removal heat exchangers, as a heat sink for the depressurization spargers, and as a source of low head (ambient containment pressure) safety injection during loss of coolant accidents (LOCAs) and loss of decay heat removal in MODE 5 (loops not filled).
The IRWST can be cooled by the Normal Residual Heat Removal System (RNS) system.
The IRWST size and injection capability is selected to provide adequate core cooling for the limiting Design Basis Accidents (DBAs) (Ref. 2).
AP1000 STS                                  B 3.5.6-1                                     Rev. 1

IRWST - Operating B 3.5.6 BASES APPLICABLE During non-LOCA events, the IRWST serves as the initial heat sink for the SAFETY     Passive Residual Heat Removal (PRHR)Heat Exchanger (PRHR HX) if ANALYSES   used during reactor cooldown to MODE 4. If RNS is available, it will be actuated in MODE 4 and used to continue the plant cooldown to MODE 5.
If RNS is not available, cooldown can continue on PRHR. Continued PRHR HX operation will result in the water in the IRWST heating up to saturation conditions and boiling. The steam generated in the IRWST enters the containment through the IRWST vents. Most of the steam generated in the IRWST condenses on the inside of the containment vessel and drains back to the IRWST.
For events which involve a loss of primary coolant inventory, such as a large break LOCA, or other events involving automatic depressurization, the IRWST provides low pressure safety injection (Ref. 2). The IRWST drain down time is dependent on several factors, including break size, location, and the return of steam condensate from the passive containment cooling system. During drain down, when the water in the IRWST reaches the Low 5 level, the containment sump will be sufficiently flooded, to initiate containment sump recirculation. This permits continued cooling of the core by recirculation of the spilled water in the containment sumps via the sump recirculation flow paths. In this situation, core cooling can continue indefinitely.
When the plant is in midloop operation, the pressurizer Automatic Depressurization System (ADS) valves are open, and the RNS is used to cool the RCS. The RNS is not a safety related system, so its failure must be considered. In this situation, with the RCS drained and the pressure boundary open, the PRHR HX cannot be used. In such a case, core cooling is provided by gravity injection from the IRWST, venting the RCS through the ADS. Injection from the IRWST provides core cooling until the tank empties and the containment is flooded up to a level sufficient to provide recirculation flow through the gravity injection lines back into the RCS. With the containment closed, the recirculation can continue indefinitely, with the decay heat generated steam condensing on the containment vessel and draining back into the IRWST.
The IRWST satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
LCO        The IRWST requirements ensure that an adequate supply of borated water is available to act as a heat sink for PRHR and to supply the required volume of borated water as safety injection for core cooling and reactivity control.
AP1000 STS                         B 3.5.6-2                                      Rev. 1

IRWST - Operating B 3.5.6 BASES LCO (continued)
To be considered OPERABLE, the IRWST must meet the water volume, boron concentration, and temperature limits defined in the Surveillance Requirements. The motor operated injection isolation valves must be open with power removed, and the motor operated sump recirculation isolation valves must be open. OPERABILITY is not expected to be challenged due to small gas accumulations in the high point, and rapid gas accumulations are not expected during plant operation. However, a relatively small gas volume was incorporated into the design for alerting operators to provide sufficient time to initiate venting operations before the gas volume would be expected to increase to a sufficient volume that might potentially challenge the OPERABILITY of passive safety injection flow. Therefore, noncondensible gas accumulation in the injection line high point that causes the water level to drop below the sensor will require operator action to investigate the cause of the gas accumulation and to vent the associated high point(s).
APPLICABILITY   In MODES 1, 2, 3, and 4, a safety related function of the IRWST is to provide a heat sink for PRHR. In MODES 1, 2, 3, and 4, a second safety related function is the low pressure safety injection of borated water following a LOCA for core cooling and reactivity control. Both of these functions must be available to meet the initial assumptions of the safety analyses. These assumptions require the specified boron concentration, the minimum water volume, and the maximum water temperature.
The requirements for the IRWST in MODES 5 and 6 are specified in LCO 3.5.7, In-containment Refueling Water Storage Tank (IRWST)  Shutdown, MODE 5, and LCO 3.5.8, In-containment Refueling Water Storage Tank (IRWST)  Shutdown, MODE 6.
ACTIONS         A.1 If an IRWST injection line actuation valve flow path or a containment recirculation line actuation valve flow path is inoperable, then the valve actuation flow path must be restored to OPERABLE status within 72 hours. In this condition, three other IRWST injection or containment sump recirculation flow paths are available and can provide 100% of the required flow assuming a break in the direct vessel injection line associated with the other injection train, but with no single failure of the actuation valve flow path in the same injection or sump recirculation flow path. The 72 hour Completion Time is consistent with times normally applied to a degraded two train emergency core cooling system (ECCS),
which can provide 100% of the required flow without a single failure.
AP1000 STS                             B 3.5.6-3                                         Rev. 1

IRWST - Operating B 3.5.6 BASES ACTIONS (continued)
B.1 Excessive amounts of noncondensible gases in one of the injection flow path squib valve outlet line pipe stubs in one IRWST injection line may interfere with the passive injection of IRWST water into the reactor vessel from the associated parallel flow path in the affected injection line.
Analyses have shown that with enough noncondensible gas accumulation, IRWST injection through the affected flow path could be delayed. However, the presence of some noncondensible gases does not mean that the IRWST injection capability is immediately inoperable, but that gases are collecting and should be vented. The venting of these gases requires containment entry to manually operate the vent valves. In this Condition, the parallel flow path in the affected injection line is capable of providing 100% of the required injection flow and the other IRWST injection line remains fully OPERABLE. These IRWST flow paths can provide the credited flow in the event of a direct vessel injection (DVI) line break downstream of the fully OPERABLE injection line, provided a single failure of the remaining parallel isolation valve does not occur. A Completion Time of 72 hours is acceptable for two train ECCS systems, which are capable of performing their safety function without a single failure.
C.1 Excessive amounts of noncondensible gases in both of the injection flow path squib valve outlet line pipe stubs in one IRWST injection line may affect the passive injection of IRWST water into the reactor vessel from the affected injection line. Sufficient gas accumulation could potentially challenge IRWST injection capability. However, the presence of some noncondensible gases does not immediately render the IRWST injection capability inoperable, but that gases are collecting and should be vented.
The level sensor location has been selected to permit additional gas accumulation before injection flow is significantly affected so that adequate time may be provided to permit containment entry for venting the gas. Anticipated noncondensible gas accumulation in this piping segment is expected to be relatively slow.
In this Condition, the remaining OPERABLE IRWST injection line is capable of performing the safety function for all plant events except for one, DVI line break. For this one event, the line with gas accumulation in both injection flow path squib valve outlet line pipe stubs will be capable of performing the safety function with a small amount of voiding that is not expected to significantly challenge the required injection flow.
AP1000 STS                                B 3.5.6-4                                        Rev. 1

IRWST - Operating B 3.5.6 BASES ACTIONS (continued)
The venting of these gases requires containment entry to manually operate the vent valves. Considering the relatively slow rate of gas accumulation, venting within 8 hours should normally prevent accumulation of amounts of noncondensible gases that could significantly challenge IRWST injection capability. A Completion Time of 8 hours is permitted for venting noncondensible gases and is acceptable since the injection capability of the other IRWST injection line is sufficient to ensure event mitigation, or in the event of a break in the DVI line connected to the OPERABLE injection line, the injection line with gas accumulation will be capable of providing the required injection flow with some voiding. If only one of the affected injection flow path squib valve outlet line pipe stubs is vented, then Condition B will apply to the remaining injection flow path squib valve outlet line pipe stub with noncondensible gas accumulation.
D.1 If the IRWST water volume, boron concentration, or temperature are not within limits, the core cooling capability from injection or PRHR HX heat transfer and the reactivity benefit of injection assumed in safety analyses may not be available. Due to the large volume of the IRWST, on-line monitoring of volume and temperature, and frequent Surveillances, the deviation of these parameters is expected to be minor. The allowable deviation of the water volume is limited to 3%. This limit prevents a significant change in boron concentration and is consistent with the long-term cooling analysis performed to justify probabilistic risk assessment (PRA) success criteria (Ref. 3), which assumed multiple failures with as many as 3 CMTs/Accumulators not injecting. This analysis shows that there is significant margin with respect to the water supplies that support containment recirculation operation. The 8 hour Completion Time is acceptable, considering that the IRWST will be fully capable of performing its assumed safety function in response to DBAs with slight deviations in these parameters.
E.1 If the motor operated IRWST isolation valves are not fully open or valve power is not removed, injection flow from the IRWST may be less than assumed in the safety analysis. In this situation, the valves must be restored to fully open with valve power removed in 1 hour. This Completion Time is acceptable based on risk considerations.
AP1000 STS                                B 3.5.6-5                                        Rev. 1

IRWST - Operating B 3.5.6 BASES ACTIONS (continued)
F.1 and F.2 If the IRWST cannot be returned to OPERABLE status within the associated Completion Times of Condition A, B, C, D, or E, or the LCO is not met for reasons other than Conditions A, B, C, D, or E, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.5.6.1 REQUIREMENTS The IRWST borated water temperature must be verified every 24 hours to ensure that the temperature is within the limit assumed in the accident analysis. This Frequency is sufficient to identify a temperature change that would approach the limit and has been shown to be acceptable through operating experience.
SR 3.5.6.2 Verification every 24 hours that the IRWST borated water volume is above the required minimum level will ensure that a sufficient initial supply is available for safety injection and floodup volume for recirculation and as the heat sink for PRHR. During shutdown with the refueling cavity flooded with water from the IRWST, this Surveillance requires that the combined volume of borated water in the IRWST and refueling cavity meet the specified limit. Since the IRWST volume is normally stable, and is monitored by redundant main control indication and alarm, a 24 hour Frequency is appropriate.
SR 3.5.6.3 Verification that excessive amounts of noncondensible gases have not caused the water level to drop below the sensor in the four IRWST injection line squib valve lines is required every 24 hours. The 8x8x8 inch tee after the outlet of the IRWST injection line squib valve lines has a vertical section of pipe which serves as a high point collection point for noncondensible gases. The thermal dispersion sensor locations on the vertical pipe sections have been selected to permit additional gas accumulation prior to significantly affecting the injection flow so that AP1000 STS                                 B 3.5.6-6                                       Rev. 1

IRWST - Operating B 3.5.6 BASES SURVEILLANCE REQUIREMENTS (continued) adequate time may be provided to permit containment entry for venting the gas.
Control room indication of the water level in this high point collection point is available to verify that noncondensible gases have not collected to the extent that the water level is depressed below the allowable level. The 24 hour Frequency is based on the expected low rate of gas accumulation and the availability of control room indication.
SR 3.5.6.4 Verification every 31 days that the boron concentration of the IRWST is greater than the required limit, ensures that the reactor will remain subcritical following a LOCA. Since the IRWST volume is large and normally stable, the 31 day Frequency is acceptable, considering additional verifications are required within 6 hours after each solution volume increase of  15,000 gal. In addition, the relatively frequent Surveillance of the IRWST water volume provides assurance that the IRWST boron concentration is not changed.
SR 3.5.6.5 This Surveillance requires verification that each motor operated injection and sump recirculation isolation valve is fully open. This Surveillance may be performed with available remote position indication instrumentation. The 12 hour Frequency is acceptable, considering the redundant remote indication and alarms and that power is removed from the valve operator.
SR 3.5.6.6 Verification is required to confirm that power is removed from each motor operated IRWST isolation valve each 31 days. Removal of power from these valves reduces the likelihood that the valves will be inadvertently closed. The 31 day Frequency is acceptable considering frequent Surveillance of valve position and that the valve has a confirmatory open signal.
SR 3.5.6.7 Each motor operated containment recirculation isolation valve must be verified to be fully open. This valve is required to be open to improve containment recirculation reliability. The 31 day Frequency is acceptable AP1000 STS                              B 3.5.6-7                                       Rev. 1

IRWST - Operating B 3.5.6 BASES SURVEILLANCE REQUIREMENTS (continued) considering the valve has a confirmatory open signal. This Surveillance may be performed with available remote position indication instrumentation.
SR 3.5.6.8 This Surveillance requires verification that each IRWST injection and each containment recirculation squib valve is OPERABLE in accordance with the Inservice Testing Program. The Surveillance Frequency for verifying valve OPERABILITY references the Inservice Testing Program.
The squib valves will be tested in accordance with the ASME OM Code (Ref. 4). The applicable ASME OM Code squib valve requirements are specified in paragraph ISTC-5260.
SR 3.5.6.9 This SR ensures that each IRWST injection and containment recirculation squib valve actuates to the correct position on an actual or simulated actuation signal. The ADS and IRWST injection blocking device ACTUATION LOGIC TEST provides overlap with this Surveillance. The OPERABILITY of the squib valves is checked by performing a continuity check of the circuit from the Protection Logic Cabinets to the squib valve.
The Frequency of 24 months is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operation.
SR 3.5.6.10 Visual inspection is required each 24 months to verify that the IRWST screens and the containment recirculation screens are not restricted by debris. A Frequency of 24 months is adequate, since there are no known sources of debris with which the gutters could become restricted.
SR 3.5.6.11 This SR requires performance of a system inspection and performance test of the IRWST injection and recirculation flow paths to verify system flow capabilities. The system inspection and performance test demonstrates that the IRWST injection and recirculation capabilities assumed in accident analyses is maintained. Although the likelihood that system performance would degrade with time is low, it is considered prudent to periodically verify system performance. The System Level AP1000 STS                             B 3.5.6-8                                      Rev. 1

IRWST - Operating B 3.5.6 BASES SURVEILLANCE REQUIREMENTS (continued)
Operability Testing Program provides specific test requirements and acceptance criteria.
REFERENCES      1. FSAR Section 6.3, Passive Core Cooling.
: 2. FSAR Section 15.6, Decrease in Reactor Coolant Inventory.
: 3. AP1000 Probabilistic Risk Assessment
: 4. ASME OM Code, Code for Operation and Maintenance of Nuclear Power Plants.
AP1000 STS                           B 3.5.6-9                                    Rev. 1

IRWST - Shutdown, MODE 5 B 3.5.7 B 3.5 PASSIVE CORE COOLING SYSTEM (PXS)
B 3.5.7 In-containment Refueling Water Storage Tank (IRWST) - Shutdown, MODE 5 BASES BACKGROUND           A description of the IRWST is provided in LCO 3.5.6, In-containment Refueling Water Storage Tank - Operating.
APPLICABLE           For postulated shutdown events in MODE 5 with the Reactor Coolant SAFETY               System (RCS) pressure boundary intact, the primary protection is Passive ANALYSES             Residual Heat Removal (PRHR), where the IRWST serves as the initial heat sink for the PRHR heat exchanger (PRHR HX). For events in MODE 5 with the RCS pressure boundary open, PRHR is not available and RCS heat removal is provided by IRWST injection and containment sump recirculation.
IRWST injection could be required to mitigate some events by providing RCS inventory makeup.
No loss of coolant accidents (LOCAs) are postulated during plant operation in MODE 5; therefore, the rupture of the direct vessel injection line (DVI) is not assumed. Since the DVI rupture is not assumed, only one train of IRWST injection and recirculation flow paths is required to mitigation postulated events, assuming a single failure.
The IRWST satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
LCO                  The IRWST requirements ensure that an adequate supply of borated water is available to act as a heat sink for PRHR and to supply the required volume of borated water as safety injection for core cooling and reactivity control.
To be considered OPERABLE, the IRWST must meet the water volume, boron concentration, and temperature limits defined in the Surveillance Requirements, and one path of injection and recirculation must be OPERABLE (the motor operated injection isolation valve must be open with power removed, and the motor operated sump recirculation isolation valves must be open). OPERABILITY is not expected to be challenged due to small gas accumulations in the high point, and rapid gas accumulations are not expected during plant operation. However, a relatively small gas volume was incorporated into the design for alerting operators to provide sufficient time to initiate venting operations before the gas volume would be expected to increase to a sufficient volume that AP1000 STS                                  B 3.5.7-1                                       Rev. 1

IRWST - Shutdown, MODE 5 B 3.5.7 BASES LCO (continued) might potentially challenge the OPERABILITY of passive safety injection flow. Noncondensible gas accumulation in the injection line high point that causes the water level to drop below the sensor will require operator action to investigate the cause of the gas accumulation and to vent the associated high point(s).
Note that during vacuum fill operations, a vapor void may form in the high point vent lines, causing the water level to drop below the high point water level sensor. Noncondensible gas accumulation will not increase to a volume that could potentially challenge the OPERABILITY of the passive safety injection flow.
APPLICABILITY   In MODE 5 with the RCS pressure boundary intact or with the RCS open with pressurizer level  20%, the IRWST is an RCS injection source of borated water for core cooling and reactivity control. Additionally, in MODE 5 with the RCS pressure boundary intact, the IRWST provides the heat sink for PRHR.
The requirements for the IRWST in MODES 1, 2, 3, and 4 are specified in LCO 3.5.6, In-containment Refueling Water Storage Tank (IRWST)  Operating. The requirements for the IRWST in MODE 6 are specified in LCO 3.5.8, In-containment Refueling Water Storage Tank (IRWST)  Shutdown, MODE 6.
ACTIONS         A.1 If a motor operated containment sump isolation valve in the required sump recirculation flow path is not fully open, the valve must be fully opened within 72 hours. The 72 hour Completion Time is consistent with times normally applied to a degraded two train emergency core cooling system (ECCS), which can provide 100% of the required flow without a single failure.
B.1 Excessive amounts of noncondensible gases in one of the injection flow path squib valve outlet line pipe stubs in the required IRWST injection line may interfere with the passive injection of IRWST water into the reactor vessel from the associated parallel flow path in the affected injection line.
Analyses have shown that with enough noncondensible gas accumulation, IRWST injection through the affected flow path could AP1000 STS                             B 3.5.7-2                                        Rev. 1

IRWST - Shutdown, MODE 5 B 3.5.7 BASES ACTIONS (continued) be delayed. However, the presence of some noncondensible gases does not mean that the IRWST injection capability is immediately inoperable, but that gases are collecting and should be vented. Venting of these gases requires containment entry to manually operate the vent valves. In this Condition the parallel flow path in the affected injection line is capable of providing 100% of the required injection. A direct vessel injection (DVI) line break is not postulated in MODE 5. A Completion Time of 72 hours is acceptable since the IRWST is capable of performing the safety function without a single failure of the remaining parallel isolation valve. In addition, the 72 hour Completion Time is consistent with the time normally applicable to one inoperable train in a two train ECCS system.
C.1 Excessive amounts of noncondensible gases in both of the injection flow path squib valve outlet line pipe stubs in the required IRWST injection line may interfere with the passive injection of IRWST water into the reactor vessel from the affected injection line. Analyses have shown that with enough noncondensible gas accumulation, IRWST injection could be delayed long enough to cause core uncovery. However, the presence of some noncondensible gases does not mean that the IRWST injection capability is immediately inoperable, but that gases are collecting and should be vented. Venting of these gases requires containment entry to manually operate the vent valves. Considering the slow rate of gas accumulation, venting within 8 hours should normally prevent accumulation of amounts of noncondensible gases that could interfere with IRWST injection. A Completion Time of 8 hours is permitted for venting noncondensible gases and is acceptable since the injection capability is not significantly affected. If only one of the affected injection flow path squib valve outlet line pipe stub is vented, then Condition B will apply to the remaining high point vent with noncondensible gas accumulation.
D.1 If the IRWST water volume, boron concentration, or temperature are not within limits, the core cooling capability from injection or PRHR heat transfer and the reactivity benefit of injection assumed in safety analyses may not be available. Due to the large volume of the IRWST, on-line monitoring of volume and temperature, and frequent Surveillances, the deviation of these parameters is expected to be minor. The allowable deviation of the water volume is limited to 3%. This limit prevents a significant change in boron concentration. During shutdown conditions, AP1000 STS                                B 3.5.7-3                                         Rev. 1

IRWST - Shutdown, MODE 5 B 3.5.7 BASES ACTIONS (continued) the control rods are inserted, the decay heat is lower compared to operation in higher modes due to the time to get to [cold] shutdown, the RCS is borated for cold shutdown conditions, and the RCS temperatures are significantly reduced below normal operating conditions. Therefore, anticipated minor deviations in these IRWST parameters are acceptable, since they provide substantial core cooling and boration margins during shutdown events. The 8 hour Completion Time is acceptable, considering that the IRWST will be fully capable of performing its assumed safety function in response to design basis accidents (DBAs) with slight deviations in these parameters.
E.1 If the required motor operated IRWST isolation valve is not fully open or valve power is not removed, injection flow from the IRWST may be less than assumed in the safety analysis. In this situation, the valve must be restored to fully open with valve power removed in 1 hour. This Completion Time is acceptable based on risk considerations.
F.1 and F.2 If the IRWST cannot be returned to OPERABLE status within the associated Completion Times of Condition A, B, C, D, or E, or the LCO is not met for reasons other than Conditions A, B, C, D, or E, the plant must be placed in a condition in which the probability and consequences of an event are minimized to the extent possible. This is done by immediately initiating action to place the plant in MODE 5 with the RCS intact with 20% pressurizer level. The time to RCS boiling is maximized by maintaining RCS inventory at  20% pressurizer level and maintaining RCS temperature as low as practical. With the RCS intact, the availability of the PRHR HX is maintained. Additionally, action to suspend positive reactivity additions is required to ensure that the SDM is maintained.
Sources of positive reactivity addition include boron dilution, withdrawal of control rods, and excessive cooling of the RCS.
SURVEILLANCE      SR 3.5.7.1 REQUIREMENTS This SR ensures that the Spent Fuel Pool Cooling System (SFS) containment isolation valves are closed. With the non-safety related SFS isolated from the IRWST, a leak in the SFS does not cause draining of the IRWST.
AP1000 STS                                B 3.5.7-4                                      Rev. 1

IRWST - Shutdown, MODE 5 B 3.5.7 BASES SURVEILLANCE REQUIREMENTS (continued)
The Surveillance Requirement is modified by a Note allowing the affected penetration flow path(s) to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the penetration flow path(s) can be rapidly isolated when a need for isolation is indicated.
SR 3.5.7.2 The LCO 3.5.6 Surveillance Requirements and Frequencies (SR 3.5.6.1 through SR 3.5.6.11, except SR 3.5.6.3) are applicable to the IRWST and the flow paths required to be OPERABLE. Refer to the corresponding Bases for LCO 3.5.6 for a discussion of each SR.
The LCO 3.5.6 Surveillance Requirement 3.5.6.3 is not applicable to the IRWST and the flow paths required to be OPERABLE. During RCS vacuum fill operations, a vapor void may form in the high point vent line, causing the water level to drop below the high point water level sensor.
Gas accumulation will not increase to a volume that could potentially challenge the OPERABILITY of the passive safety injection flow.
SR 3.5.7.3 The LCO 3.5.6 Surveillance Requirement 3.5.6.3 is applicable to the IRWST and the flow paths required to be OPERABLE. SR 3.5.7.2 is not required to be met during RCS vacuum fill operations, as a vapor void may form in the high point vent line, causing the water level to drop below the high point water level sensor. Gas accumulation will not increase to a volume that could potentially challenge the OPERABILITY of the passive safety injection flow.
REFERENCES      None AP1000 STS                             B 3.5.7-5                                      Rev. 1

IRWST - Shutdown, MODE 6 B 3.5.8 B 3.5 PASSIVE CORE COOLING SYSTEM (PXS)
B 3.5.8 In-containment Refueling Water Storage Tank (IRWST) - Shutdown, MODE 6 BASES BACKGROUND           A description of the IRWST is provided in LCO 3.5.6, In-containment Refueling Water Storage Tank (IRWST) - Operating.
APPLICABLE           For MODE 6, heat removal is provided by IRWST injection and SAFETY               containment sump recirculation.
ANALYSES IRWST injection could be required to mitigate some events by providing RCS inventory makeup.
One line with redundant, parallel valves is required to accommodate a single failure (to open) of an isolation valve.
The IRWST satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
LCO                  The IRWST requirements ensure that an adequate supply of borated water is available to supply the required volume of borated water as safety injection for core cooling and reactivity control.
To be considered OPERABLE, the IRWST in combination with the refueling cavity must meet the water volume, boron concentration, and temperature limits defined in the Surveillance Requirements, and one path of injection and recirculation must be OPERABLE. The motor operated injection isolation valve must be open and power removed, and the motor operated sump recirculation isolation valves must be open and OPERABLE. Any cavity leakage should be estimated and made up with borated water such that the volume in the IRWST plus the refueling cavity will meet the IRWST volume requirement. OPERABILITY is not expected to be challenged due to small gas accumulations in the high point, and rapid gas accumulations are not expected during plant operation.
However, a relatively small gas volume was incorporated into the design for alerting operators to provide sufficient time to initiate venting operations before the gas volume would be expected to increase to a sufficient volume that might potentially challenge the OPERABILITY of passive safety injection flow. Noncondensible gas accumulation in the injection line high point that causes the water level to drop below the sensor will require operator action to investigate the cause of the gas accumulation and to vent the associated high point(s).
AP1000 STS                                  B 3.5.8-1                                      Rev. 1

IRWST - Shutdown, MODE 6 B 3.5.8 BASES APPLICABILITY In MODE 6, the IRWST is an Reactor Coolant System (RCS) injection source of borated water for core cooling and reactivity control.
ACTIONS       A.1 With the required motor operated containment sump isolation valve not fully open, the valve must be fully opened within 72 hours. The 72 hour Completion Time is consistent with times normally applied to a degraded two train emergency core cooling system (ECCS), which can provide 100% of the required flow without a single failure.
B.1 Excessive amounts of noncondensible gases in one of the high point vents in the required IRWST injection line may interfere with the passive injection of IRWST water into the reactor vessel from the associated parallel flow path in the affected injection line. Analyses have shown that with enough noncondensible gas accumulation, IRWST injection through the affected flow path could be delayed. However, the presence of some noncondensible gases does not mean that the IRWST injection capability is immediately inoperable, but that gases are collecting and should be vented. Venting of these gases requires containment entry to manually operate the vent valves. In this Condition, the parallel flow path in the affected injection line is capable of providing 100% of the required injection. A direct vessel injection (DVI) line break is not postulated in MODE 6. A Completion Time of 72 hours is acceptable since the IRWST is capable of performing the safety function without a single failure of the remaining parallel isolation valve. In addition, the 72 hour Completion Time is consistent with the time normally applicable to one inoperable train in a two train ECCS system.
C.1 Excessive amounts of noncondensible gases in both of the high point vents in the required IRWST injection line may interfere with the passive injection of IRWST water into the reactor vessel from the affected injection line. Analyses have shown that with enough noncondensible gas accumulation, IRWST injection could be delayed long enough to cause core uncover. However, the presence of some noncondensible gases does not mean that the IRWST injection capability is immediately inoperable, but that gases are collecting and should be vented. Venting of these gases requires containment entry to manually operate the vent valves. Considering the slow rate of gas accumulation, venting within 8 hours should normally prevent accumulation of amounts of AP1000 STS                            B 3.5.8-2                                       Rev. 1

IRWST - Shutdown, MODE 6 B 3.5.8 BASES ACTIONS (continued) noncondensible gases that could interfere with IRWST injection. A Completion Time of 8 hours is permitted for venting noncondensible gases and is acceptable since the injection capability is not significantly affected. If only one of the affected injection flow path squib valve outlet line pipe stubs is vented, then Condition B will apply to the remaining high point vent with noncondensible gas accumulation.
D.1 If the IRWST and refueling cavity water volume, boron concentration, or temperature are not within limits, the core cooling capability from injection or PRHR HX heat transfer and the reactivity benefit of injection assumed in safety analyses may not be available. Due to the large volume of the IRWST, on-line monitoring of volume and temperature, and frequent Surveillances, the deviation of these parameters is expected to be minor.
The allowable deviation of the water volume is limited to 3%. This limit prevents a significant change in boron concentration. During shutdown conditions, the control rods are inserted, the decay heat is lower compared to operation in higher modes due to the time to get to shutdown, the RCS is borated for cold shutdown conditions, and the RCS temperatures are significantly reduced below normal operating conditions.
Therefore, anticipated minor deviations in these IRWST parameters are acceptable, since they provide substantial core cooling and boration margins during shutdown events. The 8 hour Completion Time is acceptable, considering that the IRWST will be fully capable of performing its assumed safety function in response to design basis accidents (DBAs) with slight deviations in these parameters.
E.1 If the required motor operated IRWST isolation valve is not fully open or valve power is not removed, injection flow from the IRWST may be less than assumed in the safety analysis. In this situation, the valve must be restored to fully open with valve power removed in 1 hour. This Completion Time is acceptable based on risk considerations.
F.1 and F.2 If the IRWST cannot be returned to OPERABLE status within the associated Completion Times or the LCO is not met for reasons other than Conditions A, B, C, D, or E, the plant must be placed in a Condition in which the probability and consequences of an event are minimized to the extent possible. In MODE 6, action must be immediately initiated to AP1000 STS                               B 3.5.8-3                                       Rev. 1

IRWST - Shutdown, MODE 6 B 3.5.8 BASES ACTIONS (continued) be in MODE 6 with the cavity water level  23 feet above the top of the reactor vessel flange.
The time to RCS boiling is maximized by maximizing the RCS inventory and maintaining RCS temperature as low as practical. With the RCS intact, another means of removing decay heat is available (the PRHR HX). Additionally, action to suspend positive reactivity additions is required to ensure that the SDM is maintained. Sources of positive reactivity addition include boron dilution, withdrawal of control rods, and excessive cooling of the RCS. These Actions place the plant in a condition which maximizes the time to IRWST injection, thus providing time for repairs or application of alternative cooling capabilities.
SURVEILLANCE      SR 3.5.8.1 REQUIREMENTS The IRWST and refueling cavity borated water temperature must be verified every 24 hours to ensure that the temperature is within the limit assumed in accident analysis. This Frequency is sufficient to identify a temperature change that would approach the limit and has been shown to be acceptable through operating experience.
SR 3.5.8.2 Verification every 24 hours that the IRWST and refueling cavity borated water volume is above the required minimum level will ensure that a sufficient initial supply is available for safety injection and floodup volume for recirculation and as the heat sink for PRHR. During shutdown with the refueling cavity flooded with water from the IRWST, the Surveillance requires that the combined volume of borated water in the IRWST and refueling cavity meets the specified limit. Since the IRWST volume is normally stable, and is monitored by redundant main control indication and alarm, a 24 hour Frequency is appropriate.
SR 3.5.8.3 This SR ensures that the Spent Fuel Pool Cooling System (SFS) containment isolation valves are closed. With the non- safety related SFS isolated from the IRWST and refueling cavity, a leak in the SFS does not cause draining of the IRWST and the refueling cavity.
The Surveillance Requirement is modified by two Notes. Note 1 allows the affected penetration flow path(s) to be unisolated intermittently under AP1000 STS                                 B 3.5.8-4                                        Rev. 1

IRWST - Shutdown, MODE 6 B 3.5.8 BASES SURVEILLANCE REQUIREMENTS (continued) administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the penetration flow path(s) can be rapidly isolated when a need for isolation is indicated.
Note 2 states that the Surveillance Requirement is only required to be met with refueling cavity and spent fuel pool volumes not in communication. In MODE 6 with refueling cavity and spent fuel pool volumes in communication, Refueling Cavity and SFS Isolation is actuated on a Spent Fuel Pool Level  Low 2 isolation signal as required by LCO 3.3.14, ESFAS IRWST and Spent Fuel Pool Level Instrumentation.
SR 3.5.8.4 Verification every 31 days that the boron concentration of the IRWST and refueling cavity is greater than the required limit ensures that the reactor will remain subcritical following shutdown events. Since the IRWST volume is large and normally stable, the 31 day Frequency is acceptable, considering additional verifications are required within 6 hours after each combined volume increase of  15,000 gal.
SR 3.5.8.5 LCO 3.5.6 Surveillance Requirements and Frequencies SR 3.5.6.3 and 3.5.6.5 through 3.5.6.11 are applicable to the IRWST and the flow paths required to be OPERABLE. Refer to the corresponding Bases for LCO 3.5.6 for a discussion of each SR.
REFERENCES      None AP1000 STS                             B 3.5.8-5                                       Rev. 1

Containment B 3.6.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment BASES BACKGROUND          The containment is a free standing steel pressure vessel surrounded by a reinforced concrete shield building. The containment vessel, including all its penetrations, is a low-leakage steel vessel designed to contain radioactive material that may be released from the reactor core following a design basis loss of coolant accident (LOCA) such that offsite radiation exposures are maintained within limits. The containment and shield building provide shielding from the fission products that may be present in the containment atmosphere following accident conditions.
The containment vessel is a vertical cylindrical steel pressure vessel with elliptical upper and lower heads, completely enclosed by a seismic Category I reinforced concrete shield building. A 4.5 foot wide annular space exists between the walls and domes of the steel containment vessel and the concrete shield building to permit inservice inspection and air flow over the steel dome for containment cooling. The containment utilizes the outer concrete building for shielding and a missile barrier, and the inner steel containment for leak tightness and passive containment cooling.
Containment piping penetration assemblies provide for the passage of process, service and sampling pipelines into the containment vessel while maintaining containment integrity. The shield building provides biological shielding and environmental missile protection for the containment vessel and the Nuclear Steam Supply System.
The inner steel containment and its penetrations establish the leakage limiting boundary of the containment. Maintaining the containment OPERABLE limits the leakage of fission product radioactivity from the containment to the environment. SR 3.6.1.1 leakage rate Surveillance Requirements comply with 10 CFR 50, Appendix J, Option B (Ref. 1), as modified by approved exemptions.
The isolation devices for the penetrations in the containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:
AP1000 STS                                  B 3.6.1-1                                      Rev. 1

Containment B 3.6.1 BASES BACKGROUND (continued)
: a. All penetrations required to be closed during accident conditions are either:
: 1. Capable of being closed by an OPERABLE automatic containment isolation system, or
: 2. Closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.3, Containment Isolation Valves;
: b. Each air lock is OPERABLE, except as provided in LCO 3.6.2, Containment Air Locks; and
: c. All equipment hatches are closed.
APPLICABLE       The safety design basis for the containment is that the containment must SAFETY           withstand the pressures and temperatures of the limiting Design Basis ANALYSES         Accident (DBA) without exceeding the design leakage rates.
The DBAs that result in a challenge to containment OPERABILITY from high pressures and temperatures are a LOCA, a steam line break, and a rod ejection accident (REA) (Ref. 2). In addition, release of significant fission product radioactivity within containment can occur from a LOCA or REA. The DBA analyses assume that the containment is OPERABLE such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage. The containment is designed with an allowable leakage rate of 0.10% of containment air weight of the original content of containment air after a DBA per day (Ref. 3). This leakage rate, used in the evaluation of offsite doses resulting from accidents, is defined in 10 CFR 50, Appendix J, Option B (Ref. 1), as La: the maximum allowable containment leakage rate at the calculated peak containment internal pressure (Pa) resulting from the limiting design basis LOCA. The allowable leakage rate represented by La forms the basis for the acceptance criteria imposed on containment leakage rate testing. La is assumed to be 0.10% per day in the safety analysis.
Satisfactory leakage rate test results is a requirement for the establishment of containment OPERABILITY.
The containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                              B 3.6.1-2                                      Rev. 1

Containment B 3.6.1 BASES LCO           Containment OPERABILITY is maintained by limiting leakage to  1.0 La, except prior to the first startup after performing a required Containment Leakage Rate Testing Program Leakage Test. At this time, the applicable leakage limits must be met.
Compliance with this LCO will ensure a containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.
Individual leakage rates specified for the containment air lock (LCO 3.6.2) are not specifically part of the acceptance criteria of 10 CFR 50, Appendix J, Option B. Therefore, leakage rates exceeding these individual limits only result in the containment being inoperable when the leakage results in exceeding the overall acceptance criteria of 1.0 La.
APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. The MODES 5 and 6 requirements are specified in LCO 3.6.7, Containment Penetrations.
ACTIONS       A.1 In the event containment is inoperable, containment must be restored to OPERABLE status within 1 hour. The 1 hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining containment OPERABLE during MODES 1, 2, 3, and 4. This time period also ensures that the probability of an accident (requiring containment OPERABILITY) occurring during periods when containment is inoperable is minimal.
B.1 and B.2 If containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
AP1000 STS                           B 3.6.1-3                                      Rev. 1

Containment B 3.6.1 BASES SURVEILLANCE SR 3.6.1.1 REQUIREMENTS Maintaining the containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Containment Leakage Rate Testing Program. Failure to meet air lock leakage limits specified in LCO 3.6.2 does not invalidate the acceptability of these overall leakage determinations unless their contribution to overall Type A, B, and C leakage causes that to exceed limits. As left leakage prior to the first startup after performing a required leakage test is required to be < 0.6 La for combined Type B and C leakage, and 0.75 La for overall Type A leakage. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of  1.0 La. At  1.0 La the offsite dose consequences are bounded by the assumptions of the safety analysis. SR Frequencies are as required by the Containment Leakage Rate Testing Program. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.
REFERENCES   1. 10 CFR 50, Appendix J, Option B Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors, Performance-Based Requirements.
: 2. FSAR Chapter 15, Accident Analyses.
: 3. FSAR Section 6.2, Containment Systems.
AP1000 STS                         B 3.6.1-4                                        Rev. 1

Containment Air Locks B 3.6.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.2 Containment Air Locks BASES BACKGROUND           Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation.
Each air lock is nominally a right circular cylinder, 10 feet in diameter, with a door at each end. The doors are interlocked to prevent simultaneous opening. During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary. Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. As such, closure of a single door supports containment OPERABILITY. Each of the doors contains double gasketed seals and local leakage rate testing capability to ensure pressure integrity. To effect a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in containment internal pressure results in increased sealing force on each door).
The containment air locks form part of the containment pressure boundary. As such, air lock integrity and leak tightness are essential for maintaining the containment leakage rate within limit in the event of a DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analyses.
APPLICABLE           The DBA that results in the largest release of radioactive material within SAFETY               containment is a loss of coolant accident (LOCA) (Ref. 1). In the ANALYSES             analyses of DBAs, it is assumed that containment is OPERABLE, such that release of fission products to the environment is controlled by the rate of containment leakage. The containment is designed with an allowable leakage rate of 0.10% of containment air weight of the original content of containment air per day after a DBA (Ref. 2). This leakage rate is defined in 10 CFR 50, Appendix J, Option B (Ref. 3), as La, the maximum allowable containment leakage rate at the calculated peak containment internal pressure Pa following a design basis LOCA. This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air locks.
The containment air locks satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                                 B 3.6.2-1                                        Rev. 1

Containment Air Locks B 3.6.2 BASES LCO           Each containment air lock forms part of the containment pressure boundary. As part of the containment pressure boundary, the air lock safety function is related to control of offsite radiation exposures resulting from a DBA. Thus, each air locks structural integrity and leak tightness are essential to the successful mitigation of such an event.
Each air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door of an air lock to be opened at one time.
This provision ensures that a gross breach of containment does not exist when containment is required to be OPERABLE. Closure of a single door in each air lock is necessary to support containment OPERABILITY following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into or exit from containment.
APPLICABILITY In MODES 1, 2, 3, and 4 a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES and large inventory of coolant.
Therefore, containment air locks are not required to be OPERABLE in MODES 5 and 6 to prevent leakage of radioactive material from containment. However, containment closure capability is required within MODES 5 and 6 as specified in LCO 3.6.7, Containment Penetrations.
ACTIONS       The ACTIONS are modified by a Note that allows entry and exit to perform repairs on the affected air lock component. If the outer door is inoperable, then it may be easily accessed for repair without interrupting containment integrity. If containment entry is required, it is preferred that the air lock be accessed from inside primary containment by entering through the other OPERABLE air lock. However, if this is not practicable, or if repairs on either door must be performed from the barrel side of the door then it is permissible to enter the air lock through the OPERABLE door, which means there is a short time during which the containment boundary is not intact (during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed. If ALARA conditions permit, entry and exit should be via an OPERABLE air lock.
AP1000 STS                           B 3.6.2-2                                       Rev. 1

Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each air lock. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable air lock. Complying with the Required Actions may allow for continued operation, and a subsequent inoperable air lock is governed by subsequent Condition entry and application of associated Required Actions.
In the event that air lock leakage results in exceeding the overall containment leakage rate, Note 3 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1, Containment.
A.1, A.2, and A.3 With one air lock door in one or more containment air locks inoperable, the OPERABLE door must be verified closed (Required Action A.1) in each affected containment air lock. This ensures a leak tight containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour. This specified time period is consistent with the ACTIONS of LCO 3.6.1, Containment, which requires containment be restored to OPERABLE status within 1 hour.
In addition, the affected air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour Completion Time.
The 24 hour Completion Time is reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed.
Required Action A.3 verifies that an air lock with an inoperable door has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable containment leakage boundary is maintained. The Completion Time of once per 31 days is reasonable based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified to be locked closed by administrative means.
Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
AP1000 STS                                 B 3.6.2-3                                      Rev. 1

Containment Air Locks B 3.6.2 BASES ACTIONS (continued)
The Required Actions are modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the airlock are inoperable. With both doors in the same airlock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of an airlock for entry and exit for 7 days, under administrative controls if both airlocks have an inoperable door. This 7 day restriction begins when the second air lock is discovered inoperable. Containment entry may be required on a periodic basis to perform Technical Specification (TS) Surveillances and Required Actions, as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (non-TS-related activities) if the containment is entered, using the inoperable airlock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open.
B.1, B.2, and B.3 With an air lock door interlock mechanism inoperable in one or more air locks, the Required Actions and associated Completion Times are consistent with Condition A.
The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same airlock are inoperable.
With both doors in the same airlock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from containment under the control of a dedicated individual stationed at the airlock to ensure that only one door is opened at a time (the individual performs the function of the interlock).
Required Action B.3 is modified by a Note that applies to airlock doors located in high radiation areas that allows these doors to be verified locked closed by administrative means. Allowing verification by administrative means is considered acceptable since access to these AP1000 STS                                  B 3.6.2-4                                      Rev. 1

Containment Air Locks B 3.6.2 BASES ACTIONS (continued) areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position is small.
C.1, C.2, and C.3 With one or more air locks inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be initiated immediately to evaluate previous combined leakage rates using current air lock test results. An evaluation is acceptable, since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour (per LCO 3.6.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.
Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed within the 1 hour Completion Time.
This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour.
Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour Completion Time. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status, assuming that one door is maintained closed in each affected air lock.
D.1 and D.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
AP1000 STS                                 B 3.6.2-5                                          Rev. 1

Containment Air Locks B 3.6.2 BASES SURVEILLANCE SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with respect to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and containment OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is as required by the Containment Leakage Rate Testing Program.
The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR requiring the results to be evaluated against the acceptance criteria applicable to SR 3.6.1.1. This ensures that air lock leakage is properly accounted for in determining the combined Type B and C containment leakage rate.
SR 3.6.2.2 The air lock door interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident containment pressure, closure of either door will support containment OPERABILITY. Thus, the door interlock feature supports containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur.
Due to the purely mechanical nature of this interlock, and given that the interlock mechanism is not normally challenged when the containment air lock door is used for entry and exit (procedures require strict adherence to single door opening), this test is only required to be performed every 24 months. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage, and the potential for loss of containment OPERABILITY if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed at 24 month Frequency. The 24 month Frequency is also based on engineering judgment and is considered adequate given that the interlock is not challenged during the use of the airlock.
AP1000 STS                          B 3.6.2-6                                       Rev. 1

Containment Air Locks B 3.6.2 BASES REFERENCES 1. FSAR Chapter 15, Accident Analyses.
: 2. FSAR Section 6.2, Containment Systems.
: 3. 10 CFR 50, Appendix J, Option B Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors, Performance-Based Requirements.
AP1000 STS                   B 3.6.2-7                                  Rev. 1

Containment Isolation Valves B 3.6.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASES BACKGROUND           The containment isolation valves form part of the containment pressure boundary and provide a means for fluid penetrations not serving accident consequence limiting systems to be provided with two isolation barriers.
These isolation devices are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Check valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses.
One of these barriers may be a closed system. These barriers (typically containment isolation valves) make up the Containment Isolation System.
Automatic isolation signals are produced during accident conditions.
FSAR Section 6.2 (Ref. 1) identifies parameters which initiate isolation signal generation for containment isolation valves. The containment isolation valves (and blind flanges) help ensure that the containment atmosphere will be isolated from the environment in the event of a release of fission product radioactivity to the containment atmosphere as a result of a Design Basis Accident (DBA).
The OPERABILITY requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed in the safety analysis. Therefore, the OPERABILITY requirements provide assurance that containment function assumed in the safety analysis will be maintained.
Containment Air Filtration System 16 inch purge valves The Containment Air Filtration System operates to:
: a. Supply outside air into the containment for ventilation and cooling or heating,
: b. Reduce the concentration of noble gases within containment prior to and during personnel access, and
: c. Equalize internal and external pressures.
AP1000 STS                                 B 3.6.3-1                                       Rev. 1

Containment Isolation Valves B 3.6.3 BASES BACKGROUND (continued)
Since the valves used in the Containment Air Filtration System are designed to meet the requirements for automatic containment isolation valves, these valves may be opened as needed in MODES 1, 2, 3 and 4.
APPLICABLE       The containment isolation valve LCO was derived from the assumptions SAFETY           related to minimizing the loss of reactor coolant inventory and ANALYSES         establishing the containment boundary during major accidents. As part of the containment boundary, containment isolation valve OPERABILITY supports leak tightness of the containment. Therefore, the safety analysis of any event requiring isolation of containment is applicable to this LCO.
The DBAs that result in a release of radioactive material within containment are a loss of coolant accident (LOCA) and a rod ejection accident (Ref. 2). In the analyses for each of the accidents, it is assumed that containment isolation valves are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through containment isolation valves (including containment purge valves) are minimized.
The DBA dose analysis assumes that, following containment isolation signal generation, the containment purge isolation valves are closed within 10 seconds. The remainder of the automatic isolation valves are assumed closed and the containment leakage is terminated except for the design leakage rate, La. Since the containment isolation valves are powered from the 1E division batteries no diesel generator startup time is applied.
The single failure criterion required to be imposed in the conduct of plant safety analyses was considered in the design of the containment purge isolation valves. Two valves in series on each purge line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred. The inboard and outboard isolation valves on each line are pneumatically operated, spring closed valves that fail in the closed position and are provided with power via independent sources.
The containment isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                              B 3.6.3-2                                       Rev. 1

Containment Isolation Valves B 3.6.3 BASES LCO           Containment isolation valves form a part of the containment boundary.
The containment isolation valves safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during a DBA.
The automatic power operated isolation valves are required to have isolation times within limits and to actuate on an automatic isolation signal. The valves covered by this LCO are listed along with their associated stroke times in the FSAR Section 6.2 (Ref. 1).
The normally closed isolation valves are considered OPERABLE when manual valves are closed, automatic valves are de-activated and secured in their closed position, or blind flanges are in place. These passive isolation valves/devices are those listed in Reference 1.
This LCO provides assurance that the containment isolation valves, except for the closed system valves and vacuum relief valves, and purge valves will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the containment boundary during accidents. The containment isolation valves associated with closed systems are not included in this LCO since they are covered in LCO 3.7.1, Main Steam Safety Valves (MSSVs), LCO 3.7.2, Main Steam Line Flow Path Isolation Valves, LCO 3.7.3, Main Feedwater Isolation Valves (MFIVs) and Main Feedwater Control Valves (MFCVs),
LCO 3.7.7, Startup Feedwater Isolation and Control Valves, and LCO 3.7.10, Steam Generator (SG) Isolation Valves.
The containment system vacuum relief valves provide containment isolation, but are also required to open to mitigate a negative pressure event within containment. Therefore, the vacuum relief valves are not included in this LCO since they are covered in LCO 3.6.9, Vacuum Relief Valves.
APPLICABILITY In MODES 1, 2, 3, and 4 a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, containment isolation valves are not required to be OPERABLE in MODES 5 and 6 to prevent leakage of radioactive material from containment. However, containment closure capability is required in MODES 5 and 6 (Ref. 3).
The requirements for containment isolation valves during MODES 5 and 6 are addressed in LCO 3.6.7, Containment Penetrations.
AP1000 STS                          B 3.6.3-3                                       Rev. 1

Containment Isolation Valves B 3.6.3 BASES ACTIONS    The ACTIONS are modified by a Note allowing containment penetration flow paths to be unisolated intermittently under administrative control.
These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated.
A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation valves are governed by subsequent Condition entry and application of associated Required Actions.
The ACTIONS are further modified by a third Note, which ensures appropriate remedial actions are taken, if necessary, if the affected systems are rendered inoperable by an inoperable containment isolation valve.
In the event that the containment isolation valve leakage results in exceeding the overall containment leakage rate, Note 4 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1.
A.1 and A.2 In the event one containment isolation valve in one or more penetration flow paths is inoperable the affected penetration flow path must be isolated. The method of isolation must include the use of one isolation barrier that cannot be adversely affected by a single active failure.
Isolation barriers that meet this criterion are a closed and de-activated automatic containment isolation valve, a closed manual valve, a blind flange, or a check valve with flow through the valve secured. For a penetration flow path isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to containment. Required Action A.1 must be completed within 4 hours. The 4 hour Completion Time is reasonable considering the time required to isolate the penetration, the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4, and the availability of a second barrier.
For affected penetrations that cannot be restored to OPERABLE status within the 4 hour Completion Time and have been isolated in accordance AP1000 STS                       B 3.6.3-4                                       Rev. 1

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) with Required Action A.1, the affected penetrations must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations that are required to be isolated following an accident and that are no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of once per 31 days for isolation devices outside containment is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as prior to entering MODE 4 from MODE 5, if not performed within the previous 92 days, is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.
Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high-radiation areas, and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these valves once they have been verified to be in the proper position, is small.
B.1 With two containment isolation valves in one or more penetration flow paths inoperable, the affected penetration flow path must be isolated within 1 hour. The method of isolation must include the use of one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and deactivated automatic valve, a closed manual valve and a blind flange.
The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1. In the event the affected penetration is isolated in accordance with Required Action B.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.2 which remains in AP1000 STS                                B 3.6.3-5                                       Rev. 1

Containment Isolation Valves B 3.6.3 BASES ACTIONS (continued) effect. This periodic verification is necessary to ensure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative control and the probability of their misalignment is low.
C.1 and C.2 If a Required Action and associated Completion Time are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE      SR 3.6.3.1 REQUIREMENTS This SR ensures that the 16 inch purge valves are closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of limits. The SR is not required to be met when the 16 inch purge valves are open for the reasons stated. The valves may be opened for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open. The 16 inch purge valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The 31 day Frequency is consistent with other containment isolation valve requirements discussed in SR 3.6.3.2.
SR 3.6.3.2 This SR requires verification that each containment isolation manual valve and blind flange located outside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those containment isolation valves outside containment and capable of being mispositioned AP1000 STS                               B 3.6.3-6                                      Rev. 1

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued) are in the correct position. Since verification of valve position for containment isolation valves outside containment is relatively easy, the 31 day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open.
This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.
The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in the proper position, is small.
SR 3.6.3.3 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. For containment isolation valves inside containment, the Frequency specified as prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days is appropriate since these containment isolation valves are operated under administrative control and the probability of their misalignment is low. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time they are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.
The Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in the proper position, is small.
AP1000 STS                             B 3.6.3-7                                      Rev. 1

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.6.3.4 Verifying that the isolation time of each automatic power operated containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analysis.
The isolation times are specified in FSAR Section 6.2.3 (Ref. 1) and Frequency of this SR is in accordance with the Inservice Testing Program.
SR 3.6.3.5 Automatic containment isolation valves close on their respective ESF signal to prevent leakage of radioactive material from containment following a DBA. The actual or simulated actuation signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valve. This SR ensures that each automatic containment isolation valve will actuate to its isolation position on its respective ESF signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.
Operating experience has shown that these components usually pass this Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
REFERENCES      1. FSAR Section 6.2, Containment Systems.
: 2. FSAR Chapter 15, Accident Analyses.
: 3. NUREG-1449, Shutdown and Low Power Operation at Commercial Nuclear Power Plants in the United States.
AP1000 STS                             B 3.6.3-8                                     Rev. 1

Containment Pressure B 3.6.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.4 Containment Pressure BASES BACKGROUND          The containment pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) or steam line break (SLB). These limits also prevent the containment pressure from exceeding the containment design negative pressure differential with respect to the outside atmosphere in the event of transients which result in a negative pressure.
Containment pressure is a process variable that is monitored and controlled. The containment pressure limits are derived from the operating band of conditions used in the containment pressure analyses for the Design Basis Events which result in internal or external pressure loads on the containment vessel. Should operation occur outside these limits, the initial containment pressure would be outside the range used for containment pressure analyses.
APPLICABLE          Containment internal pressure is an initial condition used in the DBA SAFETY              analyses to establish the maximum peak containment internal pressure.
ANALYSES            The limiting DBAs considered, relative to containment pressure, are the LOCA and SLB, which are analyzed using computer pressure transients.
The worst case LOCA generates larger mass and energy release than the worst cast SLB. Thus, the LOCA event bounds the SLB event from the containment peak pressure standpoint (Ref. 1).
The initial pressure condition used in the containment analysis was 15.7 psia (1.0 psig). This resulted in a maximum peak pressure from a LOCA, Pa, of 58.1 psig. The containment analysis (Ref. 1) shows that the maximum peak calculated containment pressure results from the limiting LOCA. The maximum containment pressure resulting from the worst case LOCA does not exceed the containment design pressure, 59 psig.
The containment was also designed for an external pressure load equivalent to 1.7 psid. The limiting negative pressure transient is a loss of all AC power sources coincident with extreme cold weather conditions which cool the external surface of the containment vessel. The initial pressure condition used in this analysis was -0.2 psig. This resulted in a minimum pressure inside containment, as illustrated in Reference 1, which is less than the design load. Other external pressure load events evaluated include:
AP1000 STS                                   B 3.6.4-1                                    Rev. 1

Containment Pressure B 3.6.4 BASES APPLICABLE SAFETY ANALYSES (continued)
* Failed fan cooler control
* Malfunction of containment purge system
* Inadvertent Passive Containment Cooling System (PCS) actuation Containment pressure satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              Maintaining containment pressure at less than or equal to the LCO upper pressure limit ensures that, in the event of a DBA, the resultant peak containment accident pressure will remain below the containment design pressure.
Maintaining containment pressure at greater than or equal to the LCO lower pressure limit ensures that the containment will not exceed the design negative differential pressure following negative pressure transients. If the containment pressure does not meet the low pressure limit, the containment vacuum relief capacity of one flow path may not be adequate to ensure the containment pressure meets the negative pressure design limit.
APPLICABILITY    In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. Since maintaining containment pressure within the high pressure limit is essential to ensure initial conditions assumed in the accident analyses are maintained, the LCO is applicable in MODES 1, 2, 3, and 4.
In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment pressure within the high pressure limit of the LCO is not required in MODE 5 or 6.
In MODES 1 through 6, the potential exists for excessive containment cooling events to produce a negative containment pressure below the design limit. However, in MODES 5 and 6, a containment air flow path may be opened (LCO 3.6.7, Containment Penetrations), providing a vacuum relief path that is sufficient to preclude a negative containment pressure below the design limit.
Therefore, maintaining containment pressure within the low pressure limit is essential to ensure initial conditions assumed in the containment AP1000 STS                             B 3.6.4-2                                       Rev. 1

Containment Pressure B 3.6.4 BASES APPLICABILITY (continued) cooling events in MODES 1 through 4 and in MODES 5 and 6 without an open containment air flow path  6 inches in diameter. With a 6 inch diameter or equivalent containment air flow path, the vacuum relief function is not needed to mitigate a low pressure event.
ACTIONS            A.1 When containment pressure is not within the limits of the LCO, it must be restored within 1 hour. The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, Containment, which requires that containment be restored to OPERABLE status within 1 hour.
B.1, B.2, and C.1 If the containment pressure cannot be restored to within its limits within the required Completion Time in MODE 1, 2, 3, or 4, the plant must be placed in a condition in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
If the containment high pressure limit is still not met, Condition C applies.
Once in MODE 5 or 6, Required Action C.1 requires that a containment air flow path  6 inches in diameter shall be opened within 8 hours from Condition entry. Any flow path (or paths) with an area equivalent to 6 inches in diameter is adequate to provide the necessary air flow.
The primary means of opening a containment air flow path is by establishing a Containment Air Filtration System (VFS) air flow path into containment. Manual actuation and maintenance as necessary to open a purge supply, purge exhaust, or vacuum relief flow path are available means to open a containment air flow path. In addition, opening of a spare penetration is an acceptable means to provide the necessary flow path. Opening of an equipment hatch or a containment airlock is acceptable, but may not be possible due to the differential pressure condition. Containment air flow paths opened must comply with LCO 3.6.7, Containment Penetrations.
AP1000 STS                               B 3.6.4-3                                       Rev. 1

Containment Pressure B 3.6.4 BASES ACTIONS (continued)
The 8 hour Completion Time is reasonable for opening a containment air flow path in an orderly manner.
SURVEILLANCE        SR 3.6.4.1 REQUIREMENTS Verifying that containment pressure is within limits ensures that unit operation remains within the limits assumed in the containment analysis.
The 12 hour Frequency of this SR was developed based on operating experience related to trending of containment pressure variations during the applicable MODES. Furthermore, the 12 hour Frequency is considered adequate in view of other indications available in the main control room, including alarms, to alert the operator to an abnormal containment pressure condition.
REFERENCES          1. FSAR Section 6.2, Containment Systems.
AP1000 STS                                B 3.6.4-4                                      Rev. 1

Containment Air Temperature B 3.6.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.5 Containment Air Temperature BASES BACKGROUND           The containment structure serves to contain radioactive material that may be released from the reactor core following a Design Basis Accident (DBA). The containment average air temperature is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) or steam line break (SLB).
The containment average air temperature limit is derived from the input conditions used in the containment functional analyses and the containment structure external pressure analyses. This LCO ensures that initial conditions assumed in the analysis of containment response to a DBA are not violated during plant operations. The total amount of energy to be removed from containment by the passive containment cooling system during post accident conditions is dependent upon the energy released to the containment due to the event, as well as the initial containment temperature and pressure. The higher the initial temperature, the more energy that must be removed, resulting in higher peak containment pressure and temperature. Exceeding containment design pressure may result in leakage greater than that assumed in the accident analysis. Operation with containment temperature in excess of the LCO limit violates an initial condition assumed in the accident analysis.
APPLICABLE           Containment average air temperature is an initial condition used in the SAFETY               DBA analyses that establishes the containment environmental ANALYSES             qualification operating envelope for both pressure and temperature. The limit for containment average air temperature ensures that operation is maintained within the assumptions used in the DBA analyses for containment (Ref. 1).
The limiting DBAs considered relative to containment OPERABILITY are the LOCA and SLB. The DBA LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure transients. No two DBAs are assumed to occur simultaneously or consecutively. The postulated DBAs are analyzed with regard to containment Engineered Safety Feature (ESF) systems, assuming the loss of one Class 1E Engineered Safety Features Actuation Cabinet (ESFAC) Division, which is the worst case single active failure, resulting in one Passive Containment Cooling System flow path being rendered inoperable.
AP1000 STS                                   B 3.6.5-1                                   Rev. 1

Containment Air Temperature B 3.6.5 BASES APPLICABLE SAFETY ANALYSES (continued)
The limiting DBA for the maximum peak containment air temperature is a LOCA or SLB. The initial containment average air temperature assumed in the design basis analyses (Ref. 1) is 120&deg;F.
The DBA temperature transients are used to establish the environmental qualification operating envelope for containment. The basis of the containment environmental qualification temperature envelope is to ensure the performance of safety related equipment inside containment (Ref. 2). The containment vessel design temperature is 300&deg;F. The containment vessel temperature remains below 300&deg;F for DBAs.
Therefore, it is concluded that the calculated transient containment air temperature is acceptable for the DBAs.
The temperature limit is also used in the depressurization analyses to ensure that the minimum pressure limit is maintained following an inadvertent actuation of the Passive Containment Cooling System (Ref. 1).
The containment is designed for an external pressure load equivalent to 1.7 psid. The limiting negative pressure transient is a loss of all ac power sources coincident with extreme cold weather conditions, which cool the external surface of the containment vessel. The initial containment average air temperature condition used in this analysis is 120&deg;F. This resulted in a minimum pressure inside containment, as illustrated in Reference 1, which is less than the design load.
The containment pressure transient is sensitive to the initial air mass in containment and, therefore, to the initial containment air temperature.
The limiting DBA for establishing the maximum peak containment internal pressure is an SLB or LOCA. The temperature limit is used in the DBA analyses to ensure that in the event of an accident the maximum containment internal pressure will not be exceeded.
Containment average air temperature satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO              During a DBA, with an initial containment average air temperature less than or equal to the LCO temperature limit, the resultant peak accident temperature is computed to remain within acceptable limits. As a result, the ability of containment to perform its design function is ensured.
AP1000 STS                             B 3.6.5-2                                        Rev. 1

Containment Air Temperature B 3.6.5 BASES LCO (continued)
The LCO establishes the maximum containment average air temperature initial condition required for the excessive cooling analysis. If the containment average air temperature exceeds the limit, the containment vacuum relief capacity of one flow path may not be adequate to ensure the containment pressure meets the negative pressure design limit.
APPLICABILITY   In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment average air temperature within the limit is not required in MODE 5 or 6 for a DBA LOCA or SLB.
In MODES 1 through 6, the potential exists for excessive containment cooling events to produce a negative containment pressure below the design limit. However, in MODES 5 and 6, a containment equipment hatch or airlock may be opened (LCO 3.6.7, Containment Penetrations),
providing a vacuum relief path that is sufficient to preclude a negative containment pressure below the design limit.
Therefore, maintaining containment average air temperature within the limit is essential to ensure initial conditions assumed in the cooling events in MODES 1 through 4 and in MODES 5 and 6 with both containment equipment hatches and both containment airlocks closed.
ACTIONS         A.1 When containment average air temperature is not within the limit of the LCO, it must be restored to within its limit within 8 hours. This Required Action is necessary to return operation to within the bounds of the containment analysis. The 8 hour Completion Time is acceptable considering the sensitivity of the conservative analysis to variations in this parameter, and provides sufficient time to correct minor problems.
B.1, B.2, and C.1 If the containment average air temperature cannot be restored to within its limit within the required Completion Time, the plant must be placed in a condition in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on AP1000 STS                              B 3.6.5-3                                      Rev. 1

Containment Air Temperature B 3.6.5 BASES ACTIONS (continued) operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Once in MODE 5 or 6, Required Action C.1 requires that a containment equipment hatch or a containment airlock shall be opened within 8 hours.
Opening of a hatch or an airlock is necessary to provide the required vacuum relief path in the event of a low pressure event if the average air temperature initial condition is not met. The allowed Completion Time is reasonable for opening a hatch or an airlock in an orderly manner. In addition, the manner in which the containment equipment hatch or containment airlock is opened must comply with the requirements of LCO 3.6.7, Containment Penetrations.
SURVEILLANCE       SR 3.6.5.1 REQUIREMENTS Verifying that the containment average air temperature is within the LCO limit ensures that containment operation remains within the limits assumed for the containment analyses. In order to determine the containment average air temperature, a weighted average is calculated using measurements taken at locations within the containment selected to provide a representative sample of the associated containment atmosphere. The 12 hour Frequency of this Surveillance Requirement is considered acceptable based on observed slow rates of temperature increase within containment as a result of environmental heat sources (due to the large volume of containment). Furthermore, the 12 hour Frequency is considered adequate in view of other indications available in the main control room, including alarms, to alert the operator to an abnormal containment temperature condition.
REFERENCES         1. FSAR Section 6.2, Containment Systems.
: 2. 10 CFR 50.49, Environmental Qualification of Electric Equipment Important to Safety for Nuclear Power Plants.
AP1000 STS                               B 3.6.5-4                                      Rev. 1

PCS B 3.6.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.6 Passive Containment Cooling System (PCS)
BASES BACKGROUND           The PCS provides containment cooling to limit post accident pressure and temperature in containment to less than the design values.
Reduction of containment pressure reduces the release of fission product radioactivity from containment to the environment, in the event of a Design Basis Accident (DBA). The PCS is designed to meet the requirements of 10 CFR 50 Appendix A GDC 38 Containment Heat Removal and GDC 40 Testing of Containment Heat Removal Systems (Ref. 1).
The PCS consists of an 800,000 gal (nominal) Passive Containment Cooling Water Storage Tank (PCCWST), four headered PCCWST discharge lines (standpipes) with flow restricting orifices, and two separate full capacity discharge headers to the containment vessel with 3 sets of isolation valves (i.e., 3 flow paths), each flow path capable of meeting the design bases. Algae growth is not expected within the PCCWST; however, to assure water clarity is maintained, a prevailing concentration of hydrogen peroxide is maintained at 50 ppm. The recirculation pumps and heater provide freeze protection for the PCCWST. However, OPERABILITY of the PCCWST is assured by compliance with the temperature limits specified in SR 3.6.6.1 and not by the recirculation pumps and heater. In addition to the recirculation pumps and heater, the PCCWST temperature can be maintained within limits by the ambient temperature, the large thermal inertia of the PCCWST, or heat from other sources. The PCS valve room temperature must not be below freezing for an extended period to assure the water flow path to the containment shell is available. The isolation valves on each flow path are powered from a separate Division.
Upon actuation of the isolation valves, gravity flow of water from the PCCWST (contained in the shield building structure above the containment) onto the upper portion of the containment shell reduces the containment pressure and temperature following a DBA. The flow of water to the containment shell surface is initially established to ensure that the short term containment cooling requirements following the postulated worst case LOCA are achieved. As the decay heat from the core becomes less with time, the water flow to the containment shell is reduced in three steps. The change in flow rate is attained without active components in the system and is dependent only on the decreasing water level in the elevated PCCWST. In order to ensure the containment surface is adequately and effectively wetted, the water is introduced at AP1000 STS                                 B 3.6.6-1                                        Rev. 1

PCS B 3.6.6 BASES BACKGROUND (continued) the center of the containment dome and flows outward. Weirs are placed on the dome surface to distribute the water and ensure effective wetting of the dome and vertical sides of the containment shell.
The path for the natural circulation of air is from the air intakes in the shield building, down the outside of the baffle, up along the containment shell to the top, center exit in the shield building and is always open. The drains in the upper annulus region must be clear to prevent water from blocking the air flow path. Heat is removed from within the containment utilizing the steel containment shell as the heat transfer surface combining conductive heat transfer to the water film, convective heat transfer from the water film to the air, radiative heat transfer from the film to the air baffle, and mass transfer (evaporation) of the water film into the air. As the air heats up and water evaporates, it becomes less dense than the cooler air in the air inlet annulus. This differential causes an increase in the natural circulation of the air upward along the containment surface, with heated air/water vapor exiting the top center of the shield building. Additional system design details are provided in Reference 2.
The PCS is actuated either automatically, by a containment High 2 pressure signal, or manually. Automatic actuation opens the PCCWST discharge valves, allowing gravity flow of the cooling water onto the containment shell. The manual containment cooling actuation consists of two momentary controls. Operating either control will actuate all applicable divisions. The discharge continues for at least three days.
The PCS is designed to limit post-accident pressure and temperature in containment to less than the design values. Reduction of containment pressure reduces the release of fission product radioactivity from containment to the environment in the event of a DBA.
The PCS is an engineered safety features (ESF) system and is designed to ensure that the heat removal capability required during the post accident period can be attained.
APPLICABLE      The PCS limits the temperature and pressure that could be experienced SAFETY          following a DBA. The limiting DBAs considered are the loss of coolant ANALYSES        accident (LOCA) and the steam line break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. No DBAs are assumed to occur simultaneously or consecutively. The postulated DBAs are analyzed with regard to containment ESF system, assuming the loss AP1000 STS                             B 3.6.6-2                                         Rev. 1

PCS B 3.6.6 BASES APPLICABLE SAFETY ANALYSES (continued) of one Class 1E Engineered Safety Features Actuation Cabinet (ESFAC)
Division, which is the worst case single active failure and results in one PCS flow path being inoperable.
The analyses and evaluations assume 100% RTP, one PCS train operating, and initial (pre-accident) containment conditions of 120&deg;F and 1.0 psig. The analyses also assume a response time delayed initiation to provide conservative peak calculated containment pressure and temperature responses.
For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the effectiveness of the Passive Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure. For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures in accordance with 10 CFR 50, Appendix K (Ref. 3).
Containment cooling system performance for post accident conditions is given in Reference 2. The result of the analysis is that each train can provide 100% of the required peak cooling capacity during the post accident condition.
The modeled PCS actuation response time from the containment analysis is based upon a response time associated with exceeding the containment High 2 pressure setpoint to opening of isolation valves.
The PCS limits the temperature and pressure that could be experienced during shutdown following a loss of decay heat removal. For shutdown events, the Reactor Coolant System (RCS) sensible and decay heat removal requirements are reduced as compared to heat removal requirements for MODE 1, 2, 3, or 4 events. Therefore, the shutdown containment heat removal requirements are bounded by analyses of MODES 1, 2, 3, and 4 events.
The PCS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              During a DBA, one PCS flow path is required to maintain the containment peak pressure and temperature below the design limits (Ref. 2). To ensure that this requirement is met, two PCS flow paths are provided.
AP1000 STS                              B 3.6.6-3                                       Rev. 1

PCS B 3.6.6 BASES LCO (continued)
Therefore, in the event of an accident, one PCS flow path operates, assuming the worst case single active failure occurs. A third PCS flow path is provided for protection against multiple failure scenarios modeled in the PRA. To ensure that these requirements are met, three PCS flow paths must be OPERABLE.
The PCS includes the PCCWST, valves, piping, instruments and controls to ensure an OPERABLE flow path capable of delivering water from the PCCWST upon an actuation signal. An OPERABLE PCS flow path consists of a normally closed valve capable of automatically opening in series with a normally open valve. However, based on PRA insights for the two flow paths containing air-operated valves, it is preferred that these valves be normally closed.
The PCCWST ensures that an adequate supply of water is available to cool and depressurize the containment in the event of a DBA. To be considered OPERABLE, the PCCWST must meet the water volume and temperature limits established in the SRs. To be considered OPERABLE, the air flow path from the shield building annulus inlet to the exit must be unobstructed, with unobstructed upper annulus safety related drains providing a path for containment cooling water runoff to preclude blockage of the air flow path.
APPLICABILITY   In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the PCS.
OPERABILITY of the PCS is required in either MODE 5 or 6 with the reactor decay heat (normally determined by calculation) greater than 7.0 MWt for heat removal in the event of a loss of non-safety decay heat removal capabilities. With the decay heat at or below 7.0 MWt, the decay heat can be removed from containment with air cooling alone for 72 hours. Confirmation of decay heat levels may be determined consistent with the assumptions and analysis basis of ANS 1979 plus 2 sigma (Ref. 4) or via an energy balance of the reactor coolant system.
AP1000 STS                             B 3.6.6-4                                       Rev. 1

PCS B 3.6.6 BASES ACTIONS    A.1 With one PCS water flow path inoperable, the affected flow path must be restored within 7 days. In this degraded condition, the remaining flow paths are capable of providing greater than 100% of the heat removal needs after an accident, even considering the worst single failure. The 7 day Completion Time was chosen in light of the remaining heat removal capability and the low probability of a DBA occurring during this period.
B.1 With two PCS water flow paths inoperable, one affected flow path must be restored to OPERABLE status within 72 hours. In this degraded condition, the remaining flow path is capable of providing greater than 100% of the heat removal needs after an accident. The 72 hour Completion Time was chosen in light of the remaining heat removal capability and the low probability of a DBA occurring during this period.
C.1 If the PCCWST water volume or temperature is not within limits, it must be restored to within limits within 8 hours. The 8 hour Completion Time is reasonable based on the remaining heat removal capability of the system and the availability of cooling water from alternate sources.
D.1 and D.2 If any of the Required Actions and associated Completion Times are not met in MODE 1, 2, 3, or 4, or if the LCO is not met for reasons other than Condition A, B, or C when in MODE 1, 2, 3, or 4, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 84 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 5 allows additional time and is reasonable when considering that the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.
E.1 and E.2 Action must be initiated if any of the Required Actions and associated Completion Times of Condition A, B, or C are not met in MODE 5, or if the LCO is not met for reasons other than Condition A, B, or C when in AP1000 STS                        B 3.6.6-5                                      Rev. 1

PCS B 3.6.6 BASES ACTIONS (continued)
MODE 5. With the RCS pressure boundary open or pressurizer level
                    < 20%, action must be initiated, immediately, to increase RCS inventory by establishing a pressurizer level  20% and closing the RCS pressure boundary so that Passive Residual Heat Removal Heat Exchanger (PRHR HX) operation is available. In this condition, the time to RCS boiling is maximized by maximizing the RCS inventory and maintaining RCS temperature as low as practical. Additionally, action to immediately suspend positive reactivity additions is required to ensure that the SDM is maintained. Sources of positive reactivity addition include boron dilution, withdrawal of rods, and excessive cooling of the RCS.
These Actions place the plant in a condition which maximizes the time to actuation of the PCS, thus providing time for repairs or application of alternate cooling capabilities.
F.1 and F.2 Action must be initiated if any of the Required Actions and associated Completion Times of Condition A, B, or C are not met in MODE 6, or if the LCO is not met for reasons other than Condition A, B, or C when in MODE 6. Action must be initiated, immediately, to increase RCS inventory by establishing a refueling cavity water level  23 feet above the top of the reactor vessel flange. In this condition, the time to RCS boiling is maximized by maximizing RCS inventory and maintaining RCS temperature as low as practical. Additionally, action to immediately suspend positive reactivity additions is required to ensure that the SDM is maintained. Sources of positive reactivity addition include boron dilution, withdrawal of rods, and excessive cooling of the RCS.
These Actions place the plant in a condition that maximizes the time to actuation of the PCS, thus providing time for repairs or application of alternate cooling capabilities.
SURVEILLANCE        SR 3.6.6.1 REQUIREMENTS This Surveillance requires verification that the PCCWST temperature is within the limits assumed in the accident analyses. The 24 hour Frequency is adequate to identify a temperature change that would approach the temperature limits since the PCCWST is large and temperature variations are slow.
AP1000 STS                                B 3.6.6-6                                       Rev. 1

PCS B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.6.6.2 Verification that the cooling water volume is above the required minimum ensures that a sufficient supply is available for containment cooling.
Since the cooling water volume is normally stable and low level is indicated by a main control room alarm, a 7 day Frequency is appropriate and has been shown to be acceptable in similar applications.
SR 3.6.6.3 Verifying the correct alignment of manual, power operated, and automatic valves, excluding check valves, in the PCS flow paths provides assurance that the proper flow paths exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to being secured. This SR does not require any testing or valve manipulation.
Rather, it involves verification, through control room instrumentation or a system walkdown, that valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control, and an improper valve position would only affect a single PCS flow path. This Frequency has been shown to be acceptable through operating experience.
SR 3.6.6.4 This SR requires verification that each automatic isolation valve actuates to its correct position upon receipt of an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power.
The 24 month Frequency is also acceptable based on consideration of the design reliability of the equipment. Operating experience has shown that these components usually pass the Surveillances when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.
AP1000 STS                              B 3.6.6-7                                      Rev. 1

PCS B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.6.6.5 Periodic inspections of the PCS air flow path from the shield building annulus inlet to the exit ensure that it is unobstructed, the baffle plates are properly installed, and the upper annulus safety related drains are unobstructed. Although there are no anticipated mechanisms which would cause air flow path or annulus drain obstruction and the effect of a missing air baffle section is small, it is considered prudent to verify this capability every 24 months. Additionally, the 24 month Frequency is based on the desire to perform this Surveillance under conditions that apply during a plant outage, the need to have access to the locations, and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation in similar situations.
SR 3.6.6.6 This SR requires performance of a PCS test to verify system flow and water coverage capabilities. The system performance test demonstrates that the containment cooling capability assumed in accident analyses is maintained by verifying the flow rates via each of the four standpipes and measurement of containment wetting coverage. The System Level OPERABILITY Testing Program provides specific test requirements and acceptance criteria. Although the likelihood that system performance would degrade with time is low, it is considered prudent to periodically verify system performance. The first refueling and 10 year Frequency is based on the ability of the more frequent Surveillances to verify the OPERABILITY of the active components and features which could degrade with time.
REFERENCES      1. 10 CFR 50, Appendix A, General Design Criteria for Nuclear Power Plants.
: 2. FSAR Section 6.2, Containment Systems.
: 3. 10 CFR 50, Appendix K, ECCS Evaluation Models.
: 4. American National Standard for Decay Heat Power in Light Water Reactors, American Nuclear Society Standards Committee Working Group ANS 5.1, Approved August 29, 1979.
AP1000 STS                             B 3.6.6-8                                         Rev. 1

Containment Penetrations B 3.6.7 B 3.6 CONTAINMENT SYSTEMS B 3.6.7 Containment Penetrations BASES BACKGROUND          Containment closure capability is required during shutdown operations when there is fuel inside containment. Containment closure is required to maintain the cooling water inventory within containment. Due to the large volume of the In-Containment Refueling Water Storage Tank (IRWST) and the reduced sensible heat during shutdown, the loss of some of the water inventory can be accepted. Since there are no unique MODES 5 and 6 containment pressurization response analyses, containment pressurization is assumed to be bounded by the design basis accident containment response. Therefore, containment closure must be capable of maintaining containment isolation at the containment design pressure of 59 psig (Ref. 1) to prevent gross failure of containment opening barriers that would challenge maintaining long-term core cooling water inventory.
Further, accident analyses have shown that containment closure capability is not required to meet offsite dose requirements. Therefore, containment does not need to be leak tight as required for MODES 1 through 4. In MODES 5 and 6, the LCO requirements are referred to as containment closure rather than containment OPERABILITY.
Containment closure means that all potential escape paths are closed or capable of being closed. Since there is no requirement for containment leak tightness, compliance with the Appendix J leakage criteria and tests are not required.
In MODES 5 and 6, there is no potential for steam release into the containment immediately following an accident. Pressurization of the containment could only occur after heatup of the IRWST due to Passive Residual Heat Removal Heat Exchanger (PRHR HX) operation (MODE 5 with RCS intact) or after heatup of the RCS with direct venting to the containment (MODE 5 with reduced RCS inventory or MODE 6 with the refueling cavity not fully flooded) or after heatup of the RCS and refueling cavity (MODE 6 with refueling cavity fully flooded). The time from loss of normal cooling until steam release to the containment for four representative sets of plant conditions is shown in Figure B 3.6.7-1 as a function of time after shutdown. Because local manual action may be required to achieve containment closure it is assumed that the containment hatches, air locks and penetrations must be closed prior to steaming into containment.
AP1000 STS                                 B 3.6.7-1                                      Rev. 1

Containment Penetrations B 3.6.7 BASES BACKGROUND (continued)
Figure B 3.6.7-1 provides allowable closure times for four representative sets of plant conditions. The time to steaming is dependent on various plant parameters (RCS temperature, IRWST temperature, etc.) and plant configuration (RCS Pressure Boundary Intact, RCS Open, etc.).
Therefore, the actual representation of the time to steaming may be different than that provided in Figure B 3.6.7 1. In determining the minimum time to steaming, conservative assumptions regarding core decay heat, RCS configuration, and initial RCS inventory are used to minimize the calculated time to steaming. The curves are based on the core decay heat prior to refueling so that closure times are longer following the core reload.
As presented in Tables 54-1 and 54-4 of Reference 2, the most risk significant events during shutdown are events that lead to a loss of Normal Residual Heat Removal System (RNS) cooling. Of these, the limiting events that lead to steaming to containment are the loss of shutdown cooling events, specifically:
* Loss of decay heat removal during drained conditions due to a failure of component cooling water or service water system;
* Loss-of-offsite power during drained conditions; and
* Loss of decay heat removal during drained conditions due to failure of the normal residual heat removal system.
These events are further discussed in FSAR Subsection 19.59.5 (Ref. 3).
Time to steaming is dependent on the postulated RCS configuration (intact versus open), and is based on the response of the plant considering features such as the operation of the 4th stage Automatic Depressurization System (ADS) valves, if necessary, status of the upper internals, status of refueling cavity, etc. Conservative assumptions regarding these features are made in the determination of the minimum time to steaming. The time assumed in the PRA (Ref. 2) to close the penetrations before steaming to containment included 15 minutes for the diagnosis and decision-making time, in addition to the time required to physically complete the closure action.
The risk of overdraining the RCS has been significantly reduced due to the automatic protection features associated with the hot leg level instruments, which isolate letdown on Low 2 hot leg water level.
Overdraining the RCS is no longer a significant contributor to core damage, as shown in Table 54-4 of Reference 2.
AP1000 STS                              B 3.6.7-2                                    Rev. 1

Containment Penetrations B 3.6.7 BASES BACKGROUND (continued)
The assumptions used in determining the required closure time for the various containment openings should be conservative, and should be consistent with the plant operating procedures, staffing levels, and status of the containment openings. The evaluation should consider the ability to close the containment for the limiting loss of shutdown cooling event, and considering the possibility of a station blackout. In determining if containment can be closed within the time permitted to containment closure specified in Figure B 3.6.7-1, the time to close containment penetrations must include both the diagnosis and decision-making time and the time required to physically complete the closure action.
Containment should be closed during the initial mid-loop period for a refueling since the time permitted to containment closure is shorter than the time to diagnose and make a decision that closure is needed following an event. The need to close containment for the mid-loop period following a refueling must be evaluated since decay heat varies with the time after shutdown and the impact of the partial core replacement with new fuel. It is expected that containment will be closed for activities where drain-down is planned, such as the RCS drain-down from no-load pressurizer level for the initial mid-loop period during a refueling. Containment is not expected to be closed for minor, unplanned RCS volume transients, such as a short-term inventory where the pressurizer level may be reduced, but not emptied, and where recovery actions are within the time to containment closure.
The containment equipment hatches, which are part of the containment pressure boundary, provide a means for moving large equipment and components into and out of containment. If closed, the equipment hatch must be held in place by four bolts. Good engineering practice dictates that bolts required by this LCO be approximately equally spaced.
Alternatively, if open, each equipment hatch can be installed using a dedicated set of hardware, tools and equipment. A self-contained power source is provided to drive each hoist while lowering the hatch into position. Large equipment and components may be moved through the hatches as long as they can be removed and the hatch closed prior to steaming into the containment.
The design of the equipment hatch is such that the four bolts would only be needed to support the hatch in place and provide adequate strength to support the hatch dead weight and associated loads. The hatch is installed on the inside containment and is held in place against a matching flange surface with mating bolt pattern by the bolts. Once the dead weight is supported, any pressure (greater than atmospheric) within AP1000 STS                              B 3.6.7-3                                      Rev. 1

Containment Penetrations B 3.6.7 BASES BACKGROUND (continued) containment will serve to exert closure force on the hatch toward the mating flange surface serving to reduce stresses on bolts. Therefore the determination of the number of bolts is limited to the quantity required to support the hatch itself and not related to any potential containment pressure.
The containment air locks, which are also part of the containment pressure boundary, provide a means for personnel access during MODES 1, 2, 3, and 4 unit operation in accordance with LCO 3.6.2, Containment Air Locks. Each air lock has a door at both ends. The doors are normally interlocked to prevent simultaneous opening when containment OPERABILITY is required. During periods of unit shutdown when containment closure is required, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary.
Temporary equipment connections (e.g., power or communications cables) are permitted as long as they can be removed to allow containment closure prior to steaming into the containment.
Containment spare penetrations which also provide a part of the containment boundary provide for temporary support services (electrical, I&C, air, and water supplies) during MODES 5 and 6. Each penetration is flanged and normally closed. During periods of plant shutdown, temporary support systems may be routed through the penetrations; temporary equipment connections (e.g., power or communications cables) are permitted as long as they can be removed to allow containment closure prior to steaming into the containment. The spare penetrations must be closed or, if open, capable of closure prior to steaming to containment.
Containment penetrations, including purge system flow paths, that provide direct access from containment atmosphere to outside atmosphere must be isolated or capable of being isolated prior to steaming into the containment on one side. Isolation may be achieved by an OPERABLE automatic isolation valve, or by a manual isolation valve, blind flange, or equivalent. Equivalent isolation methods must be approved and may include use of a material that can provide a temporary barrier for the containment penetrations. The equivalent isolation barrier must be capable of maintaining containment isolation at the containment design pressure of 59 psig (Ref. 2).
AP1000 STS                             B 3.6.7-4                                       Rev. 1

Containment Penetrations B 3.6.7 BASES APPLICABLE    For postulated shutdown events in MODES 5 and 6, RCS heat removal is SAFETY        provided by either passive residual heat removal (PRHR) or IRWST ANALYSES      injection and containment sump recirculation. To support RCS heat removal, containment closure is required to limit the loss of the cooling water inventory from containment (Ref. 2).
Containment penetrations satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO           This LCO limits the loss of cooling water inventory in containment to assure continued coolant inventory by limiting the potential escape paths for water released within containment. Penetrations closed in accordance with these requirements are not required to be leak tight.
The LCO requires any penetration providing direct access from the containment atmosphere to the outside atmosphere to be closed or capable of being closed prior to steaming into the containment. The equipment hatches may be open; however, the hatches shall be clear of obstructions such that capability to close the hatch within the indicated time period is maintained. The hardware, tools, equipment and power sources necessary to install the hatches shall be available when the hatch is open. Both doors in each containment air lock may be open; however, the air locks shall be clear of obstructions such that the capability to close one door within the indicated time period is maintained. Alternatively, one door in an air lock may be closed.
Containment spare penetrations may be open; however, the penetrations shall be clear of obstructions such that the penetrations are capable of being closed within the indicated time period. Direct access penetrations shall be closed by one manual or automatic isolation valve, blind flange or equivalent, or capable of being closed by one valve actuated by their respective ESF signal. If direct access penetrations are open, then they must be capable of being closed prior to steaming into the containment.
Figure B 3.6.7-1 provides the acceptable required closure times for various representative MODES and conditions.
APPLICABILITY The containment penetration requirements are applicable during conditions for which the primary safety related core cooling and boration capabilities are provided by IRWST or injection or PRHR  MODES 5 and 6. The capability to close containment is required to ensure that the cooling water inventory is not lost in the event of an accident.
In MODES 1, 2, 3, and 4, containment penetration requirements are addressed by LCO 3.6.1.
AP1000 STS                          B 3.6.7-5                                       Rev. 1

Containment Penetrations B 3.6.7 BASES ACTIONS      A.1 If the containment equipment hatches, air locks, or any containment penetration that provides direct access from the containment atmosphere to the outside atmosphere is not in the required status, including the containment isolation capability when automatic isolation valves are open, the penetration(s) must be restored to the required status within 1 hour.
B.1.1, B.1.2, and B.2 If Required Action A.1 is not completed within 1 hour or the LCO is not met for reasons other than Condition A, action must be taken to minimize the probability and consequences of an accident.
In MODE 5, action must be initiated, immediately, to establish a pressurizer level  20% with the RCS intact so that PRHR HX operation is available. In MODE 6, action must be initiated, immediately, to increase the reactor cavity water level  23 feet above the top of the reactor vessel flange. The time to RCS steaming to containment is maximized by maximizing RCS inventory, and allowing PRHR HX operation.
Additionally, action to suspend positive reactivity additions is required to ensure that the SDM is maintained. Sources of positive reactivity addition include boron dilution, withdrawal of control rods, and excessive cooling of the RCS.
SURVEILLANCE SR 3.6.7.1 REQUIREMENTS This Surveillance demonstrates that each of the containment penetrations required to be in its closed position is in that position. For any open purge and exhaust valves, this SR will demonstrate that the valves are not blocked from closing. Also if the purge and/or exhaust valves are open and relying on automatic closure, this Surveillance will demonstrate that each valve operator has motive power, which will ensure that each valve is capable of being closed by an automatic containment purge and exhaust isolation signal prior to steaming into containment. Alternately, purge and exhaust penetrations may be verified closed or capable of being closed prior to steaming into the containment, which will limit loss of the cooling water inventory from containment. Open containment spare penetrations shall be verified capable of being closed prior to steaming into the containment by removal of obstructions and installation of the flange or by other closure means which will limit loss of the cooling water inventory from containment.
AP1000 STS                           B 3.6.7-6                                       Rev. 1

Containment Penetrations B 3.6.7 BASES SURVEILLANCE REQUIREMENTS (continued)
The Surveillance is performed every 7 days. The Surveillance interval is selected to ensure that the required penetration status is maintained during shutdown inspections, testing, and maintenance.
SR 3.6.7.2 Each of the two equipment hatches is provided with a set of hardware, tools, equipment, and self-contained power source for moving the hatch from its storage location and installing it in the opening. The required set of hardware and tools shall be visually inspected to ensure that they can perform the required functions. The equipment and power source shall be inspected and/or operated as necessary to verify that the hatch can be closed properly. The power source shall be verified as containing sufficient energy to install the hatch from the storage location.
The 7 day Frequency is adequate considering that the hardware, tools, equipment, and power sources are dedicated to the associated equipment hatch and not used for any other functions.
The SR is modified by a Note which only requires that the Surveillance be met for an open equipment hatch. If the equipment hatch is installed in position, then the availability of the means to install the hatch is not required.
REFERENCES      1. FSAR Chapter 19, Probabilistic Risk Assessment (PRA),
Section 19.54, Low Power and Shutdown PRA.
: 2. AP1000 Probabilistic Risk Assessment.
: 3. FSAR Chapter 19, Probabilistic Risk Assessment (PRA), Section 19.59, PRA Results and Insights, Subsection 19.59.2, Use of PRA in the Design Process, and Subsection 19.59.5, Core Damage and Severe Release Frequency from Events at Shutdown.
AP1000 STS                             B 3.6.7-7                                         Rev. 1

Containment Penetrations B 3.6.7 Figure B 3.6.7-1 (page 1 of 1)
Time Prior to Coolant Inventory Boiling AP1000 STS                B 3.6.7-8                                 Rev. 1

pH Adjustment B 3.6.8 B 3.6 CONTAINMENT SYSTEMS B 3.6.8 pH Adjustment BASES BACKGROUND          The Passive Core Cooling System (PXS) includes four pH adjustment baskets which provide adjustment of the pH of the water in the containment following an accident where the containment floods.
Following an accident with a large release of radioactivity, the containment pH is automatically adjusted to greater than or equal to 7.0, to enhance iodine retention in the containment water. Chemical addition is necessary to counter the effects of the boric acid contained in the safety injection supplies and acids produced in the post-LOCA environment (nitric acid from the irradiation of water and air and hydrochloric acid from irradiation and pyrolysis of electric cable insulation). The desired pH values significantly reduce formation of elemental iodine in the containment water, which reduces the production of organic iodine and the total airborne iodine in the containment. This pH adjustment is also provided to prevent stress corrosion cracking of safety related containment components during long-term cooling.
Dodecahydrate trisodium phosphate (TSP) contained in baskets provides a passive means of pH control for such accidents. The baskets are made of stainless steel with a mesh front that readily permits contact with water. These baskets are located inside containment at an elevation that is below the minimum floodup level. The baskets are placed a foot above the floor to reduce the chance that water spills will dissolve the TSP. Natural recirculation of water inside the containment, following a LOCA, is driven by the core decay heat and provides mixing to achieve a uniform pH. The dodecahydrate form of TSP (Na3PO4*12H2O) is initially loaded into the baskets because it is hydrated and will undergo less physical and chemical change than would anhydrous TSP as a result of the humidity inside containment. (Refs. 1 and 2)
APPLICABLE          In the event of a Design Basis Accident (DBA), iodine may be released SAFETY              from the fuel to containment. To limit this iodine release from ANALYSES            containment, the pH of the water in the containment sump is adjusted by the addition of TSP. Adjusting the sump water to neutral or alkaline pH (pH  7.0) will augment the retention of the iodine, and thus reduce the iodine available to leak to the environment.
pH adjustment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                                B 3.6.8-1                                       Rev. 1

pH Adjustment B 3.6.8 BASES LCO           The requirement to maintain the pH adjustment baskets with  26,460 lbs of TSP assures that for DBA releases of iodine into containment, the pH of the containment sump will be adjusted to enhance the retention of the iodine.
APPLICABILITY In MODES 1, 2, 3, and 4 a DBA could cause release of radioactive iodine to containment requiring pH adjustment. The pH adjustment baskets assist in reducing the airborne iodine fission product inventory available for release to the environment.
In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, pH adjustment is not required to be OPERABLE in MODES 5 and 6.
ACTIONS       A.1 If the TSP weight in the pH adjustment baskets is not within limits, the iodine retention may be less than that assumed in the accident analysis for the limiting DBA. Due to the very low probability that the weight of TSP may change, the variations are expected to be minor such that the required capability is substantially available. The 72 hour Completion Time for restoration to within limits is consistent with times applied to minor degradations of ECCS parameters.
B.1 and B.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply.
To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 84 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE  SR 3.6.8.1 REQUIREMENTS The minimum amount of TSP is 26,460 pounds. This weight is based on providing sufficient TSP to buffer the post accident containment water to a minimum pH of 7.0. Additionally, the TSP weight is based on treating the maximum volume of post accident water (867,830 gallons) containing AP1000 STS                          B 3.6.8-2                                         Rev. 1

pH Adjustment B 3.6.8 BASES SURVEILLANCE REQUIREMENTS (continued) the maximum amount of boron (3050 ppm) as well as other sources of acid. The minimum required mass of TSP is 26,460ibs at an assumed assay of 100%.
While a weight is specified, the normal manner to confirm the weight limit is met is by measuring the volume of the TSP contained in the pH adjustment baskets. The minimum measured volume of TSP is 540 ft3 to meet the minimum required mass of TSP (26,460 lbs) and assumes the minimum density of TSP. The minimum TSP density is based on the manufactured density (49 lbs/ft3), since the density may increase and the volume decrease, during plant operation, due to agglomeration from humidity inside the containment. A TSP volume of 560 ft3 at the initial loading (i.e., prior to compaction and agglomeration, which may occur over time) provides about 4% margin above the minimum required TSP mass of 26,460 lbs.
The periodic verification is required every 24 months, since access to the TSP baskets is only feasible during outages, and normal fuel cycles are scheduled for 24 months. Operating experience has shown this Surveillance Frequency acceptable due to the margin in the volume of TSP placed in the containment building.
SR 3.6.8.2 Testing must be performed to ensure the solubility and buffering ability of the TSP after exposure to the containment environment. A representative sample of TSP from one of the baskets in containment is submerged in 1.0 +/- 0.01 liter of water at a boron concentration of 3050 ppm that has been heated to a temperature of 71 +/- 5&deg;C (160 +/- 9&deg;F). The solution is allowed to stand at this temperature for 4 hours without agitation. The solution is then cooled to 25 +/- 5&deg;C (77 +/-
9&deg;F) and the pH is measured. The solution pH should rise to  7.0. A TSP sample size of 2.19 grams is used if the TSP volume is verified to be at least 540 ft3 (minimum required). However, a larger TSP sample size can be used if the measured volume is verified to be greater than the minimum. For example, if the TSP volume is verified to be 560 ft, then a representative sample of 2.27 grams can be used.
Agitation of the test solution is prohibited, since an adequate standard for the agitation intensity cannot be specified. The time of 4 hours without agitation is necessary to allow time for the dissolved TSP to naturally AP1000 STS                              B 3.6.8-3                                    Rev. 1

pH Adjustment B 3.6.8 BASES SURVEILLANCE REQUIREMENTS (continued) diffuse through the sample solution. In the post LOCA sump area, rapid mixing would occur due to liquid flow, significantly decreasing the actual amount of time before the required pH is achieved.
REFERENCES      1. FSAR Section 6.3.2.1.4, Containment pH Control.
: 2. FSAR Section 6.3.2.2.4, pH Adjustment Baskets.
AP1000 STS                           B 3.6.8-4                                       Rev. 1

Vacuum Relief Valves B 3.6.9 B 3.6 CONTAINMENT SYSTEMS B 3.6.9 Vacuum Relief Valves BASES BACKGROUND           The purpose of the vacuum relief lines is to protect the containment vessel from damage due to a negative pressure (that is, a lower pressure inside than outside). Excessive negative pressure inside containment can occur, if there is a loss of ac power (Containment Recirculation Cooling System (VCS) containment heating not available, reactor trip decay heating only) with a differential (inside to outside) ambient temperature > 90&deg;F. In this case, the relative low outside ambient temperature may cool containment faster than the available heat sources (primarily, reactor decay heat) can heat containment, resulting in a reduction of the containment temperature and pressure below the negative pressure design limit since normal non-safety related pressure control means are not available due to loss of ac power. In addition, excessive negative pressure inside containment can occur, in the event of malfunction of the Containment Fan Coolers (Containment Air Filtration System (VFS)) control, in combination with low outside ambient temperature, which reduces containment temperature. The vacuum relief valves have an additional function to provide containment isolation to establish a containment boundary during positive pressure accident conditions.
The containment pressure vessel is protected from excessive external pressure loading by redundant 100% capacity vacuum relief capability within a shared containment penetration. There are two outside containment normally closed vacuum relief isolation valves, which are motor-operated valves (MOVs). The vacuum relief isolation valves receive an engineered safety features (ESF) open signal on Containment Pressure  Low 2 (Table 3.3.8-1, Function 1). The vacuum relief isolation valves close on an ESF containment isolation signal, as well as on Containment Radioactivity  High (Table 3.3.8-1, Function 3).
There are two normally closed, self-actuated check valves inside containment that opens on a negative differential pressure of 0.2 psi. To provide 100% capacity vacuum relief capability, either one of the two vacuum relief isolation valves and either one of the two check valves need to open.
The parallel vacuum relief isolation valves are interlocked with the 16 inch containment purge discharge isolation valve inside containment, VFS-PL-V009, which shares the vacuum relief containment penetration.
The vacuum relief isolation valves are blocked from opening if VFS-PL-V009 is not closed. If VFS-PL-V009 is not closed, then the AP1000 STS                                  B 3.6.9-1                                     Rev. 1

Vacuum Relief Valves B 3.6.9 BASES BACKGROUND (continued) vacuum relief isolation valves will automatically close to direct VFS purge exhaust through the normal VFS discharge flow path. However, if vacuum relief actuation is required, the vacuum relief isolation valve actuation signal overrides the closing interlock with VFS-PL-V009 to allow the vacuum relief isolation valves to open ensuring that the vacuum relief protection actuates. (Ref. 1)
APPLICABLE       Design of the vacuum relief system involves calculating the effect of a SAFETY           loss of all ac power with a low outside ambient air temperature in ANALYSES         combination with limited containment heating that reduces containment temperature and pressure (Ref. 2). Conservative assumptions are used for relevant parameters in the calculation; for example, maximum inside containment temperature, minimum outside air temperature, maximum humidity, and maximum heat transfer coefficients (Ref. 2). The resulting containment pressure versus time is calculated, including the effect of the opening of the vacuum relief valves when their negative pressure setpoint is reached. It is also assumed that one vacuum relief flow path fails to open.
The containment was designed for an external pressure load equivalent to 1.7 psid. The excessive containment cooling events were analyzed to determine the resulting reduction in containment pressure. The initial pressure condition used in this analysis was -0.2 psig. This resulted in a minimum pressure inside the containment less than the design load.
The applicable safety analyses results for the loss of ac power event bounds the analyses for the other external pressure load events described in the Bases for LCO 3.6.4, Containment Pressure.
The vacuum relief valves must also perform the containment isolation function during a containment high pressure event. For this reason, the system is designed to take the full containment positive design pressure and the environmental conditions (temperature, pressure, humidity, radiation, chemical attack, and the like) associated with the containment DBA.
The vacuum relief valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              The LCO establishes the maximum containment temperature initial condition and the minimum equipment required to accomplish the vacuum relief function following excessive containment cooling events AP1000 STS                             B 3.6.9-2                                      Rev. 1

Vacuum Relief Valves B 3.6.9 BASES LCO (continued)
(Ref. 2). This LCO also addresses the minimum equipment required to perform the containment isolation function of the vacuum relief valves.
The vacuum relief check valves are located in independent parallel paths inside containment and the vacuum relief isolation valves are located in independent parallel paths outside containment; they are connected by a common containment penetration. Therefore, two vacuum relief check valves and two vacuum relief isolation valves are required to be OPERABLE to ensure that at least one vacuum relief path is available with the failure to open of one check valve and/or one isolation valve and to ensure that there are two barriers for containment isolation. To be considered OPERABLE for opening, a vacuum relief check valve must be capable of opening on a differential pressure of less than or equal to 0.2 psi outside atmosphere-to-containment pressure. To be considered OPERABLE for closing, a vacuum relief check valve must close with a differential pressure less than or equal to 0 psi outside atmosphere-to-containment pressure. To be considered OPERABLE for opening, a vacuum relief isolation valve must be capable of opening on an ESF open signal and to be considered OPERABLE for closing, the isolation valve must be capable of closing on an ESF closure signal.
The containment inside to outside differential air temperature limit of 90&deg;F ensures that the initial condition for the excessive cooling analysis is met. If the differential air temperature exceeds the limit, the containment vacuum relief capacity of one flow path may not be adequate to ensure the containment pressure meets the negative pressure design limit.
APPLICABILITY   In MODES 1 through 6, the potential exists for excessive containment cooling events to produce a negative containment pressure below the design limit. However, in MODE 5 or 6, a containment air flow path may be opened (LCO 3.6.7, Containment Penetrations,) providing a vacuum relief path that is sufficient to preclude a negative containment pressure below the design limit.
Therefore, the vacuum relief valves are required to be OPERABLE for opening in MODES 1 through 4 and in MODES 5 and 6 without an open containment air flow path  6 inches in diameter. With a 6 inch diameter or equivalent containment air flow path, the vacuum relief function is not needed to mitigate a low pressure event.
The Applicability is modified by a Note that the vacuum relief valve OPERABILITY for closing is only required in MODES 1, 2, 3, and 4.
AP1000 STS                              B 3.6.9-3                                     Rev. 1

Vacuum Relief Valves B 3.6.9 BASES APPLICABILITY (continued)
In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the vacuum relief valve OPERABILITY for closing is only required in MODES 1, 2, 3, and 4 to prevent leakage of radioactive material from containment during positive pressure accident conditions. However, containment closure capability is required in MODES 5 and 6. The requirements for containment isolation valves, including the vacuum relief valves, during MODES 5 and 6 are addressed in LCO 3.6.7, Containment Penetrations.
ACTIONS            The Actions are modified by a Note that directs entry into the applicable Conditions and Required Actions of LCO 3.6.1, Containment, in the event that vacuum relief valve leakage results in exceeding the overall containment leakage rate acceptance criteria.
A.1 With one vacuum relief check valve inoperable for opening, vacuum relief capability is reduced below that required to meet single failure criterion.
The inoperable valve must be restored to OPERABLE for opening status within 72 hours. It is acceptable to enter Conditions A and B concurrently.
The vacuum relief function is maintained with at least one check valve and one isolation valve OPERABLE, which is assured provided Condition F or G is not entered for two vacuum relief check valves or two vacuum relief isolation valves inoperable for opening. The specified Completion Time is consistent with other LCOs for the loss of one train of a system required to mitigate the consequences of a LOCA or other DBA.
B.1 With one vacuum relief isolation valve inoperable for opening, vacuum relief capability is reduced below that required to meet single failure criterion. The inoperable valve must be restored to OPERABLE for opening status within 72 hours. Provided Condition F or G is not entered for two vacuum relief check valves or two vacuum relief isolation valves inoperable for opening, then the vacuum relief function is maintained with at least one check valve and one isolation valve (i.e., it is acceptable to enter Conditions A and B concurrently). The Completion Time period is AP1000 STS                                 B 3.6.9-4                                      Rev. 1

Vacuum Relief Valves B 3.6.9 BASES ACTIONS (continued) consistent with other LCOs for the loss of one train of a system required to mitigate the consequences of a LOCA or other DBA.
C.1 With one or more vacuum relief check valves inoperable for closing or with one or more vacuum relief isolation valves inoperable for closing (including either two vacuum relief check valves inoperable for closing or two vacuum relief isolation valves inoperable for closing), provided Condition D is not entered, the penetration has not lost single failure isolation capability.
The Completion Time to restore the valve(s) to OPERABLE for closing status in 7 days has been shown to be acceptable based on probability risk assessment considering the importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4, with the availability of one barrier for containment isolation, while also maintaining the capability for vacuum relief.
D.1 With one or more vacuum relief check valves and one or more vacuum relief isolation valves inoperable for closing, either both vacuum relief check valves or both vacuum relief isolation valves are to be restored to OPERABLE for closing status within 1 hour, to restore the capability to isolate the containment penetration. With one check valve and one isolation valve inoperable for closing, the containment isolation capability is lost and a release path remains open. To address this, either both vacuum relief check valves or both vacuum relief isolation valves need to be restored to OPERABLE for closing status to provide a containment isolation barrier. The 1 hour Completion Time is consistent with Action B of LCO 3.6.1.
E.1 and E.2 If the containment inside to outside differential air temperature is > 90&deg;F, then the differential air temperature shall be restored to within the limit within 8 hours. The 8 hour Completion Time is reasonable, considering that limit is based on a worst case condition and the time needed to reduce the containment temperature while controlling pressure within limits of LCO 3.6.4, Containment Pressure.
If the differential temperature cannot be restored, Required Action E.2 provides an alternate requirement. Reduction of the containment AP1000 STS                                 B 3.6.9-5                                        Rev. 1

Vacuum Relief Valves B 3.6.9 BASES ACTIONS (continued) average temperature to  80&deg;F provides an initial condition for excessive cooling events that ensures the vacuum relief system capacity is sufficient (Ref. 2).
F.1 and F.2 If a Required Action and associated Completion Time of Condition A, B, C, D, or E are not met in MODE 1, 2, 3, or 4, or two vacuum relief check valves are inoperable for opening in MODE 1, 2, 3, or 4, or two vacuum relief isolation valves are inoperable for opening in MODE 1, 2, 3, or 4, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
G.1 Once in MODE 5 or 6, Required Action G.1 requires that a containment air flow path with an area equivalent to a circular opening  6 inches in diameter shall be opened within 8 hours if a Required Action and associated Completion Time of Condition A, B, or E are not met, or if two vacuum relief check valves are inoperable for opening, or if two vacuum relief isolation valves are inoperable for opening. Any flow path (or paths) with an area equivalent to a circular opening 6 inches in diameter is adequate to provide the necessary air flow for containment vacuum relief.
The primary means of opening a containment air flow path is by establishing a VFS air flow path into containment. Available means to open an acceptable containment air flow path, with manual actuation and maintenance as necessary, are to open a purge supply, purge exhaust, or vacuum relief flow path. In addition, opening of a spare penetration is an acceptable means to provide the necessary flow path. Opening of an equipment hatch or a containment airlock is also acceptable.
Containment air flow paths opened must comply with LCO 3.6.7, Containment Penetrations.
The 8 hour Completion Time is reasonable for opening a containment air flow path in an orderly manner.
AP1000 STS                                 B 3.6.9-6                                      Rev. 1

Vacuum Relief Valves B 3.6.9 BASES SURVEILLANCE SR 3.6.9.1 REQUIREMENTS Verification that the containment inside to outside differential air temperature is  90&deg;F is required every 12 hours. The containment inside to outside differential air temperature is the difference between the outside ambient air temperature (measured by the site meteorological instrumentation or equivalent) and the inside containment average air temperature (measured using the same instrumentation as used for SR 3.6.5.1).
The Frequency is based on the normally stable containment average air temperature and the relatively small outside ambient air temperature changes within this time.
SR 3.6.9.2 Each vacuum relief isolation valve must be verified to be closed every 31 days. This SR assures that the vacuum relief isolation valves are closed as required, or if open, the valves are open for an allowable reason. The vacuum relief isolation valves are normally closed. The Frequency of 31 days is appropriate considering the valves should only be opened to relieve vacuum or manually opened to perform Surveillances and, therefore, the probability of a valve misalignment is low.
SR 3.6.9.2 is modified by two Notes. Note 1 states that SR 3.6.9.2 is not required to be met for vacuum relief valves that are open during Surveillances. Surveillances which open the vacuum relief isolation valves are performed infrequently and the valves will only be open for a limited period of time. Note 2 states that SR 3.6.9.2 is not required to be met for vacuum relief valves performing their vacuum relief function. If vacuum relief is required, the valves open to perform their safety function to maintain the integrity of the containment vessel. Air will flow into containment from the atmosphere due to the differential pressure, which will prevent radiological release from containment during vacuum relief.
SR 3.6.9.3 Each vacuum relief check valve and each vacuum relief isolation valve is tested to be OPERABLE for opening and OPERABLE for closing. This SR cites the Inservice Testing Program, which establishes the requirement that inservice testing of the ASME Code Class 1, 2, and 3 valves shall be performed in accordance with the ASME OM Code (Ref. 3). Therefore, SR Frequency is governed by the Inservice Testing Program.
AP1000 STS                          B 3.6.9-7                                        Rev. 1

Vacuum Relief Valves B 3.6.9 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.6.9.4 This SR ensures that each vacuum relief isolation valve will actuate to the open position on an actual or simulated actuation signal and will actuate to the closed position on an actual or simulated actuation signal.
The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the associated valve. The Frequency of 24 months is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operations.
REFERENCES      1. FSAR Subsection 9.4.7, Containment Air Filtration System.
: 2. FSAR Subsection 6.2.1.1.4, External Pressure Analysis.
: 3. ASME OM Code, Code for Operation and Maintenance of Nuclear Power Plants.
AP1000 STS                           B 3.6.9-8                                      Rev. 1

MSSVs B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)
BASES BACKGROUND          The primary purpose of the MSSVs is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available. The MSSVs also are containment isolation valves.
Six MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in Reference 1. The MSSVs must have sufficient capacity to limit the secondary system pressure to  110% of the steam generator design pressure in order to meet the requirements of the ASME Code, Section III (Ref. 2). The MSSV design includes staggered setpoints, as shown in Table 3.7.1-2 of the specification, so that only the needed valves actuate.
Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open the valves following a turbine-reactor trip.
APPLICABLE          The design basis for the MSSVs comes from Reference 2 and its SAFETY              purpose is to limit the secondary system pressure to  110% of design ANALYSES            pressure for any anticipated operating occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis.
The events that challenge the relieving capacity of the MSSVs, are those characterized as decreased heat removal events, which are presented in FSAR Section 15.2 (Ref. 3). Of these, the full power turbine trip without turbine bypass is the limiting AOO. This event also terminates normal feedwater flow to the steam generators.
The safety analysis demonstrates that the transient response for turbine trip without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System. One turbine trip analysis is performed assuming primary system pressure control via operation of the pressurizer spray. This analysis demonstrates that the departure from nucleate boiling (DNB) design basis is met. Another analysis is performed assuming no primary system pressure control, but crediting reactor trip on High 2 pressurizer pressure and operation of the pressurizer safety valves. This analysis demonstrates that RCS integrity AP1000 STS                                 B 3.7.1-1                                        Rev. 1

MSSVs B 3.7.1 BASES APPLICABLE SAFETY ANALYSES (continued) is maintained by showing that the maximum RCS pressure does not exceed 110% of the design pressure.
All cases analyzed demonstrate that the MSSVs maintain Main Steam System integrity by limiting the maximum steam pressure to less than 110% of the steam generator design pressure.
In addition to the decreased heat removal events, reactivity insertion events may also challenge the relieving capacity of the MSSVs. The uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power event is characterized by an increase in core power and steam generation rate until reactor trip occurs when either the Overtemperature T or Power Range Neutron Flux  High Positive Rate setpoint is reached. Steam flow to the turbine will not increase from its initial value for this event. The increased heat transfer to the secondary side causes an increase in steam pressure and may result in opening of the MSSVs prior to reactor trip, assuming no credit for operation of the atmospheric or condenser steam dump valves. The FSAR Section 15.4.2 safety analysis of the RCCA bank withdrawal at power event for a range of initial core power levels demonstrates that the MSSVs are capable of preventing secondary side overpressurization for this AOO (Ref. 4).
The FSAR safety analyses discussed above assume that all of the MSSVs for each steam generator are OPERABLE. If there are inoperable MSSV(s), it is necessary to limit the primary system power during steady state operation and AOOs to a value that does not result in exceeding the combined steam flow capacity of the turbine (if available) and the remaining OPERABLE MSSVs. The required limitation on primary system power necessary to prevent secondary system overpressurization may be determined by system transient analyses or conservatively arrived at by a simple heat balance calculation. In some circumstances it is necessary to limit the primary side heat generation that can be achieved during an AOO by reducing the setpoint of the Overpower T reactor trip Function. For example, if more than one MSSV on a single steam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurring from a partial power level may result in an increase in reactor power that exceeds the combined steam flow capacity of the turbine and the remaining OPERABLE MSSVs.
Thus, for multiple inoperable MSSVs on the same steam generator it is necessary to prevent this power increase by lowering the Overpower T setpoints to an appropriate value.
AP1000 STS                               B 3.7.1-2                                     Rev. 1

MSSVs B 3.7.1 BASES APPLICABLE SAFETY ANALYSES (continued)
In addition, the MSSVs are containment isolation valves and support the assumptions related to minimizing the loss of inventory and establishing the containment boundary during major accidents. Therefore, the safety analysis of any event requiring isolation of containment is applicable to the MSSVs.
The MSSVs are assumed to have two active and one passive failure modes. The active failure modes are spurious opening, and failure to reclose once opened. The passive failure mode is failure to open upon demand.
The MSSVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              The accident analysis requires six MSSVs per steam generator to provide overpressure protection for design basis transients occurring at 102% of RTP. A MSSV will be considered inoperable if it fails to open in the event of a pressure excursion in excess of the setpoint. The LCO requires that six MSSVs be OPERABLE in compliance with Reference 2.
Operation with less than the full number of MSSVs requires limitations on allowable THERMAL POWER (to meet ASME Code requirements).
These limitations are according to Table 3.7.1-1 of the Specification and Required Action A.1.
The OPERABILITY of the MSSVs is defined as the ability to open within the setpoint tolerances, relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic Surveillances in accordance with the Inservice Testing Program (Ref. 5).
The lift settings specified in Table 3.7.1-2 in the accompanying LCO, correspond to ambient conditions of the valve at nominal operating temperature and pressure.
This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB or Main Steam System integrity.
APPLICABILITY    In MODE 1, 2, 3, or 4, six MSSVs per steam generator are required to be OPERABLE. However, as stated in the Note to the Applicability, the MSSVs are not required to be OPERABLE for opening in MODE 4 when the Reactor Coolant System (RCS) is being cooled by the Normal Residual Heat Removal System (RNS).
AP1000 STS                             B 3.7.1-3                                      Rev. 1

MSSVs B 3.7.1 BASES APPLICABILITY (continued)
In MODE 4 in service, there are no credible transients requiring the MSSVs to be opened. The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized.
Thus, there is no requirement for the MSSVs to be OPERABLE in these MODES.
ACTIONS            The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each MSSV.
A.1 and A.2 With one or both steam generators with one or more MSSVs inoperable for opening, reduce power so that the available MSSV relieving capacity meets Reference 2 requirements for the applicable THERMAL POWER.
Operation with less than all six MSSVs OPERABLE for opening for each steam generator is permissible, if THERMAL POWER is proportionally limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam generator. The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described below and in the attachment to Reference 6, with an appropriate allowance for calorimetric power uncertainty.
To determine the maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs, the governing heat transfer relationship is the equation q =(dm/dt)h, where q is the heat input from the primary side, dm/dt is the mass flow rate of the steam, and h is the increase in enthalpy that occurs in converting the secondary side water to steam. If it is conservatively assumed that the secondary side water is all saturated liquid (i.e., no subcooled feedwater), then the h is the heat of vaporization (hfg) at the steam relief pressure. The following equation is used to determine the maximum allowable power level for continued operation with inoperable MSSVs.
Maximum NSSS Power  (100/Q) (ws hfg N) / K AP1000 STS                                B 3.7.1-4                                      Rev. 1

MSSVs B 3.7.1 BASES ACTIONS (continued) where:
Q   =    Nominal NSSS power rating of the plant (including reactor coolant pump heat), MWt K   =    Conversion factor, 947.82 (Btu/sec)/MWt ws =     Minimum total steam flow rate capability of the OPERABLE MSSVs on any one steam generator at the highest OPERABLE MSSV opening pressure, including tolerance and accumulation as appropriate, lbm/sec hfg =    Heat of vaporization at the highest MSSV opening pressure, including tolerance and accumulation as appropriate, Btu/lbm N   =    Number of steam generators in the plant To determine the Table 3.7.1-1 Maximum Allowable Power, the Maximum NSSS Power calculated using the equation above is reduced by 9% RTP to account for Overpower T trip channel uncertainties.
The allowed Completion Times are reasonable based on operating experience to accomplish the Required Actions in an orderly manner without challenging unit systems.
B.1 With one or both steam generators with one or more MSSVs inoperable for closing, the inoperable MSSV must be restored to OPERABLE status within 72 hours. The specified time period is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of maintaining containment integrity during MODES 1, 2, 3, and 4.
C.1 and C.2 If a Required Action and associated Completion Time of Condition A are not met, or if one or both steam generators have less than two MSSVs OPERABLE, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 3 within 6 hours, and in MODE 4, with RCS cooling provided by the RNS, within 24 hours. The allowed Completion Times are reasonable, based AP1000 STS                                  B 3.7.1-5                                        Rev. 1

MSSVs B 3.7.1 BASES ACTIONS (continued) on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1 and D.2 If the Required Action and associated Completion Time of Condition B are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.7.1.1 REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the Inservice Testing Program. The safety and relief valve tests are required to be performed in accordance with ASME OM Code (Refs. 5 and 7). According to Reference 5, the following tests are required:
: a. Visual examination;
: b. Seat tightness determination;
: c. Set pressure determination (lift setting);
: d. Compliance with owners seat tightness criteria; and
: e. Verification of the balancing device integrity on balanced valves.
The ANSI/ASME standard requires that all valves be tested every 5 years and a minimum of 20% of the valves be tested every 24 months.
The ASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7.1-2 allows a +/-1% setpoint tolerance for OPERABILITY, and the valves are reset to remain within +/-1% during the Surveillance to allow for drift. The lift settings, according to Table 3.7.1-2, correspond to ambient conditions of the valve at nominal operating temperature and pressure.
AP1000 STS                                  B 3.7.1-6                                     Rev. 1

MSSVs B 3.7.1 BASES SURVEILLANCE REQUIREMENTS (continued)
This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.
REFERENCES      1. FSAR Chapter 10, Steam and Power Conversion Systems Description.
: 2. ASME Boiler and Pressure Vessel Code, Section III, Article NC-7000, Overpressure Protection, Class 2 Components.
: 3. FSAR Section 15.2, Decreased Heat Removal by Secondary System.
: 4. FSAR Section 15.4.2, Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power.
: 5. ASME OM Code, Appendix I, Inservice Testing of Pressure Relief Devices in Light-Water Reactor Nuclear Power Plants.
: 6. NRC Information Notice 94-60, Potential Overpressurization of the Main Steam System, August 22, 1994.
: 7. ASME OM Code, Code for Operation and Maintenance of Nuclear Power Plants.
AP1000 STS                             B 3.7.1-7                                      Rev. 1

Main Steam Line Flow Path Isolation Valves B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Main Steam Line Flow Path Isolation Valves BASES BACKGROUND           Each main steam line has one MSIV, which is safety related, to isolate steam flow from the secondary side of the steam generators, which may be required following a high energy line break. MSIV closure terminates flow from the unaffected (intact) steam generator.
One MSIV is located in each main steam line outside containment. The MSIVs are downstream from the main steam safety valves (MSSVs).
Downstream from the MSIVs, main steam enters the high pressure turbine through four stop valves and four governing control valves.
Closing the MSIVs isolates each steam generator from the other and isolates the turbine bypass system, and other steam supplies from the steam generator.
The MSIVs, turbine bypass valves, and moisture separator reheater 2nd stage steam isolation valves close on a steam line isolation signal from either of two Class 1E power divisions generated on Steam Line Pressure  Low 2 (LCO 3.3.8 Function 24), Containment Pressure High 2 (LCO 3.3.8 Function 2), Tcold  Low 2 (LCO 3.3.8 Function 11), or if in MODE 3 below the Pressurizer Pressure, P-11 interlock setpoint when Steam Line Pressure - Low 2 is blocked, Steam Line Pressure Negative Rate  High (LCO 3.3.8 Function 25). The turbine stop and control valves close on a turbine trip. The MSIVs close on an actuation signal from either of two Class 1E power divisions. The MSIVs also fail to a closed position upon loss of actuating hydraulic power.
Each MSIV has an MSIV bypass valve. Although these bypass valves are normally closed, they receive the same emergency closure signal as do their associated MSIVs. The MSIVs may also be actuated manually.
A description of the MSIVs is found in the FSAR Section 10.3 (Ref. 1).
Descriptions for the turbine bypass valves, and moisture separator reheater 2nd stage steam isolation valves are found in the FSAR Section 10.4 (Ref. 2).
APPLICABLE           The design basis of the MSIVs is established by the containment SAFETY               analysis for the large steam line break (SLB) inside containment, ANALYSES             discussed in FSAR Section 6.2 (Ref. 3). It is also affected by the accident analysis of the SLB events presented in FSAR Section 15.1 (Ref. 4). The design precludes the blowdown of more than one steam AP1000 STS                                 B 3.7.2-1                                      Rev. 1

Main Steam Line Flow Path Isolation Valves B 3.7.2 BASES APPLICABLE SAFETY ANALYSES (continued) generator, assuming a single active component failure (e.g., the failure of one MSIV to close on demand).
Design basis events of concern for containment analysis are SLB inside containment with the failure of the associated MSIV to close, or a main feedwater line break with the associated failure of a main feedwater isolation or control valve to close. At lower powers, the steam generator secondary water inventory and temperature are at their maximum, which conservatively maximizes the analyzed mass and energy release to the containment. Due to the failure of the MSIV to close and the resulting reverse flow, the additional mass and energy in the steam headers, downstream from the other MSIV, contribute to the total release in containment. With the most reactive rod assumed stuck in the fully withdrawn position, there is an increased possibility that the resulting reactor coolant system (RCS) cooldown will cause the core to become critical and return to power. The core is ultimately shut down by the boric acid injection delivered by the Core Makeup Tanks (CMTs).
The accident analysis compares several different SLB events against different acceptance criteria. The large SLB outside containment upstream of the MSIV is limiting for offsite dose, although a break in this short section of main steam header piping has a very low probability.
The large SLB inside containment at hot zero power is the limiting case for a post trip return to power. The analysis includes consideration of scenarios with offsite power available, and with a loss of offsite power.
With offsite power available, the reactor coolant pumps continue to circulate coolant for a longer period through the steam generators, maximizing the RCS cooldown. The PMS includes a safety related signal that initiates the coastdown of the reactor coolant pumps early in the large SLB transient (trip of all reactor coolant pumps on CMT actuation). Therefore, there is very little difference in the predicted departure from nucleate boiling ratio between cases with and without offsite power. Significant single failures considered include failure of an MSIV to close.
The four sets of non-safety related turbine stop or control valves, in combination with the six turbine bypass valves, and the two moisture separator reheater 2nd stage steam isolation valves, are assumed as a non-safety related backup to isolate the steam flow path given a single failure of an MSIV to close. The safety analyses do not differentiate between the availability of a turbine stop valve and its in-series control valve. Either the turbine stop valve or its associated turbine control valve, in each of the four sets, is required by this LCO to be OPERABLE.
AP1000 STS                               B 3.7.2-2                                       Rev. 1

Main Steam Line Flow Path Isolation Valves B 3.7.2 BASES APPLICABLE SAFETY ANALYSES (continued)
These valves, along with the turbine bypass, and moisture separator reheater 2nd stage steam isolation valves are considered as alternate downstream isolation valves.
The MSIVs serve a safety related function and remain open during power operation. These valves operate under the following situations:
: a. A high energy line break inside containment. In order to maximize the mass and energy release into containment, the analysis assumes that the MSIV in the affected steam generator remains open. For this accident scenario, steam is discharged into containment from both steam generators until the unaffected steam generator MSIV closes. After MSIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIV of the unaffected steam generator. Closure of the MSIV isolates the break from the unaffected steam generator.
: b. A steamline break outside of containment, and upstream of an MSIV or downstream of the MSIVs. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for an uncontrolled RCS cooldown and positive reactivity addition.
Closure of the MSIVs or alternate downstream valves isolates the break, and limits the blowdown to a single steam generator.
: c. A steam generator tube rupture. Closure of the MSIVs isolates the ruptured steam generator to minimize radiological releases.
: d. Other events such as a feedwater line break. However, these events are less limiting so far as MSIV OPERABILITY is concerned.
In addition, the MSIV bypass valves and main steam line drain valves are containment isolation valves and support the assumptions related to minimizing the loss of inventory and establishing the containment boundary during major accidents. Therefore, the safety analysis of any event requiring isolation of containment is applicable to the MSIV bypass valves and main steam line drain isolation valves.
Following an SLB and main steam isolation signal, the analyses assume continued steam loss through the main steam line drain lines, turbine gland seal system, and the main steam to auxiliary steam header which supplies the auxiliary steam line to the deaerator. Since these valves are not assumed for steam isolation to mitigate an SLB, they do not satisfy AP1000 STS                             B 3.7.2-3                                     Rev. 1

Main Steam Line Flow Path Isolation Valves B 3.7.2 BASES APPLICABLE SAFETY ANALYSES (continued) the 10 CFR 50.36(c)(2)(ii) criteria; however, main steam line drain isolation valves satisfy the 10 CFR 50.36(c)(2)(ii) criteria for containment isolation as discussed above.
The MSIVs, the alternate downstream valves, the MSIV bypass valves, and the main steam line drain valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              This LCO requires the minimum combination of valves for isolation of each main steam line flow path to be OPERABLE. This requires that one MSIV in each of the two main steam line flow paths be OPERABLE and requires MSIV bypass valves and main steam line drain valves to be OPERABLE. The MSIVs are considered OPERABLE when their isolation times are within limits, and they close on an isolation actuation signal.
This LCO requires the minimum combination of turbine stop and control valves required for alternate downstream isolation of each main steam line flow path into the high pressure turbine to be OPERABLE. This LCO requires two turbine stop valves or the two associated turbine control valves in main steam line flow path A and two turbine stop valves or the two associated turbine control valves in main steam line flow path B be OPERABLE. A valve is considered OPERABLE when its closure time is within the safety analysis isolation time limit and the valve closes on an actuation signal. Example combinations of turbine stop and associated turbine control valves required by this LCO are as follows:
* If V001A and/or V003A (i.e., one or both turbine stop valve(s) in main steam line flow path A) are/is not OPERABLE, then associated valves V002A and V004A (i.e., both turbine control valves in main steam line flow path A) are required to be OPERABLE.
* If V002B and/or V004B (i.e., one or both turbine control valves in main steam line flow path B) are/is not OPERABLE, then associated valves V001B and V003B (i.e., both turbine stop valves in main steam line flow path B) are required to be OPERABLE.
This LCO also requires six turbine bypass valves and two moisture separator reheater 2nd stage steam isolation valves be OPERABLE.
A valve is considered OPERABLE when its isolation time is within the safety analysis isolation time limit and it closes on an MSIV actuation signal.
AP1000 STS                              B 3.7.2-4                                        Rev. 1

Main Steam Line Flow Path Isolation Valves B 3.7.2 BASES LCO (continued)
This LCO provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 50.34 limits or the NRC staff approved licensing basis.
This LCO provides assurance that the design and performance of the alternate downstream valves are compatible with the accident conditions for which they are called upon to function (Ref. 5).
APPLICABILITY   The MSIVs, MSIV bypass valves, main steam line drain valves, turbine stop or associated turbine control valves, turbine bypass valves, and moisture separator reheater 2nd stage steam isolation valves must be OPERABLE in MODES 1, 2, 3, and 4, when there is significant mass and energy in the RCS and steam generators and where a DBA could cause a release of radioactive material to containment.
In MODE 5 or 6, the steam generators do not contain much energy because their temperature is below the boiling point of water; therefore, the MSIVs and alternate downstream valves are not required for isolation of potential high energy secondary system pipe breaks in these MODES.
ACTIONS         A.1 With one MSIV inoperable in MODE 1, action must be taken to restore it to OPERABLE status within 8 hours. Some repairs to the valves can be made with the plant hot. The 8 hour Completion Time is reasonable considering the low probability of an accident occurring during this time period that would require a closure of these valves. With a single MSIV inoperable, the safety function, isolation of the main steam line flow path, is provided by the OPERABLE alternate downstream valves, but cannot accommodate a single failure. The assumptions and criteria of the accident analyses are preserved by the ability to automatically isolate the steam flow path.
The 8 hour Completion Time is greater than that normally allowed for containment isolation valves because the MSIVs are valves that isolate a closed system penetrating containment. These valves differ from other containment isolation valves in that the closed system provides a positive means for containment isolation.
AP1000 STS                             B 3.7.2-5                                      Rev. 1

Main Steam Line Flow Path Isolation Valves B 3.7.2 BASES ACTIONS (continued)
B.1 With any number of the turbine stop valves and the associated turbine control valves, turbine bypass valves, or moisture separator reheater 2nd stage steam isolation valves inoperable in MODE 1, action must be taken to restore the inoperable valve(s) to OPERABLE status within 72 hours. Some repairs to the valves can be made with the plant hot.
The 72 hour Completion Time is reasonable considering the low probability of an accident occurring during this time period that would require a closure of these valves. With the backup isolation valves inoperable, the safety function, isolation of the main steam line flow path, is provided by the remaining OPERABLE valves, but cannot accommodate a single failure. The assumptions and criteria of the accident analyses are preserved by the ability to automatically isolate the steam flow path.
C.1 With two MSIVs inoperable in MODE 1 or one MSIV and an alternate downstream valve inoperable or if the valves cannot be restored to OPERABLE status in accordance with Required Action A.1 or B.1, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours and Condition D would be entered. The Completion Time is reasonable, based on operating experience, to reach MODE 2 in an orderly manner and without challenging unit systems.
D.1 and D.2 Condition D is modified by a Note indicating that a separate Condition entry is allowed for each main steam line flow path.
With one or two MSIVs inoperable or any number of turbine stop valves and the associated turbine control valves, turbine bypass, or moisture separator reheater 2nd stage steam isolation valves inoperable in MODE 2, 3, or 4, the inoperable valve(s) may either be restored to OPERABLE status or the affected main steam line flow path isolated.
When isolated, the main steam line flow path is in the condition required by the assumptions in the safety analysis.
The 8 hour Completion Time is consistent with that allowed in Condition A, and conservative considering the reduced energy in the steam generators in MODES 2, 3, and 4.
AP1000 STS                                B 3.7.2-6                                       Rev. 1

Main Steam Line Flow Path Isolation Valves B 3.7.2 BASES ACTIONS (continued)
For inoperable main steam line flow path isolation valves that cannot be restored to OPERABLE status within the specified Completion Time but whose affected flow paths are isolated, these isolated flow paths must be verified to be continually isolated on a periodic basis. This is necessary to ensure that the assumptions in the safety analyses remain valid. The 7 day Completion Time is based on engineering judgment, and is considered reasonable in view of MSIV status indications available in the control room and other administrative controls which ensure that these valves will continue to be closed.
E.1 and E.2 With one or more MSIV bypass or main steam line drain valves inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration must be isolated. The method of isolation must include the use of one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and deactivated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration flow path. Required Action E.1 must be completed within the 72 hour Completion Time. The specified time period is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of maintaining containment integrity during MODES 1, 2, 3, and 4. In the event that the affected penetration is isolated in accordance with Required Action E.1, the affected penetration must be verified to be isolated on a periodic basis. This periodic verification is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low.
Condition E is modified by a Note indicating that separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation valves are governed by subsequent Condition entry and application of associated Required Actions.
AP1000 STS                                  B 3.7.2-7                                      Rev. 1

Main Steam Line Flow Path Isolation Valves B 3.7.2 BASES ACTIONS (continued)
The Required Actions are modified by a Note allowing containment penetration flow paths to be unisolated intermittently under administrative control. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated.
Required Action E.2 is modified by two Notes. Note 1 applies to valves and blind flanges located in high radiation areas, and allows these devices to be verified closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.
F.1, F.2, and F.3 If the main steam line flow path isolation valves cannot be restored to OPERABLE status or affected flow paths isolated within the associated Completion Times of Condition D or E, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 3 within 6 hours, in MODE 4 with normal residual heat removal system in service within 24 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.7.2.1 REQUIREMENTS This SR verifies that MSIV closure time is  5.0 seconds, on an actual or simulated actuation signal. The MSIV isolation time is assumed in the accident and containment analyses. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. The MSIVs should not be tested at power, since even a part stroke exercise increases the risk of a valve closure when the unit is generating power.
AP1000 STS                                B 3.7.2-8                                       Rev. 1

Main Steam Line Flow Path Isolation Valves B 3.7.2 BASES SURVEILLANCE REQUIREMENTS (continued)
The Frequency is in accordance with the Inservice Testing Program.
This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows the option to perform testing in MODE 3 or 4.
SR 3.7.2.2 This SR verifies that the turbine stop, turbine control, turbine bypass, and moisture separator reheater 2nd stage steam isolation valves closure time is  5.0 seconds, on an actual or simulated actuation signal. These alternate downstream isolation valves must meet the MSIV isolation time assumed in the accident and containment analyses. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. The alternate downstream valves should not be tested at power, since even a part stroke exercise increases the risk of a valve closure when the unit is generating power.
The Frequency is in accordance with the Inservice Testing Program.
This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows the option to perform testing in MODES 3 or 4.
SR 3.7.2.3 Verifying that the isolation time of each MSIV bypass and steam line drain valve is within limits is required to demonstrate OPERABILITY.
The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation times are specified in FSAR Section 6.2.3 (Ref. 6) and Frequency of this SR is in accordance with the Inservice Testing Program.
SR 3.7.2.4 This SR ensures that each MSIV bypass and steam line drain valve will actuate to its isolation position on an actual or simulated actuation signal.
The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves. The 24 month Frequency is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operation.
AP1000 STS                             B 3.7.2-9                                       Rev. 1

Main Steam Line Flow Path Isolation Valves B 3.7.2 BASES REFERENCES 1. FSAR Section 10.3, Main Steam System.
: 2. FSAR Section 10.4, Other Features of Steam and Power Conversion Systems.
: 3. FSAR Section 6.2.1, Containment Functional Design.
: 4. FSAR Section 15.1, Increase in Heat Removal by Secondary System.
: 5. NUREG-138, Issue 1, Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976, Memorandum from Director NRR to NRR Staff.
: 6. FSAR Section 6.2, Containment Systems.
AP1000 STS                    B 3.7.2-10                                   Rev. 1

MFIVs and MFCVs B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Main Feedwater Isolation Valves (MFIVs) and Main Feedwater Control Valves (MFCVs)
BASES BACKGROUND         The MFIVs isolate main feedwater (MFW) flow to the secondary side of the steam generators following a high energy line break. The safety related function of the MFCVs is to provide the second isolation of MFW flow to the secondary side of the steam generators following a high energy line break. Closure of the MFIVs or MFCVs terminates flow to the steam generators, terminating the event for feedwater line breaks occurring upstream of the MFIVs or MFCVs. The consequences of events occurring in the main steam lines or in the MFW lines downstream from the MFIVs will be mitigated by their closure. Closure of the MFIVs or MFCVs, effectively terminates the addition of main feedwater to an affected steam generator, limiting the mass and energy release for steam or feedwater line breaks inside containment, and reducing the cooldown effects for steam line breaks (SLBs).
The MFIVs or MFCVs isolate the non-safety related portions from the safety related portions of the system. In the event of a secondary side pipe rupture inside containment, the valves limit the quantity of high energy fluid that enters containment through the break, and provide a pressure boundary for the controlled addition of startup feedwater (SFW) to the intact loops of the steam generator.
One MFIV and one MFCV are located on each MFW line, outside but close to containment. The MFIVs and MFCVs are located in the MFW line and are independent of the delivery of the MFW or SFW via the SFW line which is separately connected and isolated from the steam generator.
This configuration permits MFW or SFW to be supplied to the steam generators following MFIV or MFCV closure. The piping volume from these valves to the steam generators must be accounted for in calculating mass and energy releases following either an SLB or FWLB.
The MFIVs and MFCVs close on receipt of engineered safeguards feedwater isolation signal generated from any of the following conditions:
* Automatic or manual safeguards actuation S signal Safeguards Actuation  Manual Initiation (LCO 3.3.9 Function 1)
Containment Pressure  High 2 (LCO 3.3.8 Function 2)
Pressurizer Pressure  Low (LCO 3.3.8 Function 5)
AP1000 STS                                 B 3.7.3-1                                      Rev. 1

MFIVs and MFCVs B 3.7.3 BASES BACKGROUND (continued)
RCS Cold Leg Temperature (Tcold)  Low (LCO 3.3.8 Function 11)
Steam Line Pressure  Low (LCO 3.3.8 Function 24)
* Steam Generator Narrow Range Water Level  High 2 (LCO 3.3.8 Function 23)
* Reactor Coolant Average Temperature (Tavg)  Low 2 (LCO 3.3.8 Function 13) coincident with reactor trip (P-4) (LCO 3.3.12) (MFIVs only)
* Reactor Coolant Average Temperature (Tavg)  Low (LCO 3.3.8 Function 12) coincident with reactor trip (P-4) (LCO 3.3.12) (MFCVs only)
* Feedwater Isolation  Manual Initiation (LCO 3.3.9 Function 5)
Each valve may be actuated manually. In addition to the MFIVs and the MFCVs, a check valve is available outside containment to isolate the feedwater line penetrating containment. In the event of feedwater line depressurization due to pump trip on a feedwater line break, the check valve provides rapid backup isolation of the steam generators limiting the inventory loss. A description of the MFIVs and MFCVs is found in Reference 1.
APPLICABLE       The design basis of the MFIVs and MFCVs is established by the SAFETY           analyses for the large SLB. It is also influenced by the accident analysis ANALYSES         for the large Feedwater Line Break (FWLB). Closure of the MFIVs and MFCVs may also be relied on to mitigate an SLB for core response analysis and excess feedwater event upon the receipt of a Steam Generator Narrow Range Water Level  High 3 (LCO 3.3.8 Function 23) signal.
Failure of an MFIV (or MFCV), to close following an SLB or FWLB, can result in additional mass and energy being delivered to the steam generators, contributing to cooldown. This failure also results in additional mass and energy releases following an SLB or FWLB event.
In addition, the MFIVs are containment isolation valves and support the assumptions related to minimizing the loss of inventory and establishing the containment boundary during major accidents. Therefore, the safety AP1000 STS                             B 3.7.3-2                                      Rev. 1

MFIVs and MFCVs B 3.7.3 BASES APPLICABLE SAFETY ANALYSES (continued) analysis of any event requiring isolation of containment is applicable to the MFIVs.
The MFIVs and MFCVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              This LCO ensures that the MFIVs and the MFCVs will isolate the main feedwater system from the secondary side of the steam generators.
This LCO requires that the one isolation valve and one control valve on each feedwater line be OPERABLE. These valves are considered OPERABLE when their isolation times are within limits and they close on an isolation actuation signal.
Failure to meet the LCO requirements can result in additional mass and energy being released to containment following an SLB or FWLB inside containment. A main feedwater isolation signal on High-3 steam generator level is relied on to terminate an excess feedwater flow event, and therefore failure to meet the LCO may result in the introduction of water into the main steam lines.
APPLICABILITY    The MFIVs and MFCVs must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and the steam generators. This ensures that, in the event of a high energy line break, a single failure cannot result in the blowdown of more than one steam generator. In MODES 1, 2, 3, and 4, these valves are required to be OPERABLE to limit the amount of available fluid that could be added to the containment in the case of a secondary system pipe break inside containment and where a DBA could cause a release of radioactive material to containment.
In MODES 5 and 6 steam generator energy is low. Therefore, the MFIVs and the MFCVs are normally closed since MFW is not required.
ACTIONS          The ACTIONS table is modified by a Note indicating that separate condition entry is allowed for each feedwater flow path.
A.1 and A.2 The condition of one or both feedwater flow paths with an MFIV or MFCV inoperable corresponds to one of the following possible situations: one or AP1000 STS                              B 3.7.3-3                                     Rev. 1

MFIVs and MFCVs B 3.7.3 BASES ACTIONS (continued) two MFIVs inoperable, one or two MFCVs inoperable, or the MFIV inoperable in one flow path and the MFCV inoperable in the other flow path. In this condition, each affected flow path must be isolated in 72 hours. When a feedwater flow path is isolated, it is performing the required safety function.
The 72 hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves, and the low probability of an event that would require isolation of the main feedwater flow paths occurring during this period.
For inoperable MFIVs and MFCVs that cannot be restored to OPERABLE status within the specified Completion Time for which each associated flow path is isolated, the affected flow paths must be periodically verified to be isolated. This is necessary to ensure that the assumptions in the safety analyses remain valid. The periodic Completion Time of once per 7 days is reasonable based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls that ensure each affected feedwater flow path remains isolated.
B.1 With the MFIV and MFCV both inoperable in one or both feedwater flow paths, there may be no redundant system to automatically perform the required isolation safety function in each affected feedwater flow path. In this condition, within 8 hours, either one valve in each affected flow path must be restored to OPERABLE status, or each affected flow path must be isolated. This action returns the system to the situation in which one valve in each affected flow path is performing the required safety function.
The 8 hour Completion Time is a reasonable amount of time to complete the actions required to isolate the affected flow paths, which may include closing the MFIV or MFCV, and performing a controlled plant shutdown.
The Completion Time is reasonable based on operating experience to reach MODE 2 with the feedwater flow paths isolated, from full-power conditions in an orderly manner and without challenging plant systems.
C.1, C.2, and C.3 If the MFIVs and MFCVs cannot be restored to OPERABLE status, or the affected flow paths cannot be isolated within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 3 within 6 hours, in MODE 4 with the normal residual heat removal system in AP1000 STS                                B 3.7.3-4                                      Rev. 1

MFIVs and MFCVs B 3.7.3 BASES ACTIONS (continued) service within 24 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.7.3.1 REQUIREMENTS This SR verifies that the closure time of each MFIV and MFCV is 5.0 seconds, on an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves. The MFIV and MFCV isolation times are assumed in the accident and containment analyses. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. These valves should not be tested at power, since even a part stroke exercise increases the risk of a valve closure when the unit is generating power.
The Frequency is in accordance with the Inservice Testing Program.
The SR is modified by a Note which states that the SR is only required to be performed prior to entry into MODE 2. This allows the option to perform testing in MODE 3 or 4.
REFERENCES          1. FSAR Section 10.4.7, Condensate and Feedwater System.
: 2. ASME OM Code, Code for Operation and Maintenance of Nuclear Power Plants.
AP1000 STS                                 B 3.7.3-5                                     Rev. 1

Secondary Specific Activity B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Secondary Specific Activity BASES BACKGROUND          Activity in the secondary coolant results from steam generator tube LEAKAGE from the Reactor Coolant System (RCS). Therefore, fission product isotopes, as well as activated corrosion products in lesser amounts, may be found in the secondary coolant. While fission products present in the primary coolant, as well as activated corrosion products, enter the secondary coolant system due to the primary to secondary LEAKAGE, only the iodines are of a significant concern relative to airborne release of activity in the event of an accident or abnormal occurrence (radioactive noble gases that enter the secondary side are not retained in the coolant but are released to the environment via the condenser air removal system throughout normal operation).
The limit on secondary coolant radioactive iodines minimizes releases to the environment due to anticipated operational occurrences or postulated accidents.
APPLICABLE          The accident analysis of the main steam line break (SLB) as discussed in SAFETY              FSAR Chapter 15 (Ref. 1) assumes the initial secondary coolant specific ANALYSES            activity to have a radioactive isotope concentration of 0.01 Ci/gm DOSE EQUIVALENT I-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accident.
The accident analysis, based on this and other assumptions, shows that the radiological consequences of a postulated SLB are within the acceptance criteria in SRP Section 15.0.1, and within the exposure guideline values of 10 CFR 50.34.
Secondary specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                 As indicated in the Applicable Safety Analyses, the specific activity limit of the secondary coolant is required to be  0.01 Ci/gm DOSE EQUIVALENT I-131 to maintain the validity of the analyses reported in FSAR Chapter 15 (Ref. 1).
Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the unit in an operational MODE that would minimize the radiological consequences of a DBA.
AP1000 STS                                B 3.7.4-1                                       Rev. 1

Secondary Specific Activity B 3.7.4 BASES APPLICABILITY In MODES 1, 2, 3, and 4 the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere.
In MODES 5 and 6, the steam generators are not being used for heat removal. Both the RCS and steam generators are depressurized, and primary to secondary LEAKAGE is minimal. Therefore, monitoring of secondary specific activity is not required.
ACTIONS       A.1 and A.2 DOSE EQUIVALENT I-131 exceeding the allowable value in the secondary coolant is an indication of a problem in the RCS and contributes to increased post-accident doses. If the secondary specific activity cannot be restored to within limits within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 3 within 6 hours and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE  SR 3.7.4.1 REQUIREMENTS This SR verifies that the secondary specific activity is within the limits of the accident analysis. A gamma isotopic analysis of the secondary coolant, which determines DOSE EQUIVALENT I-131, confirms the validity of the safety analysis assumptions as to the source terms in post-accident releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or leakage. The 31 day Frequency is based on the detection of increasing trends of the level of DOSE EQUIVALENT I-131, and allows for appropriate action to be taken to maintain levels below the LCO limit.
REFERENCES    1. FSAR Chapter 15, Accident Analyses.
AP1000 STS                           B 3.7.4-2                                       Rev. 1

Spent Fuel Pool Water Level B 3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Spent Fuel Pool Water Level BASES BACKGROUND           The minimum water level in the spent fuel pool meets the assumptions of iodine decontamination factors following a fuel handling accident. The specified water level shields and minimizes the general area dose when the storage racks are at their maximum capacity. The water also provides shielding during the movement of spent fuel, and a large capacity heat sink in the event the spent fuel pool cooling system is unavailable.
A general description of the spent fuel pool design is given in FSAR Section 9.1.2 (Ref. 1). A description of the Spent Fuel Pool Cooling System is given in FSAR Section 9.1.3 (Ref. 2). The assumptions of the fuel handling accident are given in FSAR Section 15.7.4 (Ref. 3).
APPLICABLE           The minimum water level in the spent fuel pool meets the assumptions of SAFETY               the fuel handling accident described in Regulatory Guide 1.183 (Ref. 4).
ANALYSES             The design basis radiological consequences resulting from a postulated fuel handling accident are within the dose values provided in FSAR Section 15.7.4 (Ref. 3).
According to Reference 3 there is 23 ft of water between the damaged fuel bundle and the fuel pool surface during a fuel handling accident. In the case of a single bundle dropped and lying horizontally on top of the spent fuel racks, however, there may be < 23 ft of water above the top of the fuel bundle and the surface, indicated by the width of the bundle.
This slight reduction in water depth does not adversely affect the margin of conservatism associated with the assumed pool scrubbing factor of 500 for elemental iodine.
In addition to mitigation of the effects of a fuel handling accident, the required minimum water level in the spent fuel pool and connected fuel transfer canal provides a large capacity heat sink for spent fuel pool cooling in the event the spent fuel pool cooling system is unavailable.
The Spent Fuel Pool Water Level satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                                  B 3.7.5-1                                        Rev. 1

Spent Fuel Pool Water Level B 3.7.5 BASES LCO           The spent fuel pool water level is required to be  23 ft over the top of irradiated fuel assemblies seated in the storage racks. The specified water level preserves the assumptions of the fuel handling accident analysis (Ref. 3) and loss of spent fuel pool cooling. As such, it is the minimum required for fuel storage and movement within the spent fuel pool.
APPLICABILITY This LCO applies when irradiated fuel assemblies are stored in the spent fuel pool. Irradiated fuel assemblies generate decay heat and cooling of the irradiated fuel assemblies would be negatively impacted by the loss of spent fuel pool cooling.
ACTIONS       LCO 3.0.3 is applicable while in MODE 1, 2, 3, or 4. Since spent fuel pool cooling requirements apply when irradiated fuel assemblies are stored in the spent fuel pool, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. Spent fuel pool cooling requirements are independent of reactor operations. Entering LCO 3.0.3 while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
A.1 When the initial conditions assumed in accident analyses cannot be met, steps should be taken to preclude the accident from occurring. When the spent fuel pool water level is lower than the required level, the movement of irradiated fuel assemblies shall be suspended. This action effectively precludes the occurrence of a fuel handling accident. This does not preclude movement of a fuel assembly to a safe position.
If moving irradiated fuel assemblies while in MODE 4, 5, or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODES 1, 2 and 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not a sufficient reason to require a reactor shutdown.
A.2 If the water level in the spent fuel pool is < 23 ft, the heat capacity of the spent fuel pool will be less than that assumed in the event of a loss of spent fuel pool cooling. In this case, action must be initiated within 1 hour to restore the water level in the spent fuel pool to  23 ft above the top of the irradiated fuel assemblies. Initiation of this action requires that the action be continued until a water level of  23 ft is attained.
AP1000 STS                           B 3.7.5-2                                         Rev. 1

Spent Fuel Pool Water Level B 3.7.5 BASES ACTIONS (continued)
The Completion Time of 1 hour assures prompt action to compensate for a degraded condition.
SURVEILLANCE        SR 3.7.5.1 REQUIREMENTS This SR verifies sufficient spent fuel pool water is available in the event of a fuel handling accident or loss of spent fuel pool cooling. The water level in the spent fuel pool must be checked periodically. The 7 day Frequency is appropriate because the volume in the pool is normally stable. Water level changes are controlled by plant procedures and are acceptable based on operating experience.
During refueling operations, the level in the spent fuel pool is in equilibrium with the refueling canal, and the level in the refueling canal is checked daily in accordance with SR 3.9.4.1.
REFERENCES          1. FSAR Section 9.1.2, Spent Fuel Storage.
: 2. FSAR Section 9.1.3, Spent Fuel Pool Cooling System.
: 3. FSAR Section 15.7.4, Fuel Handling Accident.
: 4. Regulatory Guide 1.183, Rev. 0, Alternate Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors.
AP1000 STS                                B 3.7.5-3                                        Rev. 1

VES B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Main Control Room Emergency Habitability System (VES)
BASES BACKGROUND           The Main Control Room Emergency Habitability System (VES) provides a protected environment from which operators can control the plant following an uncontrolled release of radioactivity, hazardous chemicals, or smoke. The system is designed to operate following a Design Basis Accident (DBA) which requires protection from the release of radioactivity.
In these events, the Nuclear Island Non-Radioactive Ventilation System (VBS) would continue to function if AC power is available. If AC power is lost for greater than 10 minutes, or Low main control room differential pressure is sensed for greater than 10 minutes, or a High-2 iodine or particulate Main Control Room Envelope (MCRE) radiation signal (LCO 3.3.13) is received, the VES is actuated. The MCRE radioactivity is measured by detectors in the MCR supply air duct, downstream of the filtration units. The major functions of the VES are: 1) to provide forced ventilation to deliver an adequate supply of breathable air (Ref. 1) for the MCRE occupants; 2) to provide forced ventilation to maintain the MCRE at a 1/8 inch water gauge positive pressure with respect to the surrounding areas; 3) to provide passive filtration to filter contaminated air in the MCRE; and 4) to limit the temperature increase of the MCRE equipment and facilities that must remain functional during an accident, via de-energizing (load shedding) nonessential, non-safety main control room (MCR) electrical equipment (e.g., wall panel information system displays, office equipment, water heater, kitchen appliances, and non-emergency lighting) and the heat absorption of passive heat sinks.
The VES consists of compressed air storage tanks, two air delivery flow paths, an eductor, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section for removal of gaseous activity (principally iodines), associated valves or dampers, piping, and instrumentation. The tanks contain enough breathable air to supply the required air flow to the MCRE for at least 72 hours. The VES system is designed to maintain CO2 concentration less than 0.5% by volume for up to 11 MCRE occupants.
The MCRE is the area within the confines of the MCRE boundary that contains the spaces that control room operators inhabit to control the unit during normal and accident conditions. This area encompasses the main control area, operations work area, operational break room, shift supervisors office, kitchen, and toilet facilities (Ref. 2). The MCRE is protected during normal operation, natural events, and accident conditions. The MCRE boundary is the combination of walls, floor, roof, AP1000 STS                                   B 3.7.6-1                                      Rev. 1

VES B 3.7.6 BASES BACKGROUND (continued) electrical and mechanical penetrations, and access doors. The OPERABILITY of the MCRE boundary must be maintained to ensure that the inleakage of unfiltered air into the MCRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to MCRE occupants. The MCRE and its boundary are defined in the Main Control Room Envelope Habitability Program.
Heat sources inside the MCRE include operator workstations, emergency lighting and occupants. During normal operation, temperatures in the main control room, instrumentation and control rooms, dc equipment rooms, Class 1E electrical penetration rooms, and some adjacent rooms are maintained within a specified range by the VBS. As described in UFSAR Section 9.4.1.2, the VBS consists of independent subsystems, including the main control room / control support area HVAC subsystem and the Class 1E Electrical room HVAC subsystem. The Class 1E Electrical room HVAC subsystem is further divided into two independent subsystems, with one serving the Division A & C Class 1E electrical division rooms and the other serving the Division B & D Class 1E electrical division rooms. Each independent subsystem serves its associated rooms with two redundant, 100 percent capacity equipment trains, maintaining temperatures within the specified range.
To support OPERABILITY of the VES, passive heat sink air temperatures are maintained by VBS in required dc Equipment Rooms and required I&C Rooms. Certain required room-pairs (i.e., 12201/12301, 12203/12302, 12205/12305, and 12207/12304) require the average temperature of the combined room-pair to be  85&deg;F, as monitored by temperature elements located in the shared return air ducting. Other required individual rooms (i.e., 12202, 12204, 12300, 12313, 12412, and 12501) are each required to be  85&deg;F. Additionally, a maximum air temperature limit of  75&deg;F is also placed on the MCRE. The passive heat sinks limit the temperature rise inside each room and the MCRE during the 72 hour period following VES actuation.
Access corridors, stairwells, rooms separated by an air gap, and other rooms without significant heat loads are not monitored because these areas do not contain significant heat sources and their temperatures are assumed to match the connected spaces. These unmonitored rooms are identified as: 12211, 12311, 12400, 12405, 12411, 21480, 40400, and Stairwells.
Initial temperatures assumed for remaining rooms are conservatively selected to match the initial 115&deg;F outdoor ambient (12212, 12213, AP1000 STS                             B 3.7.6-2                                      Rev. 1

VES B 3.7.6 BASES BACKGROUND (continued) 12306, 12312, 12404, and 12406) or do not have an appreciable impact on the analyses. These unmonitored rooms are identified as: 12212, 12213, 12306, 12312, 12404, 12406, 12504, 12505, 12506, and Level 1 rooms.
Nonessential, non-safety MCR heat loads are de-energized by the Protection and Safety Monitoring System (PMS) VES actuation signal, which is generated by the Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization ESF actuation signal, to maintain the MCRE within habitable limits for 72 hours.
Upon receipt of a Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization ESF actuation signal, PMS Divisions A and C energize associated redundant relays in each of the two safety related electrical panels (VES-EP-01 and VES-EP-02). Energizing one set of relays in each panel disconnects non-safety related electrical power to the non-safety electrical loads in the MCRE. Energizing just one set of relays in one panel deenergizes the non-safety loads associated only with that panel.
De-energized non-safety loads are separated into Stage 1 and Stage 2 to maximize the availability of the non-safety related wall panel information system which is de-energized with Stage 2 loads. Timers and associated relays, which actuate to de-energize the Stage 1 and Stage 2 non-safety loads, are internal to each safety related load shed panel. Stage 1 loads are de-energized by both panels immediately after the timers in each panel receive the PMS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization ESF actuation signal.
Stage 2 loads are de-energized by both panels within 180 minutes after the timers in each panel receive the PMS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization ESF actuation signal.
OPERABILITY of two redundant divisions of MCR Class 1E load shed relays and timers located in two safety related panels is required to meet the single failure criterion. Each panel contains redundant load shed relays and timers actuated by the two PMS divisions such that actuation of either division deenergizes the specified loads associated with both panels.
In the unlikely event that power to the VBS is unavailable for more than 72 hours, MCRE habitability is maintained by operating one of the two MCRE ancillary fans to supply outside air to the MCRE.
AP1000 STS                              B 3.7.6-3                                     Rev. 1

VES B 3.7.6 BASES BACKGROUND (continued)
The compressed air storage tanks are initially filled to contain greater than 327,574 scf of compressed air. The compressed air storage tanks, the tank pressure, and the room temperature are monitored to confirm that the required volume of breathable air is stored. During operation of the VES, a self-contained pressure regulating valve maintains a constant downstream pressure regardless of the upstream pressure. The eductor, which operates with an integrated inlet flow metering orifice, or the orifice downstream of the regulating valve is used to control the air flow rate into the MCRE. The MCRE is maintained at a 1/8 inch water gauge positive pressure to minimize the infiltration of airborne contaminants from the surrounding areas. The VES operation in maintaining the MCRE habitable is discussed in Reference 2.
APPLICABLE      The compressed air storage tanks are sized such that the set of tanks SAFETY          has a combined capacity that provides at least 72 hours of VES ANALYSES        operation.
Operation of the VES is automatically initiated by any of the following safety related signals:
* Main Control Room Air Supply Iodine or Particulate Radiation High 2 (LCO 3.3.13 Function 1);
* Main Control Room Differential Pressure  Low (for greater than 10 minutes) (LCO 3.3.13 Function 2); or
* Class 1E 24-Hour Battery Charger Undervoltage (Loss of AC power for more than 10 minutes) (LCO 3.3.13 Function 3).
In the event of a loss of AC power for greater than 10 minutes, the VBS isolation valves automatically close and the VES isolation valves automatically open. These actions protect the MCRE occupants from a potential radiation release. In addition, the loss of AC power coincident with MCRE isolation will de-energize the control room air supply radiation monitors in order to conserve the battery capacity.
Operation of the VES may also be manually initiated using either of two momentary controls in the MCR. Since the manual VES initiation Function does not satisfy the LCO selection criteria of 10 CFR 50.36(c)(2)(ii), its OPERABILITY is not required to support VES OPERABILITY.
AP1000 STS                             B 3.7.6-4                                      Rev. 1

VES B 3.7.6 BASES APPLICABLE SAFETY ANALYSES (continued)
In the event that a High 1 radioactivity setpoint value is reached, the non-safety VBS re-aligns to supplemental filtration mode, providing MCRE pressurization, cooling, and filtration. Upon High 2 particulate or iodine radioactivity in the VBS MCRE air supply duct exceeding the Main Control Room Air Supply Iodine or Particulate Radiation  High 2 setpoint, a safety related signal is generated to isolate the MCRE and to initiate air flow from the VES storage tanks. Isolation of the MCRE consists of closing safety related valves in the lines that penetrate the MCRE pressure boundary. Valves in the VBS supply and exhaust ducts, and the Sanitary Drainage System (SDS) vent lines are automatically isolated. The relief damper isolation valves also open allowing the pressure relief dampers to function and discharge the damper flow to purge the vestibule. The Main Control Room Air Supply Iodine or Particulate Radiation  High 2 Function initiates VES air flow by generating a safety related signal that opens the isolation valves in the VES supply lines.
The VES provides protection from smoke and hazardous chemicals to the MCRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the MCRE following a hazardous chemical release (Ref. 2). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the MCRE occupants to control the reactor either from the control room or from the remote shutdown room (Ref. 3).
The VES functions to mitigate a DBA or transient that either assumes the failure of or challenges the integrity of the fission product barrier.
The VES satisfies the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO             The VES limits the MCRE temperature rise and maintains the MCRE at a positive pressure relative to the surrounding environment.
Two air delivery flow paths are required to be OPERABLE to ensure that at least one is available, assuming a single failure.
AP1000 STS                              B 3.7.6-5                                      Rev. 1

VES B 3.7.6 BASES LCO (continued)
The VES is considered OPERABLE when the individual components necessary to deliver a supply of breathable air to the MCRE are OPERABLE. This includes components listed in SR 3.7.6.1 through SR 3.7.6.12:
* MCRE heat sinks (as indicated by MCRE air temperature)
* MCRE pressure boundary
* VES compressed air storage tanks, air volume and quality
* VES air delivery isolation valves
* VES air header manual isolation valves are open
* VBS MCRE isolation valves
* VES pressure relief isolation valves within the MCRE pressure boundary
* VES pressure relief dampers
* VES self-contained pressure regulating valves
* VES air delivery flow paths
* VES passive filtration system (eductors and filters)
* Main control room (MCR) load shed function panels The MCRE pressure boundary must be maintained, including the integrity of the walls, floors, ceilings, electrical and mechanical penetrations, and access doors. The MCRE pressure boundary includes the Potable Water System (PWS) and SDS running (piping drain) traps, which retain a fluid level sufficient to maintain a seal preventing gas flow through the piping.
The MCRE pressure boundary also includes the Waste Water System (WWS) drain line, which is isolated by a normally closed isolation valve.
In order for the VES to be considered OPERABLE, the MCRE boundary must be maintained such that the MCRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing AP1000 STS                              B 3.7.6-6                                      Rev. 1

VES B 3.7.6 BASES LCO (continued) basis consequence analysis for DBAs, and that MCRE occupants are protected from hazardous chemicals and smoke.
The initial MCRE heat sink thermal mass, required individual room heat sink thermal mass, and required room-pair heat sink thermal mass are initial conditions required to limit the maximum MCRE temperature.
Thermal mass is the ability of a material to absorb and store heat energy.
In the context of the MCRE heat-up analysis, the thermal mass of the heat sinks provides inertia against temperature changes. Establishing the passive heat sink nominal conditions is related to the time of exposure and magnitude of relevant heat sources, and is dependent upon material properties such as specific heat capacity and density of concrete. The thermal mass of the required MCRE heat sinks (the MCRE, individual required rooms adjacent to and below the MCRE, required room-pairs adjacent to and below the MCRE, and the room above the MCRE) must be within limits to support VES OPERABILITY and limit the maximum MCRE temperature for 72 hours after VES actuation.
The LCO is modified by a Note allowing the MCRE boundary to be opened intermittently under administrative controls. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the MCRE. This individual will have a method to rapidly close the opening and to restore the MCRE boundary to a condition equivalent to the design condition when a need for MCRE isolation is indicated.
Both PMS Divisions A and C in the two safety related electrical panels are required to be OPERABLE, so that non-safety Stage 1 and Stage 2 MCR heat loads can be de-energized by the VES system actuation signal within the required time, assuming a single failure. This maintains the MCR temperature within habitable limits.
APPLICABILITY   In MODES 1, 2, 3, and 4 and during movement of irradiated fuel assemblies, the VES must be OPERABLE to ensure that the MCRE will remain habitable during and following a DBA.
The VES is not required to be OPERABLE in MODES 5 and 6 when irradiated fuel is not being moved because accidents resulting in fission product release are not postulated.
AP1000 STS                              B 3.7.6-7                                     Rev. 1

VES B 3.7.6 BASES ACTIONS    A.1 When a VES valve, a VES damper, or a main control room boundary isolation valve is inoperable, action is required to restore the component to OPERABLE status. A Completion Time of 7 days is permitted to restore the valve or damper to OPERABLE status before action must be taken to reduce power. The Completion Time of 7 days is based on engineering judgment, considering the low probability of an accident that would result in a significant radiation release from the fuel, the low probability of not containing the radiation, and that the remaining components can provide the required capability.
B.1 If one division of one or more MCR load shed panel(s) is inoperable, all divisions of both MCR load shed panels must be restored to OPERABLE status within 7 days. In this condition, the OPERABLE unaffected division of the panel is capable of providing 100% of the load shed function.
A Completion Time of 7 days is permitted to restore the inoperable division of MCR load shed panel(s) to OPERABLE status before action must be taken to reduce power. The Completion Time of 7 days is based on engineering judgment, considering the low probability of an accident that would require VES actuation, and that the remaining panel division can provide the required load shed function.
As described in Subsection 6.4.2.3 of Ref. 1, any component failure in a PMS division of the load shed panel(s) renders that division inoperable. If this failure affects only one PMS division, leaving the remaining division of PMS unaffected, including the associated power and control circuit, it renders the panel(s) inoperable, while still maintaining the full load shed function. An event or action that impacts both PMS divisions in either panel does not maintain the full load shed function, and Condition F or G of LCO 3.7.6 would apply.
C.1 and C.2 When the thermal mass of one or more of the required MCRE heat sinks (the MCRE, individual required rooms adjacent to and below the MCRE, required room-pairs adjacent to and below the MCRE, and the room above the MCRE) is not within the required limit(s), the heat sink air temperature must be restored to within limit in 24 hours and the thermal mass of the required heat sink(s) must be restored to within limit(s) in 5 days.
AP1000 STS                        B 3.7.6-8                                       Rev. 1

VES B 3.7.6 BASES ACTIONS (continued)
The Required Action C.1 Completion Time of 24 hours to initially restore the heat sink air temperature to within limit is based on engineering judgment, considering the low probability of an accident that would require VES actuation under the worst case temperature conditions, and is permitted based upon the availability of temperature indication in the MCRE and individual required rooms, and in the air return ducts to the adjacent required room-pairs. It is judged to be a sufficient amount of time allotted to correct the deficiency in the non-safety VBS ventilation system.
The MCRE heatup analysis demonstrates that the heat sink thermal mass returns to baseline assumptions after a variable time period depending upon the extent of VBS HVAC system degradation and outage time (i.e.,
extent and duration of the loss of VBS cooling) and upon heat sink wall thickness. For a total loss of VBS cooling that lasts for 24 hours, maintaining ambient air temperature below the limit for the MCRE (i.e.,
75&deg;F), the individual required rooms (i.e.,  85&deg;F), and adjacent required room-pairs (i.e.,  85&deg;F) for 4 days is one method of re-establishing the heat sink thermal mass assumed in the safety analysis. Alternatively, analyses or local measurements can evaluate ambient air temperature excursions for impact on meeting the thermal mass assumed in the main control room heatup calculations and Condition C can be exited once the thermal mass of the required heat sinks is determined to be within limits.
The Completion Time for Required Action C.2 is 5 days.
The selection of air temperature is an indication of heat sink temperature and heat sink thermal mass. It is recognized that the thermal mass of the passive heat sinks will not be restored to baseline assumptions after air temperature is restored within limits because the heat sinks take longer to be restored to the initial conditions assumed in the MCRE heatup analysis.
D.1, D.2, and D.3 If the unfiltered inleakage of potentially contaminated air past the MCRE boundary and into the MCRE can result in MCRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of MCRE occupants from hazardous chemicals or smoke, the MCRE boundary is inoperable. Actions must be taken to restore an OPERABLE MCRE boundary within 90 days.
During the period that the MCRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the AP1000 STS                                B 3.7.6-9                                      Rev. 1

VES B 3.7.6 BASES ACTIONS (continued) effect on MCRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that MCRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that MCRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable MCRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions.
Required Action D.3 allows time to restore the MCRE boundary to OPERABLE status provided mitigating actions can ensure that the MCRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3 (Ref. 4) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 5). These compensatory measures may also be used as mitigating actions as required by Required Action D.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 6).
Options for restoring the MCRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the MCRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the MCRE boundary has been restored to OPERABLE status. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of MCRE occupants within analyzed limits while limiting the probability that MCRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the MCRE boundary.
E.1, E.2, and E.3 If one bank of VES air tanks (8 tanks out of 32 total) is inoperable, then the VES is able to supply air to the MCRE for 54 hours (75% of the AP1000 STS                               B 3.7.6-10                                      Rev. 1

VES B 3.7.6 BASES ACTIONS (continued) required 72 hours). If the VES is actuated, the operator must take actions to maintain habitability of the MCRE once the air in the tanks has been exhausted. The VBS supplemental filtration mode or MCRE ancillary fans are both capable of maintaining the habitability of the MCRE after 54 hours.
With one bank of VES air tanks inoperable, action must be taken to restore OPERABLE status within 7 days. In this Condition, the stored amount of compressed air in the remaining OPERABLE VES air tanks must be verified within 2 hours and every 12 hours thereafter to be
                  > 245,680 scf. The 245,680 scf value is 75% of the minimum amount of stored compressed air that must be available in the compressed air storage tanks. The standard volume is determined using the compressed air storage tank room temperature (VAS-TE-080A/B), compressed air storage tanks pressure (VES-PT-001A/B) via the plant control system and chart in the system procedures, as illustrated by Figure B 3.7.6 1, Compressed Air Storage Tanks Minimum Volume  One Bank of VES Air Tanks (8 Tanks) Inoperable. Values above the 245,680 scf line in the figure meet the Required Action criteria. Verification that the minimum volume of compressed air is contained in the OPERABLE compressed air storage tanks ensures a 54 hour air supply will be available if needed.
Additionally, within 24 hours, the VBS ancillary fans are verified to be OPERABLE so that, if needed, can be put into use once the OPERABLE compressed air storage tanks have been exhausted.
The Completion Times associated with these actions and the 7 day Completion Time to restore VES to OPERABLE status are based on engineering judgment, considering the low probability of an accident that would result in a significant radiation release from the reactor core, the low probability of radioactivity release, and that the remaining components and compensatory systems can provide the required capability. The 54 hours of air in the remaining OPERABLE compressed air storage tanks, along with compensatory operator actions, are adequate to protect the main control room envelope habitability. Dose calculations verify that the MCRE dose limits will remain within the requirements of GDC 19 with the compensatory actions taken at 54 hours.
F.1 and F.2 In MODE 1, 2, 3, or 4 if a Required Action and associated Completion Time of Condition A, B, C, D, or E are not met, or the VES is inoperable for reasons other than Condition A, B, C, D, or E, the unit must be AP1000 STS                              B 3.7.6-11                                       Rev. 1

VES B 3.7.6 BASES ACTIONS (continued) placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 3 within 6 hours and in MODE 5 within 36 hours.
G.1 During movement of irradiated fuel assemblies, if a Required Action and associated Completion Time of Condition A, B, C, or E are not met, or the VES is inoperable for reasons other than Condition A, B, C, or E or the VES is inoperable due to an inoperable MCRE boundary, action must be taken immediately to suspend the movement of fuel. This does not preclude the movement of fuel to a safe position.
SURVEILLANCE      SR 3.7.6.1 REQUIREMENTS This SR requires verification every 24 hours that the compressed air storage tanks contain > 327,574 scf of breathable air.
The standard volume is determined using the compressed air storage tank room temperature (VAS-TE-080A/B), compressed air storage tanks pressure (VES PT 001A/B) via the plant control system and chart in the system procedures, as illustrated by Figure B 3.7.6-2, Compressed Air Storage Tanks Minimum Volume. Values above the 327,574 scf line in the figure meet the Surveillance criteria. Verification that the minimum volume of compressed air is contained in the compressed air storage tanks ensures that there will be an adequate supply of breathable air to maintain MCRE habitability for a period of 72 hours. The Frequency of 24 hours is based on the availability of pressure indication in the MCRE.
SR 3.7.6.2 SR 3.7.6.2 verifies that the thermal mass of the required heat sinks is within limit(s) every 24 hours. One method of satisfying SR 3.7.6.2 is maintaining ambient air temperature below the limit for the MCRE (i.e.,  75&deg;F), the individual required rooms (i.e.,  85&deg;F), and adjacent required room-pairs (i.e.,  85&deg;F) for 4 days. Alternatively, analyses or local measurements can satisfy the verification of the heat sink thermal mass assumed in the main control room heatup calculation.
Satisfying the required heat sink room temperature limits (i.e.,  75&deg;F for the MCRE and  85&deg;F for the individual required rooms and the adjacent required room-pairs) for sufficient duration (i.e., 4 days) establishes the AP1000 STS                               B 3.7.6-12                                       Rev. 1

VES B 3.7.6 BASES SURVEILLANCE REQUIREMENTS (continued) equilibrium initial heat sink thermal mass assumed in the main control room heatup calculation.
Passive heat sink air temperatures in required dc Equipment Rooms and required I&C Room pairs (12201/12301, 12203/12302, 12205/12305, and 12207/12304) are verified by temperature elements located in the shared return air ducting (alternatively, local measurement of each room may be utilized). Other required individual rooms (12202, 12204, 12300, 12303, 12313, 12412, and 12501) are verified using indication from the temperature elements in each room.
This is done to verify that the VBS is performing as required to maintain the initial conditions assumed in the safety analyses, and to verify the VES heat sinks provide adequate thermal mass to limit the temperature increase in the MCRE, dc Equipment Rooms, and I&C Rooms from exceeding the allowable limits after VES actuation.
The 24 hour Frequency is acceptable based on the availability of automatic VBS temperature controls, alarms, and indication in the MCRE.
Room air temperatures may also be verified using local measurement.
SR 3.7.6.3 Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing VES once every month provides an adequate check of the system. This monthly VES operation requires operation of one of the two pressure regulating valves Additionally, the main air delivery line has two parallel air delivery flow paths via automatically actuated isolation valves (VES-V005A/B) that are also required to be exercised quarterly. Monthly testing of the three air delivery flow paths on a STAGGERED TEST BASIS will result in at least quarterly exercising of each air delivery valve. The 31 day on a STAGGERED TEST BASIS Frequency is based on the reliability of the equipment and the availability of system redundancy.
SR 3.7.6.4 VES air header isolation valves are required to be verified open at 31 day intervals. This SR is designed to ensure that the pathways for supplying breathable air to the MCRE are available should loss of VBS occur.
These valves should be closed only during required testing or maintenance of downstream components, or to preclude complete AP1000 STS                             B 3.7.6-13                                      Rev. 1

VES B 3.7.6 BASES SURVEILLANCE REQUIREMENTS (continued) depressurization of the system should the VES isolation valves in the air delivery line open inadvertently or begin to leak.
SR 3.7.6.5 Verification that the air quality of the air storage tanks meets the requirements of Appendix C, Table C-1 of ASHRAE Standard 62 (Ref. 1) with a pressure dew point of  40&deg;F at  3400 psig is required every 92 days. If air has not been added to the air storage tanks since the previous verification, verification may be accomplished by confirmation of the acceptability of the previous Surveillance results along with examination of the documented record of air makeup. The purpose of ASHRAE Standard 62 states: This standard specifies minimum ventilation rates and indoor air quality that will be acceptable to human occupants and are intended to minimize the potential for adverse health effects. Verification of the initial air quality (in combination with the other Surveillances) ensures that breathable air is available for 11 MCRE occupants for at least 72 hours. Confirmation of the pressure dew point verifies that water has not formed in the line, eliminating the potential for freezing at the pressure regulating valve during VES operation. In addition, the dry air allows the MCRE to remain below the maximum relative humidity to support the 90&deg;F wet bulb globe temperature (WBGT) required for human factors performance.
SR 3.7.6.6 Verification that the VBS isolation valves and the Sanitary Drainage System (SDS) isolation valves are OPERABLE and will actuate upon demand is required every 24 months to ensure that the MCRE can be isolated upon loss of VBS operation. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves.
SR 3.7.6.7 Verification that each VES pressure relief isolation valve within the MCRE pressure boundary is OPERABLE is required in accordance with the Inservice Testing Program. The valves should actuate on an actual or simulated signal to the correct position. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves. The SR is used in combination with SR 3.7.6.8 to ensure that adequate vent area is available to mitigate MCRE overpressurization.
AP1000 STS                             B 3.7.6-14                                         Rev. 1

VES B 3.7.6 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.7.6.8 Verification that the VES pressure relief damper is OPERABLE is required at 24 month intervals. The SR is used in combination with SR 3.7.6.7 to ensure that adequate vent area is available to mitigate MCRE overpressurization.
SR 3.7.6.9 This SR verifies the OPERABILITY of the MCRE boundary by testing for unfiltered air inleakage past the MCRE boundary and into the MCRE.
The details of the testing are specified in the Main Control Room Envelope Habitability Program.
The MCRE is considered habitable when the radiological dose to MCRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem Total Effective Dose Equivalent (TEDE) and the MCRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the MCRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition D must be entered.
SR 3.7.6.10 This SR verifies that the required VES testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VES filter tests are in accordance with the UFSAR Appendix 1A position for Regulatory Guide 1.52 (Ref. 7). The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and physical properties of the activated charcoal. Specific test frequencies and additional information are discussed in detail in the VFTP.
SR 3.7.6.11 Verification that the MCR load shed function actuates on an actual or simulated signal from each PMS division is required every 24 months to confirm that the non-safety Stage 1 and Stage 2 MCR heat loads can be de-energized by the VES actuation signal within the required time. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage to minimize the potential for adversely affecting MCR operations.
AP1000 STS                            B 3.7.6-15                                    Rev. 1

VES B 3.7.6 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.7.6.12 Verification that the main VES air delivery isolation valves actuate on an actual or simulated signal to the correct position is required every 24 months to confirm that the VES operates as assumed in the safety analysis. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage to minimize adversely affecting MCR operations.
REFERENCES      1. ASHRAE Standard 62-1989, Ventilation for Acceptable Indoor Air Quality.
: 2. FSAR Section 6.4, Main Control Room Habitability Systems.
: 3. FSAR Section 9.5.1, Fire Protection System.
: 4. Regulatory Guide 1.196, Control Room Habitability at Light-Water Nuclear Power Reactors.
: 5. NEI 99-03, Control Room Habitability Assessment, June 2001.
: 6. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 30, 2004, NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability. (ADAMS Accession No. ML040300694).
: 7. Regulatory Guide 1.52, Design, Inspection, and Testing Criteria for Air filtration and Adsorption Units of Post-Accident Engineered-Safety-Feature Atmosphere Cleanup Systems in Light-Water-Cooled Nuclear Power Plants, Revision 3.
AP1000 STS                             B 3.7.6-16                                     Rev. 1

VES B 3.7.6 Figure B 3.7.6-1 (page 1 of 1)
Compressed Air Storage Tanks Minimum Volume  One Bank of VES Air Tanks (8 Tanks)
Inoperable AP1000 STS                            B 3.7.6-17                                Rev. 1

VES B 3.7.6 Figure B 3.7.6-2 (page 1 of 1)
Compressed Air Storage Tanks Minimum Volume AP1000 STS                   B 3.7.6-18                Rev. 1

Startup Feedwater Isolation and Control Valves B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Startup Feedwater Isolation and Control Valves BASES BACKGROUND          The startup feedwater system supplies feedwater to the steam generators during plant startup, hot standby and cooldown, and in the event of main feedwater unavailability.
The startup feedwater system serves no safety related function and has no safety related design basis, except to isolate feedwater in the event of a Feedline Break (FLB), a Steam Line Break (SLB), a Steam Generator Tube Rupture (SGTR), or other secondary side event.
The startup feedwater system consists of a flow path to each of the steam generators. Each flow path consists of two series startup feedwater valves to provide feedwater control for low feedwater demand conditions.
Feedwater can be supplied to the startup feedwater line via either the main or startup feedwater pumps. The feedwater is delivered directly to the steam generator (SG) independent of the main feedwater line. Each startup feedwater line contains one control valve and one isolation valve (Ref. 1).
APPLICABLE          The basis for the requirement to isolate the startup feedwater system is SAFETY              established by the analysis for large SLB inside containment. It is also ANALYSES            based on the analyses for a large FLB and a steam generator tube rupture.
Failure to isolate the startup feedwater system following a SLB or FLB can lead to additional mass and energy being delivered to the steam generators, resulting in excessive cooldown and additional mass and energy release in containment. Failure to isolate the startup feedwater system following an SGTR may result in overfilling the steam generator.
The following ESFAS signals automatically close the startup feedwater control and isolation valves and trip the startup feedwater pumps:
* RCS Cold Leg Temperature (Tcold)  Low 2 (LCO 3.3.8 Function 11)
* SG Narrow Range Water Level  High (LCO 3.3.8 Function 22) coincident with reactor trip (P-4) (LCO 3.3.12)
AP1000 STS                                 B 3.7.7-1                                      Rev. 1

Startup Feedwater Isolation and Control Valves B 3.7.7 BASES APPLICABLE SAFETY ANALYSES (continued)
* SG Narrow Range Water Level  High 2 (LCO 3.3.8 Function 23)
In addition, the startup feedwater isolation valves are containment isolation valves and support the assumptions related to minimizing the loss of inventory and establishing the containment boundary during major accidents. Therefore, the safety analysis of any event requiring isolation of containment is applicable to these valves.
The startup feedwater isolation and control valves are components which actuate to mitigate a Design Basis Accident, and as such meet Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO             This LCO ensures that the startup feedwater isolation and control valves will actuate on command, following a SLB, FLB or SGTR, and isolate startup feedwater flow to the steam generators.
The startup feedwater isolation and control valves are considered OPERABLE when they automatically close on an isolation actuation signal, and their isolation times are within the required limits.
APPLICABILITY   The startup feedwater isolation and control valves must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and the steam generators. In MODES 1, 2, 3, and 4, where a DBA could cause a release of radioactive material to containment, the startup feedwater isolation and control valves are required to be OPERABLE in order to limit the amount of mass and energy that could be added to containment in the event of an SLB or FLB and to prevent steam generator overfill in the event of an SGTR.
In MODES 5 and 6, the energy in the steam generators is low, and isolation of the startup feedwater system is not required.
ACTIONS         The ACTIONS are modified by a Note allowing flow paths to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the flow paths can be rapidly isolated.
AP1000 STS                              B 3.7.7-2                                     Rev. 1

Startup Feedwater Isolation and Control Valves B 3.7.7 BASES ACTIONS (continued)
The second Note allows separate Condition entry for each flow path.
This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable flow path.
A.1 and A.2 With only one isolation or control valve OPERABLE in one or more flow paths, there is no redundant capability to isolate the flow paths. In this case, both an isolation and a control valve in each flow path must be restored to OPERABLE status with 72 hours, or the flow path must be isolated. A Completion Time of 72 hours is acceptable since, with one valve in a flow path inoperable, there is a second valve available in the flow path to isolate the line.
If the inoperable valve in the flow path cannot be restored to OPERABLE status, then the flow path must be isolated within a Completion Time of 72 hours. The method of isolation must include the use of one isolation barrier that cannot be adversely affected by a single active failure.
For flow paths isolated in accordance with Required Action A.1, the affected flow paths must be verified to be isolated on a periodic basis.
This is necessary to ensure that flow paths required to be isolated following an accident will be in the isolation position should an event occur. Required Action A.2 does not require any testing or device manipulation. Rather, it involves verification that the isolation devices are in the correct position. The periodic Completion Time of once per 7 days is appropriate considering that the devices are operated under administrative controls, valve status indication is provided in the main control room and the probability of valve misalignment is low.
B.1 With both the isolation and control valves inoperable in one flow path, the affected flow path must be restored to OPERABLE status or isolated within a Completion Time of 8 hours. The method of isolation must include the use of one isolation barrier that cannot be adversely affected by a single active failure.
C.1, C.2, and C.3 If the isolation and control valves cannot be restored to OPERABLE status, closed, or isolated within the associated Completion Times, the unit must be placed in a MODE in which the LCO does not apply. To AP1000 STS                               B 3.7.7-3                                       Rev. 1

Startup Feedwater Isolation and Control Valves B 3.7.7 BASES ACTIONS (continued) achieve this status, the plant must be placed in MODE 3 within 6 hours, in MODE 4 with RCS cooling provided by the normal residual heat removal system within 24 hours, and in MODE 5 within 36 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE       SR 3.7.7.1 REQUIREMENTS This Surveillance requires verification in accordance with the Inservice Testing Program to assure that each startup feedwater isolation and control valve is OPERABLE. The Surveillance Frequency is provided in the Inservice Testing Program.
SR 3.7.7.2 This SR ensures that each startup feedwater isolation valve and startup feedwater control valve will actuate to its isolation position on an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves.
The 24 month Frequency is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operation.
REFERENCES         1. FSAR Section 10.4.9, Startup Feedwater System.
AP1000 STS                               B 3.7.7-4                                        Rev. 1

Main Steam Line Leakage B 3.7.8 B 3.7 PLANT SYSTEMS B 3.7.8 Main Steam Line Leakage BASES BACKGROUND          A limit on leakage from the main steam line inside containment is required to limit system operation in the presence of excessive leakage. Leakage is limited to an amount which would not compromise safety consistent with the Leak-Before-Break (LBB) analysis discussed in FSAR Chapter 3 (Ref. 1). This leakage limit ensures appropriate action can be taken before the integrity of the lines is impaired.
LBB is an argument which allows elimination of design for dynamic load effects of postulated pipe breaks. The fundamental premise of LBB is that the materials used in nuclear plant piping are strong enough that even a large through wall crack leaking well in excess of rates detectable by present leak detection systems would remain stable, and would not result in a double-ended guillotine break under maximum loading conditions. The benefit of LBB is the elimination of pipe whip restraints, jet impingement effects, subcompartment pressurization, and internal system blowdown loads.
As described in FSAR Section 3.6 (Ref. 1), LBB has been applied to the main steam line pipe runs inside containment. Hence, the potential safety significance of secondary side leaks inside containment requires detection and monitoring of leakage inside containment (FSAR Section 3.6.3.3 of Ref. 1). This LCO protects the main steam lines inside containment against degradation, and helps assure that serious leaks will not develop. The consequences of violating this LCO include the possibility of further degradation of the main steam lines, which may lead to pipe break.
APPLICABLE          The safety significance of plant leakage inside containment varies SAFETY              depending on its source, rate, and duration. Therefore, detection and ANALYSES            monitoring of plant leakage inside containment are necessary. This is accomplished via the instrumentation required by LCO 3.4.9, RCS Leakage Detection Instrumentation, and the Reactor Coolant System (RCS) water inventory balance (SR 3.4.7.1). Subtracting RCS leakage as well as any other identified non-RCS leakage into the containment area from the total plant leakage inside containment provides qualitative information to the operators regarding possible main steam line leakage.
This allows the operators to take corrective action should leakage occur which is detrimental to the safety of the facility and/or the public.
AP1000 STS                                  B 3.7.8-1                                     Rev. 1

Main Steam Line Leakage B 3.7.8 BASES APPLICABLE SAFETY ANALYSES (continued)
Although the main steam line leakage limit is not required by the 10 CFR 50.36(c)(2)(ii) criteria, this specification has been included in Technical Specifications in accordance with NRC direction (Ref. 2).
LCO              Main steam line leakage is defined as leakage inside containment in any portion of the two (2) main steam line pipe walls. Up to 0.5 gpm of leakage is allowable because it is below the leak rate for LBB analyzed cases of a main steam line crack twice as long as a crack leaking at ten (10) times the detectable leak rate under normal operating load conditions. Violation of this LCO could result in continued degradation of the main steam line.
APPLICABILITY    Because of elevated main steam system temperatures and pressures, the potential for main steam line leakage is greatest in MODES 1, 2, 3, and 4.
In MODES 5 and 6, a main steam line leakage limit is not provided because the main steam system pressure is far lower, resulting in lower stresses and a reduced potential for leakage. In addition, the steam generators are not the primary method of RCS heat removal in MODES 5 and 6.
ACTIONS          A.1 and A.2 With main steam line leakage in excess of the LCO limit, the unit must be brought to lower pressure conditions to reduce the severity of the leakage and its potential consequences. The reactor must be placed in MODE 3 with 6 hours and MODE 5 within 36 hours. This action reduces the main steam line pressure and leakage, and also reduces the factors which tend to degrade the main steam lines. The Completion Time of 6 hours to reach MODE 3 from full power without challenging plant systems is reasonable based on operating experience. Similarly, the Completion Time of 36 hours to reach MODE 5 without challenging plant systems is also reasonable based on operating experience. In MODE 5, the pressure stresses acting on the main steam line are much lower, and further deterioration of the main steam line is less likely.
AP1000 STS                             B 3.7.8-2                                       Rev. 1

Main Steam Line Leakage B 3.7.8 BASES SURVEILLANCE SR 3.7.8.1 REQUIREMENTS Verifying that main steam line leakage is within the LCO limit assures the integrity of those lines inside containment is maintained. An early warning of main steam line leakage is provided by the automatic system which monitors the containment sump level. Main steam line leakage would appear as unidentified leakage inside containment via this system, and can only be positively identified by inspection. However, by performance of an RCS water inventory balance (SR 3.4.7.1) and evaluation of the cooling and chilled water systems inside containment, determination of whether the main steam line is a potential source of unidentified leakage inside containment is possible.
REFERENCES   1. FSAR Section 3.6, Protection Against the Dynamic Effects Associated with the Postulated Rupture of Piping.
: 2. NRC letter, Diane T. Jackson to Westinghouse (Nicholas J.
Liparulo), dated September 5, 1996, Staff Update to Draft Safety Evaluation Report (DSER) Open Items (OIs) Regarding the Westinghouse AP600 Advanced Reactor Design, Open Item #365.
AP1000 STS                           B 3.7.8-3                                    Rev. 1

Spent Fuel Pool Makeup Water Sources B 3.7.9 B 3.7 PLANT SYSTEMS B 3.7.9 Spent Fuel Pool Makeup Water Sources BASES BACKGROUND           The spent fuel pool is normally cooled by the non-safety spent fuel pool cooling system. In the event the normal cooling system is unavailable, the spent fuel pool can be cooled by the normal residual heat removal system. Alternatively, the spent fuel pool and the fuel transfer canal contain sufficient water inventory for decay heat removal by boiling. To support extended periods of loss of normal pool cooling, makeup water is required to provide additional cooling by boiling. Both safety and non-safety makeup water sources are available on-site.
Safety related, gravity fed sources of makeup water are provided to the spent fuel pool. These makeup water sources contain sufficient water to maintain spent fuel pool cooling for 72 hours. When irradiated fuel is in the spent fuel pool, the fuel transfer canal, with the gate open, must be available to provide makeup water to the spent fuel pool. When the spent fuel pool decay heat is > 4.0 MWt and  7.0 MWt, the fuel transfer canal and cask washdown pit must be available to provide makeup to the spent fuel pool. When the spent fuel pool decay heat is > 5.0 MWt and 7.0 MWt the fuel transfer canal, the cask washdown pit, and the cask loading pit must be available to provide makeup to the spent fuel pool.
When the spent fuel pool decay heat is > 7.0 MWt and the reactor decay heat is  7.0 MWt, the Passive Containment Cooling Water Storage Tank (PCCWST) must be available to provide makeup water to the spent fuel pool (when the tank is no longer required for containment cooling purposes). Additional on-site makeup water sources are available to provide spent fuel pool cooling between 3 and 7 days.
The PCCWST is isolated by two normally closed valves. The normally closed valves will be opened only to provide emergency makeup to the spent fuel pool. A third downstream valve permits the operator to regulate addition of water to the spent fuel pool as required to maintain the cooling water inventory.
Once decay heat in the spent fuel pool is  4.0 MWt, the spent fuel pool water inventory, as required by LCO 3.7.5, Spent Fuel Pool Water Level, and fuel transfer canal inventory is sufficient, without makeup, to maintain spent fuel pool cooling for 72 hours.
A general description of the spent fuel pool design is given in FSAR Section 9.1.2 (Ref. 1). A description of the Spent Fuel Pool Cooling and Cleanup System is given in FSAR Section 9.1.3 (Ref. 2).
AP1000 STS                                  B 3.7.9-1                                      Rev. 1

Spent Fuel Pool Makeup Water Sources B 3.7.9 BASES APPLICABLE In the event the normal spent fuel pool cooling system is unavailable, the SAFETY     spent fuel cooling is provided by the heat capacity of the spent fuel pool ANALYSES   and spent fuel pool makeup water sources available to the pool. The worst case decay heat load (decay heat > 7.0 MWt) is produced by a full core off-load following a refueling plus fifteen years of spent fuel. The worst case event is a seismic event concurrent with a station blackout where the spent fuel pool cooling suction line to the spent fuel pool is assumed to fail, and the water in the pool and makeup sources are assumed to drain to the bottom elevation of the spent fuel pool suction piping attachment to the spent fuel pool. For this case the spent fuel pool and fuel transfer canal inventory provided by the water over the stored fuel and below the pump suction connection is capable of cooling the spent fuel pool without boiling for 2.0 hours, following a loss of normal spent fuel pool cooling. After boiling starts, makeup water may be required to replace water lost by boiling and is available, without offsite support, via the PCCWST.
The requirements of LCO 3.6.6, Passive Containment Cooling System, are applicable in MODES 1, 2, 3, and 4, and in MODES 5 and 6 with reactor decay heat > 7.0 MWt. LCO 3.6.6 requires availability of the containment cooling water tank for containment heat removal. With reactor decay heat < 7.0 MWt, containment air cooling is adequate for 72 hours without support from the PCCWST, which can then provide a makeup water source for the spent fuel pool.
None of the FSAR Chapter 15 Design Basis Accident analyses assume availability of the PCCWST, the cask washdown pit, or the cask loading pit for spent fuel pool makeup. A loss of spent fuel pool cooling is not within the scope of events to be evaluated against Criteria 2 and 3 as described in the Commissions final policy statement on TS improvements (Ref. 3). Therefore, spent fuel pool makeup water sources required by this Specification satisfy none of the Criteria of 10 CFR 50.36(c)(2)(ii).
However, when the spent fuel pool decay heat load is > 4.0 MWt, the fuel transfer canal, the cask washdown pit, and the cask loading pit makeup water sources may be needed to maintain adequate cooling in the event normal pool cooling is lost for 72 hours assuming no operator manual intervention (Ref. 1). Therefore, this LCO is included for defense in depth consistent with the NRC guidance in Reference 4.
LCO        The spent fuel pool makeup water sources are required to contain the following amounts of water to be considered OPERABLE:
* Fuel transfer canal with the gate open in communication with the spent fuel pool (which will establish water level as required by LCO 3.7.5, Spent Fuel Pool Water Level).
AP1000 STS                        B 3.7.9-2                                       Rev. 1

Spent Fuel Pool Makeup Water Sources B 3.7.9 BASES LCO (continued)
* Cask washdown pit water level must be  13.75 ft and capable of being manually aligned.
* Cask loading pit water level must be  43.9 ft with the gate open in communication with the spent fuel pool.
* PCCWST is required to contain  756,700 gallons of water.
An OPERABLE flow path from the required makeup source assures spent fuel pool cooling for 72 hours. Several additional makeup sources are available, including the ground level passive containment cooling ancillary water storage tank (PCCAWST). These makeup sources assure spent fuel pool cooling for 7 days.
Note 1 specifies that the cask washdown pit is required to be OPERABLE when the spent fuel pool decay heat is > 4.0 MWt and  7.0 MWt.
Note 2 specifies that the cask loading pit is required to be OPERABLE when the spent fuel pool decay heat is > 5.0 MWt and  7.0 MWt.
Note 3 specifies that the PCCWST is required to be OPERABLE when the spent fuel pool decay heat is > 7.0 MWt, which is normal following a full core off load. The larger makeup source is necessary for the higher decay heat load. In MODES 5 and 6, with reactor decay heat > 7.0 MWt, the PCCWST is reserved for containment cooling in accordance with LCO 3.6.6, Passive Containment Cooling System (PCS). Thus, fuel movement from the reactor to the spent fuel pool must be suspended until reactor decay heat is  7.0 MWt if the fuel movement will increase the spent fuel pool decay heat to > 7.0 MWt.
Note 4 specifies that the fuel transfer canal is required to be OPERABLE when irradiated fuel is in the spent fuel pool.
The spent fuel pool decay heat and reactor decay heat specified in the first three Notes are normally determined by calculation.
When a portion of the fuel is returned to the reactor vessel in preparation for startup, the spent fuel pool decay heat is reduced to  5.0 MWt and makeup from the fuel transfer canal and cask washdown pit is sufficient to maintain spent fuel pool water cooling for 72 hours.
AP1000 STS                              B 3.7.9-3                                      Rev. 1

Spent Fuel Pool Makeup Water Sources B 3.7.9 BASES APPLICABILITY This LCO applies during storage of irradiated fuel in the spent fuel pool.
Irradiated fuel assemblies generate decay heat and the required makeup sources provide for 3 days of cooling in the event of a station blackout with seismic event, which results in the spent fuel pool water inventory at the bottom of the pump suction connection to the pool.
ACTIONS       LCO 3.0.3 is applicable while in MODES 1, 2, 3, and 4. The ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable, since spent fuel pool cooling requirements are independent of reactor operations. Entering LCO 3.0.3 while in MODE 1, 2, 3, or 4 would require the unit to be shut down unnecessarily.
A.1 If the fuel transfer canal, cask washdown pit (with spent fuel pool decay heat > 4.0 and  7.0 MWt), the cask loading pit (with spent fuel pool decay heat > 5.0 MWt and  7.0 MWt) or the PCCWST (with spent fuel pool decay heat > 7.0 MWt) is inoperable, Action must be initiated immediately to restore the makeup source or its associated flow path to OPERABLE status.
Additionally, in order to provide the maximum cooling capability, the spent fuel pool should be filled to its maximum level. Non-safety related makeup sources can be used to fill the pool. This action is not specified in the specification, since the benefit of adding approximately 6 inches of water to the pool is less than a 5% improvement in cooling capability.
SURVEILLANCE  SR 3.7.9.1 REQUIREMENTS This SR verifies that the three flow paths from the PCCWST to the containment vessel are isolated and secured to prevent inadvertent opening and loss of required tank volume. The verification is required to be performed prior to declaring the PCCWST OPERABLE for spent fuel pool usage.
The 7 day Frequency is appropriate because the valves in the passive containment cooling system are controlled by plant procedures.
SR 3.7.9.2 This SR verifies sufficient PCCWST volume is available in the event of a loss of spent fuel cooling prior to declaring the tank OPERABLE for spent fuel pool usage.
AP1000 STS                            B 3.7.9-4                                     Rev. 1

Spent Fuel Pool Makeup Water Sources B 3.7.9 BASES SURVEILLANCE REQUIREMENTS (continued)
The 7 day Frequency is appropriate because the volume in the PCCWST is normally stable and water level changes are controlled by plant procedures.
SR 3.7.9.3 This SR verifies sufficient cask washdown pit water volume is available in the event of a loss of spent fuel cooling. The 13.75 ft level specified provides makeup water for stored fuel with decay heat (normally determined by calculation) > 4.0 and  7.0 MWt. The cask washdown pit is no longer required when the decay heat level requires that the PCCWST is OPERABLE for spent fuel pool usage.
The 31 day Frequency is appropriate because the cask washdown pit has only one drain line which is isolated by series manual valves which are only operated in accordance with plant procedures, thus providing assurance that inadvertent level reduction is not likely.
SR 3.7.9.4 This SR verifies sufficient cask loading pit water volume is available and connected to the spent fuel pool such that no action is required in the fuel handling area, in the event of a loss of spent fuel cooling. The 43.9 foot level specified provides makeup water for stored fuel with decay heat (normally determined by calculation) > 5.0 and  7.0 MWt. The cask loading pit is no longer required when the decay heat level requires that the PCCWST is OPERABLE for spent fuel pool usage.
The 31 day Frequency is appropriate because the cask loading pit has only one drain line, which is isolated by series manual valves, which are operated only in accordance with plant procedures. This provides assurance that inadvertent level reduction is not likely.
SR 3.7.9.5 This SR verifies sufficient fuel transfer canal water volume is available and connected to the spent fuel pool such that no action is required in the fuel handling area, in the event of a loss of spent fuel cooling.
The 31 day Frequency is appropriate because the fuel transfer canal has only one drain line isolated by a locked-closed manual valve and is isolated from the refueling cavity by a gate valve and blind flange.
Connection to the fuel transfer canal is operated only in accordance with AP1000 STS                             B 3.7.9-5                                       Rev. 1

Spent Fuel Pool Makeup Water Sources B 3.7.9 BASES SURVEILLANCE REQUIREMENTS (continued) plant procedures. This provides assurance that inadvertent level reduction is not likely.
SR 3.7.9.6 This SR requires verification of the OPERABILITY of the manual makeup water source isolation valves in accordance with the requirements and Frequency specified in the Inservice Testing Program. Manual valves PCS-PL-V009, PCS PL-V045, PCS-PL-V051, isolate the makeup flow path from the PCCWST. Manual valves SFS-PL-V042, SFS-PL-V045, SFS-PL-V049, SFS-PL-V066, and SFS-PL-V068 isolate the makeup flow path from the cask washdown pit.
REFERENCES      1. FSAR Section 9.1.2, Spent Fuel Storage.
: 2. FSAR Section 9.1.3, Spent Fuel Pool Cooling System.
: 3. Nuclear Regulatory Commission Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors, July 16, 1993.
: 4. NRC letter, William C. Huffman to Westinghouse Electric Corporation, Summary of Telephone Conference with Westinghouse to Discuss Proposed Design Changes to the AP600 Main Control Room Habitability System, dated September 11, 1997.
AP1000 STS                             B 3.7.9-6                                  Rev. 1

SG Isolation Valves B 3.7.10 B 3.7 PLANT SYSTEMS B 3.7.10 Steam Generator (SG) Isolation Valves BASES BACKGROUND         The steam generator (SG) isolation valves consist of the
* power operated relief valves (PORVs) (SGS-PL-V233A & B),
* PORV block valves (SGS-PL-V027A & B), and
* blowdown isolation valves (SGS-PL-V074A & B and SGS-PL-V075A & B).
The PORV flow paths must be isolated following a Steam Generator Tube Rupture (SGTR) event to minimize radiological releases. The blowdown flow path must be isolated following Loss of Feedwater and Feedwater Line Break (FLB) events to retain the SG water inventory for Reactor Coolant System (RCS) heat removal.
A PORV is installed in a 6 inch branch line off of the main steam line piping from each SG, to provide for controlled removal of reactor decay heat during normal RCS cooldown when the main steam isolation valves (MSIVs) are closed or the turbine bypass system is not available. A normally-open block valve is provided in each PORV line to provide backup isolation capability. Both the PORV and the block valve receive a Protection and Safety Monitoring System (PMS) isolation signal on steam line pressure below the Steam Line Pressure  Low 2 setpoint (LCO 3.3.8 Function 24) in the associated SG. The SG PORV block valves are also containment isolation valves.
The blowdown line from each SG is provided with two in-series isolation valves, both located outside, but close to, containment. The two blowdown valves for each SG receive a PMS isolation signal on SG Narrow Range Water Level  Low 2 (LCO 3.3.8 Function 20) in the associated SG. In addition, all four blowdown valves receive a PMS isolation signal on a Passive Residual Heat Removal (PRHR) actuation signal. The first blowdown isolation valve outside of containment for each SG is also a containment isolation valve; these CIVs (SGS PL-V074A &
B) also receive a PMS isolation signal on a containment isolation actuation signal.
The SG PORVs and the SG blowdown isolation valves fail closed on loss of control or actuation power. The SG PORV block valves fail as-is on AP1000 STS                               B 3.7.10-1                                      Rev. 1

SG Isolation Valves B 3.7.10 BASES BACKGROUND (continued) loss of control or actuation power. The SG isolation valves may also be actuated manually.
Descriptions of the PORVs and SG blowdown isolation are found in FSAR Section 10.3.2.2.3 and FSAR Section 10.4.8 (Refs. 1 and 2).
APPLICABLE      The PORV flow paths must be isolated following an SGTR to minimize SAFETY          radiological releases from the ruptured SG into the atmosphere. The ANALYSES        PORV flow path is assumed to open due to high secondary side pressure, during the SGTR. Dose analyses take credit for subsequent isolation of the PORV flow path by the PORV or block valve, both of which receive a PMS isolation signal to close on Steam Line Pressure  Low 2.
The blowdown flow path on each SG must be isolated following Loss of Feedwater and FLB events to retain SG water inventory for use in RCS heat removal via the SGs. RCS heat removal for these events is, primarily, provided by the PRHR heat exchanger (HX); however, SG heat removal is also assumed. The SG blowdown isolation valves receive a PMS isolation signal on SG Narrow Range Water Level  Low 2 and on PRHR actuation. The loss of feedwater and FLB event analyses take credit for SG heat removal using the water inventory retained after blowdown isolation. If the blowdown line were not isolated, much of the inventory would drain from the SG rather than cool the RCS.
In addition, the PORV block valves and SG blowdown valves (closest to each containment penetration) are containment isolation valves and support the assumptions related to minimizing the loss of inventory and establishing the containment boundary during major accidents. Therefore, the safety analysis of any event requiring isolation of containment is applicable to the PORV block valves and SG blowdown valves.
The SG isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO             This LCO requires the SG PORV, SG PORV block valve, and SG blowdown isolation valves on each SG to be OPERABLE. These isolation valves are considered OPERABLE when the valves are capable of closing on a PMS isolation signal.
This LCO provides assurance that each SG PORV and SG PORV block valve will perform its design safety function to mitigate the consequences of an SGTR event that could result in offsite exposures.
AP1000 STS                             B 3.7.10-2                                      Rev. 1

SG Isolation Valves B 3.7.10 BASES LCO (continued)
Additionally, this LCO provides assurance that each SG blowdown isolation valve will perform its design safety function to mitigate the consequences of Loss of Feedwater and FLB events by retaining SG water inventory for RCS heat removal.
APPLICABILITY   The SG PORVs, PORV block valves, and blowdown isolation valves must be OPERABLE in MODES 1, 2, 3, and 4, where a DBA could cause a release of radioactive material to containment. The Applicability is modified by a Note indicating that PORV OPERABILITY is not required in MODE 4 with the RCS cooling being provided by the Normal Residual Heat Removal System (RNS).
In MODE 4 with the RCS cooling being provided by the RNS and in MODES 5 and 6, the SGs are not needed for RCS cooling and the potential for SGTR, or Loss of Feedwater and FLB events is minimized due to the reduced mass and energy in the RCS and SGs.
In MODE 4 with an RCS temperature < 350&deg;F and MODES 5 and 6, the RCS pressure and temperature are reduced and an SGTR is not credible.
However, the Applicability conservatively requires OPERABILITY in MODE 4 with RCS temperature < 350&deg;F for PORVs until the RCS is being cooled by RNS.
ACTIONS         The ACTIONS are modified by a Note allowing the SG blowdown flow paths to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room.
In this way, the flow path can be rapidly isolated when a need for blowdown isolation is indicated.
The second Note allows separate Condition entry for each SG PORV and blowdown flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SG PORV and blowdown flow path.
A.1 and A.2 With one valve in one or more SG PORV flow paths (i.e., a SG PORV or SG PORV block valve) inoperable, action must be taken to isolate the flow path with a closed and deactivated valve. The valve must be deactivated to assure that the flow path will not be opened by a high AP1000 STS                             B 3.7.10-3                                       Rev. 1

SG Isolation Valves B 3.7.10 BASES ACTIONS (continued) pressure signal during the course of an SGTR event. This action places the flow path in a condition which assures the safety function is performed. A Completion Time of 72 hours is based on the availability of one OPERABLE PORV flow path isolation valve that is fully capable of performing the required isolation function.
To ensure the PORV flow path remains isolated, periodic verification is required. This is necessary to ensure that the assumptions in the safety analysis remain valid. This Required Action does not require any testing or valve manipulation. Rather, it involves verification that the valve is in the correct position and deactivated. The 31 day Completion Time is reasonable, considering the fact that the valves are operated under administrative controls and the probability of their misalignment is low.
Required Action A.2 is modified by two Notes. Note 1 applies to valves and blind flanges located in high radiation areas, and allows these devices to be verified closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.
B.1 and B.2 With one valve in one or more blowdown flow paths inoperable, action must be taken to isolate the flow path with a closed valve. This action places the flow path in a condition which assures the safety function is performed. A Completion Time of 72 hours to isolate the flow path is based on the availability of one OPERABLE blowdown flow path isolation valve which is fully capable of performing the required isolation function.
Since the blowdown isolation valve is not deactivated, periodic verification is required to assure that the flow path remains isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of status indications available in the control room, and other administrative controls, to ensure that the valve remains in the closed position.
AP1000 STS                                B 3.7.10-4                                        Rev. 1

SG Isolation Valves B 3.7.10 BASES ACTIONS (continued)
C.1 With both valves in one or more SG PORV flow paths inoperable, action must be taken to isolate the flow path with a closed and deactivated valve. The valve must be deactivated to assure that the flow path will not be opened by a high pressure signal during the course of an SGTR event.
This action places the flow path in a condition that assures the safety function is performed. The 8 hour Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the SG PORV flow path isolation valves. The incremental conditional core damage probability with this Completion Time is more than an order of magnitude less than the value indicated to have a small impact on plant risk in Reference 3.
In the event the affected flow path is isolated in accordance with Required Action C.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.2, which remains in effect.
D.1 With two valves in one or more SG blowdown flow paths inoperable, action must be taken to isolate the flow path with a closed valve. This action places the flow path in a condition that assures the safety function is performed. The 8 hour Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the SG blowdown flow path isolation valves. The incremental conditional core damage probability with this Completion Time is more than an order of magnitude less than the value indicated to have a small impact on plant risk in Reference 3.
In the event the affected flow path is isolated in accordance with Required Action D.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action B.2, which remains in effect.
E.1, E.2, and E.3 If the SG PORV flow path or blowdown flow path isolation valves cannot be restored to OPERABLE status or are not closed within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 3 within 6 hours, in MODE 4 with the RCS cooling provided by the RNS within 24 hours, and in MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to AP1000 STS                              B 3.7.10-5                                      Rev. 1

SG Isolation Valves B 3.7.10 BASES ACTIONS (continued) reach the required unit conditions in an orderly manner and without challenging unit systems. Required Action E.3 to be in MODE 5 is modified by a Note stating that it is not applicable to inoperable PORV(s).
PORV Applicability is exited on completion of Required Action E.2.
SURVEILLANCE        SR 3.7.10.1 REQUIREMENTS The function of the SG PORV isolation valves (PORV block valves (SGS-PL-V027A & B), and PORVs (SGS-PL-V233A & B)) and blowdown isolation valves (SGS-PL-V074A & B and SGS-PL-V075A & B) is to isolate the SGs in the event of SGTR, Loss of Feedwater or FLB.
Stroking the valves closed demonstrates their capability to perform the isolation function. The Frequency for this SR is in accordance with the Inservice Testing Program.
SR 3.7.10.2 Verifying that the isolation time of each SG PORV block valve and SG blowdown isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analysis.
The isolation times are specified in FSAR Section 6.2.3 (Ref. 4) and the Frequency of this SR is in accordance with the Inservice Testing Program.
SR 3.7.10.3 This Surveillance verifies that each SG PORV, SG PORV block valve, and SG blowdown isolation valve actuates to the isolation position on an actual or simulated actuation signal. The actual or simulated signal is processed through the component interface module to verify the continuity between the output of the component interface module and the valves.
The Frequency of 24 months is based on the need to perform this Surveillance during periods in which the plant is shutdown for refueling to prevent any upsets of plant operation.
AP1000 STS                                B 3.7.10-6                                       Rev. 1

SG Isolation Valves B 3.7.10 BASES REFERENCES 1. FSAR Section 10.3.2.2.3, Power-Operated Atmospheric Relief Valves.
: 2. FSAR Section 10.4.8, Steam Generator Blowdown System.
: 3. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk Informed Decisionmaking: Technical Specifications, August 1998.
: 4. FSAR Section 6.2.3, Containment Isolation System.
AP1000 STS                  B 3.7.10-7                                     Rev. 1

Spent Fuel Pool Boron Concentration B 3.7.11 B 3.7 PLANT SYSTEMS B 3.7.11 Spent Fuel Pool Boron Concentration BASES BACKGROUND           The water in the spent fuel pool normally contains soluble boron, which would result in large subcriticality margins under actual operating conditions. For storage of fuel in the spent fuel racks, the design basis for preventing criticality outside the reactor is that there is a 95% probability at a 95% confidence level, without soluble boron, that the effective multiplication factor (keff) of the fuel assembly array will be less than 0.997, including uncertainties and tolerances. The NRC guidelines specify a keff limit of < 1.0 for normal storage in the absence of soluble boron. Therefore, the design is based on the use of unborated water, which maintains a subcritical condition (Ref. 1). The double contingency principle discussed in ANSI N-16.1-1975 and the April 1978 NRC letter (Ref. 2) allows credit for soluble boron under other abnormal or accident conditions, since only a single independent accident need be considered at one time. For example, the only accident scenario that has a potential for more than negligible positive reactivity effect is an inadvertent mislocating of a new fuel assembly. This accident has the potential for exceeding the limiting reactivity, should there be a concurrent and independent accident condition resulting in the loss of all soluble poison.
To mitigate these postulated criticality related accidents, boron is dissolved in the pool water. Safe operation with unborated water and no movement of assemblies may, therefore, be achieved by controlling the location of each assembly in accordance with LCO 3.7.12, Spent Fuel Pool Storage. Prior to movement of an assembly, it is necessary to perform SR 3.7.12.1.
APPLICABLE           Although credit for the soluble boron normally present in the spent fuel SAFETY               pool water is permitted under abnormal or accident conditions, most ANALYSES             abnormal or accident conditions will not result in exceeding the limiting reactivity even in the absence of soluble boron. The effects on reactivity of credible abnormal and accident conditions due to temperature increase, dropped assembly, and mislocating/misloading of a fuel assembly have been analyzed. The reactivity effects of bulk spent fuel pool temperature increase (> 140&deg;F) and steaming from the pool water surface or dropped assembly are assessed as none or negligible. The spent fuel pool keff storage limit of 0.95 is maintained during mislocating/misloading of a fuel assembly events by a minimum boron concentration of greater than or equal to 800 ppm established by criticality analysis (Ref. 3). Compliance with the LCO minimum boron AP1000 STS                                   B 3.7.11-1                                        Rev. 1

Spent Fuel Pool Boron Concentration B 3.7.11 BASES APPLICABLE SAFETY ANALYSES (continued) concentration limit of 2300 ppm provides sufficient margin to ensure that the credited concentration is available.
The concentration of dissolved boron in the spent fuel pool satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO             The spent fuel pool boron concentration is required to be  2300 ppm.
The specified concentration of dissolved boron in the spent fuel pool preserves the assumptions used in the analyses of the potential critical accident scenarios as described in References 1 and 3. This concentration of dissolved boron is the minimum required concentration for spent fuel assembly storage and movement within the spent fuel pool.
APPLICABILITY   This LCO applies whenever fuel assemblies are stored in the spent fuel pool.
ACTIONS         LCO 3.0.3 is applicable while in MODE 1, 2, 3, or 4. Since spent fuel pool cooling requirements apply in all MODES when fuel is stored in the spent fuel pool, the ACTIONS have been modified by the Note stating that LCO 3.0.3 is not applicable. Entering LCO 3.0.3 while in MODE 1, 2, 3, or 4 would require a unit shutdown unnecessarily.
A.1 and A.2 When the concentration of boron in the spent fuel pool is less than required, immediate action must be taken to preclude the occurrence of an accident or to mitigate the consequences of an accident in progress.
This is most efficiently achieved by immediately suspending the movement of fuel assemblies. The concentration of boron is restored simultaneously with suspending movement of fuel assemblies.
SURVEILLANCE    SR 3.7.11.1 REQUIREMENTS This SR verifies that the concentration of boron in the spent fuel pool is within the required limit. As long as this SR is met, the analyzed accidents are fully addressed. The 7 day Frequency is appropriate because no major replenishment of pool water is expected to take place over such a short period of time.
AP1000 STS                            B 3.7.11-2                                      Rev. 1

Spent Fuel Pool Boron Concentration B 3.7.11 BASES REFERENCES 1. FSAR Sections 9.1.2, Spent Fuel Storage and 15.7.4, Fuel Handling Accident.
: 2. Double contingency principle of ANSI N16.1-1975, as specified in the April 14, 1978, NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).
: 3. APP-GW-GLR-029, AP1000 Spent Fuel Storage Racks Criticality Analysis, Westinghouse Electric Company LLC (Westinghouse Proprietary).
AP1000 STS                    B 3.7.11-3                                      Rev. 1

Spent Fuel Pool Storage B 3.7.12 B 3.7 PLANT SYSTEMS B 3.7.12 Spent Fuel Pool Storage BASES BACKGROUND           The high density spent fuel storage racks are divided into two separate and distinct regions and include locations for storage of defective fuel as shown in Figure 4.3-1. Region 1, with a maximum of 243 storage locations and the Defective Fuel Cells, with 5 storage locations are designed to accommodate new fuel assemblies with a maximum enrichment of 4.95 weight percent U-235, or spent fuel assemblies regardless of the combination of initial enrichment and burnup. Region 2, with a maximum of 641 storage locations, is designed to accommodate spent fuel assemblies in all locations which comply with the combination of initial enrichment and burnup specified in LCO Figure 3.7.12-1, Minimum Fuel Assembly Burnup Versus Initial Enrichment for Region 2 Spent Fuel Cells. To allow for burnup uncertainty, which the Region 2 loading curve of LCO Figure 3.7.12-1 does not include, the fuel assembly burnup from the reactor records shall be conservatively reduced.
The water in the spent fuel pool normally contains soluble boron, which would result in large subcriticality margins under actual operating conditions. For storage of fuel in the spent fuel racks, the design basis for preventing criticality outside the reactor is that there is a 95% probability at a 95% confidence level, without soluble boron, that the effective multiplication faction (keff) of the fuel assembly array will be less than 0.997, including uncertainties and tolerances. The NRC guidelines specify a keff limit of < 1.0 for normal storage in the absence of soluble boron. Hence, the design is based on the use of unborated water, which maintains a subcritical condition for the allowed loading patterns.
The double contingency principle discussed in ANSI N-16.1-1975 and the April 1978 NRC letter (Ref. 1) allows credit for soluble boron under other abnormal and accident conditions, since only a single independent accident need be considered at one time. For example, the only accident scenario that has the potential for more than negligible positive reactivity effect is an inadvertent mislocating of a new fuel assembly. This accident has the potential for exceeding the limiting reactivity, should there be a concurrent and independent accident condition resulting in the loss of all soluble poison. To mitigate these postulated criticality related accidents, boron is dissolved in the pool water. Safe operation with unborated water and no movement of assemblies may, therefore, be achieved by controlling the combination of initial enrichment and burnup in accordance with the accompanying LCO. Prior to movement of an assembly, it is necessary to perform SR 3.7.12.1.
AP1000 STS                                   B 3.7.12-1                                        Rev. 1

Spent Fuel Pool Storage B 3.7.12 BASES APPLICABLE    The fuel handling accident can only take place during or as a result of the SAFETY        movement of a fuel assembly (Refs. 2 and 3). For the occurrence of this ANALYSES      accident, the presence of soluble boron in the spent fuel pool (controlled by LCO 3.7.11, Fuel Pool Boron Concentration) prevents criticality. By closely controlling the movement of each assembly and by checking the location of each assembly after movement, the time period for potential accidents may be limited to a small fraction of the total operating time.
During the remaining time period with no potential for accidents, the operation may be under the auspices of the accompanying LCO.
The configuration of fuel assemblies in the spent fuel pool satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO           The restrictions on the placement of fuel assemblies within Region 2 of the spent fuel pool in the accompanying LCO, ensure the keff of the spent fuel pool will always remain < 0.997, assuming the pool to be flooded with unborated water and  0.95, with a boron concentration of greater than or equal to 800 ppm.
Region 2 permits storage of spent fuel assemblies in any cell location provided the assembly meets the combination of initial enrichment and burnup shown in LCO Figure 3.7.12-1, Minimum Fuel Assembly Burnup Versus Initial Enrichment for Region 2 Spent Fuel Cells. The Acceptable Region of the Figure is to the left and above the curve.
APPLICABILITY This LCO applies whenever any fuel assembly is stored in Region 2 of the spent fuel pool.
ACTIONS       LCO 3.0.3 is applicable while in MODE 1, 2, 3, or 4. Since spent fuel pool storage requirements apply in all MODES when fuel is stored in Region 2, the ACTIONS have been modified by a Note stating the LCO 3.0.3 is not applicable. Spent fuel pool storage requirements are independent of reactor operations. Entering LCO 3.0.3 while in MODE 1, 2, 3, or 4 would require a unit shutdown unnecessarily.
A.1 The LCO is not met if spent fuel assemblies stored in Region 2 spent fuel assembly storage locations do not meet the applicable initial enrichment and burnup limits in accordance with Figure 3.7.12-1.
AP1000 STS                          B 3.7.12-2                                       Rev. 1

Spent Fuel Pool Storage B 3.7.12 BASES ACTIONS (continued)
When the LCO is not met, action must be initiated immediately to make the necessary fuel assembly movement(s) in Region 2 to bring the storage configuration into compliance with Figure 3.7.12-1 by moving the affected fuel assemblies to Region 1 or the Defective Fuel Cells.
SURVEILLANCE      SR 3.7.12.1 REQUIREMENTS This SR verifies by administrative means that the initial enrichment and burnup of the fuel assembly is in accordance with Figure 3.7.12-1. Fuel assemblies stored in Region 2 that do not meet the Figure 3.7.12-1 enrichment and burnup limits shall be stored in Region 1 or Defective Fuel Cells.
REFERENCES        1. Double contingency principle ANSI N16.1-1975, as specified in the April 14, 1978, NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).
: 2. APP-GW-GLR-029, AP1000 Spent Fuel Storage Racks Criticality Analysis, Westinghouse Electric Company LLC (Westinghouse Proprietary).
: 3. FSAR Sections 9.1.2, Spent Fuel Storage and 15.7.4, Fuel Handling Accident.
AP1000 STS                             B 3.7.12-3                                      Rev. 1

SFS Containment Isolation Valves B 3.7.13 B 3.7 PLANT SYSTEMS B 3.7.13 Spent Fuel Pool Cooling System (SFS) Containment Isolation Valves BASES BACKGROUND           The safety related SFS containment isolation valves are used to isolate the SFS from the refueling cavity in the event of a leak in the non-safety related SFS.
The SFS containment isolation valves are on the SFS supply and return lines that penetrate the containment barrier, which can be aligned to and from the refueling cavity and In-Containment Refueling Water Storage Tank (IRWST). The SFS supply line is isolated by one motor-operated valve located outside containment (SFS-PL-V038) and one check valve located inside containment (SFS-PL-V037). The SFS return line is isolated by two motor-operated isolation valves, one located inside containment (SFS-PL-V034) and one located outside containment (SFS-PL-V035). The two SFS containment isolation valves on each of the two penetration flow paths are required to meet the single failure criterion.
Each motor-operated isolation valve may be actuated manually from the main control room.
The SFS containment isolation valves close automatically as required by LCO 3.3.14, ESFAS IRWST and Spent Fuel Pool Level Instrumentation.
APPLICABLE           In the event of a leak in the non-safety related SFS in MODE 6 with SAFETY               refueling cavity and spent fuel pool volumes in communication, a loss of ANALYSES             refueling cavity water inventory may occur. Automatic actuation to close the SFS containment isolation valves on a Spent Fuel Pool Level  Low 2 signal with refueling cavity and spent fuel pool volumes in communication terminates draining of the refueling cavity before reducing the combined IRWST and refueling cavity water inventory below the minimum volume required to provide adequate decay heat removal in MODE 6.
In MODE 6 with refueling cavity and spent fuel pool volumes in communication, the spent fuel pool level is the same as the refueling cavity, and Refueling Cavity and SFS Isolation on Spent Fuel Pool Level Low 2 also terminates draining of the spent fuel pool. Therefore, each SFS containment isolation valve is required to be OPERABLE in MODE 6 with refueling cavity and spent fuel pool volumes in communication.
The SFS containment isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AP1000 STS                                 B 3.7.13-1                                      Rev. 1

SFS Containment Isolation Valves B 3.7.13 BASES LCO           The requirement that the SFS containment isolation valves be OPERABLE assures that there will be redundant means available to terminate draining of the refueling cavity and spent fuel pool in the event that a leak in the non-safety related SFS occurs in MODE 6 with refueling cavity and spent fuel pool volumes in communication.
APPLICABILITY The SFS containment isolation valves must be OPERABLE in MODE 6 with refueling cavity and spent fuel pool volumes in communication.
LCO 3.6.3, Containment Isolation Valves, requires OPERABILITY of the SFS containment isolation valves in MODES 1, 2, 3, and 4. Surveillance Requirements of LCO 3.5.7, In containment Refueling Water Storage Tank (IRWST) - Shutdown, MODE 5, and LCO 3.5.8, IRWST -
Shutdown, MODE 6, require the SFS containment isolation valves to be closed, except under administrative controls, in MODE 5 and in MODE 6 with refueling cavity and spent fuel pool volumes not in communication.
ACTIONS       The ACTIONS are modified by two Notes. Note 1 allows penetration flow path(s) to be unisolated intermittently under administrative controls.
These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the penetration flow path can be rapidly isolated when a need for penetration flow path isolation is indicated. Note 2 allows separate Condition entry for each SFS penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SFS penetration flow path.
A.1 and A.2 With one or more penetration flow paths with one or more SFS containment isolation valves inoperable, the affected penetration flow path must be isolated within 24 hours. When the affected penetration flow path is isolated, it is performing its required safety function.
Additionally, to assure that the penetration flow path remains closed, the penetration flow path shall be isolated by the use of one of the specified means (Required Action A.2.1) or the penetration flow path shall be verified to be isolated (Required Action A.2.2). A means of isolating the affected penetration flow path includes at least one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured within 7 days. If one of the AP1000 STS                          B 3.7.13-2                                        Rev. 1

SFS Containment Isolation Valves B 3.7.13 BASES ACTIONS (continued)
Required Action A.2.1 specified isolation means is not used, the affected penetration flow path shall be verified to be isolated once per 7 days.
B.1 If a Required Action and associated Completion Time of Condition A are not met, the IRWST must be declared inoperable immediately. Declaring the IRWST inoperable allows the supported system Required Actions (i.e., LCO 3.5.8) to dictate the required measures. The IRWST LCO provides appropriate Required Actions for the inoperability of the SFS containment isolation valves. This action is in accordance with LCO 3.0.6, which requires that the applicable Conditions and Required Actions for the IRWST declared inoperable shall be entered in accordance with LCO 3.0.2.
SURVEILLANCE      SR 3.7.13.1 REQUIREMENTS SR 3.7.13.1 requires performance of Surveillances required by SR 3.6.3.4 and SR 3.6.3.5 for the SFS containment isolation valves required OPERABLE. The Frequencies associated with each specified SR are applicable. Therefore, see the corresponding Bases for LCO 3.6.3 for a discussion of each SR.
REFERENCES        None AP1000 STS                              B 3.7.13-3                                      Rev. 1

DC Sources - Operating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 DC Sources - Operating BASES BACKGROUND          The Class 1E DC and UPS System (IDS) provides electrical power for safety related and vital control instrumentation loads, including monitoring equipment and main control room emergency lighting. It also provides power for safe shutdown when all the onsite and offsite AC power sources are lost and cannot be recovered for up to 72 hours. As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the Class 1E DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure.
The Class 1E DC electrical power system also conforms to the requirements of Regulatory Guide 1.6 (Ref. 2) and IEEE-308 (Ref. 3).
The 250 VDC electrical power system consists of four independent safety related Class 1E DC electrical power subsystems (Division A, B, C, and D). Divisions A and D each consist of one battery bank, one battery charger, and the associated control equipment and interconnecting cable.
Divisions B and C each consist of two battery banks, two battery chargers, and the associated control equipment and interconnecting cabling. The first battery bank in each of the four divisions, designated as the 24 hour battery bank, provides power to the loads required for the first 24 hours following an event. The second battery bank in Divisions B and C, designated as the 72 hour battery bank, is used for those loads requiring power for 72 hours following an event.
The loads on the battery banks (including those on the associated inverters) are grouped according to their role in response to a Design Basis Accident (DBA). Loads which are a one time or limited duration load (engineered safety features (ESF) actuation cabinets and reactor trip function) that are required within the first 24 hours following an accident are connected to the 24 hour battery bank. Loads which are continuous or required beyond the first 24 hours following an accident (emergency lighting, post accident monitoring, and Qualified Data Processing System) are connected to the 72 hour battery bank. There are a total of six battery banks. A battery bank (also referred to as the battery) consists of two battery strings connected in series. Each battery string consists of 60 cells connected in series. Divisions A and D each have one 2400 ampere hour battery bank and Divisions B and C each have two 2400 ampere hour battery banks.
Additionally, there is one installed spare battery bank and one installed spare battery charger, which provide backup service in the event that one AP1000 STS                                 B 3.8.1-1                                       Rev. 1

DC Sources - Operating B 3.8.1 BASES BACKGROUND (continued) of the battery banks and/or one of the preferred battery chargers is out of service. The spare battery bank and charger are Class 1E and have the same rating as the primary components. If the spare battery bank with the charger is substituted for one of the preferred battery banks or chargers, then the requirements of independence and redundancy between subsystems are maintained and the division is OPERABLE.
During normal operation, the 250 VDC load is powered from the battery chargers with the batteries floating on the system. In case of loss of normal power to the battery charger, the DC load is automatically powered from the station batteries.
Each battery bank provides power to an inverter, which in turn powers an AC instrumentation and control bus. The AC instrumentation and control bus loads are connected to inverters according to the battery bank type, 24 hour or 72 hour.
The Class 1E DC power distribution system is described in more detail in Bases for LCO 3.8.5, Distribution Systems - Operating, and LCO 3.8.6, Distribution Systems - Shutdown.
Each battery has adequate storage capacity to carry the required load for the required duration as discussed in Reference 4.
Each 250 VDC battery bank, including the spare battery bank, is separately housed in a ventilated room apart from its charger and distribution centers. Each subsystem is located in an area separated physically and electrically from the other subsystems to ensure that a single failure in one subsystem does not cause a failure in a separate subsystem. There is no sharing between separate Class 1E subsystems such as batteries, battery chargers, or distribution panels.
The batteries for each Class 1E electrical power subsystem are based on 125% of required capacity. The battery terminal minimum established float voltage limit is 2.20 V per cell, which corresponds to a total minimum voltage output of 264 V per battery discussed in Reference 4. The criteria for sizing large lead storage batteries are defined in IEEE-485 (Ref. 5).
Each electrical power subsystem has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged. Each battery charger has sufficient capacity to restore the AP1000 STS                               B 3.8.1-2                                      Rev. 1

DC Sources - Operating B 3.8.1 BASES BACKGROUND (continued) battery bank from the design minimum charge to its fully charged state within 24 hours while supplying normal steady state loads (Ref. 4).
The main control room air supply radiation monitor sample pumps are deenergized by the Protection and Safety Monitoring System (PMS) on a Class 1E 24-hour Battery Charger Undervoltage signal (refer to LCO 3.3.13, ESFAS Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization, Bases) to remove non-essential loads from the batteries.
APPLICABLE      The initial conditions of DBA and transient analyses in the FSAR SAFETY          Chapter 6 (Ref. 6) and FSAR Chapter 15, (Ref. 7), assume that ANALYSES        engineered safety features are OPERABLE. The Class 1E DC electrical power system provides 250 volt power for safety related and vital control instrumentation loads including monitoring and main control room emergency lighting during all MODES of operation. It also provides power for safe shutdown when all the onsite and offsite AC power sources are lost.
The OPERABILITY of the Class 1E DC sources is consistent with the initial assumptions of the accident analyses. This includes maintaining three of the four divisions of DC sources OPERABLE during accident conditions in the event of:
: a. An assumed loss of all offsite and onsite AC power sources; and
: b. A worst case single failure.
The Class 1E DC Sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO             Class 1E DC electrical power subsystems are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. Loss of Class 1E DC electrical power from one division does not prevent the minimum safety function from being performed (Ref. 4).
An OPERABLE Class 1E DC electrical power subsystem requires all required batteries and respective chargers to be operating and connected to the associated DC bus(es). The spare battery and/or charger may be used by one subsystem for OPERABILITY.
AP1000 STS                             B 3.8.1-3                                     Rev. 1

DC Sources - Operating B 3.8.1 BASES LCO (continued)
De-energization of each main control room air supply radiation monitor sample pump on a valid PMS signal is also required to be OPERABLE to support the Class 1E 24-hour battery OPERABILITY based on the assumed battery load profile, to maintain room temperature below the equipment qualification limitation, and maintain the assumed heat load for Main Control Room habitability.
APPLICABILITY   The Class 1E DC electrical power sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure safe unit operation and to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.
Class 1E DC electrical power requirements for MODES 5 and 6 and during movement of irradiated fuel assemblies are addressed in the Bases for LCO 3.8.2, DC Sources - Shutdown.
ACTIONS         A.1, A.2, and A.3 Condition A represents one division with one or two battery chargers inoperable (e.g., the voltage limit of SR 3.8.1.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 6 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 24 hours, the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability.
Because of the passive system design and the use of fail-safe components, the remaining Class 1E DC electrical power subsystems AP1000 STS                             B 3.8.1-4                                       Rev. 1

DC Sources - Operating B 3.8.1 BASES ACTIONS (continued) have the capacity to support a safe shutdown and to mitigate most DBAs following a subsequent worst case single failure. The 6 hour Completion Time is reasonable based on engineering judgement balancing the risks of operation without one DC subsystem against the risks of a forced shutdown. Additionally, the Completion Time reflects a reasonable time to assess plant status; attempt to repair or replace, thus avoiding an unnecessary shutdown; and, if necessary, prepare and effect an orderly and safe shutdown.
A discharged battery having terminal voltage of the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within 24 hours, avoiding a premature shutdown with its own attendant risk.
If established battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 6 hours, and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.
If the charger is operating in the current limit mode after 6 hours that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 24 hours (Required Action A.2).
Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it has now been fully recharged. If at the expiration of the initial 24 hour period the battery float current is not less than or equal to 2 amps this indicates there may be additional battery problems and the battery must be declared inoperable.
AP1000 STS                                 B 3.8.1-5                                       Rev. 1

DC Sources - Operating B 3.8.1 BASES ACTIONS (continued)
Required Action A.3 limits the restoration time for the inoperable battery charger to 7 days. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The 7 day Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.
B.1, B.2, and B.3 Condition B represents two divisions with one or more battery chargers inoperable (e.g., the voltage limit of SR 3.8.1.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action B.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 24 hours, the battery will be restored to its fully charged condition (Required Action B.2) from any discharge that might have occurred due to the charger inoperability.
A discharged battery having terminal voltage of the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within 24 hours, avoiding a premature shutdown with its own attendant risk.
A battery charger operating in the current limit mode after 2 hours is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 24 hours (Required Action B.2).
AP1000 STS                                 B 3.8.1-6                                      Rev. 1

DC Sources - Operating B 3.8.1 BASES ACTIONS (continued)
Required Action B.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it has now fully recharged. If at the expiration of the initial 24 hour period the battery float current is not less than or equal to 2 amps this indicates there may be additional battery problems and the battery must be declared inoperable.
Required Action B.3 limits the restoration time for the inoperable battery charger to 7 days. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The 7 day Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.
C.1 Condition C represents one division with one or more batteries inoperable. With one or more batteries inoperable, the DC bus is being supplied by the OPERABLE battery chargers. Any event that results in a loss of the AC bus supporting the battery chargers will also result in loss of DC to that train.
Because of the passive system design and the use of fail-safe components, the remaining Class 1E DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate most DBAs following a subsequent worst case single failure. The 6 hour Completion Time is reasonable based on engineering judgement balancing the risks of operation without one DC subsystem against the risks of a forced shutdown. Additionally, the Completion Time reflects a reasonable time to assess plant status; attempt to repair or replace, thus avoiding an unnecessary shutdown; and, if necessary, prepare and effect an orderly and safe shutdown.
The installed spare battery bank and charger may be used to restore an inoperable Class 1E DC electrical power subsystem; however, all applicable Surveillances must be met by the spare equipment used, prior to declaring the subsystem OPERABLE.
D.1 Condition D represents two divisions with one or more batteries inoperable. With one or more batteries inoperable, the DC bus is being AP1000 STS                               B 3.8.1-7                                        Rev. 1

DC Sources - Operating B 3.8.1 BASES ACTIONS (continued) supplied by the OPERABLE battery charger. Any event that results in a loss of the AC bus supporting the battery charger will also result in loss of DC to that train. The 2 hour limit allows sufficient time to effect restoration of an inoperable battery given that the majority of the conditions that lead to battery inoperability (e.g., loss of battery charger, battery cell voltage less than 2.07 V, etc.) are identified in Specifications 3.8.1, 3.8.2, and 3.8.7 together with additional specific Completion Times.
The installed spare battery bank and charger may be used to restore an inoperable Class 1E DC electrical power subsystem; however, all applicable Surveillances must be met by the spare equipment used, prior to declaring the subsystem OPERABLE.
E.1 If one of the Class 1E DC electrical power subsystems is inoperable, the remaining Class 1E DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate all design basis accidents, based on conservative analysis.
Because of the passive system design and the use of fail-safe components, the remaining Class 1E DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate most DBAs following a subsequent worst case single failure. The 6 hour Completion Time is reasonable based on engineering judgement balancing the risks of operation without one DC subsystem against the risks of a forced shutdown. Additionally, the Completion Time reflects a reasonable time to assess plant status; attempt to repair or replace, thus avoiding an unnecessary shutdown; and, if necessary, prepare and effect an orderly and safe shutdown.
The 6 hour Completion Time is also consistent with the time specified for restoration of one (of four) Protection and Safety Monitoring System (PMS) actuation divisions (LCO 3.3.15, Engineered Safety Feature Actuation System (ESFAS) Actuation Logic - Operating). Depending on the nature of the DC electrical power subsystem inoperability, one supported division of instrumentation could be considered inoperable.
Inoperability of a PMS division is similar to loss of one DC electrical power subsystem. In both cases, actuation of the safety functions associated with one of the four subsystems/divisions may no longer be available.
AP1000 STS                               B 3.8.1-8                                          Rev. 1

DC Sources - Operating B 3.8.1 BASES ACTIONS (continued)
F.1 Condition F represents two subsystems with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is, therefore, imperative that the operators attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected distribution subsystems. The 2 hour limit is consistent with the allowed time for two inoperable DC distribution subsystems.
If two of the required DC electrical power subsystems are inoperable (e.g., inoperable battery, inoperable battery charger(s), or inoperable battery charger and associated inoperable battery), the two remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate all but the very worst case events. Since a subsequent worst case single failure would, however, result in the loss of the third subsystem, leaving only one subsystem with limited capacity to mitigate events, continued power operation should not exceed 2 hours.
The 2 hour Completion Time is based on Regulatory Guide 1.93 (Ref. 8) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.
G.1 and G.2 If the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE      SR 3.8.1.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the battery chargers which support ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the AP1000 STS                                B 3.8.1-9                                      Rev. 1

DC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued) battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to optimally charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the initial voltages assumed in the battery sizing calculations. This voltage maintains the battery plates in a condition that supports maintaining the grid life (expected to be approximately 20 years). The 7 day Frequency is consistent with manufacturer recommendations.
SR 3.8.1.2 This SR verifies the design capacity of the battery chargers. According to Regulatory Guide 1.32 (Ref. 9), the battery charger supply is recommended to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences.
The minimum required amperes and duration ensures that these requirements can be satisfied.
This SR provides two options. One option requires that each battery charger be capable of supplying 150 amps at the minimum established float voltage for 8 hours. The ampere requirements are based on the design minimum charger size of the chargers. The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time period is sufficient for the charger temperature to have stabilized and to have been maintained for 2 hours.
The other option requires that each battery charger be capable of recharging the battery after a service test coincident with supplying the largest combined demands of the various continuous steady state loads (irrespective of the status of the plant during which these demands occur). This level of loading may not normally be available following the battery service test and will need to be supplemented with additional loads. The duration for this test may be longer than the charger sizing criteria since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current. The battery is recharged when the measured charging current is  2 amps.
The Surveillance Frequency is acceptable, given the unit conditions required to perform the test and the other administrative controls existing to ensure adequate charger performance during these 24 month intervals.
AP1000 STS                             B 3.8.1-10                                     Rev. 1

DC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
In addition, this Frequency is intended to be consistent with expected fuel cycle lengths.
SR 3.8.1.3 A battery service test is a special test of battery capability, as found, to satisfy the design requirements (battery duty cycle) of the Class 1E DC electrical power system. The discharge rate and test length corresponds to the design duty cycle requirements as specified in Reference 4.
The Surveillance Frequency of 24 months is consistent with the recommendations of Regulatory Guide 1.32 (Ref. 8) and Regulatory Guide 1.129 (Ref. 10), which state that the battery service test should be performed with intervals between tests not to exceed 24 months. This Surveillance may be performed during any plant condition with the spare battery and charger providing power to the bus.
This SR is modified by a Note. The Note allows the performance of a modified performance discharge test in lieu of a service test.
The modified performance discharge test is a simulated duty cycle consisting of just two rates; the one minute rate published for the battery or the largest current load of the duty cycle, followed by the test rate employed for the performance test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a rated one minute discharge represents a very small portion of the battery capacity, the test rate can be changed to that for the performance test without compromising the results of the performance discharge test. The battery terminal voltage for the modified performance discharge test should remain above the minimum battery terminal voltage specified in the battery service test for the duration of time equal to that of the service test.
A modified discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the batterys ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a service test.
AP1000 STS                            B 3.8.1-11                                         Rev. 1

DC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.8.1.4 Verification that the main control room air supply radiation monitor sample pump de-energize on an actual or simulated signal from the PMS is required every 24 months to assure that the non-essential Class 1E 24-hour battery loads are shed to maintain the assumed battery load profile.
The Surveillance Frequency is acceptable, given the unit conditions required to perform the test and other administrative controls existing to ensure adequate charger performance during these 24 month intervals.
In addition, this Frequency is intended to be consistent with expected fuel cycle lengths.
This Surveillance is modified by a Note stating that it is only required to be met when the main control room air supply radiation monitor sample pump is energized.
REFERENCES      1. 10 CFR 50, Appendix A, GDC 17.
: 2. Regulatory Guide 1.6, Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems, U.S. Nuclear Regulatory Commission, March 10, 1971.
: 3. IEEE-308 1991, IEEE Standard Criteria for Class 1E Power Systems for Nuclear Power Generating Stations, Institute of Electrical and Electronic Engineers.
: 4. FSAR Section 8.3.2, Class 1E DC Power Systems.
: 5. IEEE-485 1997, IEEE Recommended Practice for Sizing Lead-Acid Batteries for Stationary Applications, Institute of Electrical and Electronic Engineers, June 1983.
: 6. FSAR Chapter 6, Engineered Safety Features.
: 7. FSAR Chapter 15, Accident Analyses.
: 8. Regulatory Guide 1.93, Availability of Electric Power Sources, U.S.
Nuclear Regulatory Commission, December 1974.
AP1000 STS                             B 3.8.1-12                                         Rev. 1

DC Sources - Operating B 3.8.1 BASES REFERENCES (continued)
: 9. Regulatory Guide 1.32, Criteria for Safety-Related Electric Power Systems for Nuclear Power Plants, U.S. Nuclear Regulatory Commission, February 1977.
: 10. Regulatory Guide 1.129 Revision 1, Maintenance Testing and Replacement of Large Lead Storage Batteries for Nuclear Power Plants, U.S. Nuclear Regulatory Commission, February 1978.
AP1000 STS                           B 3.8.1-13                                     Rev. 1

DC Sources - Shutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 DC Sources - Shutdown BASES BACKGROUND          A description of the Class 1E DC power sources is provided in the Bases for LCO 3.8.1, DC Sources - Operating.
APPLICABLE          The initial conditions of Design Basis Accident (DBA) and transient SAFETY              analyses in the FSAR Chapter 6 (Ref. 1) and FSAR Chapter 15 (Ref. 2),
ANALYSES            assume engineered safety features are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the emergency auxiliaries and control and switching during all MODES of operation.
The OPERABILITY of the DC subsystem is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems OPERABILITY.
The OPERABILITY of the minimum Class 1E DC power sources during MODES 5 and 6 and during movement of irradiated fuel assemblies ensures that:
: a. The unit can be maintained in the shutdown or refueling condition for extended periods;
: b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
: c. Adequate Class 1E DC power sources are provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.
In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required.
The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and AP1000 STS                                 B 3.8.2-1                                        Rev. 1

DC Sources - Shutdown B 3.8.2 BASES APPLICABLE SAFETY ANALYSES (continued) design requirements during shutdown conditions are allowed by the LCO for required systems.
The shutdown Technical Specification requirements are designed to ensure that the unit has the capability to mitigate the consequences of certain postulated accidents. Worst case Design Basis Accidents which are analyzed for operating MODES are generally viewed not to be a significant concern during shutdown MODES due to the lower energies involved. The Technical specifications therefore require a lesser complement of electrical equipment to be available during shutdown than is required during operating MODES. More recent work completed on the potential risks associated with shutdown, however, have found significant risk associated with certain shutdown evolutions. As a result, in addition to the requirements established in the Technical Specifications, the industry has adopted NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, as an Industry initiative to manage shutdown tasks and associated electrical support to maintain risk at an acceptable low level. This may require the availability of additional equipment beyond that required by the shutdown Technical Specifications.
The Class 1E DC Sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              Class 1E DC electrical power subsystems are required to be OPERABLE to support required trains of Class 1E Distribution System divisions required to be OPERABLE by LCO 3.8.6. This ensures the availability of sufficient Class 1E DC power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents, inadvertent reactor vessel draindown).
De-energization of the main control room air supply radiation monitor sample pumps on a valid PMS signal is also required to be OPERABLE to support the Class 1E 24-hour battery OPERABILITY based on the assumed battery load profile, to maintain room temperature below the equipment qualification limitation, and maintain the assumed heat load for Main Control Room habitability.
As described in the previous section, Applicable Safety Analyses, in the event of an accident during shutdown, the Technical Specifications are designed to maintain the plant in such a condition that, even with a single failure, the plant will not be in immediate difficulty.
AP1000 STS                               B 3.8.2-2                                     Rev. 1

DC Sources - Shutdown B 3.8.2 BASES APPLICABILITY The Class 1E DC power sources required to be OPERABLE in MODES 5 and 6 and during movement of irradiated fuel assemblies provide assurance that:
: a. Required features to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core in case of an inadvertent draindown of the reactor vessel;
: b. Required features needed to mitigate a fuel-handling accident are available;
: c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
: d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
The Class 1E DC electrical power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.1, DC Sources - Operating.
ACTIONS       LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
A.1, A.2, and A.3 Condition A represents one division with one or two battery chargers inoperable (e.g., the voltage limit of SR 3.8.1.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 6 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 24 hours, AP1000 STS                           B 3.8.2-3                                       Rev. 1

DC Sources - Shutdown B 3.8.2 BASES ACTIONS (continued) the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability.
A discharged battery having terminal voltage of the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus, there is good assurance of fully recharging the battery within 24 hours, avoiding a premature shutdown with its own attendant risk.
If the charger is operating in the current limit mode after 6 hours that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 24 hours (Required Action A.2).
Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it has now been fully recharged. If at the expiration of the initial 24 hour period the battery float current is not less than or equal to 2 amps this indicates there may be additional battery problems and the battery must be declared inoperable.
Required Action A.3 limits the restoration time for the inoperable battery charger to 72 hours. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The 72 hours Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.
B.1, B.2.1, B.2.2, B.2.3, and B.2.4 With one or more of the required (per LCO 3.8.6, Distribution Systems -
Shutdown) Class 1E DC power subsystems inoperable, the remaining subsystems may be capable of supporting sufficient systems to allow AP1000 STS                                  B 3.8.2-4                                       Rev. 1

DC Sources - Shutdown B 3.8.2 BASES ACTIONS (continued) continuation of irradiated fuel movement and operations with a potential for draining the reactor vessel. By allowing the option to declare required features inoperable with the associated DC power source(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCO ACTIONS. In many instances this option would likely involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend movement of irradiated fuel assemblies, any activities that could potentially result in inadvertent draining of the reactor vessel, and operations involving positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit) to assure continued safe operation. The Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory, provided the required SDM is maintained.
Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystems and to continue this action until restoration is accomplished in order to provide the necessary Class 1E DC electrical power to the unit safety systems.
The installed spare battery bank and charger may be used to restore an inoperable Class 1E DC power subsystem; however, all applicable Surveillances must be met by the spare equipment used, prior to declaring the subsystem OPERABLE.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required Class 1E DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.
SURVEILLANCE        SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires performance of all Surveillances required by SR 3.8.1.1 through SR 3.8.1.4. Therefore, see the corresponding Bases for LCO 3.8.1 for a discussion of each SR.
This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their AP1000 STS                                  B 3.8.2-5                                       Rev. 1

DC Sources - Shutdown B 3.8.2 BASES SURVEILLANCE REQUIREMENTS (continued) capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required.
REFERENCES      1. FSAR Chapter 6, Engineered Safety Features.
: 2. FSAR Chapter 15, Accident Analyses.
AP1000 STS                            B 3.8.2-6                                     Rev. 1

Inverters - Operating B 3.8.3 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Inverters - Operating BASES BACKGROUND            The inverters are the preferred source of power for the Class 1E AC instrument and control buses because of the stability and reliability they achieve. Divisions A and D, each consist of one Class 1E inverter.
Divisions B and C, each consist of two inverters. The function of the inverter is to convert Class 1E DC electrical power to AC electrical power, thus providing an uninterruptible power source for the instrumentation and controls for the Protection and Safety Monitoring System (PMS). The inverters are powered from the Class 1E 250 V battery sources (Ref. 1).
Under normal operation, a Class 1E inverter supplies power to the Class 1E AC instrument and control bus. If the inverter is inoperable or the Class 1E 250 VDC input to the inverter is unavailable, the Class 1E AC instrument and control bus is powered from the backup source associated with the same division via a static transfer switch featuring a make-before-break contact arrangement. In addition, a manual mechanical bypass switch is used to provide a backup power source to the Class 1E AC instrument and control bus when the inverter is removed from service. The backup source is a Class 1E 480-208/120 volt voltage regulating transformer providing a regulated output to the Class 1E AC instrument and control bus through a static transfer switch and a manual bypass switch.
In addition to powering safety loads, the Class 1E AC power sources are used for emergency lighting in the main control room and remote shutdown workstation. When a normal AC power source for emergency lighting is lost, the loads are automatically transferred to a Class 1E AC power source. Specific details on inverters and their operating characteristics are found in FSAR Chapter 8 (Ref. 1).
APPLICABLE            The initial conditions of Design Basis Accident (DBA) and transient SAFETY                analyses in FSAR Chapter 6 (Ref. 2) and FSAR Chapter 15 (Ref. 3),
ANALYSES              assume engineered safety features are OPERABLE. The inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the PMS instrumentation and controls so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Technical Specification AP1000 STS                                    B 3.8.3-1                                      Rev. 1

Inverters - Operating B 3.8.3 BASES APPLICABLE SAFETY ANALYSES (continued)
Sections 3.2 (Power Distribution Limits), 3.4 (Reactor Coolant System),
and 3.6 (Containment Systems).
The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining all Class 1E AC instrument and control buses OPERABLE in at least three of the four electrical power distribution system divisions during accident conditions in the event of:
: a. An assumed loss of all offsite and onsite AC power source; and
: b. A worst case single failure.
Inverters are a part of distribution systems, and as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              The inverters ensure the availability of AC electrical power for the systems instrumentation required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA.
Maintaining the required inverters OPERABLE ensures that the redundancy incorporated into the design of the PMS instrumentation and controls is maintained. The six inverters (Divisions A and D, one each and Divisions B and C, two each; six total) ensure an uninterruptible supply of AC electrical power to the six Class 1E AC instrument and control buses even if all AC power sources are de-energized.
OPERABLE inverters require that the Class 1E AC instrument and control bus be powered by the inverter with output voltage and frequency within tolerances, and the power input to the inverter be from a 250 VDC station battery.
This LCO is modified by a Note that allows one inverter to be disconnected from its associated Class 1E DC bus for  72 hours, if the associated Class 1E AC instrument and control bus is powered from its Class 1E voltage regulating transformer during the period and all other inverters are OPERABLE. This allows an equalizing charge to be placed on one battery bank. If the inverter was not disconnected, the resulting voltage condition might damage the inverter. These provisions minimize the loss of equipment that would occur in the event of a loss of offsite AP1000 STS                              B 3.8.3-2                                      Rev. 1

Inverters - Operating B 3.8.3 BASES LCO (continued) power. The 72 hour time period for the allowance minimizes the time during which a loss of offsite power could result in the loss of equipment energized from the affected Class 1E AC instrument and control bus while taking into consideration the time required to perform an equalizing charge on the battery bank.
The intent of this Note is to limit the number of inverters that may be disconnected. Only the inverter associated with the single battery bank undergoing an equalizing charge may be disconnected. All other inverters must be aligned to their associated batteries.
APPLICABILITY   The inverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
Inverter requirements for MODES 5 and 6 are covered in the Bases for LCO 3.8.4, Inverters Shutdown.
ACTIONS         A.1 With one or two inverters inoperable in one division, the associated Class 1E AC instrument and control bus is automatically energized from its voltage regulating transformer. A manual switch is also provided which can be used if the static transfer switch does not properly function.
For this reason, a Note has been included with Required Action A.1 requiring entry into the applicable Conditions and Required Actions of LCO 3.8.5, Distribution Systems - Operating, for any division with an AC instrument and control bus de-energized. This ensures that each affected Class 1E AC instrument and control bus is re-energized within 6 hours.
Required Action A.1 allows 24 hours to fix each inoperable inverter and return it to service. The 24 hour time limit is based upon engineering AP1000 STS                             B 3.8.3-3                                      Rev. 1

Inverters - Operating B 3.8.3 BASES ACTIONS (continued) judgment, taking into consideration the time required to repair an inverter and the additional risk to which the unit is exposed because of the inverter inoperability. This has to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When a Class 1E AC instrument and control bus is powered from its voltage regulating transformer, it is relying upon interruptible AC electrical power sources (offsite and onsite).
The uninterruptible inverter source to the Class 1E AC instrument and control buses is the preferred source for powering instrumentation trip setpoint devices.
B.1 and B.2 If the inoperable inverter cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to MODE 5 where the probability and consequences of an event are minimized. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR 3.8.3.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required switches and circuit breakers closed and Class 1E AC instrument and control buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the PMS instrumentation connected to the Class 1E AC instrument and control buses. The 7 day Frequency takes into account the effectiveness of the voltage and frequency instruments, the redundant capability of the inverters, and other indications available in the control room that alert the operator to inverter malfunctions.
REFERENCES          1. FSAR Section 8.3.2.1.1.2, Class 1E Uninterruptible Power Supplies.
: 2. FSAR Chapter 6, Engineered Safety Features.
: 3. FSAR Chapter 15, Accident Analyses.
AP1000 STS                                 B 3.8.3-4                                      Rev. 1

Inverters - Shutdown B 3.8.4 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.4 Inverters - Shutdown BASES BACKGROUND            A description of the inverters is provided in the Bases for Specification 3.8.3, Inverters - Operating.
APPLICABLE            The initial conditions of Design Basis Accident (DBA) and transient SAFETY                analyses in FSAR Chapter 6 (Ref. 1) and FSAR Chapter 15 (Ref. 2),
ANALYSES              assume engineered safety features (ESF) are OPERABLE. The inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the Protection and Monitoring System (PMS) instrumentation and controls so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded.
The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems OPERABILITY.
The OPERABILITY of the minimum inverters to each Class 1E AC instrument and control bus during MODES 5 and 6, and during movement of irradiated fuel assemblies, ensures that (Refs. 1 and 2):
: a. The unit can be maintained in the shutdown or refueling condition for extended periods;
: b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
: c. Adequate power is available to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.
In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite AC power is not required. The rationale for this is based on the fact that many DBAs that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6 because the energy contained within the reactor coolant system pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence AP1000 STS                                   B 3.8.4-1                                        Rev. 1

Inverters - Shutdown B 3.8.4 BASES APPLICABLE SAFETY ANALYSES (continued) being significantly reduced or eliminated, and in minimal consequences.
These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.
The shutdown Technical Specification requirements are designed to ensure that the unit has the capability to mitigate the consequences of certain postulated accidents. Worst case DBAs which are analyzed for operating MODES are generally viewed as not being a significant concern during shutdown MODES due to the lower energies involved.
The Technical specifications therefore require a lesser complement of electrical equipment to be available during shutdown than is required during operating MODES. More recent work completed on the potential risks associated with shutdown, however, have found significant risk associated with certain shutdown evolutions. As a result, in addition to the requirements established in the Technical Specifications, the industry has adopted NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, as an Industry initiative to manage shutdown tasks and associated electrical support to maintain risk at an acceptable low level. This may require the availability of additional equipment beyond that required by the shutdown Technical Specifications.
The Class 1E uninterruptible power supply (UPS) inverters are part of the Class 1E AC instrument and control electrical power distribution system and, as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO              The inverters ensure the availability of electrical power for the instrumentation for systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or postulated DBA. The 250 VDC station battery powered inverters provide an uninterruptible supply of AC electrical power to the Class 1E AC instrument and control buses, even if the normal power supply from a standby diesel generator backed non-Class 1E 480 VAC motor control center is deenergized. OPERABILITY of the inverters requires that the Class 1E instrument and control buses be powered by the inverter with output voltage and frequency within tolerances, and the power input to the inverter be from a 250 VDC station battery. This ensures the availability of sufficient inverter power sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents, inadvertent reactor vessel draindown).
AP1000 STS                              B 3.8.4-2                                      Rev. 1

Inverters - Shutdown B 3.8.4 BASES APPLICABILITY The inverters required to be OPERABLE in MODES 5 and 6 and during movement of irradiated fuel assemblies provide assurance that:
: a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core in case of an inadvertent draindown of the reactor vessel;
: b. Systems needed to mitigate a fuel handling accident are available;
: c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
: d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
Class 1E UPS inverter requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.3, Inverters - Operating.
ACTIONS       LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
A.1, A.2.1, A.2.2, A.2.3, and A.2.4 If one or more required (per LCO 3.8.6, Distribution Systems - Shutdown) inverters are inoperable, the remaining OPERABLE inverters may be capable of supporting required features to allow continuation of fuel movement, and operations with a potential for draining the reactor vessel.
By allowance of the option to declare required features inoperable with associated inverter(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCOs Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., suspend movement of irradiated fuel assemblies, any activities that could potentially result in inadvertent draining of the reactor vessel, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6)). Suspending positive reactivity additions that AP1000 STS                            B 3.8.4-3                                        Rev. 1

Inverters - Shutdown B 3.8.4 BASES ACTIONS (continued) could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive moderator temperature coefficient (MTC) must also be evaluated to ensure they do not result in a loss of required SDM.
Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required inverters and to continue this action until restoration is accomplished in order to provide the necessary inverter power to the unit safety systems.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required inverters should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power or powered from a voltage regulating transformer.
SURVEILLANCE       SR 3.8.4.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and Class 1E AC instrument and control buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation connected to the Class 1E AC instrument and control buses. The 7 day Frequency takes into account the redundant capability of the inverters, and indications available in the control room that alert the operator to inverter malfunctions.
REFERENCES         1. FSAR Chapter 6, Engineered Safety Features.
: 2. FSAR Chapter 15, Accident Analyses.
AP1000 STS                                 B 3.8.4-4                                      Rev. 1

Distribution Systems - Operating B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 Distribution Systems - Operating BASES BACKGROUND            The onsite Class 1E DC and uninterruptible power supply (UPS) electrical power distribution system is divided by division into four independent divisions of AC and DC electrical power distribution subsystems (Divisions A, B, C, and D).
The Class 1E AC distribution Divisions A and D each consists of one 208/120 V instrument and control bus (distribution panel). The Class 1E AC distribution Divisions B and C each consists of two 208/120 V instrument and control buses (distribution panels). The AC buses are normally powered from separate inverters which are connected to the respective division Class 1E battery banks through the associated Class 1E 250 VDC buses (switchboards). The backup electrical power source provided for each division of the Class 1E AC instrument and control buses is a Class 1E voltage regulating transformer providing regulated output to the Class 1E AC instrument and control buses through a static transfer switch and a manual bypass switch. Power to the transformer is provided by the non-safety related Main AC Power System. Additional description of this system may be found in the Bases for Specification 3.8.3, Inverters - Operating.
The Class 1E DC distribution Divisions A and D each consists of one 250 VDC bus (switchboard). The Class 1E DC distribution Divisions B and C each consists of two 250 VDC buses (switchboards). The buses for the four Divisions are normally powered from their associated Division battery chargers. The backup electrical power source for each Class 1E DC bus is its associated Class 1E battery bank. Additionally, there is one installed spare Class 1E battery bank and one installed spare Class 1E battery charger, which can provide backup power to a Class 1E DC bus in the event that one of the battery banks or one of the chargers is out of service. Additional description of this system may be found in the Bases for Specification 3.8.1, DC Sources - Operating.
The list of all required distribution Class 1E AC distribution and DC buses and panels is presented in Table B 3.8.5-1 and shown in FSAR Section 8.3.2 (Ref. 1).
APPLICABLE            The initial conditions of Design Basis Accident (DBA) and transient SAFETY                analyses in FSAR Chapter 6 (Ref. 2) and FSAR Chapter 15 (Ref. 3),
ANALYSES              assume engineered safety features (ESFs) are OPERABLE. The AP1000 STS                                    B 3.8.5-1                                     Rev. 1

Distribution Systems - Operating B 3.8.5 BASES APPLICABLE SAFETY ANALYSES (continued)
Class 1E AC instrument and control and DC electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the ESFs so that the fuel, Reactor Coolant System (RCS) and containment design limits are not exceeded.
These limits are discussed in more detail in the Bases for Technical Specifications 3.2 (Power Distribution Limits), 3.4 (Reactor Coolant System), and 3.6 (Containment Systems).
The OPERABILITY of the Class 1E AC instrument and control and DC electrical power distribution systems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining three of the four Divisions of Class 1E AC instrument and control and DC electrical power distribution systems OPERABLE during accident conditions in the event of:
: a. An assumed loss of all offsite and onsite AC power sources; and
: b. A worst case single failure.
The Class 1E AC instrument and control and DC electrical power distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO             The required electrical power distribution subsystems listed in Table B 3.8.5-1 ensure the availability of Class 1E AC instrument and control and DC electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. The Division A, B, C, and D Class 1E AC instrument and control and DC electrical power distribution subsystems are required to be OPERABLE.
Maintaining the Division A, B, C, and D AC instrument and control and DC electrical power distribution subsystems OPERABLE ensures that the redundancy incorporated into the design of the ESFs is not defeated.
Three of the four Class 1E AC instrument and control and DC electrical power distribution subsystems are capable of providing the necessary electrical power to the associated ESF components. Therefore, a single failure within any subsystem or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.
AP1000 STS                            B 3.8.5-2                                         Rev. 1

Distribution Systems - Operating B 3.8.5 BASES LCO (continued)
OPERABLE Class 1E DC electrical power distribution subsystems require the associated buses (switchboards), distribution panels, motor control centers, and electrical circuits to be energized to their proper voltage from either the associated battery bank or charger. The spare battery bank, the spare battery charger, or both may be used by one DC electrical power distribution subsystem for OPERABILITY.
OPERABLE Class 1E AC instrument and control electrical power distribution subsystems require the associated buses (distribution panels) to be energized to their proper voltages and frequencies from the associated inverter or voltage regulating transformer.
APPLICABILITY   The Class 1E AC instrument and control and DC electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
The Class 1E AC instrument and control and DC electrical power distribution subsystem requirements for MODES 5 and 6 are covered in the Bases for Specification 3.8.6, Class 1E Distribution Systems -
Shutdown.
ACTIONS         A.1 With one Class 1E AC instrument and control division inoperable (for Division B or C, either one or both required distribution panels inoperable can cause that division to be inoperable) the remaining Class 1E AC instrument and control divisions have the capacity to support a safe shutdown and to mitigate all DBAs, based on conservative analysis.
Because of the passive system design and the use of fail-safe components, the remaining Class 1E AC instrument and control divisions have the capacity to support a safe shutdown and to mitigate most design basis accidents following a subsequent worst case single failure.
AP1000 STS                             B 3.8.5-3                                       Rev. 1

Distribution Systems - Operating B 3.8.5 BASES ACTIONS (continued)
The 6 hour Completion Time is reasonable based on engineering judgement balancing the risks of operation without one AC instrument and control division against the risks of a forced shutdown. Additionally, the Completion Time reflects a reasonable time to assess plant status; attempt to repair or replace, thus avoiding an unnecessary shutdown; and, if necessary, prepare and effect an orderly and safe shutdown.
This 6 hour limit is shorter than Completion Times allowed for most supported systems which would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 6 hours, is acceptable because of:
: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) while allowing stable operations to continue;
: b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected division; and
: c. The potential for an event in conjunction with a single failure of a redundant component.
The 6 hour Completion Time takes into account the importance to safety of restoring the Class 1E AC instrument and control division to OPERABLE status, the passive design of the ESF systems, the redundant capability afforded by the other OPERABLE Class 1E AC instrument and control divisions, and the low probability of a DBA occurring during this period which requires more than two OPERABLE AC instrument and control divisions.
The 6 hour Completion Time is also consistent with the time specified for restoration of one (of four) Protection and Safety Monitoring System actuation division (LCO 3.3.15, Engineered Safety Feature Actuation System (ESFAS) Actuation Logic - Operating). Depending on the nature of the AC instrument and control inoperability, one supported division of instrumentation could be considered inoperable. Inoperability of a PMS division is similar to loss of one AC instrument and control division. In both cases, actuation of the safety functions associated with one of the four subsystems/divisions may no longer be available.
AP1000 STS                                 B 3.8.5-4                                      Rev. 1

Distribution Systems - Operating B 3.8.5 BASES ACTIONS (continued)
B.1 With one Class 1E DC electrical power distribution subsystem inoperable (for Division B or C, either one or more required buses or distribution panels inoperable can cause that division to be inoperable), the remaining divisions have the capacity to support a safe shutdown and to mitigate all DBAs, based on conservative analysis.
Because of the passive system design and the use of fail-safe components, the remaining divisions have the capacity to support a safe shutdown and to mitigate most design basis accidents following a subsequent worst case single failure. The 6 hour Completion Time is reasonable based on engineering judgement balancing the risks of operation without one division against the risks of a forced shutdown.
Additionally, the completion time reflects a reasonable time to assess plant status; attempt to repair or replace, thus avoiding an unnecessary shutdown; and, if necessary, prepare and effect an orderly and safe shutdown.
The 6 hour Completion Time is also consistent with the time specified for restoration of one (of four) Protection and Safety Monitoring System division (LCO 3.3.15, Engineered Safety Feature Actuation System (ESFAS) Actuation Logic - Operating). Depending on the nature of the DC electrical power distribution subsystem inoperability, one supported division of instrumentation could be considered inoperable. Inoperability of a PMS division is similar to loss of one DC electrical power distribution system division. In both cases, actuation of the safety functions associated with one of the four divisions may no longer be available.
This 6 hour limit is shorter than Completion Times allowed for most supported systems which would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 6 hours, is acceptable because of:
: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) while allowing stable operations to continue;
: b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to AP1000 STS                                  B 3.8.5-5                                     Rev. 1

Distribution Systems - Operating B 3.8.5 BASES ACTIONS (continued) perform the necessary evaluations and actions to restore power to the affected division; and
: c. The potential for an event in conjunction with a single failure of a redundant component.
C.1 With two AC instrument and control divisions inoperable, the remaining OPERABLE divisions are capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition. Overall reliability is reduced, however, since an additional single failure could result in the minimum required ESF functions not being supported. Therefore, one required division of AC instrument and control must be restored to OPERABLE status within 2 hours by powering the division from the associated inverter via inverted DC, inverter using internal AC source, or Class 1E voltage regulating transformer.
Condition C represents two AC instrument and control divisions without power; potentially both the DC source and the associated AC source are nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss of all noninterruptable power. It is, therefore, imperative that the operators attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining divisions and restoring power to one affected division.
This 2 hour time limit is more conservative than Completion Times allowed for the vast majority of components that are without adequate AC instrument and control power. Taking exception to LCO 3.0.2 for components without adequate vital AC power, which would have the Required Action Completion Times shorter than 2 hours if declared inoperable, is acceptable because of:
: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) and not allowing stable operations to continue);
: b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without adequate AC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and AP1000 STS                                B 3.8.5-6                                       Rev. 1

Distribution Systems - Operating B 3.8.5 BASES ACTIONS (continued)
: c. The potential for an event in conjunction with a single failure of a redundant component The 2 hour Completion Time takes into account the importance to safety of restoring one AC instrument and control division to OPERABLE status, the redundant capability afforded by the other OPERABLE divisions, and the low probability of a DBA occurring during this period.
D.1 With two DC electrical power distribution system divisions inoperable, the remaining DC electrical power distribution system divisions are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution system divisions could result in the minimum required ESF functions not being supported.
Therefore, one required DC division must be restored to OPERABLE status within 2 hours by powering the division from the associated battery or charger.
Condition D represents two divisions without adequate DC power; potentially both with the battery significantly degraded and the associated charger nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss of all DC power. It is, therefore, imperative that the operators attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining divisions and restoring power to one affected division.
This 2 hour limit is more conservative than Completion Times allowed for the vast majority of components that would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 2 hours, is acceptable because of:
: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) while allowing stable operations to continue;
: b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to AP1000 STS                                 B 3.8.5-7                                      Rev. 1

Distribution Systems - Operating B 3.8.5 BASES ACTIONS (continued) perform the necessary evaluations and actions for restoring power to the affected divisions; and
: c. The potential for an event in conjunction with a single failure of a redundant component.
The 2 hour Completion Time for restoring one DC electric power distribution system division to OPERABLE status is consistent with Regulatory Guide 1.93 (Ref. 4).
E.1 and E.2 If the inoperable distribution division(s) cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to MODE 5 where the probability and consequences on an event are minimized. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
F.1 With two inoperable divisions that result in a loss of safety function, adequate core cooling, containment OPERABILITY and other vital functions for DBA mitigation would be compromised, and immediate plant shutdown in accordance with LCO 3.0.3 is required.
SURVEILLANCE        SR 3.8.5.1 REQUIREMENTS This Surveillance verifies that the Class 1E AC instrument and control and DC electrical power distribution subsystems are functioning properly, with the required circuit breakers and switches properly aligned. The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The 7 day Frequency takes into account the redundant capability of the Class 1E AC instrument and control and DC electrical power distribution subsystems, and other indications available in the control room that alert the operator to electrical power distribution system malfunctions.
AP1000 STS                                  B 3.8.5-8                                      Rev. 1

Distribution Systems - Operating B 3.8.5 BASES REFERENCES 1. FSAR Section 8.3.2, DC Power Systems.
: 2. FSAR Chapter 6, Engineering Safety Features.
: 3. FSAR Chapter 15, Accident Analyses.
: 4. Regulatory Guide 1.93, Availability of Electric Power Sources, U.S.
Nuclear Regulatory Commission, December 1974.
AP1000 STS                   B 3.8.5-9                                      Rev. 1

Distribution Systems - Operating B 3.8.5 Table B 3.8.5-1 (page 1 of 1)
Class 1E AC and DC Electrical Power Distribution System TYPE               VOLTAGE        DIVISION A    DIVISION B       DIVISION C    DIVISION D DC Buses (switchboards)        250 Vdc       IDSA-DS-1      IDSB-DS-1       IDSC-DS-1     IDSD-DS-1 IDSB-DS-2       IDSC-DS-2 DC Distribution Panels         250 Vdc       IDSA-DD-1      IDSB-DD-1       IDSC-DD-1     IDSD-DD-1 IDSA-DK-1      IDSB-DK-1       IDSC-DK-1     IDSD-DK-1 AC Instrument and Control      120 Vac       IDSA-EA-1      IDSB-EA-1       IDSC-EA-1     IDSD-EA-1 Distribution Panels (Buses)                                 IDSB-EA-3       IDSC-EA-3 AP1000 STS                                       B 3.8.5-10                                      Rev. 1

Distribution Systems - Shutdown B 3.8.6 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.6 Distribution Systems - Shutdown BASES BACKGROUND             A description of the Class 1E AC instrument and control and Class 1E DC electrical power distribution systems (Ref. 1) is provided in the Bases for Specification 3.8.5, Distribution Systems - Operating.
APPLICABLE             The initial conditions of Design Basis Accident (DBA) and transient SAFETY                 analyses in FSAR Chapter 6 (Ref. 2) and FSAR Chapter 15 (Ref. 3),
ANALYSES               assume engineered safety features (ESFs) are OPERABLE. The Class 1E AC instrument and control and DC electrical power sources and associated power distribution systems are designed to provide sufficient capacity, redundancy, and reliability to ensure the availability of necessary power to the ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded.
The OPERABILITY of the minimum Class 1E AC instrument and control and DC electrical power sources and associated power distribution subsystems during MODES 5 and 6, and during movement of irradiated fuel assemblies ensures that:
: a. The unit can be maintained in the shutdown or refueling condition for extended periods;
: b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
: c. Adequate power is provided to mitigate events postulated during shutdown, such as an inadvertent draindown of the vessel or a fuel handling accident.
The Class 1E AC instrument and control and DC electrical power distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                    Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the electrical distribution system necessary to support OPERABILITY of required systems, equipment, and AP1000 STS                                    B 3.8.6-1                                        Rev. 1

Distribution Systems - Shutdown B 3.8.6 BASES LCO (continued) components - all specifically addressed in each LCO and implicitly required via the definition of OPERABILITY.
Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the unit in a safe manner to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents), including single failure. To demonstrate robust design, a single failure is assumed, consistent with the single failure assumptions in TS 3.8.5 and the shutdown evaluation in FSAR Appendix 19E (Ref. 4).
APPLICABILITY   The Class 1E AC instrument and control and DC electrical power distribution subsystems are required to be OPERABLE in MODES 5 and 6 and during movement of irradiated fuel assemblies to provide assurance that:
: a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core in case of an inadvertent draindown of the reactor vessel;
: b. Systems needed to mitigate a fuel handling accident are available;
: c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
: d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition and refueling condition.
The Class 1E AC instrument and control and DC electrical power distribution subsystem requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.5, Distribution Systems - Operating.
ACTIONS         LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily.
AP1000 STS                              B 3.8.6-2                                      Rev. 1

Distribution Systems - Shutdown B 3.8.6 BASES ACTIONS (continued)
A.1, A.2.1, A.2.2, A.2.3, and A.2.4 If one or more required Class 1E DC or Class 1E AC instrument and control electrical power distribution subsystems are inoperable, the remaining OPERABLE divisions may be capable of supporting required features to allow continuation of fuel movement, and operations with a potential for draining the reactor vessel. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions will be implemented in accordance with the affected equipment LCO Required Actions. In many instances this would likely involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend movement of irradiated fuel assemblies, any activities that could potentially result in inadvertent draining of the reactor vessel, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6)). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration.
This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation.
Introduction of temperature changes including temperature increases when operating with a positive moderator temperature coefficient (MTC) must also be evaluated to ensure they do not result in a loss of required SDM.
Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions will minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC instrument and control and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power.
AP1000 STS                                B 3.8.6-3                                        Rev. 1

Distribution Systems - Shutdown B 3.8.6 BASES SURVEILLANCE SR 3.8.6.1 REQUIREMENTS This Surveillance verifies that the Class 1E AC instrument and control and DC electrical power distribution subsystems are functioning properly, with the required circuit breakers and switches properly aligned. The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The 7 day Frequency takes into account the redundant capability of the electrical power distribution subsystems and other indications available in the control room that alert the operator to subsystem malfunctions.
REFERENCES   1. FSAR Section 8.3.2, DC Power Systems.
: 2. FSAR Chapter 6, Engineered Safety Features.
: 3. FSAR Chapter 15, Accident Analyses.
: 4. FSAR Appendix 19E, Shutdown Evaluation.
AP1000 STS                          B 3.8.6-4                                      Rev. 1

Battery Parameters B 3.8.7 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.7 Battery Parameters BASES BACKGROUND           Technical Specification 3.8.7, Battery Parameters, delineates the limits on electrolyte temperature, electrolyte level, float voltage and float current for the DC power source batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.1, DC Sources - Operating, and LCO 3.8.2, DC Sources - Shutdown.
In addition to the limitations of this Technical Specification, Technical Specification 5.5.11, Battery Monitoring and Maintenance Program, requires implementing a licensee controlled program for monitoring various battery parameters, including specific gravity.
APPLICABLE           The initial conditions of Design Basis Accident (DBA) and transient SAFETY               analyses in FSAR Chapter 6 (Ref. 1), and FSAR Chapter 15 (Ref. 2),
ANALYSES             assume engineered safety features are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for safety related and vital control instrumentation loads including monitoring and main control room emergency lighting during all MODES of operation. It also provides power for safe shutdown when all the onsite and offsite AC power sources are lost.
The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining three of the four divisions of DC sources OPERABLE during accident conditions, in the event of:
: a. An assumed loss of all offsite and onsite AC power sources; and
: b. A worst case single failure.
Battery parameters satisfy the Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                  Battery parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA. Battery parameter limits are conservatively established, allowing continued DC electrical system function even with limits not met. Additional preventive maintenance, testing, and monitoring performed in accordance with the licensee controlled program is conducted as specified in Specification 5.5.11.
AP1000 STS                                   B 3.8.7-1                                       Rev. 1

Battery Parameters B 3.8.7 BASES APPLICABILITY The battery parameters are required solely for the support of the associated DC electrical power subsystems. Therefore, battery parameter limits are only required when the DC power source is required to be OPERABLE. Refer to the Applicability discussion in Bases for LCO 3.8.1 and LCO 3.8.2.
ACTIONS       A.1, A.2, and A.3 With one or more cells in one or more batteries in one division with cell float voltage < 2.07 V, the battery cell is degraded. Within 2 hours verification of the OPERABILITY of each battery's required battery charger is completed by monitoring the battery terminal voltage (SR 3.8.1.1) and verification of the overall battery state of charge is completed by monitoring the battery float charge current (SR 3.8.7.1).
These verifications provide assurance that the affected batteries still have sufficient battery capacity to perform their intended function. Therefore, the affected batteries are not required to be considered inoperable solely as a result of having one or more cells with cell float voltage < 2.07 V, and continued operation is permitted for a limited period up to 24 hours.
Since the Required Actions only specify perform, a failure of SR 3.8.1.1 or SR 3.8.7.1 acceptance criteria does not result in this Required Action not met. However, if one of the SRs is failed the appropriate Condition(s), depending on the cause of the failures, is entered. If SR 3.8.7.1 is failed then there is no assurance that there is still sufficient battery capacity to perform the intended function and the battery must be declared inoperable immediately.
B.1 and B.2 Condition of one or more batteries in one division with float current
              > 2 amps indicates that a partial discharge of the battery capacity has occurred for each affected battery. This may be due to a temporary loss of a battery charger or possibly due to one or more battery cells in a low voltage condition reflecting some loss of capacity. Within 2 hours verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage. If the terminal voltage is found to be less than the minimum established float voltage there are two possibilities, the battery charger is inoperable or is operating in the current limit mode. Condition A addresses charger inoperability. If the charger is operating in the current limit mode after 2 hours that is an indication that the battery has been substantially discharged and likely cannot perform its required design functions. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC AP1000 STS                            B 3.8.7-2                                        Rev. 1

Battery Parameters B 3.8.7 BASES ACTIONS (continued) system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 24 hours (Required Action B.2). The battery must therefore be declared inoperable.
If the float voltage is found to be satisfactory but there are one or more battery cells with float voltage less than 2.07 V, the associated OR statement in Condition F is applicable and the battery must be declared inoperable immediately. If float voltage is satisfactory and there are no cells less than 2.07 V there is good assurance that, within 24 hours, the battery will be restored to its fully charged condition (Required Action B.2) from any discharge that might have occurred due to a temporary loss of the battery charger.
A discharged battery with float voltage (the charger setpoint) across its terminals indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within 24 hours, avoiding a premature shutdown with its own attendant risk.
If the condition is due to one or more cells in a low voltage condition but still greater than 2.07 V and float voltage is found to be satisfactory, this is not indication of a substantially discharged battery and 24 hours is a reasonable time prior to declaring the battery inoperable.
Since Required Action B.1 only specifies perform, a failure of SR 3.8.1.1 acceptance criteria does not result in the Required Action not met.
However, if SR 3.8.1.1 is failed, the appropriate Condition(s), depending on the cause of the failure, is entered.
C.1, C.2, and C.3 With one or more batteries in one division with one or more cells with electrolyte level above the top of the plates, but below the minimum established design limits, the affected batteries still retain sufficient capacity to perform their intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of electrolyte level not met. Within 31 days the minimum established design limits for electrolyte level must be re-established.
AP1000 STS                                 B 3.8.7-3                                        Rev. 1

Battery Parameters B 3.8.7 BASES ACTIONS (continued)
With electrolyte level below the top of the plates there is a potential for dryout and plate degradation. Required Actions C.1 and C.2 address this potential (as well as provisions in Specification 5.5.11, Battery Monitoring and Maintenance Program). These actions are modified by a Note that indicates they are only applicable if electrolyte level is below the top of the plates. A Note for Condition C also assures that Required Action C.2, to verify no evidence of electrolyte leakage, is completed whenever the electrolyte level is detected to be below the top of the plates. Within 8 hours, level is required to be restored to above the top of the plates.
The Required Action C.2 requirement to verify that there is no electrolyte leakage by visual inspection and the Specification 5.5.11.b.3 requirement to initiate action to equalize and test battery cells with electrolyte level below the top of the plates are taken from IEEE-450 (Ref. 3). They are performed following the restoration of the electrolyte level to above the top of the plates. Based on the results of the manufacturers recommended testing the batteries may have to be declared inoperable and the affected cells replaced.
D.1 With one or more batteries in one division with pilot cell temperature less than the minimum established design limits, 12 hours is allowed to restore the temperature to within limits. A low electrolyte temperature limits the current and power available. Since the battery is sized with margin, while battery capacity is degraded, sufficient capacity exists to perform the intended function and the affected battery is not required to be considered inoperable solely as a result of the pilot cell temperature not met.
E.1 With one or more batteries in two or more divisions with battery parameters not within limits there is not sufficient assurance that battery capacity has not been affected to the degree that the batteries can still perform their required function, given that redundant batteries are involved. With redundant batteries involved this potential could result in a total loss of function on multiple systems that rely upon the batteries. The longer Completion Times specified for battery parameters on non-redundant batteries not within limits are therefore not appropriate, and the parameters must be restored to within limits in three divisions within 2 hours.
AP1000 STS                                B 3.8.7-4                                         Rev. 1

Battery Parameters B 3.8.7 BASES ACTIONS (continued)
F.1 With one or more batteries with any battery parameter outside the allowances of the Required Actions for Condition A, B, C, D, or E, sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding battery must be declared inoperable.
Additionally, discovering one or more batteries in one division with one or more battery cells with float voltage less than 2.07 V and float current greater than 2 amps indicates that the battery capacity may not be sufficient to perform the intended functions. The battery must therefore be declared inoperable immediately.
SURVEILLANCE       SR 3.8.7.1 REQUIREMENTS Verifying battery float current while on float charge is used to determine the state of charge of the battery. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a charged state.
The float current requirements are based on the float current indicative of a charged battery. Use of float current to determine the state of charge of the battery is consistent with IEEE-450 (Ref. 3). The 7 day Frequency is consistent with IEEE-450 (Ref. 3).
This SR is modified by a Note that states the float current requirement is not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.1.1. When this float voltage is not maintained the Required Actions of LCO 3.8.1 ACTION A are being taken, which provide the necessary and appropriate verifications of the battery condition. Furthermore, the float current limit of 2 amps is established based on the nominal float voltage value and is not directly applicable when this voltage is not maintained.
SR 3.8.7.2 and SR 3.8.7.5 Optimal long term battery performance is obtained by maintaining a float voltage greater than or equal to the minimum established design limits provided by the battery manufacturer, which corresponds to 264.0 V at the battery terminals, or 2.20 Volts per cell. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge, which could eventually render the battery inoperable. Float voltages in this range or less, but greater than 2.07 Volts per cell, are addressed in Specification 5.5.11. SRs 3.8.7.2 and 3.8.7.5 require verification that the AP1000 STS                                B 3.8.7-5                                       Rev. 1

Battery Parameters B 3.8.7 BASES SURVEILLANCE REQUIREMENTS (continued) cell float voltages are equal to or greater than the short term absolute minimum voltage of 2.07 V. The Frequency for cell voltage verification every 31 days for pilot cell and 92 days for each connected cell is consistent with IEEE-450 (Ref. 3).
SR 3.8.7.3 The limit specified for electrolyte level ensures that the plates suffer no physical damage and maintains adequate electron transfer capability.
The Frequency is consistent with IEEE-450 (Ref. 3).
SR 3.8.7.4 This Surveillance verifies that the pilot cell electrolyte temperature is greater than or equal to the minimum established design limit (i.e., 60&deg;F).
Pilot cell electrolyte temperature is maintained above this temperature to assure the battery can provide the required current and voltage to meet the design requirements. Temperatures lower than assumed in battery sizing calculations act to inhibit or reduce battery capacity. The Frequency is consistent with IEEE-450 (Ref. 3).
SR 3.8.7.6 A battery performance discharge test is a test of constant current capacity of a battery, normally done in the as found condition, after having been in service, to detect any change in the capacity determined by the acceptance test. The test is intended to determine overall battery degradation due to age and usage.
Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.7.6; however, only the modified performance discharge test may be used to satisfy the battery service test requirements of SR 3.8.1.3. This Surveillance may be performed during any plant condition with the spare battery and charger providing power to the bus.
A modified discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the batterys ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a service test.
AP1000 STS                               B 3.8.7-6                                       Rev. 1

Battery Parameters B 3.8.7 BASES SURVEILLANCE REQUIREMENTS (continued)
The modified performance discharge test is a test, in the as found condition, of a batterys capacity with the discharge rate(s) modified to encompass every portion of the battery duty cycle. This allows the performance test to be accomplished in the minimum amount of time while still demonstrating the high rate capability of the battery to meet duty cycle requirements. Thus, a modified performance test satisfies both the requirement to perform periodic performance tests as well as the requirement to perform periodic service tests.
The battery terminal voltage for the modified performance discharge test is required to remain above the minimum battery terminal voltage specified in the battery service test for the duration of the service test portion of the test. Initial conditions for the modified performance discharge test are identical to those specified for a service test.
The acceptance criteria for this Surveillance are consistent with IEEE-450 (Ref. 3) and IEEE-485 (Ref. 4). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturers rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.
Furthermore, the battery is sized to meet the assumed duty cycle loads when the battery design capacity reaches this 80% limit.
The Surveillance Frequency for this test is normally 60 months, or 25% of the expected life, whichever is less. If the battery shows degradation, or if the battery has reached 85% of its expected life and capacity is < 100%
of the manufacturers rating, the Surveillance Frequency is reduced to 12 months. However, if the battery shows no degradation but has reached 85% of its expected life, the Surveillance Frequency is only reduced to 24 months for batteries that retain capacity  100% of the manufacturers ratings. Degradation is indicated, according to IEEE-450 (Ref. 3), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is below 90% of the manufacturers rating. These Frequencies are consistent with the recommendations in IEEE-450 (Ref. 3) and Information Notice 2013-05 (Ref. 5).
AP1000 STS                             B 3.8.7-7                                        Rev. 1

Battery Parameters B 3.8.7 BASES REFERENCES 1. FSAR Chapter 6, Engineered Safety Features.
: 2. FSAR Chapter 15, Accident Analyses.
: 3. IEEE-450 1995, IEEE Recommended Practice for Maintenance, Testing, and Replacement of Vented Lead-Acid Batteries for Stationary Applications..
: 4. IEEE-485-1983, June 1983, IEEE Recommended Practice for Sizing Large Lead Storage Batteries for Generating Stations and Substations..
: 5. NRC Information Notice 2013-05, March 19, 2013.
AP1000 STS                    B 3.8.7-8                                    Rev. 1

Boron Concentration B 3.9.1 B 3.9 REFUELING OPERATIONS B 3.9.1 Boron Concentration BASES BACKGROUND         The limit on the boron concentration of the Reactor Coolant System (RCS), the refueling cavity, and the fuel transfer canal during refueling ensures that the reactor remains subcritical during MODE 6. Refueling boron concentration is the soluble boron concentration in the coolant in each of these volumes having direct access to the reactor core during refueling.
The soluble boron concentration offsets the core reactivity and is measured by chemical analysis of a representative sample of the coolant in each of the volumes. The refueling boron concentration limit is specified in the COLR. Plant procedures ensure the specified boron concentration in order to maintain an overall core reactivity of keff  0.95 during fuel handling with control rods and fuel assemblies assumed to be in the most adverse configuration (least negative reactivity) allowed by procedures.
GDC 26 of 10 CFR 50, Appendix A requires that two independent reactivity control systems of different design principles be provided (Ref. 1). One of these systems, the Passive Core Cooling System (PXS),
is capable of holding the core subcritical under safe shutdown conditions as described in FSAR Section 7.4 (Ref. 2).
The reactor is brought to shutdown conditions before beginning operations to open the reactor vessel for refueling. After the RCS is cooled down and depressurized, the vessel head is unbolted and slowly removed. The refueling cavity and the fuel transfer canal are then flooded with borated water from the In-containment Refueling Water Storage Tank (IRWST) by the use of the Spent Fuel Pool Cooling System (SFS).
During refueling, the water volumes in the RCS, the fuel transfer canal and the refueling cavity are contiguous. However, the soluble boron concentration is not necessarily the same in each volume. If additions of boron are required during refueling, the Chemical and Volume Control System (CVS) provides the borated makeup.
The pumping action of the Normal Residual Heat Removal System (RNS) in the RCS, the SFS pumps in the spent fuel pool and refueling cavity, and the natural circulation due to thermal driving heads in the reactor vessel and refueling cavity mix the added concentrated boric acid AP1000 STS                                B 3.9.1-1                                        Rev. 1

Boron Concentration B 3.9.1 BASES BACKGROUND (continued) with the water in the fuel transfer canal. The RNS is in operation during refueling to provide forced circulation in the RCS, while the SFS is in operation to cool and purify the spent fuel pool and refueling cavity. Their operation assists in maintaining the boron concentration in the RCS, the refueling cavity, and fuel transfer canal above the COLR limit.
APPLICABLE      The boron concentration limit, specified in the COLR, is based on the SAFETY          core reactivity at the beginning of each fuel cycle (the end of refueling)
ANALYSES        and includes an uncertainty allowance.
The required boron concentration and the plant refueling procedures that verify the correct fuel loading plan (including full core mapping) ensure that the keff of the core will remain  0.95 during the refueling operation.
Hence, a 5% k/k margin of safety is established during refueling.
The RCS boron concentration satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO             The LCO requires that boron concentration be maintained within limit in the RCS, the refueling cavity and the fuel transfer canal while in MODE 6.
The boron concentration limit specified in the COLR ensures that a core keff  0.95 is maintained during fuel handling operations. Violation of the LCO could lead to an inadvertent criticality during MODE 6.
APPLICABILITY   This LCO is applicable in MODE 6 to ensure that the fuel in the reactor vessel will remain subcritical. The required boron concentration ensures a keff of  0.95. Above MODE 6, LCO 3.1.1, SHUTDOWN MARGIN (SDM), ensures that an adequate amount of negative reactivity is available to shut down the reactor and maintain it subcritical.
The Applicability is modified by a Note. The Note states that the limits on boron concentration are applicable to the fuel transfer canal and the refueling cavity only when those volumes are connected to the RCS.
When the fuel transfer canal and the refueling cavity are isolated from the RCS, no potential path for boron dilution exists from those volumes.
AP1000 STS                              B 3.9.1-2                                       Rev. 1

Boron Concentration B 3.9.1 BASES ACTIONS      A.1 Continuation of positive reactivity additions (including actions to reduce boron concentration) is contingent upon maintaining the plant in compliance with the LCO. If the boron concentration of any coolant volume in the RCS, the refueling cavity, or the fuel transfer canal is less than its limit, all operations involving positive reactivity additions must be suspended immediately.
Suspension of positive reactivity additions shall not preclude completion of actions to establish a safe condition, including moving a component to a safe position.
A.2 In addition to immediately suspending positive reactivity additions, boration to restore the concentration must be initiated immediately.
In determining the required combination of boration flow rate and concentration, no unique design basis accident (DBA) must be satisfied.
The only requirement is to restore the boron concentration to its required value as soon as possible. In order to raise the boron concentration as soon as possible, the operator shall begin boration with the best source available for plant operations.
Once boration is initiated, it must be continued until the boron concentration is restored. The restoration time depends on the amount of boron that must be injected to reach the required concentration.
SURVEILLANCE SR 3.9.1.1 REQUIREMENTS This SR verifies that the coolant boron concentration in the RCS, the refueling cavity and the fuel transfer canal is within the COLR limit. The boron concentration of the coolant in each volume is determined periodically by chemical analysis.
A minimum Frequency of once every 72 hours is a reasonable amount of time between verifications of the boron concentration. The Surveillance interval is based on operating experience, isolation of unborated water sources in accordance with LCO 3.9.2, and the availability of the source range neutron flux monitors required by LCO 3.9.3.
AP1000 STS                            B 3.9.1-3                                       Rev. 1

Boron Concentration B 3.9.1 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.
: 2. FSAR Section 7.4, Systems Required for Safe Shutdown.
AP1000 STS                  B 3.9.1-4                                  Rev. 1

Unborated Water Source Flow Paths B 3.9.2 B 3.9 REFUELING OPERATIONS B 3.9.2 Unborated Water Source Flow Paths BASES BACKGROUND          During MODE 6 operation, all flow paths for reactor makeup water sources containing unborated water which are connected to the Reactor Coolant System (RCS) must be closed to prevent an unplanned dilution of the reactor coolant. One isolation valve in each flow path must be secured in the closed position.
The Chemical and Volume Control System is capable of supplying borated and unborated water to the RCS through various flow paths.
Since a positive reactivity addition, made by reducing the boron concentration, is inappropriate during MODE 6, isolation of all unborated water sources prevents an unplanned boron dilution event.
APPLICABLE          The possibility of an unplanned boron dilution event (Ref. 1) in MODE 6 SAFETY              is precluded by adherence to this LCO which requires that potential ANALYSES            dilution sources be isolated. Closing the required valves during refueling operations prevents the flow of unborated water to the filled portions of the RCS. The valves are used to isolate unborated water sources.
These valves have the potential to indirectly allow dilution of the RCS boron concentration in MODE 6. By isolating unborated water sources, a safety analysis for an uncontrolled boron dilution accident in accordance with the Standard Review Plan (Ref. 2) is not required in MODE 6.
The RCS boron concentration satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                 This LCO requires that one valve in each flow path to the RCS from unborated water sources be secured in the closed position to prevent unplanned boron dilution during MODE 6 and, thus, avoid a reduction in SHUTDOWN MARGIN.
APPLICABILITY       In MODE 6, this LCO is applicable to prevent an unplanned boron dilution event by ensuring isolation of all sources of unborated water to the RCS.
In MODES 1 through 5, the requirements of LCO 3.1.9, Chemical and Volume Control System (CVS) Demineralized Water Isolation (DWI)
Valves and Makeup Line Isolation (MLI) Valves, apply.
AP1000 STS                                B 3.9.2-1                                       Rev. 1

Unborated Water Source Flow Paths B 3.9.2 BASES ACTIONS      The ACTIONS Table has been modified by a Note which allows separate Condition entry for each unborated water source flow path.
Condition A has been modified by a Note to require that Required Action A.2 must be completed whenever Condition A is entered.
A.1 Preventing unplanned dilution of the reactor coolant boron concentration is dependent on maintaining the unborated water isolation valves secured closed. Securing the valves in the closed position verifies that the valves cannot be inadvertently opened. The Completion Time of Immediately requires an operator to initiate actions to close an open valve and secure the isolation valve in the closed position immediately. Once actions are initiated, they must be continued until the valves are secured in the closed position.
A.2 Due to the potential of having diluted the boron concentration of the reactor coolant, SR 3.9.1.1 (verification of boron concentration) must be performed whenever Condition A is entered to verify that the required boron concentration exists. The Completion Time of 4 hours is sufficient to obtain and analyze a reactor coolant sample for boron concentration.
SURVEILLANCE SR 3.9.2.1 REQUIREMENTS These valves are to be secured closed to isolate possible dilution flow paths. The likelihood of a significant reduction in the boron concentration during MODE 6 operations is remote due to the large mass of borated water in the refueling cavity and the fact that all unborated water source flow paths are isolated, precluding a dilution. The boron concentration is checked every 72 hours during MODE 6 under SR 3.9.1.1. This Surveillance demonstrates that the valves are closed. The 31 day Frequency is based on engineering judgment and is considered reasonable in view of other administrative controls that will verify that the valve opening is an unlikely possibility.
REFERENCES   1. FSAR Chapter 15, Accident Analyses.
: 2. NUREG-0800, Standard Review Plan, Section 15.4.6, Inadvertent Decrease in Boron Concentration in the Reactor Coolant System (PWR).
AP1000 STS                           B 3.9.2-2                                      Rev. 1

Nuclear Instrumentation B 3.9.3 B 3.9 REFUELING OPERATIONS B 3.9.3 Nuclear Instrumentation BASES BACKGROUND            The source range neutron flux monitors are used to monitor the core reactivity during refueling operations. The source range neutron flux monitors are part of the Protection and Safety Monitoring System (PMS).
These detectors are located external to the reactor vessel and detect neutrons leaking from the core.
The source range neutron flux monitors are BF3 detectors operating in the proportional region of the gas filled detector characteristic curve. The detectors monitor the neutron flux in counts per second. The instrument range covers six decades of neutron flux (1 cps to 1E6 cps) with a 5% instrument accuracy. The detectors also provide continuous visual and audible indication in the main control room and an audible alarm in the main control room and containment building.
APPLICABLE            Two OPERABLE source range neutron flux monitors are required to SAFETY                provide a signal to alert the operator to unexpected changes in core ANALYSES              reactivity such as those associated with an improperly loaded fuel assembly. During initial fuel loading, or when otherwise required, temporary neutron detectors may be used to provide additional reactivity monitoring (Ref. 1). The potential for an uncontrolled boron dilution accident is eliminated by isolating all unborated water sources as required by LCO 3.9.2 (Ref. 2).
The source range neutron flux monitors satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO                   This LCO requires two source range neutron flux monitors to be OPERABLE to ensure that redundant monitoring capability is available to detect changes in core reactivity. The source range neutron flux monitor OPERABILITY includes only a visual monitoring function (audible alarm is not required for OPERABILITY).
APPLICABILITY         In MODE 6, the source range neutron flux monitors are required to be OPERABLE to determine possible changes in core reactivity. There are no other direct means available to monitor the core reactivity conditions.
In MODES 2, 3, 4, and 5, the source range neutron flux detectors and associated circuitry are also required to be OPERABLE by LCO 3.3.2, AP1000 STS                                   B 3.9.3-1                                       Rev. 1

Nuclear Instrumentation B 3.9.3 BASES APPLICABILITY (continued)
Reactor Trip System (RTS) Source Range Instrumentation, and LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS)
Instrumentation, Function 17, Source Range Neutron Flux Doubling.
ACTIONS            A.1 and A.2 Redundancy has been lost if only one source range neutron flux monitor is OPERABLE. Since these instruments are the only direct means of monitoring core reactivity conditions, positive reactivity additions, and introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that which would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Performance of Required Action A.1 shall not preclude completion of actions to establish a safe condition.
B.1 If no source range neutron flux monitors are OPERABLE, actions to restore a monitor to OPERABLE status shall be initiated immediately.
Once initiated, actions shall be continued until a source range neutron flux monitor is restored to OPERABLE status.
B.2 If no source range neutron flux monitors are OPERABLE, there is no direct means of detecting changes in core reactivity. However, since positive reactivity additions are discontinued, the core reactivity condition is stabilized and no changes are permitted until the source range neutron flux monitors are restored to OPERABLE status. This stable condition is confirmed by performing SR 3.9.1.1 to verify that the required boron concentration exists.
The Completion Time of 12 hours for the initial verification that reactor coolant boron concentration is within limits is sufficient to obtain and analyze a reactor coolant sample for boron concentration. The Frequency of once per 12 hours ensures that unplanned changes in AP1000 STS                                B 3.9.3-2                                       Rev. 1

Nuclear Instrumentation B 3.9.3 BASES ACTIONS (continued) boron concentration would be identified. The 12 hour Frequency is reasonable considering the low probability of a change in core reactivity during this time period.
SURVEILLANCE        SR 3.9.3.1 REQUIREMENTS This SR is the performance of a CHANNEL CHECK, which is the comparison of the indicated parameter values monitored by each of these instruments. It is based on the assumption that the two indication channels should be consistent for the existing core conditions. Changes in core geometry due to fuel loading can result in significant differences between the source range channels, however each channel should be consistent with its local conditions.
The Frequency of 12 hours is consistent with the CHANNEL CHECK Frequency specified for these same instruments in LCO 3.3.2, Reactor Trip System (RTS) Source Range Instrumentation, and LCO 3.3.8, Engineered Safety Feature Actuation System (ESFAS) Instrumentation, Function 17.
SR 3.9.3.2 This SR is the performance of a CHANNEL CALIBRATION every 24 months. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. The CHANNEL CALIBRATION for the source range neutron flux monitors consists of obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturers data. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage. Operating experience has shown these components usually pass the Surveillance when performed at a 24 month Frequency.
REFERENCES          1. FSAR Section 14.2.7.1, Initial Fuel Loading.
: 2. FSAR Chapter 15, Accident Analyses.
AP1000 STS                                 B 3.9.3-3                                       Rev. 1

Refueling Cavity Water Level B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Refueling Cavity Water Level BASES BACKGROUND           The movement of irradiated fuel assemblies within containment requires a minimum water level of 23 ft above the top of the reactor vessel flange.
During refueling, this maintains sufficient water level in containment, refueling cavity, fuel transfer canal, and spent fuel pool to retain iodine fission product activity in the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite doses from the accident to within the values reported in FSAR Chapter 15 (Ref. 3).
APPLICABLE           During movement of irradiated fuel assemblies, the water level in the SAFETY               refueling cavity and the refueling canal is an initial condition design ANALYSES             parameter in the analysis of a fuel-handling accident in containment, as postulated by Regulatory Guide 1.183 (Ref. 1).
The fuel handling accident analysis inside containment is described in Reference 2. This analysis assumes a minimum water level of 23 ft above the top of the reactor vessel flange.
In the case of a single bundle dropped and lying horizontally on top of the spent fuel racks, there may be less than 23 feet of water above the top of the fuel bundle and the surface of the water, indicated by the width of a fuel bundle. This slight reduction in water depth does not adversely affect the margin of conservatism associated with the assumed pool scrubbing factor of 200 for iodine.
Refueling Cavity Water Level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                  A minimum refueling cavity water level of 23 ft above the reactor vessel flange is required to ensure that the radiological consequences of a postulated fuel handling accident inside containment are within the values calculated in Reference 1.
APPLICABILITY        Refueling Cavity Water Level is applicable when moving irradiated fuel assemblies within containment. The LCO minimizes the possibility of radioactive release due to a fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel AP1000 STS                                  B 3.9.4-1                                        Rev. 1

Refueling Cavity Water Level B 3.9.4 BASES APPLICABILITY (continued) assemblies are not being moved in containment, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements for fuel handling accidents in the spent fuel pool are covered by LCO 3.7.5, Spent Fuel Pool Water Level.
ACTIONS            A.1 With a water level of < 23 ft above the top of the reactor vessel flange, all operations involving movement of irradiated fuel assemblies within containment shall be suspended immediately to ensure that a fuel handling accident cannot occur.
The suspension of fuel movement shall not preclude completion of movement to safe position.
SURVEILLANCE       SR 3.9.4 1 REQUIREMENTS Verification of a minimum water level of 23 ft above the top of the reactor vessel flange ensures that the design basis for the analysis of the postulated fuel handling accident during refueling operations is met.
Water at the required level above the top of the reactor vessel flange limits the consequences of damaged fuel rods that are postulated to result from a fuel handling accident inside containment (Ref. 2).
The Frequency of 24 hours is based on engineering judgment and is considered adequate in view of the large volume of water and the normal procedural controls of valve positions which make significant unplanned level changes unlikely.
REFERENCES         1. Regulatory Guide 1.183, Alternate Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors.
: 2. FSAR Section 15.7.4, Fuel Handling Accident.
: 3. FSAR Chapter 15, Accident Analyses.
AP1000 STS                                B 3.9.4-2                                       Rev. 1

Decay Time B 3.9.5 B 3.9 REFUELING OPERATIONS B 3.9.5 Decay Time BASES BACKGROUND         The movement of irradiated fuel assemblies in the reactor pressure vessel requires allowing 48 hours for radioactive decay time before fuel assembly handling can be initiated. During fuel handling, this ensures that sufficient radioactive decay has occurred in the event of a fuel handling accident (Refs. 1 and 2). Sufficient radioactive decay of short-lived fission products would have occurred to limit offsite doses from the accident to within the values reported in FSAR Chapter 15 (Ref. 3).
APPLICABLE         During movement of irradiated fuel assemblies, the radioactivity decay SAFETY             time is an initial condition design parameter in the analysis of a fuel ANALYSES           handling accident inside containment or in the fuel handling area inside the auxiliary building, as postulated by Regulatory Guide 1.183 (Ref. 1).
The fuel handling accident analysis inside containment or in the fuel handling area inside the auxiliary building is described in Reference 2.
This analysis assumes a minimum radioactive decay time of 48 hours.
Radioactive decay time satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO                A minimum radioactive decay time of 48 hours is required to ensure that the radiological consequences of a postulated fuel handling accident inside containment or in the fuel handling area inside the auxiliary building are within the values calculated in Reference 2.
APPLICABILITY      Radioactive decay time is applicable when moving irradiated fuel assemblies in the reactor pressure vessel. The LCO minimizes the possibility of radioactive release due to a fuel handling accident that is beyond the assumptions of the safety analysis. If irradiated fuel assemblies are not being moved, there can be no significant radioactivity release as a result of a postulated fuel handling accident. If irradiated fuel assemblies are being moved outside of the reactor pressure vessel, then they were previously assured of having been subcritical for more than 48 hours before being moved from the reactor pressure vessel. Requirements for fuel handling accidents in the spent fuel pool are also covered by LCO 3.7.5, Spent Fuel Pool Water Level.
AP1000 STS                                B 3.9.5-1                                       Rev. 1

Decay Time B 3.9.5 BASES ACTIONS      A.1 With a decay time of less than 48 hours, all operations involving movement of irradiated fuel assemblies within the reactor pressure vessel shall be suspended immediately to ensure that a fuel handling accident cannot occur.
The suspension of fuel movement shall not preclude completion of movement to safe position.
SURVEILLANCE SR 3.9.5.1 REQUIREMENTS Verification that the reactor has been subcritical for  48 hours prior to movement of irradiated fuel in the reactor pressure vessel ensures that the design basis for the analysis of the postulated fuel handling accident during refueling operations is met. Specifying a radioactive decay time limits the consequences of damaged fuel rods that are postulated to result from a fuel handling accident (Ref. 2).
REFERENCES   1. Regulatory Guide 1.183, Alternate Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors.
: 2. FSAR Section 15.7.4, Fuel Handling Accident.
: 3. FSAR Chapter 15, Accident Analyses.
AP1000 STS                          B 3.9.5-2                                      Rev. 1

NRC FORM 335                                                                        U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER (12-2010)                                                                                                                 (Assigned by NRC, Add Vol., Supp., Rev.,
NRCMD 3.7                                                                                                                 and Addendum Numbers, if any.)
BIBLIOGRAPHIC DATA SHEET (See instructions on the reverse)                                          NUREG-2194 Volume 2, Revision 1
: 2. TITLE AND SUBTITLE                                                                                                         3. DATE REPORT PUBLISHED Standard Technical Specifications, Westinghouse Advanced Passive 1000 (AP1000) Plants,                                        MONTH                   YEAR Volume 2: Bases January                   2024
: 4. FIN OR GRANT NUMBER
: 5. AUTHOR(S)                                                                                                           6. TYPE OF REPORT NRC:                                                               BNL:
C. C. Harbuck         A. P. Russell J. M. Wilson                   P. K. Samanta                                                        Technical T. R. Tjader          C. E. Tilton G. Lentchner                    A. Varuttamaseni.                                  7. PERIOD COVERED (Inclusive Dates)
D. P. Scully          T. G. Sweat
: 8. PERFORMING ORGANIZATION - NAME AND ADDRESS (If NRC, provide Division, Office or Region, U. S. Nuclear Regulatory Commission, and mailing address; if contractor, provide name and mailing address.)
Division of Safety Systems Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555-0001
: 9. SPONSORING ORGANIZATION - NAME AND ADDRESS (If NRC, type "Same as above", if contractor, provide NRC Division, Office or Region, U. S. Nuclear Regulatory Commission, and mailing address.)
Same as above
: 10. SUPPLEMENTARY NOTES When NUREG is revised it will be superseded by next revision.
: 11. ABSTRACT (200 words or less)
NUREG-2194 contains the Standard Technical Specifications (STS) for Westinghouse AP1000 plants.
NUREG-2194, Rev. 0, was based on the generic technical specifications (TS) of Revision 19 of the generic design control document (DCD) of the AP1000 certified design rule (Appendix D to 10 CFR Part 52). The generic TS were derived from Revision 2 of the improved STS for Westinghouse plants, NUREG 1431, issued in 2001. NUREG-2194, Revision 0 included applicable NRC-approved generic changes to NUREG-1431 since Revision 2 (with exceptions), which are contained in NUREG-1431, Revision 5, issued in 2021. NUREG-2194 Revision 0 also included changes to the generic TS incorporated in the plant-specific TS issued with the combined license (COL No. NFP-91) (78 FR 64541) of the lead-plant for the AP1000 certified design, Vogtle Electric Generating Plant (VEGP) Unit 3, as revised on September 9, 2013, by COL Amendment 13 to the VEGP Unit 3 plant-specific TS. Details of changes to the generic TS contained in NUREG-2194 Revision 0 are described in generic TS travelers available at Agencywide Documents Access and Management System (ADAMS) Package Accession No. ML22240A001.
NUREG-2194, Rev. 1, Volume 1, Specifications and Volume 2, Bases, include additional applicable NRC-approved generic changes to NUREG-1431, and changes to maintain consistency with the VEGP Unit 3 plant-specific TS and Bases by incorporating plant specific TS changes through COL Amendment 186, and plant-specific TS Bases changes through Bases Rev. 70. Users may access the STS NUREGs in the PDF format at (http://www.nrc.gov). Users may print or download copies from the NRC Web site.
: 12. KEY WORDS/DESCRIPTORS (List words or phrases that will assist researchers in locating the report.)                            13. AVAILABILITY STATEMENT AP1000                                                                                                                                        unlimited Technical Specifications                                                                                                         14. SECURITY CLASSIFICATION Standard Technical Specifications (STS)                                                                                           (This Page)
AP1000 STS                                                                                                                                 unclassified Safety Limits                                                                                                                     (This Report)
Limiting Condition for Operation                                                                                                           unclassified Surveillance Requirements                                                                                                        15. NUMBER OF PAGES Westinghouse Advanced Passive 1000 Design Features                                                                                                                  16. PRICE NRC FORM 335 (12-2010)

NUREG-2194, Vol. 2          Standard Technical Specifications         January 2024 Revision 1         Westinghouse Advanced Passive 1000 (AP1000) Plants}}