View source for RS-22-048, 2 to Updated Safety Analysis Report, B 2.0 Safety Limits (Sls)

{{Adams
| number = ML22111A225
| issue date = 03/31/2022
| title = 2 to Updated Safety Analysis Report, B 2.0 Safety Limits (Sls)
| author name = 
| author affiliation = Constellation Energy Generation, LLC
| addressee name = 
| addressee affiliation = NRC/NRR
| docket = 05000461
| license number = NPF-062
| contact person = 
| case reference number = RS-22-048
| package number = ML22111A226
| document type = Technical Specifications, Updated Final Safety Analysis Report (UFSAR)
| page count = 844
}}

=Text=
{{#Wiki_filter:Reactor Core SLs B 2.1.1 B 2.0   SAFETY LIMITS (SLs)
B 2.1.1   Reactor Core SLs BASES BACKGROUND         GDC 10 (Ref. 1) requires, and SLs ensure, that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs).
The fuel cladding integrity SL is set such that no fuel damage is calculated to occur if the limit is not violated.
Because fuel damage is not directly observable, a stepback approach is used to establish an SL, such that 99.9% of the fuel rods avoid transition boiling. Meeting the SL can be demonstrated by analysis that confirms no more than 0.1% of the fuel rods in the core are susceptible to transition boiling or by demonstrating that the MCPR is not less than the limit specified in Specification 2.1.1.2. MCPR greater than the specified limit represents a conservative margin relative to the conditions required to maintain fuel cladding integrity.
The fuel cladding is one of the physical barriers that separate the radioactive materials from the environs. The integrity of this cladding barrier is related to its relative freedom from perforations or cracking. Although some corrosion or use related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses, which occur from reactor operation significantly above design conditions.
While fission product migration from cladding perforation is just as measurable as that from use related cracking, the thermally caused cladding perforations signal a threshold beyond which still greater thermal stresses may cause gross, rather than incremental, cladding deterioration. Therefore, the fuel cladding SL is defined with a margin to the conditions that would produce onset of transition boiling (i.e., MCPR = 1.00). These conditions represent a significant departure from the condition intended by design for planned operation. This is accomplished by having a Safety Limit Minimum Critical Power Ratio (SLMCPR) design basis, referred to as SLMCPR95/95, which corresponds to a 95%
probability at a 95% confidence level (the 95/95 MCPR criterion) that transition boiling will not occur.
(continued)
CLINTON                              B 2.0-1                    Revision No. 21-8

Reactor Core SLs B 2.1.1 BASES BACKGROUND        Operation above the boundary of the nucleate boiling regime (continued)     could result in excessive cladding temperature because of the onset of transition boiling and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.
APPLICABLE        The fuel cladding must not sustain damage as a result of SAFETY ANALYSES   normal operation and AOOs. The Technical Specification SL is set generically on a fuel product MCPR correlation basis as the MCPR which corresponds to a 95% probability at a 95%
confidence level that transition boiling will not occur, referred to as SLMCPR95/95.
The Reactor Protection System setpoints (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), in combination with other LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System water level, pressure, and THERMAL POWER level that would result in reaching the MCPR SL.
2.1.1.1   Fuel Cladding Integrity GE critical power correlations are applicable for all critical power calculations at pressures t 700 psia for GNF2 (Ref. 2) and t 600 psia for GNF3 (Ref. 3) and core flows t 10% of rated flow. For operation at low pressures or low flows, another basis is used, as follows:
Since the pressure drop in the bypass region is essentially all elevation head, the core pressure drop at low power and flows will always be > 4.5 psi.
Analyses (Ref. 4) show that with a bundle flow of 28 x 103 lb/hr, bundle pressure drop is nearly independent of bundle power and has a value of 3.5 psi. Thus, the bundle flow with a 4.5 psi driving head will be > 28 x 103 lb/hr. Full scale ATLAS test data taken at pressures from 14.7 psia to 800 psia indicate that the fuel assembly critical power at this flow is approximately 3.35 MWt. With the design peaking factors, this corresponds to a THERMAL POWER
                       > 41.7% RTP. Thus, a THERMAL POWER limit of 21.6% RTP for reactor pressure < 700 psia is conservative.
Additional information on low flow conditions is available in Reference 5.
(continued)
CLINTON                             B 2.0-2                  Revision No. 21-8

Reactor Core SLs B 2.1.1 BASES APPLICABLE      2.1.1.2   MCPR SAFETY ANALYSES (continued)   The fuel cladding integrity SL is set such that no significant fuel damage is calculated to occur if the limit is not violated. Since the parameters that result in fuel damage are not directly observable during reactor operation, the thermal and hydraulic conditions that result in the onset of transition boiling have been used to mark the beginning of the region in which fuel damage could occur.
Although it is recognized that the onset of transition boiling would not result in damage to BWR fuel rods, the critical power at which boiling transition is calculated to occur has been adopted as a convenient limit. The Technical Specification SL value is dependent on the fuel product line and the corresponding MCPR correlation, which is cycle independent. The value is based on the Critical Power Ratio (CPR) data statistics and a 95% probability with 95%
confidence that rods are not susceptible to boiling transition, referred to as MCPR95/95.
The SL is based on GNF2 and/or GNF3 fuel. For cores with a single fuel product line, the SLMCPR95/95 is the MCPR95/95 for the fuel type. For cores loaded with a mix of applicable fuel types, the SLMCPR95/95 is based on the largest (i.e.,
most limiting) of the MCPR values for the fuel product lines that are fresh or once-burnt at the start of the cycle.
2.1.1.3   Reactor Vessel Water Level During MODES 1 and 2, the reactor vessel water level is required to be above the top of the active fuel to provide core cooling capability. With fuel in the reactor vessel during periods when the reactor is shut down, consideration must be given to water level requirements due to the effect of decay heat. If the water level should drop below the top of the active irradiated fuel during this period, the ability to remove decay heat is reduced. This reduction in cooling capability could lead to elevated cladding temperatures and clad perforation in the event that the water level becomes less than two-thirds of the core height.
The reactor vessel water level SL has been established at the top of the active irradiated fuel to provide a point that can be monitored and also to provide adequate margin for effective action.
(continued)
CLINTON                           B 2.0-3                    Revision No. 21-8

Reactor Core SLs B 2.1.1 BASES   (continued)
SAFETY LIMITS       The reactor core SLs are established to protect the integrity of the fuel clad barrier to the release of radioactive materials to the environs. SL 2.1.1.1 and SL 2.1.1.2 ensure that the core operates within the fuel design criteria. SL 2.1.1.3 ensures that the reactor vessel water level is greater than the top of the active irradiated fuel in order to prevent elevated clad temperatures and resultant clad perforation.
APPLICABILITY       SLs 2.1.1.1, 2.1.1.2, and 2.1.1.3 are applicable in all MODES.
SAFETY LIMIT        2.2.1 VIOLATIONS If any SL is violated, the NRC Operations Center must be notified within 1 hour, in accordance with 10 CFR 50.72 (Ref. 6).
2.2.2 Exceeding an SL may cause fuel damage and create a potential for radioactive releases in excess of 10 CFR 100, "Reactor Site Criteria," limits (Ref. 7). Therefore, it is required to insert all insertable control rods and restore compliance with the SL within 2 hours. The 2 hour Completion Time ensures that the operators take prompt remedial action and also ensures that the probability of an accident occurring during this period is minimal. In the event reactor vessel water level is below the top of active irradiated fuel, water level would normally be restored by manually initiating Emergency Core Cooling Systems.
2.2.3 If any SL is violated, the CPS Plant Manager and the CPS Site Vice President shall be notified within 24 hours. The 24 hour period provides time for plant operators and staff to take the appropriate immediate action and assess the condition of the unit before reporting to the senior management.
(continued)
CLINTON                               B 2.0-4                  Revision No. 21-8

Reactor Core SLs B 2.1.1 BASES SAFETY LIMIT      2.2.4 VIOLATIONS (continued)     If any SL is violated, a Licensee Event Report shall be prepared and submitted within 30 days to the NRC in accordance with 10 CFR 50.73 (Ref. 8). A copy of the report shall also be submitted to the CPS Plant Manager and the CPS Site Vice President.
2.2.5 If any SL is violated, restart of the unit shall not commence until authorized by the NRC. This requirement ensures the NRC that all necessary reviews, analyses, and actions are completed before the unit begins its restart to normal operation.
REFERENCES        1. 10 CFR 50, Appendix A, GDC 10.
: 2. NEDC-33292P, Revision 3, GEXL17 Correlation for GNF2 Fuel, April 2009.
: 3. NEDC-33880P, Revision 1, GEXL21 Correlation for GNF3 Fuel, November 2017.
: 4. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, GESTAR-II," (latest approved revision).
: 5. General Electric Services Information Letter (SIL)
No. 516, Supplement 2, January 19, 1996.
: 6. 10 CFR 50.72.
: 7. 10 CFR 100.
: 8. 10 CFR 50.73.
CLINTON                             B 2.0-5                   Revision No. 21-8

RCS Pressure SL B 2.1.2 B 2.0   SAFETY LIMITS (SLs)
B 2.1.2   Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND         The SL on reactor steam dome pressure protects the RCS against overpressurization. In the event of fuel cladding failure, fission products are released into the reactor coolant. The RCS then serves as the primary barrier in preventing the release of fission products into the atmosphere. Establishing an upper limit on reactor steam dome pressure ensures continued RCS integrity. According to 10 CFR 50, Appendix A, GDC 14, "Reactor Coolant Pressure Boundary," and GDC 15, "Reactor Coolant System Design" (Ref. 1), the reactor coolant pressure boundary (RCPB) shall be designed with sufficient margin to ensure that the design conditions are not exceeded during normal operation and anticipated operational occurrences (AOOs).
During normal operation and AOOs, RCS pressure is limited from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code (Ref. 2). To ensure system integrity, all RCS components are hydrostatically tested at 125% of design pressure, in accordance with ASME Code requirements, prior to initial operation when there is no fuel in the core. Any further hydrostatic testing with fuel in the core may be done under LCO 3.10.1, "Inservice Leak and Hydrostatic Testing Operation" (Ref. 3). Following inception of unit operation, RCS components shall be pressure tested in accordance with the requirements of ASME Code, Section XI (Ref. 4).
Overpressurization of the RCS could result in a breach of the RCPB, reducing the number of protective barriers designed to prevent radioactive releases from exceeding the limits specified in 10 CFR 100, "Reactor Site Criteria" (Ref. 5). If this occurred in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere.
APPLICABLE         The RCS safety/relief valves and the Reactor Protection SAFETY ANALYSES    System Reactor Vessel Steam Dome Pressure  High Function have settings established to ensure that the RCS pressure SL will not be exceeded.
(continued)
CLINTON                              B 2.0-6                      Revision No. 0

RCS Pressure SL B 2.1.2 BASES APPLICABLE        The RCS pressure SL has been selected such that it is at a SAFETY ANALYSES   pressure below which it can be shown that the integrity of (continued)     the system is not endangered. The reactor pressure vessel is designed to ASME, Boiler and Pressure Vessel Code, Section III, 1971 Edition, including Addenda through the summer of 1973 (Ref. 6), which permits a maximum pressure transient of 110%, 1375 psig, of design pressure 1250 psig.
The SL of 1325 psig, as measured in the reactor steam dome, is equivalent to 1375 psig at the lowest elevation of the RCS. The RCS is designed to ASME Code, Section III, 1974 Edition, including addenda through the summer of 1974 (Ref. 7), for the reactor recirculation piping, which permits a maximum pressure transient of 110% of design pressures of 1250 psig for suction piping, 1650 psig for discharge piping between the pump and the discharge valve, and 1550 psig beyond the discharge valve (Ref. 8). The RCS pressure SL is selected to be the lowest transient overpressure allowed by the applicable codes.
SAFETY LIMITS     The maximum transient pressure allowable in the RCS pressure vessel under the ASME Code, Section III, is 110% of design pressure. The maximum transient pressure allowable in the RCS piping, valves, and fittings is 110% of design pressures of 1250 psig for suction piping, 1650 psig for discharge piping between the pump and the discharge valve, and 1550 psig beyond the discharge valve (Ref. 8). The most limiting of these allowances is the 110% of the suction piping design pressure; therefore, the SL on maximum allowable RCS pressure is established at 1325 psig as measured at the reactor steam dome.
APPLICABILITY     SL 2.1.2 applies in all MODES.
SAFETY LIMIT      2.2.1 VIOLATIONS If any SL is violated, the NRC Operations Center must be notified within 1 hour, in accordance with 10 CFR 50.72 (Ref. 9).
(continued)
CLINTON                             B 2.0-7                      Revision No. 0

RCS Pressure SL B 2.1.2 BASES SAFETY LIMIT      2.2.2 VIOLATIONS (continued)     Exceeding the RCS pressure SL may cause immediate RCS failure and create a potential for radioactive releases in excess of 10 CFR 100, "Reactor Site Criteria," limits (Ref. 5). Therefore, it is required to insert all insertable control rods and restore compliance with the SL within 2 hours. The 2 hour Completion Time ensures that the operators take prompt remedial action and also ensures that the probability of an accident occurring during this period is minimal.
2.2.3 If any SL is violated, the CPS Plant Manager and the CPS Site Vice President shall be notified within 24 hours. The 24 hour period provides time for plant operators and staff to take the appropriate immediate action and assess the condition of the unit before reporting to the senior management.
2.2.4 If any SL is violated, a Licensee Event Report shall be prepared and submitted within 30 days to the NRC in accordance with 10 CFR 50.73 (Ref. 10). A copy of the report shall also be submitted to the CPS Plant Manager and the CPS Site Vice President.
2.2.5 If any SL is violated, restart of the unit shall not commence until authorized by the NRC. This requirement ensures the NRC that all necessary reviews, analyses, and actions are completed before the unit begins its restart to normal operation.
REFERENCES       1. 10 CFR 50, Appendix A, GDC 14, GDC 15, and GDC 28.
(continued)
CLINTON                             B 2.0-8                    Revision No. 6-1

RCS Pressure SL B 2.1.2 BASES REFERENCES       2. ASME, Boiler and Pressure Vessel Code, Section III.
(continued)
: 3. USAR, Section 5.4.1.5.
: 4. ASME, Boiler and Pressure Vessel Code, Section XI, Article IWA-5000.
: 5. 10 CFR 100.
: 6. ASME, Boiler and Pressure Vessel Code, 1971 Edition, Addenda, summer of 1973.
: 7. ASME, Boiler and Pressure Vessel Code, 1974 Edition, Addenda, summer of 1974.
: 8. USAR, Table 5.4-1.
: 9. 10 CFR 50.72.
: 10. 10 CFR 50.73.
CLINTON                             B 2.0-9                     Revision No. 0

LCO Applicability B 3.0 B 3.0   LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs               LCO 3.0.1 through LCO 3.0.9 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.
LCO   3.0.1        LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification).
LCO   3.0.2        LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered, unless otherwise specified.
The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:
: a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and
: b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.
There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.) The second type of Required Action specifies the remedial measures that permit continued operation of the (continued)
CLINTON                              B 3.0-1                  Revision No. 21-3

LCO Applicability B 3.0 BASES LCO 3.0.2     unit that is not further restricted by the Completion Time.
(continued) In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.
Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications.
The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Condition no longer exists. The individual LCO's ACTIONS specify the Required Actions where this is the case.
An example of this is in LCO 3.4.11, "RCS Pressure and Temperature (P/T) Limits."
The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The ACTIONS for not meeting a single LCO adequately manage any increase in plant risk, provided any unusual external conditions (e.g., severe weather, offsite power instability) are considered. In addition, the increased risk associated with simultaneous removal of multiple structures, systems, trains or components from service is assessed and managed in accordance with 10 CFR 50.65(a)(4). Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed.
When a change in MODE or other specified condition is required to comply with Required Actions, the unit may enter a MODE or other specified condition in which another Specification becomes applicable. In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable and the ACTIONS Condition(s) are entered.
(continued)
CLINTON                         B 3.0-2                 Revision No. 20-12

LCO Applicability B 3.0 BASES   (continued)
LCO   3.0.3         LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and:
: a. An associated Required Action and Completion Time is not met and no other Condition applies; or
: b. The condition of the unit is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.
This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS. Planned entry into LCO 3.0.3 should be avoided. If it is not practicable to avoid planned entry into LCO 3.0.3, plant risk should be assessed and managed in accordance with 10 CFR 50.65(a)(4), and the planned entry into LCO 3.0.3 should have less effect on plant safety than other practicable alternatives.
Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to enter lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times.
(continued)
CLINTON                               B 3.0-3                 Revision No. 20-12

LCO Applicability B 3.0 BASES LCO 3.0.3     A unit shutdown required in accordance with LCO 3.0.3 may be (continued) terminated and LCO 3.0.3 exited if any of the following occurs:
: a. The LCO is now met.
: b. The LCO is no longer applicable.
: c. A Condition exists for which the Required Actions have now been performed.
: d. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.
The time limits of Specification 3.0.3 allow 37 hours for the unit to be in MODE 4 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for entering the next lower MODE applies. If a lower MODE is entered in less time than allowed, however, the total allowable time to enter MODE 4, or other applicable MODE, is not reduced. For example, if MODE 2 is entered in 2 hours, then the time allowed for entering MODE 3 is the next 11 hours, because the total time for entering MODE 3 is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to enter a lower MODE of operation in less than the total time allowed.
In MODES 1, 2, and 3, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 4 and 5 because the unit is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, or 3) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.
Exceptions to LCO 3.0.3 are provided in instances where requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in LCO 3.7.7, "Fuel Pool Water Level." LCO 3.7.7 has an Applicability of "During movement of irradiated fuel (continued)
CLINTON                         B 3.0-4                  Revision No. 19-5

LCO Applicability B 3.0 BASES LCO 3.0.3     assemblies in the associated fuel storage pool." Therefore, (continued) this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.7 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.7 of "Suspend movement of irradiated fuel assemblies in the associated fuel storage pool(s)" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications.
LCO   3.0.4   LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with either LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.
LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered following entry into the MODE or other specified condition in the Applicability will permit continued operation within the MODE or the other specified condition for an unlimited period of time.
Compliance with ACTIONS that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change.
Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made and the Required Actions followed after entry into the Applicability.
For example, LCO 3.0.4.a may be used when the Required Action to be entered states that an inoperable instrument channel must be placed in the trip condition within the Completion Time. Transition into a MODE or other specified condition in the Applicability may be made in accordance with LCO 3.0.4 and the channel is subsequently placed in the tripped condition within the Completion Time, which begins when the Applicability is entered. If the instrument channel cannot be placed in the tripped condition and the subsequent default ACTION ("Required Action and associated Completion Time not met") allows the OPERABLE train to be placed in operation, use of LCO 3.0.4.a is acceptable because the subsequent ACTIONS to be entered following entry (continued)
CLINTON                         B 3.0-5                  Revision No. 19-5

LCO Applicability B 3.0 BASES LCO 3.0.4     into the MODE include ACTIONS (place the OPERABLE train in (continued) operation) that permit safe plant operation for an unlimited period of time in the MODE or other specified condition to be entered.
LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate.
The risk assessment may use quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities be assessed and managed. The risk assessment, for the purposes of LCO 3.0.4.b, must take into account all inoperable Technical Specification equipment regardless of whether the equipment is included in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants. Regulatory Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants. These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.
LCO 3.0.4.b may be used with single, or multiple systems and components unavailable. NUMARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components.
(continued)
CLINTON                         B 3.0-6                  Revision No. 19-5

LCO Applicability B 3.0 BASES LCO 3.0.4     The results of the risk assessment shall be considered in (continued) determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented.
The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated above. However, there is a small subset of systems and components that have been determined to be more important to risk and use of the LCO 3.0.4.b allowance is prohibited. The LCOs governing these system and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable.
LCO 3.0.4.c allows entry into a MODE or other specified condition in the Applicability with the LCO not met based on a Note in the Specification which states LCO 3.0.4.c is applicable. These specific allowances permit entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time and a risk assessment has not been performed. This allowance may apply to all the ACTIONS or to a specific Required Action of a Specification. The risk assessments performed to justify the use of LCO 3.0.4.b usually only consider systems and components. For this reason, LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., reactor coolant system specific activity),
and may be applied to other Specifications based on NRC plant-specific approval.
The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit (continued)
CLINTON                         B 3.0-7                  Revision No. 19-5

LCO Applicability B 3.0 BASES LCO 3.0.4     shutdown is defined as a change in MODE or other specified (continued) condition in the Applicability associated with transitioning from MODE 1 to MODE 2 or 3, MODE 2 to MODE 3, and MODE 3 to MODE 4.
Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the applicable Conditions and Required Actions until the Condition is resolved, until the LCO is met, or until the unit is not within the Applicability of the Technical Specification.
Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.
LCO   3.0.5   LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of SRs to demonstrate:
: a. The OPERABILITY of the equipment being returned to service; or
: b. The OPERABILITY of other equipment.
The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allowed SRs. This Specification does not provide time to perform any other preventive or corrective maintenance. LCO 3.0.5 should not be used in lieu of other practicable alternatives that comply with Required Actions and that do not require changing the MODE or other specified conditions in the Applicability in order to demonstrate equipment is OPERABLE. LCO 3.0.5 is not intended to be used repeatedly.
(continued)
CLINTON                         B 3.0-8                  Revision No. 19-5

LCO Applicability B 3.0 BASES LCO 3.0.5     An example of demonstrating equipment is OPERABLE with the (continued) Required Actions not met is opening a manual valve that was closed to comply with Required Actions to isolate a flowpath with excessive Reactor Coolant System (RCS) Pressure Isolation Valve (PIV) leakage in order to perform testing to demonstrate that RCS PIV leakage is now within limit.
Examples of demonstrating equipment OPERABILITY include instances in which it is necessary to take an inoperable channel or trip system out of a tripped condition that was directed by a Required Action, if there is no Required Action Note for this purpose. An example of verifying OPERABILITY of equipment removed from service is taking a tripped channel out of the tripped condition to permit the logic to function and indicate the appropriate response during performance of required testing on the inoperable channel.
Examples of demonstrating the OPERABILITY of other equipment are taking an inoperable channel or trip system out of the tripped condition 1) to prevent the trip function from occurring during the performance of an SR on another channel in the other trip system, or 2) to permit the logic to function and indicate the appropriate response during the performance of an SR on another channel in the same trip system.
The administrative controls in LCO 3.0.5 apply in all cases to systems or components in Chapter 3 of the Technical Specifications, as long as the testing could not be conducted while complying with the Required Actions. This includes the realignment or repositioning of redundant or alternate equipment or trains previously manipulated to comply with ACTIONS, as well as equipment removed from service or declared inoperable to comply with ACTIONS.
LCO   3.0.6   LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system's LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the plant is maintained in a safe condition are specified in the support systems' LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions.
(continued)
CLINTON                         B 3.0-9                  Revision No. 19-5

LCO Applicability B 3.0 BASES LCO 3.0.6     When a support system is inoperable and there is an LCO (continued) specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability.
However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCO's Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the plant is maintained in a safe condition in the support system's Required Actions.
However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system. This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.
Specification 5.5.10, "Safety Function Determination Program" (SFDP), ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.
Cross division checks to identify a loss of safety function for those support systems that support safety systems are required. The cross division check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained.
If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.
LCO   3.0.7   There are certain special tests and operations required to be performed at various times over the life of the unit.
(continued)
CLINTON                        B 3.0-10                  Revision No. 19-5

LCO Applicability B 3.0 BASES LCO 3.0.7     These special tests and operations are necessary to (continued) demonstrate select unit performance characteristics, to perform special maintenance activities, and to perform special evolutions. Special Operations LCOs in Section 3.10 allow specified TS requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS. Unless otherwise specified, all the other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.
The Applicability of a Special Operations LCO represents a condition not necessarily in compliance with the normal requirements of the TS. Compliance with Special Operations LCOs is optional. A special operation may be performed either under the provisions of the appropriate Special Operations LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Special Operations LCO, the requirements of the Special Operations LCO shall be followed. When a Special Operations LCO requires another LCO to be met, only the requirements of the LCO statement are required to be met regardless of that LCO's Applicability (i.e., should the requirements of this other LCO not be met, the ACTIONS of the Special Operations LCO apply, not the ACTIONS of the other LCO). However, there are instances where the Special Operations LCO's ACTIONS may direct the other LCO's ACTIONS be met. The Surveillances of the other LCO are not required to be met, unless specified in the Special Operations LCO. If conditions exist such that the Applicability of any other LCO is met, all the other LCO's requirements (ACTIONS and SRs) are required to be met concurrent with the requirements of the Special Operations LCO.
(continued)
CLINTON                         B 3.0-11                 Revision No. 20-4

LCO Applicability B 3.0 BASES   (continued)
LCO 3.0.8           LCO 3.0.8 establishes conditions under which systems are considered to remain capable of performing their intended safety function when associated snubbers are not capable of providing their associated support function(s). This LCO states that the supported system is not considered to be inoperable solely due to one or more snubbers not capable of performing their associated support function(s). This is appropriate because a limited length of time is allowed for maintenance, testing, or repair of one or more snubbers not capable of performing their associated support function(s) and appropriate compensatory measures are specified in the snubber requirements, which are located outside of the Technical Specifications (TS) under licensee control.
LCO 3.0.8 applies to snubbers that only have seismic function. It does not apply to snubbers that also have design functions to mitigate steam/water hammer or other transient loads. The snubber requirements do not meet the criteria in 10 CFR 50.36(c)(2)(ii), and, as such, are appropriate for control by the licensee.
If the allowed time expires and the snubber(s) are unable to perform their associated support function(s), the affected supported system's LCO(s) must be declared not met and the conditions and Required Actions entered in accordance with LCO 3.0.2.
LCO 3.0.8.a applies when one or more snubbers are not capable of providing their associated support function(s) to a single train or subsystem of a multiple train or subsystem supported system or to a single train or subsystem supported system. LCO 3.0.8.a allows 72 hours to restore the snubber(s) before declaring the supported system inoperable.
The 72 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function and due to the availability of the redundant train of the supported system.
LCO 3.0.8.b applies when one or more snubbers are not capable of providing their associated support function(s) to more than one train or subsystem of a multiple train or subsystem supported system. LCO 3.0.8.b allows 12 hours to restore the snubber(s) before declaring the supported system inoperable. The 12-hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function.
(continued)
CLINTON                              B 3.0-12                  Revision No. 20-4

LCO Applicability B 3.0 BASES LCO 3.0.8     The following configuration restrictions shall be applied (continued) to the use of LCO 3.0.8:
(1)  LCO 3.0.8.a can only be used if one of the following two means of heat removal is available:
: a. At least one high pressure makeup path (e.g., using High Pressure Core Spray (HPCS) or Reactor Core Isolation Cooling (RCIC)) and heat removal capability (e.g., suppression pool cooling), including a minimum set of supporting equipment required for success, not associated with the inoperable snubber(s),
OR
: b. At least one low pressure makeup path (e.g., Low Pressure Coolant Injection (LPCI) or Low Pressure Core Spray (LPCS)) and heat removal capability (e.g., suppression pool cooling or shutdown cooling), including a minimum set of supporting equipment required for success, not associated with the inoperable snubber(s).
(2)  LCO 3.0.8.b can only be used following verification that at least one success path exists, using equipment not associated with the inoperable snubber(s), to provide makeup and core cooling needed to mitigate Loss of Offsite Power (LOOP) accident sequences (i.e., initiated by a seismically-induced LOOP event with concurrent loss of all safety system trains supported by the out-of-service snubbers).
Each use of LCO 3.0.8 requires confirmation that at least one train (or subsystem) of systems supported by the inoperable snubbers would remain capable of performing their required safety or support functions for postulated design loads other than seismic loads. LCO 3.0.8 does not apply to non-seismic snubbers. In addition, a record of the design function of the inoperable snubber (i.e., seismic vs. non-seismic), implementation and compliance with the configuration restrictions defined above, and the associated plant configuration shall be available on a recoverable basis for NRC inspection.
(continued)
CLINTON                        B 3.0-13                  Revision No. 20-4

LCO Applicability B 3.0 BASES LCO 3.0.8     LCO 3.0.8 requires that risk be assessed and managed.
(continued) Industry and NRC guidance on the implementation of 10 CFR 50.65(a)(4) (i.e., the Maintenance Rule) does not address seismic risk. However, use of LCO 3.0.8 should be considered with respect to other plant maintenance activities, and integrated into the existing Maintenance Rule process to the extent possible so that maintenance on any unaffected train or subsystem is properly controlled, and emergent issues are properly addressed. The risk assessment need not be quantified, but may be a qualitative awareness of the vulnerability of systems and components when one or more snubbers are not able to perform their associated support function.
LCO 3.0.8 does not apply to non-seismic functions of snubbers. The provisions of LCO 3.0.8 apply to seismic snubbers that may also have non-seismic functions provided the supported systems would remain capable of performing their required safety or support functions for postulated design loads other than seismic loads. Non-seismic snubber issues will be addressed in the corrective action program.
LCO   3.0.9   LCO 3.0.9 establishes conditions under which systems described in the Technical Specifications are considered to remain OPERABLE when required barriers are not capable of providing their related support function(s).
Barriers are doors, walls, floor plugs, curbs, hatches, installed structures or components, or other devices, not explicitly described in Technical Specifications, that support the performance of the safety function of systems described in the Technical Specifications. This LCO states that the supported system is not considered to be inoperable solely due to required barriers not capable of performing their related support function(s) under the described conditions. LCO 3.0.9 allows 30 days before declaring the supported system(s) inoperable and the LCO(s) associated with the supported system(s) not met. A maximum time is placed on each use of this allowance to ensure that as required barriers are found or are otherwise made unavailable, they are restored. However, the allowable duration may be less than the specified maximum time based on the risk assessment.
If the allowed time expires and the barriers are unable to perform their related support function(s), the supported system's LCO(s) must be declared not met and the Conditions (continued)
CLINTON                        B 3.0-14                  Revision No. 21-3

LCO Applicability B 3.0 BASES LCO 3.0.9     and Required Actions entered in accordance with LCO 3.0.2.
(continued)
This provision does not apply to barriers which support ventilation systems or to fire barriers. The Technical Specifications for ventilation systems provide specific Conditions for inoperable barriers. Fire barriers are addressed by other regulatory requirements and associated plant programs. This provision does not apply to barriers which are not required to support system OPERABILITY (see NRC Regulatory Issue Summary 2001-09, "Control of Hazard Barriers," dated April 2, 2001).
The provisions of LCO 3.0.9 are justified because of the low risk associated with required barriers not being capable of performing their related support function. This provision is based on consideration of the following initiating event categories:
x Loss of coolant accidents; x High energy line breaks; x Feedwater line breaks; x Internal flooding; x External flooding; x Turbine missile ejection; and x Tornado or high wind.
The risk impact of the barriers which cannot perform their related support function(s) must be addressed pursuant to the risk assessment and management provision of the Maintenance Rule, 10 CFR 50.65(a)(4), and the associated implementation guidance, Regulatory Guide 1.160, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants."
Regulatory Guide 1.160 endorses the guidance in Section 11 of NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." This guidance provides for the consideration of dynamic plant configuration issues, emergent conditions, and other aspects pertinent to plant operation with the barriers unable to perform their related support function(s). These considerations may result in risk management and other compensatory actions being required during the period that barriers are unable to perform their related support function(s).
LCO 3.0.9 may be applied to one or more trains or subsystems of a system supported by barriers that cannot provide their related support function(s), provided that risk is assessed and managed (including consideration of the effects on (continued)
CLINTON                        B 3.0-15                  Revision No. 21-3

LCO Applicability B 3.0 BASES LCO 3.0.9     Large Early Release and from external events). If applied (continued) concurrently to more than one train or subsystem or a multiple train or subsystem supported system, the barriers supporting each of these trains or subsystems must provide their related support function(s) for different categories of initiating events. For example, LCO 3.0.9 may be applied for up to 30 days for more than one train of a multiple train supported system if the affected barrier for one train protects against internal flooding and the affected barrier for the other train protects against tornado missiles. In this example, the affected barrier may be the same physical barrier but serve different protection functions for each train.
The Reactor Core Isolation Cooing (RCIC) system is designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of coolant flow from the feedwater system to provide adequate core cooling and control of RPV water level. Under these conditions, the High Pressure Core Spray (HPCS) and RCIC systems perform similar functions. The function of the RCIC system is to respond to transient events by providing makeup coolant to the reactor. The RCIC system is not an Engineered Safety Feature and no credit is taken in the safety analysis for RCIC system operation. The HPCS system provides backup in case of a RCIC system failure. The ADS (Automatic Depressurization System) and low pressure ECCS subsystems provide the core cooling function in the event of failure of the HPCS system during an accident. Thus, for the purposes of LCO 3.0.9, the HPCS system, the RCIC system, and the ADS are considered independent subsystems of a single system and LCO 3.0.9 can be used on these single train systems in a manner similar to multiple train or subsystem systems.
If during the time that LCO 3.0.9 is being used, the required OPERABLE train or subsystem becomes inoperable, it must be restored to OPERABLE status within 24 hours.
Otherwise, the train(s) or subsystem(s) supported by barriers that cannot perform their related support function(s) must be declared inoperable and the associated LCOs declared not met. This 24 hour period provides time to respond to emergent conditions that would otherwise likely lead to entry into LCO 3.0.3 and a rapid plant shutdown, which is not justified given the low probability of an initiating event which would require the barrier(s) not capable of performing their related support function(s).
During this 24 hour period, the plant risk associated with the existing conditions is assessed and managed in accordance with 10 CFR 50.65(a)(4).
CLINTON                        B 3.0-16                  Revision No. 21-3

SR Applicability B 3.0 B 3.0   SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRs                SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated. SR 3.0.2 and SR 3.0.3 apply in Chapter 5 only when invoked by a Chapter 5 Specification.
SR  3.0.1          SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO.
Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:
: a. The systems or components are known to be inoperable, although still meeting the SRs; or
: b. The requirements of the Surveillance(s) are known to be not met between required Surveillance performances.
Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a Special Operations LCO are only applicable when the Special Operations LCO is used as an allowable exception to the requirements of a Specification.
Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply.
Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status.
(continued)
CLINTON                             B 3.0-17                  Revision No. 21-3

SR Applicability B 3.0 BASES SR   3.0.1     Upon completion of maintenance, appropriate post maintenance (continued) testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed. Some examples of this process are:
: a. Control rod drive maintenance during refueling that requires scram testing at t 950 psig. However, if other appropriate testing is satisfactorily completed and the scram time testing of SR 3.1.4.3 is satisfied, the control rod can be considered OPERABLE. This allows startup to proceed to reach 950 psig to perform other necessary testing.
: b. Reactor Core Isolation Cooling (RCIC) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with RCIC considered OPERABLE. This allows operation to reach the specified pressure to complete the necessary post maintenance testing.
SR   3.0.2     SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a "once per..."
interval.
SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g.,
transient conditions or other ongoing Surveillance or maintenance activities).
(continued)
CLINTON                         B 3.0-18                  Revision No. 21-3

SR Applicability B 3.0 BASES SR   3.0.2     The 25% extension does not significantly degrade the (continued) reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. The requirements of regulations take precedence over the TS. Therefore, when a test interval is specified in the regulations, the test interval cannot be extended by the TS, and the TS will then include a Note stating, "SR 3.0.2 is not applicable." An example of an exception when the test interval is not specified in the regulations is the Note in the Primary Containment Leakage Rate Testing Program, "SR 3.0.2 is not applicable." This exception is provided because the program already includes extension of test intervals.
As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per..." basis. The 25%
extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25%
extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.
The provisions of SR 3.0.2 are not intended to be used repeatedly to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.
SR   3.0.3     SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been performed within the specified Frequency. A delay period of up to 24 hours or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the (continued)
CLINTON                         B 3.0-19                  Revision No. 21-3

SR Applicability B 3.0 BASES SR   3.0.3     time that the specified Frequency was not met. This delay (continued) period provides adequate time to perform Surveillances that have been missed. This delay period permits the performance of a Surveillance before complying with Required Actions or other remedial measures that might preclude performance of the Surveillance.
The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.
When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the surveillance.
However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity. SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.
SR 3.0.3 is only applicable if there is a reasonable expectation the associated equipment is OPERABLE or that variables are within limits, and it is expected that the Surveillance will be met when performed. Many factors should be considered, such as the period of time since the Surveillance was last performed, or whether the Surveillance, or a portion thereof, has ever been performed, and any other indications, tests, or activities that might support the expectation that the Surveillance will be met when performed. An example of the use of SR 3.0.3 would be a relay contact that was not tested as required in accordance with a particular SR, but previous successful performances of the SR included the relay contact; the adjacent, physically connected relay contacts were tested during the SR performance; the subject relay contact has been tested by another SR; or historical operation of the subject relay contact has been successful. It is not sufficient to infer the behavior of the associated equipment (continued)
CLINTON                          B 3.0-20                 Revision No. 21-3

SR Applicability B 3.0 BASES SR   3.0.3     from the performance of similar equipment. The rigor of (continued) determining whether there is a reasonable expectation a Surveillance will be met when performed should increase based on the length of time since the last performance of the Surveillance. If the Surveillance has been performed recently, a review of the Surveillance history and equipment performance may be sufficient to support a reasonable expectation that the Surveillance will be met when performed. For Surveillances that have not been performed for a long period or that have never been performed, a rigorous evaluation based on objective evidence should provide a high degree of confidence that the equipment is OPERABLE. The evaluation should be documented in sufficient detail to allow a knowledgeable individual to understand the basis for the determination.
Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used repeatedly to extend Surveillance intervals. While up to 24 hours or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants. This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management actions up to an including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component.
Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the Clinton Power Station Corrective Action Program.
(continued)
CLINTON                         B 3.0-21                  Revision No. 21-3

SR Applicability B 3.0 BASES SR   3.0.3     If a Surveillance is not completed within the allowed delay (continued) period, then the equipment is considered inoperable or the variable then is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.
Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.
SR   3.0.4     SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.
This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4.
However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES (continued)
CLINTON                         B 3.0-22                  Revision No. 21-3

SR Applicability B 3.0 BASES SR   3.0.4     or other specified conditions of the Applicability.
(continued) However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes.
SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3.
The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2 or 3, MODE 2 to MODE 3, and MODE 3 to MODE 4.
The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCOs Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.
CLINTON                         B 3.0-23                  Revision No. 21-3

SR Applicability B 3.0 This page intentionally left blank.
CLINTON               B 3.0-24              Revision No. 21-3

SDM B 3.1.1 B 3.1   REACTIVITY CONTROL SYSTEMS B 3.1.1   SHUTDOWN MARGIN (SDM)
BASES BACKGROUND         SDM requirements are specified to ensure:
: a. The reactor can be made subcritical from all operating conditions and transients and Design Basis Events;
: b. The reactivity transients associated with postulated accident conditions are controllable within acceptable limits; and
: c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.
These requirements are satisfied by the control rods, as described in GDC 26 (Ref. 1), which can compensate for the reactivity effects of the fuel and water temperature changes experienced during all operating conditions.
APPLICABLE         The control rod drop accident (CRDA) analysis (Refs. 2 SAFETY ANALYSES    and 3) assumes the core is subcritical with the highest worth control rod withdrawn. Typically, the first control rod withdrawn has a very high reactivity worth and, should the core be critical during the withdrawal of the first control rod, the consequences of a CRDA could exceed the fuel damage limits for a CRDA (see Bases for LCO 3.1.6, "Control Rod Pattern"). Also, SDM is assumed as an initial condition for the control rod removal error during a refueling accident (Ref. 4). The analysis of this reactivity insertion event assumes the refueling interlocks are OPERABLE when the reactor is in the refueling mode of operation. These interlocks prevent the withdrawal of more than one control rod from the core during refueling.
(Special consideration and requirements for multiple control rod withdrawal during refueling are covered in Special Operations LCO 3.10.6, "Multiple Control Rod Withdrawal  Refueling.") The analysis assumes this condition is acceptable since the core will be shut down with the highest worth control rod withdrawn, if adequate SDM has been demonstrated.
(continued)
CLINTON                              B 3.1-1                     Revision No. 0

SDM B 3.1.1 BASES APPLICABLE      Prevention or mitigation of reactivity insertion events is SAFETY ANALYSES necessary to limit energy deposition in the fuel to prevent (continued)   significant fuel damage, which could result in undue release of radioactivity. Adequate SDM provides assurance that inadvertent criticalities and potential CRDAs involving high worth control rods (namely the first control rod withdrawn) will not cause significant fuel damage.
SDM satisfies Criterion 2 of the NRC Policy Statement.
LCO             The specified SDM limit accounts for the uncertainty in the demonstration of SDM by testing. Separate SDM limits are provided for testing where the highest worth control rod is determined analytically or by measurement. This is due to the reduced uncertainty in the SDM test when the highest worth control rod is determined by measurement. When SDM is demonstrated by calculations not associated with a test (i.e., to confirm SDM during the fuel loading sequence),
additional margin is included to account for uncertainties in the calculation. To ensure adequate SDM during the design process, a design margin is included to account for uncertainties in the design calculations (Ref. 5).
APPLICABILITY   In MODES 1 and 2, SDM must be provided because subcriticality with the highest worth control rod withdrawn is assumed in the CRDA analysis (Ref. 3). In MODES 3 and 4, SDM is required to ensure the reactor will be held subcritical with margin for a single withdrawn control rod.
SDM is required in MODE 5 to prevent an inadvertent criticality during the withdrawal of a single control rod from a core cell containing one or more fuel assemblies.
ACTIONS         A.1 With SDM not within the limits of the LCO in MODE 1 or 2, SDM must be restored within 6 hours. Failure to meet the specified SDM may be caused by a control rod that cannot be inserted. The 6 hour Completion Time is acceptable, considering that the reactor can still be shut down, assuming no additional failures of control rods to insert, and the low probability of an event occurring during this interval.
(continued)
CLINTON                           B 3.1-2                      Revision No. 0

SDM B 3.1.1 BASES ACTIONS       B.1 (continued)
If the SDM cannot be restored, the plant must be brought to MODE 3 within 12 hours, to prevent the potential for further reductions in available SDM (e.g., additional stuck control rods). The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
C.1 With SDM not within limits in MODE 3, the operator must immediately initiate action to fully insert all insertable control rods. Action must continue until all insertable control rods are fully inserted. This action results in the least reactive condition for the core.
D.1, D.2, D.3, D.4, and D.5 With SDM not within limits in MODE 4, the operator must immediately initiate action to fully insert all insertable control rods. Action must continue until all insertable control rods are fully inserted. This action results in the least reactive condition for the core. Actions must also be initiated within 1 hour to provide means for control of potential radioactive releases. This includes ensuring secondary containment is OPERABLE; at least one Standby Gas Treatment (SGT) subsystem is OPERABLE; and secondary containment isolation capability (i.e., at least one isolation valve and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each secondary containment and secondary containment bypass penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases. This may be performed as an administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the Surveillances may (continued)
CLINTON                         B 3.1-3                     Revision No. 0

SDM B 3.1.1 BASES ACTIONS D.1, D.2, D.3, D.4, and D.5  (continued) need to be performed to restore the component to OPERABLE status. In addition, at least one door in the upper containment personnel air lock must be closed. The closed air lock door completes the boundary for control of potential radioactive releases. With the appropriate administrative controls however, the closed door can be opened intermittently for entry and exit. This allowance is acceptable due to the need for containment access and due to the slow progression of events which may result from inadequate SDM. Inadvertent reactor criticalities would not be expected to result in the immediate release of appreciable fission products to the containment atmosphere.
Actions must continue until all requirements of this Condition are satisfied.
E.1, E.2, E.3, E.4, E.5, and E.6 With SDM not within limits in MODE 5, the operator must immediately suspend CORE ALTERATIONS that could reduce SDM, e.g., insertion of fuel in the core or the withdrawal of control rods. Suspension of these activities shall not preclude completion of movement of a component to a safe condition. Inserting control rods or removing fuel from the core will reduce the total reactivity and are therefore excluded from the suspended actions.
Action must also be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies have been fully inserted. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and therefore do not have to be inserted.
Action must also be initiated within 1 hour to provide means for control of potential radioactive releases. This includes ensuring secondary containment is OPERABLE; at least one SGT subsystem is OPERABLE; and secondary containment isolation capability (i.e., at least one isolation valve and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each secondary containment and secondary containment bypass penetration (continued)
CLINTON                   B 3.1-4                     Revision No. 0

SDM B 3.1.1 BASES ACTIONS      E.1, E.2, E.3, E.4, E.5, and E.6  (continued) flow path not isolated that is assumed to be isolated to mitigate radioactivity releases. This may be performed as an administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the Surveillances may need to be performed to restore the component to OPERABLE status. In addition, at least one door in the upper containment personnel air lock must be closed. The closed air lock door completes the boundary for control of potential radioactive releases. With the appropriate administrative controls however, the closed door can be opened intermittently for entry and exit. This allowance is acceptable due to the need for containment access and due to the slow progression of events which may result from inadequate SDM. Inadvertent reactor criticalities would not be expected to result in the immediate release of appreciable fission products to the containment atmosphere.
Actions must continue until all requirements of this Condition are satisfied.
SURVEILLANCE SR  3.1.1.1 REQUIREMENTS Adequate SDM must be demonstrated to ensure the reactor can be made subcritical from any initial operating condition.
Adequate SDM is demonstrated by testing before or during the first startup after fuel movement, or shuffling within the reactor pressure vessel, or control rod replacement.
Control rod replacement refers to the decoupling and removal of a control rod from a core location, and subsequent replacement with a new control rod or a control rod from another core location. Since core reactivity will vary during the cycle as a function of fuel depletion and poison burnup, the beginning of cycle (BOC) test must also account for changes in core reactivity during the cycle. Therefore, to obtain the SDM, the initial measured value must be increased by an adder, "R", which is the difference between the calculated value of maximum core reactivity during the operating cycle and the calculated BOC core reactivity. If the value of R is negative (i.e., BOC is the most reactive (continued)
CLINTON                        B 3.1-5                     Revision No. 0

SDM B 3.1.1 BASES SURVEILLANCE SR  3.1.1.1   (continued)
REQUIREMENTS point in the cycle), no correction to the BOC measured value is required (Ref. 5). For the SDM demonstrations that rely solely on calculation, additional margin (0.10% 'k/k) must be added to the SDM limit of 0.28% 'k/k to account for uncertainties in the calculation of the highest worth control rod.
The SDM may be demonstrated during an in sequence control rod withdrawal, in which the highest worth control rod is analytically determined, or during local criticals, where the highest worth control rod is determined by testing.
Local critical tests require the withdrawal of out of sequence control rods. This testing would therefore require bypassing of the Rod Pattern Control System to allow the out of sequence withdrawal, and therefore additional requirements must be met (see LCO 3.10.7, "Control Rod Testing  Operating").
The Frequency of 4 hours after reaching criticality is allowed to provide a reasonable amount of time to perform the required calculations and appropriate verification.
During MODE 5, adequate SDM is also required to ensure the reactor does not reach criticality during control rod withdrawals. An evaluation of each in vessel fuel movement during fuel loading (including shuffling fuel within the core) is required to ensure adequate SDM is maintained during refueling. This evaluation ensures the intermediate loading patterns are bounded by the safety analyses for the final core loading pattern. For example, bounding analyses that demonstrate adequate SDM for the most reactive configurations during the refueling may be performed to demonstrate acceptability of the entire fuel movement sequence. These bounding analyses include additional margin to the SDM limit to account for the associated uncertainties. Spiral offload or reload sequences inherently satisfy the SR, provided the fuel assemblies are reloaded in the same configuration analyzed for the new cycle. Removing fuel from the core will always result in an increase in SDM.
(continued)
CLINTON                         B 3.1-6                     Revision No. 0

SDM B 3.1.1 BASES   (continued)
SURVEILLANCE        SR  3.1.1.1  (continued)
REQUIREMENTS With regard to SDM values obtained pursuant to this SR, as determined from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 6).
REFERENCES          1. 10 CFR 50, Appendix A, GDC 26.
: 2. USAR, Section 15.4.9.
: 3. NEDO-21231, "Banked Position Withdrawal Sequence,"
Section 4.1, January 1977.
: 4. USAR, Section 15.4.1.1.
: 5. NEDE-24011-P-A, "GE Standard Application for Reactor Fuel, GESTAR II" (latest approved revision).
: 6. Calculation IP-0-0002.
CLINTON                               B 3.1-7                  Revision No. 13-4

Reactivity Anomalies B 3.1.2 B 3.1   REACTIVITY CONTROL SYSTEMS B 3.1.2   Reactivity Anomalies BASES BACKGROUND         In accordance with GDC 26, GDC 28, and GDC 29 (Ref. 1),
reactivity shall be controllable such that subcriticality is maintained under cold conditions and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences. Reactivity anomaly is used as a measure of the predicted versus measured core reactivity during power operation. The continual confirmation of core reactivity is necessary to ensure that the Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity anomaly could be the result of unanticipated changes in fuel reactivity, control rod worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity, and could potentially result in a loss of SDM or violation of acceptable fuel design limits. Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to cold, subcritical conditions.
When the reactor core is critical or in normal power operation, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance, since parameters are being maintained relatively stable under steady state power conditions. The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers, producing zero net reactivity.
In order to achieve the required fuel cycle energy output, the uranium enrichment in the new fuel loading and the fuel loaded in the previous cycles provide excess positive reactivity beyond that required to sustain steady state operation at the beginning of cycle (BOC). When the reactor (continued)
CLINTON                              B 3.1-8                     Revision No. 0

Reactivity Anomalies B 3.1.2 BASES BACKGROUND      is critical at RTP, the excess positive reactivity is (continued)   compensated by burnable absorbers (if any), control rods, and whatever neutron poisons (mainly xenon and samarium) are present in the fuel.
The predicted core reactivity, as represented by core keffective (keff), is calculated by a 3D core simulator code as a function of cycle exposure. This calculation is performed for projected operating states and conditions throughout the cycle. The measured or monitored core keff is calculated by the core monitoring system for actual plant conditions and is then compared to the predicted value for the cycle exposure.
APPLICABLE      Accurate prediction of core reactivity is either an explicit SAFETY ANALYSES or implicit assumption in the accident analysis evaluation (Ref. 2). In particular, SDM and reactivity transients, such as control rod withdrawal accidents or rod drop accidents, are very sensitive to accurate prediction of core reactivity. These accident analysis evaluations rely on computer codes that have been qualified against available test data, operating plant data, and analytical benchmarks.
Monitoring reactivity anomaly provides additional assurance that the nuclear methods provide an accurate representation of the core reactivity.
The comparison between measured and predicted initial core reactivity provides a normalization for the calculational models used to predict core reactivity. If the measured and predicted core keff for identical core conditions at BOC do not reasonably agree, then the assumptions used in the reload cycle design analysis or the calculation models used to predict core keff may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured value. Thereafter, any significant deviations in the measured core keff from the predicted core keff that develop during fuel depletion may be an indication that the assumptions of the DBA and transient analyses are no longer valid, or that an unexpected change in core conditions has occurred.
Reactivity anomalies satisfy Criterion 2 of the NRC Policy Statement.
(continued)
CLINTON                               B 3.1-9                   Revision No. 14-5

Reactivity Anomalies B 3.1.2 BASES   (continued)
LCO                 The reactivity anomaly limit is established to ensure plant operation is maintained within the assumptions of the safety analyses. Large differences between monitored and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the Nuclear Design Methodology are larger than expected. A limit on the difference between the monitored core keff and the predicted core keff of 1% 'k/k has been established based on engineering judgment. A > 1%
deviation in reactivity from that predicted is larger than expected for normal operation and should therefore be evaluated.
APPLICABILITY       In MODE 1, most of the control rods are withdrawn and steady state operation is typically achieved. Under these conditions, the comparison between predicted and monitored core reactivity provides an effective measure of the reactivity anomaly. In MODE 2, control rods are typically being withdrawn during a startup. In MODES 3 and 4, all control rods are fully inserted, and, therefore, the reactor is in the least reactive state, where monitoring core reactivity is not necessary. In MODE 5, fuel loading results in a continually changing core reactivity. SDM requirements (LCO 3.1.1) ensure that fuel movements are performed within the bounds of the safety analysis, and an SDM demonstration is required during the first startup following operations that could have altered core reactivity (e.g., fuel movement, control rod replacement, control rod shuffling). The SDM test, required by LCO 3.1.1, provides a direct comparison of the predicted and monitored core reactivity at cold conditions; therefore, reactivity anomaly is not required during these conditions.
ACTIONS             A.1 Should an anomaly develop between measured and predicted core reactivity, the core reactivity difference must be restored to within the limit to ensure continued operation is within the core design assumptions. Restoration to within the limit could be performed by an evaluation of the core design and safety analysis to determine the reason for the anomaly. This evaluation normally reviews the core (continued)
CLINTON                               B 3.1-10                  Revision No. 14-5

Reactivity Anomalies B 3.1.2 BASES ACTIONS      A.1   (continued) conditions to determine their consistency with input to design calculations. Measured core and process parameters are also normally evaluated to determine that they are within the bounds of the safety analysis, and safety analysis calculational models may be reviewed to verify that they are adequate for representation of the core conditions.
The required Completion Time of 72 hours is based on the low probability of a DBA during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.
B.1 If the core reactivity cannot be restored to within the 1% 'k/k limit, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE SR   3.1.2.1 REQUIREMENTS Verifying the reactivity difference between the monitored and predicted core keff is within the limits of the LCO provides further assurance that plant operation is maintained within the assumptions of the DBA and transient analyses. The Core Monitoring System calculates the core keff for the reactor conditions obtained from plant instrumentation. A comparison of the monitored core keff to the predicted core keff at the same cycle exposure is used to calculate the reactivity difference. The comparison is required when the core reactivity has potentially changed by a significant amount. This may occur following a refueling in which new fuel assemblies are loaded, fuel assemblies are shuffled within the core, or control rods are replaced or shuffled. Control rod replacement refers to the decoupling and removal of a control rod from a core location, and subsequent replacement with a new control rod (continued)
CLINTON                        B 3.1-11                  Revision No. 14-5

Reactivity Anomalies B 3.1.2 BASES SURVEILLANCE SR  3.1.2.1  (continued)
REQUIREMENTS or a control rod from another core location. Also, core reactivity changes during the cycle. The 24 hour interval after reaching equilibrium conditions following a startup is based on the need for equilibrium xenon concentrations in the core, such that an accurate comparison between the monitored and predicted core keff values can be made. For the purposes of this SR, the reactor is assumed to be at equilibrium conditions when steady state operations (no control rod movement) at t 80% RTP have been obtained for at least 24 hours. The 1000 MWD/T Frequency was developed, considering the relatively slow change in core reactivity with exposure and operating experience related to variations in core reactivity. This comparison requires the core to be operating at power levels which minimize the uncertainties and measurement errors, in order to obtain meaningful results. Therefore, the comparison is only done when in MODE 1.
With regard to core reactivity differences values obtained pursuant to this SR, as determined from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).
REFERENCES   1. 10 CFR 50, Appendix A, GDC 26, GDC 28, and GDC 29.
: 2. USAR, Chapter 15.
: 3. Calculation IP-0-0002.
CLINTON                       B 3.1-12                   Revision No. 14-5

Control Rod OPERABILITY B 3.1.3 B 3.1   REACTIVITY CONTROL SYSTEMS B 3.1.3   Control Rod OPERABILITY BASES BACKGROUND         Control rods are components of the Control Rod Drive (CRD)
System, which is the primary reactivity control system for the reactor. In conjunction with the Reactor Protection System, the CRD System provides the means for the reliable control of reactivity changes to ensure that under conditions of normal operation, including anticipated operational occurrences, specified acceptable fuel design limits are not exceeded. In addition, the control rods provide the capability to hold the reactor core subcritical under all conditions and to limit the potential amount and rate of reactivity increase caused by a malfunction in the CRD System. The CRD System is designed to satisfy the requirements of GDC 26, GDC 27, GDC 28, and GDC 29, (Ref. 1).
The CRD System consists of 145 locking piston control rod drive mechanisms (CRDMs) and a hydraulic control unit for each drive mechanism. The locking piston type CRDM is a double acting hydraulic piston, which uses condensate water as the operating fluid. Accumulators provide additional energy for scram. An index tube and piston, coupled to the control rod, are locked at fixed increments by a collet mechanism. The collet fingers engage notches in the index tube to prevent unintentional withdrawal of the control rod, but without restricting insertion.
This Specification, along with LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod Scram Accumulators,"
ensure that the performance of the control rods in the event of a Design Basis Accident (DBA) or transient meets the assumptions used in the safety analyses of References 2, 3, 4, 5, 6, and 7.
APPLICABLE         The analytical methods and assumptions used in the SAFETY ANALYSES    evaluations involving control rods are presented in References 2, 3, 4, 5, 6, and 7. The control rods provide the primary means for rapid reactivity control (reactor scram), for maintaining the reactor subcritical, and for (continued)
CLINTON                             B 3.1-13                     Revision No. 0

Control Rod OPERABILITY B 3.1.3 BASES APPLICABLE      limiting the potential effects of reactivity insertion SAFETY ANALYSES events caused by malfunctions in the CRD System.
(continued)
The capability of inserting the control rods provides assurance that the assumptions for scram reactivity in the DBA and transient analyses are not violated. Since the SDM ensures the reactor will be subcritical with the highest worth control rod withdrawn (assumed single failure), the additional failure of a second control rod to insert could invalidate the demonstrated SDM and potentially limit the ability of the CRD System to hold the reactor subcritical.
If the control rod is stuck at an inserted position and becomes decoupled from the CRD, a control rod drop accident (CRDA) can possibly occur. Therefore, the requirement that all control rods be OPERABLE ensures the CRD System can perform its intended function.
The control rods also protect the fuel from damage that could result in release of radioactivity. The limits protected are the MCPR Safety Limit (SL) (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), the 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLGHR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), and the fuel damage limit (see Bases for LCO 3.1.6, "Control Rod Pattern")
during reactivity insertion events.
The negative reactivity insertion (scram) provided by the CRD System provides the analytical basis for determination of plant thermal limits and provides protection against fuel damage limits during a CRDA. Bases for LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6 discuss in more detail how the SLs are protected by the CRD System.
Control rod OPERABILITY satisfies Criterion 3 of the NRC Policy Statement.
LCO             OPERABILITY of an individual control rod is based on a combination of factors, primarily the scram insertion times, the control rod coupling integrity, and the ability to determine the control rod position. Accumulator OPERABILITY is addressed by LCO 3.1.5. The associated scram accumulator status for a control rod only affects the scram insertion times and therefore an inoperable accumulator does not (continued)
CLINTON                           B 3.1-14                  Revision No. 1-1

Control Rod OPERABILITY B 3.1.3 BASES LCO           immediately require declaring a control rod inoperable.
(continued) Although not all control rods are required to be OPERABLE to satisfy the intended reactivity control requirements, strict control over the number and distribution of inoperable control rods is required to satisfy the assumptions of the DBA and transient analyses.
APPLICABILITY In MODES 1 and 2, the control rods are assumed to function during a DBA or transient and are therefore required to be OPERABLE in these MODES. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in Shutdown and a control rod block is applied. This provides adequate requirements for control rod OPERABILITY during these conditions. Control rod requirements in MODE 5 are located in LCO 3.9.5, "Control Rod OPERABILITY  Refueling."
ACTIONS       The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each control rod.
This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable control rod. Complying with the Required Actions may allow for continued operation, and subsequent inoperable control rods are governed by subsequent Condition entry and application of associated Required Actions.
A.1, A.2, and A.3 A control rod is considered stuck if it will not insert by either CRD drive water or scram pressure. With a fully inserted control rod stuck, no actions are required as long as the control rod remains fully inserted. The Required Actions are modified by a Note that allows a stuck control rod to be bypassed in the Rod Action Control System (RACS) to allow continued operation. SR 3.3.2.1.9 provides additional requirements when control rods are bypassed in RACS to ensure compliance with the CRDA analysis. With one withdrawn control rod stuck, the associated control rod drive must be disarmed within 2 hours. The allowed Completion Time of 2 hours is acceptable, considering the reactor can still be shut down, assuming no additional control rods fail to insert, and provides a reasonable amount of time to perform the Required Action in an orderly (continued)
CLINTON                         B 3.1-15                  Revision No. 1-1

Control Rod OPERABILITY B 3.1.3 BASES ACTIONS A.1, A.2, and A.3   (continued) manner. Isolating the control rod from scram prevents damage to the CRDM. The control rod can be isolated from scram by isolating the hydraulic control unit from scram and normal drive and withdraw pressure, yet still maintain cooling water to the CRD.
Monitoring of the insertion capability for each withdrawn control rod must also be performed within 24 hours.
SR 3.1.3.3 performs periodic tests of the control rod insertion capability of withdrawn control rods. Testing each withdrawn control rod ensures that a generic problem does not exist. The allowed Completion Time of 24 hours provides a reasonable time to test the control rods, considering the potential for a need to reduce power to perform the tests.
Required Action A.2 has a modified time zero Completion Time. The 24 hour Completion Time for this Required Action starts when the withdrawn control rod is discovered to be stuck and THERMAL POWER is greater than the actual low power setpoint (LPSP) of the rod pattern control system (RPCS),
since the notch insertions may not be compatible with the requirements of rod pattern control (LCO 3.1.6) and the RPCS (LCO 3.3.2.1, "Control Rod Block Instrumentation").
To allow continued operation with a withdrawn control rod stuck, an evaluation of adequate SDM is also required within 72 hours. Should a DBA or transient require a shutdown, to preserve the single failure criterion an additional control rod would have to be assumed to have failed to insert when required. Therefore, the original SDM demonstration may not be valid. The SDM must therefore be evaluated (by measurement or analysis) with the stuck control rod at its stuck position and the highest worth OPERABLE control rod assumed to be fully withdrawn.
The allowed Completion Time of 72 hours to verify SDM is adequate, considering that with a single control rod stuck in a withdrawn position, the remaining OPERABLE control rods are capable of providing the required scram and shutdown reactivity. Failure to reach MODE 4 is only likely if an additional control rod adjacent to the stuck control rod also fails to insert during a required scram. Even with the postulated additional single failure of an adjacent control (continued)
CLINTON                   B 3.1-16                 Revision No. 13-1

Control Rod OPERABILITY B 3.1.3 BASES ACTIONS A.1, A.2, and A.3   (continued) rod to insert, sufficient reactivity control remains to reach and maintain MODE 3 conditions (Ref. 8).
B.1 With two or more withdrawn control rods stuck, the plant should be brought to MODE 3 within 12 hours. The occurrence of more than one control rod stuck at a withdrawn position increases the probability that the reactor cannot be shut down if required. Insertion of all insertable control rods eliminates the possibility of an additional failure of a control rod to insert. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
C.1 and C.2 With one or more control rods inoperable for reasons other than being stuck in the withdrawn position, operation may continue, provided the control rods are fully inserted within 3 hours and disarmed (electrically or hydraulically) within 4 hours. Inserting a control rod ensures the shutdown and scram capabilities are not adversely affected.
The control rod is disarmed to prevent inadvertent withdrawal during subsequent operations. The control rods can be hydraulically disarmed by closing the drive water and exhaust water isolation valves. Electrically, the control rods can be disarmed by disconnecting power from all four directional control valve solenoids. Required Action C.1 is modified by a Note that allows control rods to be bypassed in the RACS if required to allow insertion of the inoperable control rods and continued operation. SR 3.3.2.1.9 provides additional requirements when the control rods are bypassed to ensure compliance with the CRDA analysis.
(continued)
CLINTON                   B 3.1-17                     Revision No. 0

Control Rod OPERABILITY B 3.1.3 BASES ACTIONS C.1 and C.2 (continued)
The allowed Completion Times are reasonable, considering the small number of allowed inoperable control rods, and provide time to insert and disarm the control rods in an orderly manner and without challenging plant systems.
D.1 and D.2 Out of sequence control rods may increase the potential reactivity worth of a dropped control rod during a CRDA. At d 16.7% RTP, the generic banked position withdrawal sequence (BPWS) analysis (Ref. 8) requires inserted control rods not in compliance with BPWS to be separated by at least two OPERABLE control rods in all directions, including the diagonal. Therefore, if two or more inoperable control rods are not in compliance with BPWS and not separated by at least two OPERABLE control rods, action must be taken to restore compliance with BPWS or restore the control rods to OPERABLE status. A Note has been added to the Condition to clarify that the Condition is not applicable when
        > 16.7% RTP since the BPWS is not required to be followed under these conditions, as described in the Bases for LCO 3.1.6. The allowed Completion Time of 4 hours is acceptable, considering the low probability of a CRDA occurring.
E.1 If any Required Action and associated Completion Time of Condition A, C, or D are not met or nine or more inoperable control rods exist, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. This ensures all insertable control rods are inserted and places the reactor in a condition that does not require the active function (i.e., scram) of the control rods. The number of control rods permitted to be inoperable when operating above 16.7% RTP (i.e., no CRDA considerations) could be more than the value specified, but the occurrence of a large number of inoperable control rods could be indicative of a generic problem, and investigation and resolution of the potential problem should be undertaken. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                  B 3.1-18                   Revision No. 7-5

Control Rod OPERABILITY B 3.1.3 BASES   (continued)
SURVEILLANCE        SR  3.1.3.1 REQUIREMENTS The position of each control rod must be determined, to ensure adequate information on control rod position is available to the operator for determining control rod OPERABILITY and controlling rod patterns. Control rod position may be determined by the use of OPERABLE position indicators, by moving control rods to a position with an OPERABLE indicator, or by the use of other appropriate methods. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.1.3.2 Deleted SR  3.1.3.3 Control rod insertion capability is demonstrated by inserting each partially or fully withdrawn control rod at least one notch and observing that the control rod moves.
The control rod may then be returned to its original position. This ensures the control rod is not stuck and is free to insert on a scram signal. This Surveillance is modified by a note identifying that the Surveillance is not required to be performed when THERMAL POWER is less than or equal to the actual LPSP of the RPCS since the notch insertions may not be compatible with the requirements of BPWS (LCO 3.1.6) and the RPCS (LCO 3.3.2.1). This note also provides a time allowance (i.e., the associated SR Frequency plus the extension allowed by SR 3.0.2) such that the Surveillance is not required to be performed until the next scheduled control rod testing. This note provides this allowance to prevent unnecessary perturbations in reactor operation to perform this testing on a control rod. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. At any time, if a control rod is (continued)
CLINTON                              B 3.1-19                  Revision No. 14-2

Control Rod OPERABILITY B 3.1.3 BASES SURVEILLANCE SR  3.1.3.3   (continued)
REQUIREMENTS immovable, a determination of that control rod's trippability (OPERABILITY) must be made and appropriate action taken.
SR  3.1.3.4 Verifying the scram time for each control rod to notch position 13 is d 7 seconds provides reasonable assurance that the control rod will insert when required during a DBA or transient, thereby completing its shutdown functions.
This SR is performed in conjunction with the control rod scram time testing of SR 3.1.4.1, SR 3.1.4.2, SR 3.1.4.3, and SR 3.1.4.4. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1, "Reactor Protection System (RPS)
Instrumentation," and the functional testing of SDV vent and drain valves in LCO 3.1.8, "Scram Discharge Volume (SDV)
Vent and Drain Valves," overlap this Surveillance to provide complete testing of the assumed safety function. The associated Frequencies are acceptable, considering the more frequent testing performed to demonstrate other aspects of control rod OPERABILITY and operating experience, which shows scram times do not significantly change over an operating cycle.
With regard to scram time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).
SR  3.1.3.5 Coupling verification is performed to ensure the control rod is connected to the CRDM and will perform its intended function when necessary. The Surveillance requires verifying that a control rod does not go to the withdrawn overtravel position when it is fully withdrawn. The overtravel position feature provides a positive check on the coupling integrity, since only an uncoupled CRD can reach the overtravel position. If the control rod goes to the withdrawn overtravel position, the control rod drive mechanism can be inserted to attempt recoupling, within the limitations of Condition C. This verification is required (continued)
CLINTON                        B 3.1-20                 Revision No. 13-1

Control Rod OPERABILITY B 3.1.3 BASES SURVEILLANCE SR  3.1.3.5 (continued)
REQUIREMENTS to be performed anytime a control rod is withdrawn to the "full out" position (notch position 48) or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This includes control rods inserted one notch and then returned to the "full out" position during the performance of SR 3.1.3.2.
This Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not being moved and operating experience related to uncoupling events.
REFERENCES   1. 10 CFR 50, Appendix A, GDC 26, GDC 27, GDC 28, and GDC 29.
: 2. USAR, Section 4.3.2.
: 3. USAR, Section 4.6.1.1.2.5.3.
: 4. USAR, Section 5.2.2.2.2.3.
: 5. USAR, Section 15.4.1.
: 6. USAR, Section 15.4.2.
: 7. USAR, Section 15.4.9.
: 8. NEDO-21231, "Banked Position Withdrawal Sequence,"
Section 7.2, January 1977.
: 9. Calculation IP-0-0010.
CLINTON                       B 3.1-21                   Revision No. 4-6

Control Rod Scram Times B 3.1.4 B 3.1   REACTIVITY CONTROL SYSTEMS B 3.1.4   Control Rod Scram Times BASES BACKGROUND         The scram function of the Control Rod Drive (CRD) System controls reactivity changes during abnormal operational transients to ensure that specified acceptable fuel design limits are not exceeded (Ref. 1). The control rods are scrammed by positive means, using hydraulic pressure exerted on the CRD piston.
When a scram signal is initiated, control air is vented from the scram valves, allowing them to open by spring action.
Opening the exhaust valves reduces the pressure above the main drive piston to atmospheric pressure, and opening the inlet valve applies the accumulator or reactor pressure to the bottom of the piston. Since the notches in the index tube are tapered on the lower edge, the collet fingers are forced open by cam action, allowing the index tube to move upward without restriction because of the high differential pressure across the piston. As the drive moves upward and accumulator pressure drops below the reactor pressure, a ball check valve opens, letting the reactor pressure complete the scram action. If the reactor pressure is low, such as during startup, the accumulator will fully insert the control rod within the required time without assistance from reactor pressure.
APPLICABLE         The analytical methods and assumptions used in evaluating SAFETY ANALYSES    the control rod scram function are presented in References 2, 3, 4, 5, 6, and 7. The Design Basis Accident (DBA) and transient analyses assume that all of the control rods scram at a specified insertion rate. The resulting negative scram reactivity forms the basis for the determination of plant thermal limits (e.g., the MCPR). Other distributions of scram times (e.g., several control rods scramming slower than the average time, with several control rods scramming faster than the average time) can also provide sufficient scram reactivity. Surveillance of each individual control rod's scram time ensures the scram reactivity assumed in the DBA and transient analyses can be met.
(continued)
CLINTON                             B 3.1-22                     Revision No. 0

Control Rod Scram Times B 3.1.4 BASES APPLICABLE      The scram function of the CRD System protects the MCPR SAFETY ANALYSES Safety Limit (SL) (see Bases for SL 2.1.1, "Reactor Core (continued)   SLs," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"),
and the 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded. Above 950 psig, the scram function is designed to insert negative reactivity at a rate fast enough to prevent the actual MCPR from becoming less than the MCPR SL during the analyzed limiting power transient. Below 950 psig, the scram function is assumed to perform during the control rod drop accident (Ref. 7) and, therefore, also provides protection against violating fuel damage limits during reactivity insertion accidents (see Bases for LCO 3.1.6, "Control Rod Pattern"). For the reactor vessel overpressure protection analysis, the scram function, along with the safety/relief valves, ensure that the peak vessel pressure is maintained within the applicable ASME Code limits.
Control rod scram times satisfy Criterion 3 of the NRC Policy Statement.
LCO             The scram times specified in Table 3.1.4-1 (in the accompanying LCO) are required to ensure that the scram reactivity assumed in the DBA and transient analysis is met.
To account for single failure and "slow" scramming control rods, the scram times specified in Table 3.1.4-1 are faster than those assumed in the design basis analysis. The scram times have a margin to allow up to 7.5% of the control rods (i.e., 145 x 7.5% = 10) to have scram times that exceed the specified limits (i.e., "slow" control rods) assuming a single stuck control rod (as allowed by LCO 3.1.3, "Control Rod OPERABILITY") and an additional control rod failing to scram per the single failure criterion. The scram times are specified as a function of reactor steam dome pressure to account for the pressure dependence of the scram times. The scram times are specified relative to measurements based on reed switch positions, which provide the control rod position indication. The reed switch closes ("pickup") when the index tube passes a specific location and then opens
("dropout") as the index tube travels upward. Verification of the specified scram times in Table 3.1.4-1 is accomplished through measurement of the "dropout" times.
(continued)
CLINTON                           B 3.1-23                  Revision No. 9-5

Control Rod Scram Times B 3.1.4 BASES LCO           To ensure that local scram reactivity rates are maintained (continued) within acceptable limits, no "slow" control rod may occupy a location adjacent to another "slow" control rod or adjacent to a withdrawn stuck control rod.
Table 3.1.4-1 is modified by two Notes, which state control rods with scram times not within the limits of the Table are considered "slow" and that control rods with scram times
              > 7 seconds are considered inoperable as required by SR 3.1.3.4.
This LCO applies only to OPERABLE control rods since inoperable control rods will be inserted and disarmed (LCO 3.1.3). Slow scramming control rods may be conservatively declared inoperable and not accounted for as "slow" control rods.
APPLICABILITY In MODES 1 and 2, a scram is assumed to function during transients and accidents analyzed for these plant conditions. These events are assumed to occur during startup and power operation; therefore, the scram function of the control rods is required during these MODES. In MODES 3 and 4, the control rods are not able to be withdrawn since the reactor mode switch is in Shutdown and a control rod block is applied. This provides adequate requirements for control rod scram capability during these conditions.
Scram requirements in MODE 5 are contained in LCO 3.9.5, "Control Rod OPERABILITY  Refueling."
ACTIONS       A.1 When the requirements of this LCO are not met, the rate of negative reactivity insertion during a scram may not be within the assumptions of the safety analyses. Therefore, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                        B 3.1-24                      Revision No. 0

Control Rod Scram Times B 3.1.4 BASES   (continued)
SURVEILLANCE        The four SRs of this LCO are modified by a Note stating that REQUIREMENTS        during a single control rod scram time surveillance, the CRD pumps shall be isolated from the associated scram accumulator. With the CRD pump isolated (i.e., charging valve closed), the influence of the CRD pump head does not affect the single control rod scram times. During a full core scram, the CRD pump head would be seen by all control rods and would have a negligible effect on the scram insertion times.
SR  3.1.4.1 The scram reactivity used in DBA and transient analyses is based on assumed control rod scram time. Measurement of the scram times with reactor steam dome pressure t 950 psig demonstrates acceptable scram times for the transients analyzed in References 3 and 4.
Scram insertion times increase with increasing reactor pressure because of the competing effects of reactor steam dome pressure and stored accumulator energy. Therefore, demonstration of adequate scram times at reactor steam dome pressure t 950 psig ensures that the scram times will be within the specified limits at higher pressures. Limits are specified as a function of reactor pressure to account for the sensitivity of the scram insertion times with pressure and to allow a range of pressures over which scram time testing can be performed. To ensure scram time testing is performed within a reasonable time following fuel movement within the reactor pressure vessel or after a shutdown t 120 days, control rods are required to be tested before exceeding 40% RTP. In the event fuel movement is limited to selected core cells, it is the intent of this SR that only those CRDs associated with the core cells affected by the fuel movements are required to be scram time tested.
However, if the reactor remains shutdown t 120 days, all control rods are required to be scram time tested. This Frequency is acceptable, considering the additional surveillances performed for control rod OPERABILITY, the frequent verification of adequate accumulator pressure, and the required testing of control rods affected by work on control rods or the CRD System.
With regard to scram time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).
(continued)
CLINTON                              B 3.1-25                   Revision No. 4-6

Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR  3.1.4.2 REQUIREMENTS Additional testing of a sample of control rods is required to verify the continued performance of the scram function during the cycle. A representative sample contains at least 10% of the control rods. The sample remains "representative" if no more than 7.5% of the control rods in the tested sample are determined to be "slow." If more than 7.5% of the sample is declared to be "slow" per the criteria in Table 3.1.4-1, additional control rods are tested until this 7.5% criterion (i.e., 7.5% of the entire sample size) is satisfied, or until the total number of "slow" control rods throughout the core, from all surveillances) exceed the LCO limit. For planned testing, the control rods selected for the sample should be different for each test. Data from inadvertent scrams should be used whenever possible to avoid unnecessary testing at power, even if the control rods with data were previously tested in a sample. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to scram time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).
SR  3.1.4.3 When work that could affect the scram insertion time is performed on a control rod or the CRD System, testing must be done to demonstrate that each affected control rod retains adequate scram performance over the range of applicable reactor pressures from zero to the maximum permissible pressure. The scram testing must be performed once before declaring the control rod OPERABLE. The required scram time testing must demonstrate that the affected control rod is still within acceptable limits by demonstrating an acceptable scram insertion time to notch position 13. The scram time acceptance criteria for this alternate test shall be determined by linear interpolation between 0.95 seconds at a reactor coolant pressure of 0 psig and 1.40 seconds at 950 psig. The limits for reactor pressures < 950 psig are established based on a high (continued)
CLINTON                       B 3.1-26                  Revision No. 14-2

Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR  3.1.4.3   (continued)
REQUIREMENTS probability of meeting the acceptance criteria at reactor pressures t950 psig. Limits for t 950 psig are found in Table 3.1.4-1. If testing demonstrates the affected control rod does not meet these limits, but is within the 7 second limit of Table 3.1.4-1 Note 2, the control rod can be declared OPERABLE and "slow."
Specific examples of work that could affect the scram times include (but are not limited to) the following: removal of any CRD for maintenance or modification; replacement of a control rod; and maintenance or modification of a scram solenoid pilot valve, scram valve, accumulator isolation valve, or check valves in the piping required for scram.
The Frequency of once prior to declaring the affected control rod OPERABLE is acceptable because of the capability of testing the control rod over a range of operating conditions and the more frequent surveillances on other aspects of control rod OPERABILITY.
With regard to scram time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).
SR  3.1.4.4 When work that could affect the scram insertion time is performed on a control rod or CRD System, testing must be done to demonstrate each affected control rod is still within the limits of Table 3.1.4-1 with the reactor steam dome pressure t 950 psig. Where work has been performed at high reactor pressure, the requirements of SR 3.1.4.3 and SR 3.1.4.4 will be satisfied with one test. For a control rod affected by work performed while shut down, however, a zero pressure and a high pressure test may be required.
This testing ensures that the control rod scram performance is acceptable for operating reactor pressure conditions prior to withdrawing the control rod for continued operation. Alternatively, a test during hydrostatic pressure testing could also satisfy both criteria.
The Frequency of once prior to exceeding 40% RTP is acceptable because of the capability of testing the control rod at the different conditions and the more frequent surveillances on other aspects of control rod OPERABILITY.
(continued)
CLINTON                        B 3.1-27                   Revision No. 4-6

Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR  3.1.4.4  (continued)
REQUIREMENTS With regard to scram time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).
REFERENCES   1. 10 CFR 50, Appendix A, GDC 10.
: 2. USAR, Section 4.3.2.
: 3. USAR, Section 4.6.1.1.2.5.3.
: 4. USAR, Section 5.2.2.2.2.3.
: 5. USAR, Section 15.4.1.
: 6. USAR, Section 15.4.2.
: 7. USAR, Section 15.4.9.
: 8. Calculation IP-0-0010.
CLINTON                       B 3.1-27a                  Revision No. 4-6

This page intentionally blank.
CLINTON            B 3.1-27b           Revision No. 4-6

Control Rod Scram Accumulators B 3.1.5 B 3.1   REACTIVITY CONTROL SYSTEMS B 3.1.5   Control Rod Scram Accumulators BASES BACKGROUND         The control rod scram accumulators are part of the Control Rod Drive (CRD) System and are provided to ensure that the control rods scram under varying reactor conditions. The control rod scram accumulators store sufficient energy to fully insert a control rod at any reactor vessel pressure.
The accumulator is a hydraulic cylinder with a free floating piston. The piston separates the water used to scram the control rods from the nitrogen, which provides the required energy. The scram accumulators are necessary to scram the control rods within the required insertion times of LCO 3.1.4, "Control Rod Scram Times."
APPLICABLE         The analytical methods and assumptions used in evaluating SAFETY ANALYSES    the control rod scram function are presented in References 1, 2, 3, 4, and 5. The Design Basis Accident (DBA) and transient analyses assume that all of the control rods scram at a specified insertion rate. OPERABILITY of each individual control rod scram accumulator, along with LCO 3.1.3, "Control Rod OPERABILITY," and LCO 3.1.4, ensures that the scram reactivity assumed in the DBA and transient analyses can be met. The existence of an inoperable accumulator may invalidate prior scram time measurements for the associated control rod.
The scram function of the CRD System, and, therefore, the OPERABILITY of the accumulators, protects the MCPR Safety Limit (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and the 1% cladding plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded (see Bases for LCO 3.1.4). Also, the scram function at low reactor vessel pressure (i.e., startup conditions) provides protection against violating fuel design limits during reactivity insertion accidents (see Bases for LCO 3.1.6, "Control Rod Pattern").
(continued)
CLINTON                             B 3.1-28                   Revision No. 5-9

Control Rod Scram Accumulators B 3.1.5 BASES APPLICABLE      Control rod scram accumulators satisfy Criterion 3 of the SAFETY ANALYSES NRC Policy Statement.
(continued)
LCO             The OPERABILITY of the control rod scram accumulators is required to ensure that adequate scram insertion capability exists when needed over the entire range of reactor pressures. The OPERABILITY of the scram accumulators is based on maintaining adequate accumulator pressure.
APPLICABILITY   In MODES 1 and 2, the scram function is required for mitigation of DBAs and transients and, therefore, the scram accumulators must be OPERABLE to support the scram function.
In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in Shutdown and a control rod block is applied. This provides adequate requirements for control rod scram accumulator OPERABILITY under these conditions. Requirements for scram accumulators in MODE 5 are contained in LCO 3.9.5, "Control Rod OPERABILITY-Refueling.
ACTIONS         The ACTIONS table is modified by a Note indicating that a separate Condition entry is allowed for each control rod scram accumulator. This is acceptable since the Required Actions for each Condition provide appropriate compensatory action for each affected control rod. Complying with the Required Actions may allow for continued operation and subsequent affected control rods governed by subsequent Condition entry and application of associated Required Actions.
A.1 and A.2 With one control rod scram accumulator inoperable and the reactor steam dome pressure t 600 psig, the control rod may be declared "slow," since the control rod will still scram at the reactor operating pressure but may not satisfy the required scram times in Table 3.1.4-1. Required Action A.1 is modified by a Note, which clarifies that declaring the control rod "slow" is only applicable if the associated control scram time was within the limits of Table 3.1.4-1 during the last scram time test. Otherwise, the control rod (continued)
CLINTON                          B 3.1-29                     Revision No. 0

Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS A.1 and A.2  (continued) would already be considered "slow" and the further degradation of scram performance with an inoperable accumulator could result in excessive scram times. In this event, the associated control rod is declared inoperable (Required Action A.2) and LCO 3.1.3 entered. This would result in requiring the affected control rod to be fully inserted and disarmed, thereby satisfying its intended function in accordance with ACTIONS of LCO 3.1.3.
The allowed Completion Time of 8 hours is considered reasonable, based on the large number of control rods available to provide the scram function and the ability of the affected control rod to scram only with reactor pressure at high reactor pressures.
B.1, B.2.1, and B.2.2 With two or more control rod scram accumulators inoperable and reactor steam dome pressure t 600 psig, adequate pressure must be supplied to the charging water header.
With inadequate charging water pressure, all of the accumulators could become inoperable, resulting in a potentially severe degradation of the scram performance.
Therefore, within 20 minutes from discovery of charging water header pressure < 1520 psig concurrent with Condition B, adequate charging water header pressure must be restored. The allowed Completion Time of 20 minutes is considered a reasonable time to place a CRD pump into service to restore the charging header pressure, if required. This Completion Time also recognizes the ability of the reactor pressure alone to fully insert all control rods.
The control rod may be declared "slow," since the control rod will still scram using only reactor pressure, but may not satisfy the times in Table 3.1.4-1. Required Action B.2.1 is modified by a Note indicating that declaring the control rod "slow" is only applicable if the associated control scram time was within the limits of Table 3.1.4-1 during the last scram time test. Otherwise, the control rod (continued)
CLINTON                  B 3.1-30                     Revision No. 0

Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS B.1, B.2.1, and B.2.2  (continued) would already be considered "slow" and the further degradation of scram performance with an inoperable accumulator could result in excessive scram times. In this event, the associated control rod is declared inoperable (Required Action B.2.2) and LCO 3.1.3 entered. This would result in requiring the affected control rod to be fully inserted and disarmed, thereby satisfying its intended function in accordance with ACTIONS of LCO 3.1.3.
The allowed Completion Time of 1 hour is considered reasonable, based on the ability of only the reactor pressure to scram the control rods and the low probability of a DBA or transient occurring while the affected accumulators are inoperable.
C.1 and C.2 With one or more control rod scram accumulators inoperable and the reactor steam dome pressure < 600 psig, the pressure supplied to the charging water header must be adequate to ensure that accumulators remain charged. With the reactor steam dome pressure < 600 psig, the function of the accumulators in providing the scram force becomes much more important since the scram function could become severely degraded during a depressurization event or at low reactor pressures. Therefore, immediately upon discovery of charging water header pressure < 1520 psig, concurrent with Condition C, all control rods associated with inoperable accumulators must be verified to be fully inserted.
Withdrawn control rods with inoperable scram accumulators may fail to scram under these low pressure conditions. The associated control rods must also be declared inoperable within 1 hour. The allowed Completion Time of 1 hour is reasonable for Required Action C.2, considering the low probability of a DBA or transient occurring during the time the accumulator is inoperable.
(continued)
CLINTON                  B 3.1-31                    Revision No. 5-9

Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS       D.1 (continued)
The reactor mode switch must be immediately placed in the shutdown position if either Required Action and associated Completion Time associated with the loss of the CRD pump (Required Actions B.1 and C.1) cannot be met. This ensures that all insertable control rods are inserted and that the reactor is in a condition that does not require the active function (i.e., scram) of the control rods. This Required Action is modified by a Note stating that the Required Action is not applicable if all control rods associated with the inoperable scram accumulators are fully inserted, since the function of the control rods has been performed.
SURVEILLANCE  SR  3.1.5.1 REQUIREMENTS SR 3.1.5.1 requires that the accumulator pressure be checked periodically to ensure adequate accumulator pressure exists to provide sufficient scram force. The primary indicator of accumulator OPERABILITY is the accumulator pressure. A minimum accumulator pressure is specified, below which the capability of the accumulator to perform its intended function becomes degraded and the accumulator is considered inoperable. The minimum accumulator pressure of 1520 psig is well below the expected pressure of 1750 psig (Ref. 2).
Declaring the accumulator inoperable when the minimum pressure is not maintained ensures that significant degradation in scram times does not occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to accumulator pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 6).
(continued)
CLINTON                        B 3.1-32                  Revision No. 14-2

Control Rod Scram Accumulators B 3.1.5 BASES   (continued)
REFERENCES          1. USAR, Section 4.3.2.
: 2. USAR, Section 4.6.1.1.2.5.3.
: 3. USAR, Section 5.2.2.2.2.3.
: 4. USAR, Section 15.4.1.
: 5. USAR, Section 15.4.2.
: 6. Calculation IP-0-0133.
CLINTON                           B 3.1-32a                   Revision No. 5-9

This page intentionally blank.
CLINTON            B 3.1-32b           Revision No. 4-6

Control Rod Pattern B 3.1.6 B 3.1   REACTIVITY CONTROL SYSTEMS B 3.1.6   Control Rod Pattern BASES BACKGROUND         Control rod patterns during startup conditions are controlled by the operator and the rod pattern controller (RPC) (LCO 3.3.2.1, "Control Rod Block Instrumentation"), so that only specified control rod sequences and relative positions are allowed over the operating range of all control rods inserted up to the low power setpoint (LPSP).
The sequences effectively limit the potential amount of reactivity addition that could occur in the event of a control rod drop accident (CRDA).
This Specification assures that the control rod patterns are consistent with the assumptions of the CRDA analyses of References 1 and 2.
APPLICABLE         The analytical methods and assumptions used in evaluating SAFETY ANALYSES    the CRDA are summarized in References 1 and 2. CRDA analyses assume that the reactor operator follows prescribed withdrawal sequences. These sequences define the potential initial conditions for the CRDA analysis. The RPC (LCO 3.3.2.1) provides backup to operator control of the withdrawal sequences to ensure that the initial conditions of the CRDA analysis are not violated.
Prevention or mitigation of positive reactivity insertion events is necessary to limit the energy deposition in the fuel, thereby preventing significant fuel damage, which could result in undue release of radioactivity. Since the failure consequences for UO2 have been shown to be insignificant below fuel energy depositions of 300 cal/gm (Ref. 3), the fuel damage limit of 280 cal/gm provides a margin of safety from significant core damage, which would result in release of radioactivity (Refs. 4 and 5). Generic evaluations (Ref. 6) of a design basis CRDA (i.e., a CRDA resulting in a peak fuel energy deposition of 280 cal/gm) have shown that if the peak fuel enthalpy remains below 280 cal/gm, then the maximum reactor pressure will be less than the required ASME Code limits (Ref. 7) and the calculated offsite doses will be well within the required limits (Ref. 5).
(continued)
CLINTON                             B 3.1-33                     Revision No. 0

Control Rod Pattern B 3.1.6 BASES APPLICABLE      Control rod patterns analyzed in Reference 2 follow the SAFETY ANALYSES banked position withdrawal sequence (BPWS) described in (continued)   Reference 8. The BPWS is applicable from the condition of all control rods fully inserted to 16.7% RTP (Ref. 9). For the BPWS, the control rods are required to be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions (e.g.,
between notches 08 and 12). The banked positions are defined to minimize the maximum incremental control rod worths without being overly restrictive during normal plant operation. The generic BPWS analysis (Ref. 8) also evaluated the effect of fully inserted, inoperable control rods not in compliance with the sequence, to allow a limited number (i.e., eight) and distribution of fully inserted, inoperable control rods.
When performing a shutdown of the plant, an optional BPWS control rod sequence (Ref. 10) may be used provided that all withdrawn control rods have been confirmed to be coupled.
The rods may be inserted without the need to stop at intermediate positions since the possibility of a CRDA is eliminated by the confirmation that withdrawn control rods are coupled. When using the Reference 10 control rod sequence for shutdown, the rod pattern controller may be bypassed in accordance with the allowance provided in the Applicability Note for the Rod Pattern Controller in Table 3.3.2.1-1.
In order to use the Reference 10 BPWS shutdown process, an extra check is required in order to consider a control rod to be "confirmed" to be coupled. This extra check ensures that no Single Operator Error can result in an incorrect coupling check. For purposes of this shutdown process, the method for confirming that control rods are coupled varies depending on the position of the control rod in the core.
Details on this coupling confirmation requirement are provided in Reference 10. If the requirements for use of the BPWS control rod insertion process contained in Reference 10 are followed, the plant is considered to be in compliance with BPWS requirements, as required by LCO 3.1.6.
Rod pattern control satisfies the requirements of Criterion 3 of the NRC Policy Statement.
LCO             Compliance with the prescribed control rod sequences minimizes the potential consequences of a CRDA by limiting the initial conditions to those consistent with the BPWS.
This LCO only applies to OPERABLE control rods. For inoperable control rods required to be inserted, separate requirements are specified in LCO 3.1.3, "Control Rod OPERABILITY," consistent with the allowances for inoperable control rods in the BPWS.
(continued)
CLINTON                          B 3.1-34                 Revision No. 20-11

Control Rod Pattern B 3.1.6 BASES   (continued)
APPLICABILITY       In MODES 1 and 2, when THERMAL POWER is < 16.7% RTP, the CRDA is a Design Basis Accident (DBA) and, therefore, compliance with the assumptions of the safety analysis is required. When THERMAL POWER is > 16.7% RTP, there is no credible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA (Ref. 9). In MODES 3, 4, and 5, since the reactor is shut down and only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will remain subcritical with a single control rod withdrawn.
ACTIONS             A.1 and A.2 With one or more OPERABLE control rods not in compliance with the prescribed control rod sequence, action may be taken to either correct the control rod pattern or declare the associated control rods inoperable within 8 hours.
Noncompliance with the prescribed sequence may be the result of "double notching," drifting from a control rod drive cooling water transient, leaking scram valves, or a power reduction to < 16.7% RTP before establishing the correct control rod pattern. The number of OPERABLE control rods not in compliance with the prescribed sequence is limited to eight to prevent the operator from attempting to correct a control rod pattern that significantly deviates from the prescribed sequence. When the control rod pattern is not in compliance with the prescribed sequence, all control rod movement should be stopped except for moves needed to correct the control rod pattern, or scram if warranted.
Required Action A.1 is modified by a Note, which allows control rods to be bypassed in Rod Action Control System (RACS) to allow the affected control rods to be returned to their correct position. This ensures that the control rods will be moved to the correct position. A control rod not in compliance with the prescribed sequence is not considered inoperable except as required by Required Action A.2.
OPERABILITY of control rods is determined by compliance with LCO 3.1.3; LCO 3.1.4, "Control Rod Scram Times"; and LCO 3.1.5, "Control Rod Scram Accumulators." The allowed Completion Time of 8 hours is reasonable, considering the restrictions on the number of allowed out of sequence control rods and the low probability of a CRDA occurring during the time the control rods are out of sequence.
(continued)
CLINTON                              B 3.1-35                 Revision No. 20-11

Control Rod Pattern B 3.1.6 BASES ACTIONS       B.1 and B.2 (continued)
If nine or more OPERABLE control rods are out of sequence, the control rod pattern significantly deviates from the prescribed sequence. Control rod withdrawal should be suspended immediately to prevent the potential for further deviation from the prescribed sequence. Control rod insertion to correct control rods withdrawn beyond their allowed position is allowed since, in general, insertion of control rods has less impact on control rod worth than withdrawals have. Required Action B.1 is modified by a Note that allows the affected control rods to be bypassed in RACS in accordance with SR 3.3.2.1.9 to allow insertion only.
With nine or more OPERABLE control rods not in compliance with BPWS, the reactor mode switch must be placed in the shutdown position within 1 hour. With the reactor mode switch in Shutdown, the reactor is shut down, and therefore does not meet the applicability requirements of this LCO.
The allowed Completion Time of 1 hour is reasonable to allow insertion of control rods to restore compliance, and is appropriate relative to the low probability of a CRDA occurring with the control rods out of sequence.
SURVEILLANCE  SR  3.1.6.1 REQUIREMENTS The control rod pattern is periodically verified to be in compliance with the BPWS, ensuring the assumptions of the CRDA analyses are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
The RPC provides control rod blocks to enforce the required control rod sequence and is required to be OPERABLE when operating at < 16.7% RTP.
REFERENCES    1. USAR, Section 15.0
: 2. USAR, Section 15.4.9.
: 3. NUREG-0979, "NRC Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design, Docket No. 50-447,"
Section 4.2.1.3.2, April 1983.
: 4. NUREG-0800, "Standard Review Plan," Section 15.4.9, "Radiological Consequences of Control Rod Drop Accident (BWR)," Revision 2, July 1981.
: 5. 10 CFR 100.11, "Determination of Exclusion Area, Low Population Zone, and Population Center Distance."
(continued)
CLINTON                        B 3.1-36                 Revision No. 20-11

Control Rod Pattern B 3.1.6 BASES REFERENCES    6. NEDO-21778-A, "Transient Pressure Rises Affected (continued)     Fracture Toughness Requirements for Boiling Water Reactors," December 1978.
: 7. ASME, Boiler and Pressure Vessel Code.
: 8. NEDO-21231, "Banked Position Withdrawal Sequence,"
January 1977.
: 9. USAR, Section 7.6.1.7.3.
: 10. NEDO-33091-A, Revision 2, "Improved BPWS Control Rod Insertion Process," July 2004.
CLINTON                       B 3.1-37                 Revision No. 20-11

SLC System B 3.1.7 B 3.1   REACTIVITY CONTROL SYSTEMS B 3.1.7   Standby Liquid Control (SLC) System BASES BACKGROUND         The SLC System is designed to provide the capability of bringing the reactor, at any time in a fuel cycle, from full power and minimum control rod inventory (which is at the peak of the xenon transient) to a subcritical condition with the reactor in the most reactive xenon free state without taking credit for control rod movement. The SLC System satisfies the requirements of 10 CFR 50.62 (Ref. 1) on anticipated transient without scram (ATWS).
The SLC System is also used to maintain suppression pool pH at or above 7 following a loss of coolant accident (LOCA) involving significant fission product releases. Maintaining suppression pool pH levels at or above 7 following an accident ensures that iodine will be retained in the suppression pool water (Ref. 8).
The SLC System consists of a boron solution storage tank, two positive displacement pumps, two explosive valves, which are provided in parallel for redundancy, and associated piping and valves used to transfer borated water from the storage tank to the reactor pressure vessel (RPV). The preferred flow path of the boron neutron absorber solution to the reactor vessel is by the High Pressure Core Spray (HPCS) System sparger. The SLC piping is connected to the HPCS System just downstream of the HPCS manual injection isolation valve. An alternate flow path to the reactor vessel is provided by the SLC sparger near the bottom of the core shroud. This flow path is normally locked out of service by the SLC manual injection valve.
APPLICABLE         The SLC System is manually initiated from the main control SAFETY ANALYSES    room, as directed by the emergency operating procedures, if the operator believes the reactor cannot be shut down, or kept shut down, with the control rods. The SLC System is used in the event that not enough control rods can be inserted to accomplish shutdown and cooldown in the normal manner. The SLC System injects borated water into the reactor core to compensate for all of the various reactivity effects that could occur during plant operation. To meet this objective, it is necessary to inject a quantity of boron that produces a concentration equivalent to at least 1000 ppm of natural boron in the reactor core at 68&deg;F. This is accomplished by the use of enriched boron (t 30 atom%
boron 10). To allow for potential leakage and imperfect mixing in the reactor system, an additional amount of boron equal to 25% of the amount cited above is added (Ref. 2).
The concentration versus volume limits in Figure 3.1.7-1 are calculated such that the required concentration is achieved accounting for dilution in the RPV with normal water level (continued)
CLINTON                             B 3.1-38                   Revision No. 10-5

SLC System B 3.1.7 BASES APPLICABLE      and including the water volume in the residual heat removal SAFETY ANALYSES shutdown cooling piping and in the recirculation loop (continued)   piping. This quantity of borated solution is the amount that is above the storage tank level instrument zero. (The instrument zero is based on ensuring sufficient net positive suction head and includes additional margin to preclude air entrainment in the pump suction piping due to vortexing during two pump operation.)
Following a LOCA, offsite doses from the accident will remain within 10 CFR 50.67, Accident Source Term, limits (Ref. 9) provided sufficient iodine activity is retained in the suppression pool. Credit for iodine deposition in the suppression pool is allowed (Ref. 8) as long as suppression pool pH is maintained at or above 7. Alternative Source Term analyses credit the use of the SLC System for maintaining the pH of the suppression pool at or above 7.
The SLC System satisfies the requirements of the NRC Policy Statement because operating experience and probabilistic risk assessment have generally shown it to be important to public health and safety.
LCO             The OPERABILITY of the SLC System provides backup capability for reactivity control, independent of normal reactivity control provisions provided by the control rods. The OPERABILITY of the SLC System is based on the conditions of the borated solution in the storage tank and the availability of a flow path to the RPV, including the OPERABILITY of the pumps and valves. Two SLC subsystems are required to be OPERABLE, each containing an OPERABLE pump, an explosive valve and associated piping, valves, and instruments and controls to ensure an OPERABLE flow path.
APPLICABILITY   In MODES 1 and 2, shutdown capability is required. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in Shutdown and a control rod block is applied. This provides adequate controls to ensure the reactor remains subcritical. In MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Demonstration of adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") ensures that the reactor will not become critical. Therefore, the SLC System is not required to be OPERABLE during these conditions, when only a single control rod can be withdrawn.
In MODES 1, 2, and 3, the SLC System must be OPERABLE to ensure that offsite doses remain within 10 CFR 50.67 (Ref.
: 9) limits following a LOCA involving significant fission product releases. The SLC System is used to maintain (continued)
CLINTON                          B 3.1-39                   Revision No. 10-5

SLC System B 3.1.7 BASES APPLICABLE      suppression pool pH at or above 7 following a LOCA to SAFETY ANALYSIS ensure that iodine will be retained in the suppression (continued)   pool water (Ref. 8).
ACTIONS         A.1 If one SLC subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. In this condition, the remaining OPERABLE subsystem is adequate to perform the shutdown function. However, the overall reliability is reduced because a single failure in the (continued)
CLINTON                          B 3.1-39a                 Revision No. 21-7

This page intentionally blank.
CLINTON            B 3.1-39b           Revision No. 10-5

SLC System B 3.1.7 BASES ACTIONS      A.1  (continued) remaining OPERABLE subsystem could result in reduced SLC System shutdown capability. The 7 day Completion Time is based on the availability of an OPERABLE subsystem capable of performing the intended SLC System function and the low probability of a Design Basis Accident (DBA) or severe transient occurring concurrent with the failure of the Control Rod Drive System to shut down the plant.
B.1 If both SLC subsystems are inoperable, at least one subsystem must be restored to OPERABLE status within 8 hours. The allowed Completion Time of 8 hours is considered acceptable, given the low probability of a DBA or transient occurring concurrent with the failure of the control rods to shut down the reactor.
C.1 and C.2 If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours and MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE SR  3.1.7.1, SR  3.1.7.2, and SR  3.1.7.3 REQUIREMENTS SR 3.1.7.1 through SR 3.1.7.3 verify certain characteristics of the SLC System (i.e., the volume and temperature of the borated solution in the storage tank, and temperature of the pump suction piping), thereby ensuring the SLC System OPERABILITY without disturbing normal plant operation.
These Surveillances ensure the proper borated solution and temperature, including the temperature of the pump suction piping, are maintained. Maintaining a minimum specified borated solution temperature is important in ensuring that the boron remains in solution and does not precipitate out (continued)
CLINTON                       B 3.1-40                  Revision No. 14-2

SLC System B 3.1.7 BASES SURVEILLANCE SR  3.1.7.1, SR  3.1.7.2, and SR  3.1.7.3  (continued)
REQUIREMENTS in the storage tank or in the pump suction piping. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to volume and temperature values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Refs. 3, 4, 5).
SR  3.1.7.4 and SR  3.1.7.6 SR 3.1.7.4 verifies the continuity of the explosive charges in the injection valves to ensure proper operation will occur if required. Other administrative controls, such as those that limit the shelf life of the explosive charges, must be followed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.1.7.6 verifies each valve in the system is in its correct position, but does not apply to the squib (i.e.,
explosive) valves. Verifying the correct alignment for manual, power operated, and automatic valves in the SLC System flow path ensures that the proper flow paths will exist for system operation. A valve is also allowed to be in the nonaccident position, provided it can be aligned to the accident position from the control room. This is acceptable since the SLC System is a manually initiated system. This Surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since they were verified to be in the correct position prior to locking, sealing, or securing. This verification of valve alignment does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct positions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                       B 3.1-41                  Revision No. 14-2

SLC System B 3.1.7 BASES SURVEILLANCE  SR  3.1.7.5 REQUIREMENTS (continued) This Surveillance requires an examination of the sodium pentaborate solution by using chemical analysis to ensure the proper concentration of boron exists in the storage tank. SR 3.1.7.5 must be performed anytime boron or water is added to the storage tank solution to establish that the boron solution concentration is within the specified limits.
This Surveillance must be performed anytime the solution temperature is restored to > 70&deg;F, to ensure no significant boron precipitation occurred. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to boron concentration values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 6).
SR  3.1.7.7 Demonstrating each SLC System pump develops a flow rate
              > 41.2 gpm at a discharge pressure > 1220 psig ensures that pump performance has not degraded during the fuel cycle.
This minimum pump flow rate requirement ensures that, when combined with the sodium pentaborate solution concentration requirements, the rate of negative reactivity insertion from the SLC System will adequately compensate for the positive reactivity effects encountered during power reduction, cooldown of the moderator, and xenon decay. This test confirms one point on the pump design curve, and is indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this Surveillance is in accordance with the INSERVICE TESTING PROGRAM.
Values obtained for flow rate and discharge pressure pursuant to this SR, as read from plant indication instrumentation, are considered to be nominal values and therefore do not require compensation for instrument indication uncertainties (Ref. 7).
(continued)
CLINTON                        B 3.1-42                  Revision No. 19-4

SLC System B 3.1.7 BASES SURVEILLANCE  SR  3.1.7.8 and SR  3.1.7.9 REQUIREMENTS (continued) These Surveillances ensure that there is a functioning flow path from the boron solution storage tank to the RPV, including the firing of an explosive valve. The replacement charge for the explosive valve shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of that batch successfully fired.
The Surveillance may be performed in separate steps to prevent injecting boron into the RPV. An acceptable method for verifying flow from the pump to the RPV is to pump demineralized water from a test tank through one SLC subsystem and into the RPV.
Demonstrating that all piping between the boron solution storage tank and the suction inlet to the injection pumps is unblocked ensures that there is a functioning flow path for injecting the sodium pentaborate solution. An acceptable method for verifying that the suction piping is unblocked is to pump from the storage tank to the test tank. Following this test, the piping will be drained and flushed with demineralized water. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
If in performing SR 3.1.7.3, it is determined that the temperature of this piping has fallen below the specified minimum, SR 3.1.7.9 must be performed once within 24 hours after the piping temperature is restored to > 70&deg;F.
REFERENCES    1. 10 CFR 50.62.
: 2. USAR, Section 9.3.5.3.
: 3. Calculation IP-0-0012.
: 4. Calculation IP-0-0013.
: 5. Calculation IP-0-0014.
: 6. Calculation IP-0-0015.
: 7. Calculation IP-0-0016.
: 8. NUREG-1465, Accident Source Terms for Light-Water Nuclear Power Plants, Final Report, February 1, 1995.
: 9. 10 CFR 50.67, Accident Source Terms.
CLINTON                        B 3.1-43                  Revision No. 14-2

SLC System B 3.1.7 B 3.1   REACTIVITY CONTROL SYSTEMS B 3.1.8   Scram Discharge Volume (SDV) Vent and Drain Valves BASES BACKGROUND         The SDV vent and drain valves are normally open and discharge any accumulated water in the SDV to ensure that sufficient volume is available at all times to allow a complete scram. During a scram, the SDV vent and drain valves close to contain reactor water. The SDV consists of header piping that connects to each hydraulic control unit (HCU) and drains into an instrument volume. There are two headers and two instrument volumes, each receiving approximately one half of the control rod drive (CRD) discharges. The two instrument volumes are connected to a common drain line with two valves in series. Each header is connected to a common vent line with two valves in series.
The header piping is sized to receive and contain all the water discharged by the CRDs during a scram. The design and functions of the SDV are described in Reference 1.
APPLICABLE         The Design Basis Accident and transient analyses assume all SAFETY ANALYSES    the control rods are capable of scramming. The primary function of the SDV is to limit the amount of reactor coolant discharged during a scram. The acceptance criteria for the SDV vent and drain valves are that they operate automatically to:
: a. Close during scram to limit the amount of reactor coolant discharged so that adequate core cooling is maintained and offsite doses remain within the limits of 10 CFR 100 (Ref. 2); and
: b. Open on scram reset to maintain the SDV vent and drain path open so there is sufficient volume to accept the reactor coolant discharged during a scram.
Isolation of the SDV can also be accomplished by manual closure of the SDV valves. Additionally, the discharge of reactor coolant to the SDV can be terminated by scram reset or closure of the HCU manual isolation valves. For a bounding leakage case, the offsite doses are well within the limits of 10 CFR 100 (Ref. 2) and adequate core cooling is maintained (Ref. 3). The SDV vent and drain valves also (continued)
CLINTON                              B 3.1-44                    Revision No. 0

SDV Vent and Drain Valves B 3.1.8 BASES APPLICABLE      allow continuous drainage of the SDV during normal plant SAFETY ANALYSES operation to ensure the SDV has sufficient capacity to (continued)   contain the reactor coolant discharge during a full core scram. To automatically ensure this capacity, a reactor scram (LCO 3.3.1.1, "Reactor Protection System (RPS)
Instrumentation") is initiated if the SDV water level exceeds a specified setpoint. The setpoint is chosen such that all control rods are inserted before the SDV has insufficient volume to accept a full scram.
SDV vent and drain valves satisfy Criterion 3 of the NRC Policy Statement.
LCO             The OPERABILITY of all SDV vent and drain valves ensures that, during a scram, the SDV vent and drain valves will close to contain reactor water discharged to the SDV piping.
Since the vent and drain lines are provided with two valves in series, the single failure of one valve in the open position will not impair the isolation function of the system. Additionally, the valves are required to be open to ensure that a path is available for the SDV piping to drain freely at other times.
APPLICABILITY   In MODES 1 and 2, scram may be required, and therefore, the SDV vent and drain valves must be OPERABLE. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in Shutdown and a control rod block is applied. This provides adequate controls to ensure that only a single control rod can be withdrawn. Also, during MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Therefore, the SDV vent and drain valves are not required to be OPERABLE in these MODES since the reactor is subcritical and only one rod may be withdrawn and subject to scram.
ACTIONS         The ACTIONS table is modified by Note 1 indicating that a separate Condition entry is allowed for each SDV vent and drain line. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SDV line. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SDV lines are governed by subsequent Condition entry and application of associated Required Actions.
(continued)
CLINTON                           B 3.1-45                  Revision No. 10-1

SDV Vent and Drain Valves B 3.1.8 BASES ACTIONS       When a line is isolated, the potential for an inadvertent (continued) scram due to high SDV level is increased. During these periods, the line may be unisolated under administrative control. This allows any accumulated water in the line to be drained, to preclude a reactor scram on SDV high level.
This is acceptable, since the administrative controls ensure the valve can be closed quickly, by a dedicated operator, if a scram occurs with the valve open.
A.1 When one SDV vent or drain valve is inoperable in one or more lines, the associated line must be isolated to contain the reactor coolant during a scram. The 7 day Completion Time is reasonable, given the level of redundancy in the lines and the low probability of a scram occurring during the time the valve(s) are inoperable and the line is not isolated. The SDV is still isolable since the redundant valve in the affected line is OPERABLE. Since the SDV is still isolable, the affected SDV line may be opened. This allows any accumulated water in the line to be drained, to preclude a reactor scram on SDV high level. During these periods, the single failure criterion may not be preserved, and a higher risk exists to allow reactor water out of the primary system during a scram.
B.1 If both valves in a line are inoperable, the line must be isolated to contain the reactor coolant during a scram.
The 8 hour Completion Time to isolate the line is based on the low probability of a scram occurring while the line is not isolated and unlikelihood of significant CRD seal leakage.
C.1 If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                        B 3.1-46                   Revision No. 10-1

SDV Vent and Drain Valves B 3.1.8 BASES   (continued)
SURVEILLANCE        SR  3.1.8.1 REQUIREMENTS During normal operation, the SDV vent and drain valves should be in the open position (except when performing SR 3.1.8.2) to allow for drainage of the SDV piping.
Verifying that each valve is in the open position ensures that the SDV vent and drain valves will perform their intended function during normal operation. This SR does not require any testing or valve manipulation; rather, it involves verification that the valves are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Improper valve position (closed) would not affect the isolation function.
SR  3.1.8.2 During a scram, the SDV vent and drain valves should close to contain the reactor water discharged to the SDV piping.
Cycling each valve through its complete range of motion (closed and open) ensures that the valve will function properly during a scram. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.1.8.3 SR 3.1.8.3 is an integrated test of the SDV vent and drain valves to verify total system performance. After receipt of a simulated or actual scram signal, the closure of the SDV vent and drain valves is verified. The closure time of 30 seconds after a receipt of a scram signal is based on the bounding leakage case evaluated in the accident analysis.
Similarly, after receipt of a simulated or actual scram reset signal, the opening of the SDV vent and drain valves is verified. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1 and the scram time testing of control rods in LCO 3.1.3, "Control Rod OPERABILITY," overlap this Surveillance to provide complete testing of the assumed safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to SDV vent and drain valve closing time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).
(continued)
CLINTON                              B 3.1-47                  Revision No. 14-2

SDV Vent and Drain Valves B 3.1.8 BASES   (continued)
REFERENCES          1. USAR, Section 4.6.1.1.2.4.2.5.
: 2. 10 CFR 100.
: 3. NUREG-0803, "Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping,"
August 1981.
: 4. Calculation IP-0-0017.
CLINTON                            B 3.1-48                  Revision No. 14-2

APLHGR B 3.2.1 B 3.2   POWER DISTRIBUTION LIMITS B 3.2.1   AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)
BASES BACKGROUND         The APLHGR is a measure of the average LHGR of all the fuel rods in a fuel assembly at any axial location. Limits on the APLHGR are specified to ensure that the peak cladding temperature (PCT) during the postulated design basis loss of coolant accident (LOCA) does not exceed the limits specified in 10 CFR 50.46.
APPLICABLE         The analytical methods and assumptions used in evaluating SAFETY ANALYSES    Design Basis Accidents (DBAs) and normal operations that determine APLHGR limits are presented in USAR Chapters 6 and 15, and in References 1, 2, 3, and 4.
APLHGR limits are developed as a function of exposure to ensure adherence to 10 CFR 50.46 during a LOCA (Refs. 3 and 4).
(continued)
CLINTON                              B 3.2-1                   Revision No. 9-3

APLHGR B 3.2.1 BASES APPLICABLE        LOCA analyses are performed to ensure that the above SAFETY ANALYSES   determined APLHGR limits are adequate to meet the PCT and (continued)     maximum oxidation limits of 10 CFR 50.46. The analysis is performed using calculational models that are consistent with the requirements of 10 CFR 50, Appendix K. A complete discussion of the analysis code is provided in Reference 5.
The PCT following a postulated LOCA is a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is not strongly influenced by the rod to rod power distribution within an assembly.
Clinton has no additional MAPLHGR setdown requirements in the LOCA evaluation to achieve acceptable ECCS-LOCA performance. The LHGRFAC multipliers of Section 3.2.3 are sufficient to provide adequate protection for the off-rated conditions from an ECCS-LOCA perspective.
For single recirculation loop operation, the APLHGR limit must be multiplied by the MAPLHGR single loop multiplier, which is specified in the COLR. This multiplier is due to the conservative analysis assumption of an earlier departure from nucleate boiling with one recirculation loop available, resulting in a more severe cladding heatup during a LOCA.
The APLHGR satisfies Criterion 2 of the NRC Policy Statement.
LCO               The APLHGR limits specified in the COLR are the result of fuel design and LOCA analyses. For two recirculation loops operating, the limit is determined by the exposure dependent APLHGR limits. With only one (continued)
CLINTON                             B 3.2-2                   Revision No. 9-3

APLHGR B 3.2.1 BASES LCO               recirculation loop in operation, in conformance with the (continued)     requirements of LCO 3.4.1, "Recirculation Loops Operating,"
the limit is determined by multiplying the exposure dependent APLHGR limit by the MAPLHGR single loop multiplier value specified for single recirculation loop operation in the COLR, which has been determined by a specific single recirculation loop analysis (Ref. 3).
APPLICABILITY     The APLHGR limits are primarily derived from fuel design evaluations and LOCA analyses that are assumed to occur at high power levels. Design calculations and operating experience have shown that as power is reduced, the margin to the required APLHGR limits increases. This trend continues down to the power range of 5% to 15% RTP when entry into MODE 2 occurs. When in MODE 2, the intermediate range monitor (IRM) scram function provides prompt scram initiation during any significant transient, thereby effectively removing any APLHGR limit compliance concern in MODE 2. Therefore, at THERMAL POWER levels
                  < 21.6% RTP, the reactor operates with substantial margin to the APLHGR limits; thus, this LCO is not required.
ACTIONS           A.1 If any APLHGR exceeds the required limit, an assumption regarding an initial condition of the LOCA analyses may not be met. Therefore, prompt action is taken to restore the APLHGR(s) to within the required limit(s) such that the plant will be operated within analyzed conditions and within the design limits of the fuel rods. The 2 hour Completion Time is sufficient to restore the APLHGR(s) to within its limit and is acceptable based on the low probability of a LOCA occurring simultaneously with the APLHGR out of specification.
B.1 If the APLHGR cannot be restored to within its required limit within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL (continued)
CLINTON                             B 3.2-3                   Revision No. 9-3

APLHGR B 3.2.1 BASES ACTIONS           B.1  (continued)
POWER must be reduced to < 21.6% RTP within 4 hours. The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 21.6% RTP in an orderly manner and without challenging plant systems.
SURVEILLANCE      SR  3.2.1.1 REQUIREMENTS APLHGRs are required to be initially calculated within 12 hours after THERMAL POWER is t 21.6% RTP and then periodically thereafter. They are compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 12 hour allowance after THERMAL POWER t 21.6% RTP is achieved is acceptable given the large inherent margin to operating limits at low power levels. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to APLHGR values obtained pursuant to this SR, as determined from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 6).
(continued)
CLINTON                             B 3.2-4                  Revision No. 14-2

APLHGR B 3.2.1 BASES (continued)
REFERENCES        1. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, GESTAR-II" (latest approved revision).
: 2. USAR, Chapter 15, Section 15.0.
: 3. USAR, Chapter 15, Appendix 15B.
: 4. USAR, Chapter 15, Appendix 15C.
: 5. NEDE-20566, "General Electric Company Analytical Model for Loss-of-Coolant Analysis in Accordance with 10CFR50 Appendix K," November 1975.
: 6. Calculation IP-0-0002.
CLINTON                            B 3.2-4a                   Revision No. 9-3

This page intentionally left blank.
CLINTON               B 3.2-4b              Revision No. 4-6

MCPR B 3.2.2 B 3.2   POWER DISTRIBUTION LIMITS B 3.2.2   MINIMUM CRITICAL POWER RATIO (MCPR)
BASES BACKGROUND         MCPR is a ratio of the fuel assembly power that would result in the onset of boiling transition to the actual fuel assembly power. The operating limit MCPR is established to ensure that no fuel damage results during anticipated operational occurrences (AOOs), and that 99.9% of the fuel rods are not susceptible to boiling transition if the limit is not violated. Although fuel damage does not necessarily occur if a fuel rod actually experiences boiling transition (Ref. 1), the critical power at which boiling transition is calculated to occur has been adopted as a fuel design criterion.
The onset of transition boiling is a phenomenon that is readily detected during the testing of various fuel bundle designs. Based on these experimental data, correlations have been developed to predict critical bundle power (i.e.,
the bundle power level at the onset of transition boiling) for a given set of plant parameters (e.g., reactor vessel pressure, flow, and subcooling). Because plant operating conditions and bundle power levels are monitored and determined relatively easily, monitoring the MCPR is a convenient way of ensuring that fuel failures due to inadequate cooling do not occur.
APPLICABLE         The analytical methods and assumptions used in evaluating SAFETY ANALYSES    the AOOs to establish the operating limit MCPR are presented in the USAR, Chapters 4, 6, and 15, and References 2, 3, 4, 5, and 6. To ensure that the MCPR Safety Limit (SL) is not exceeded during any transient event that occurs with moderate frequency, limiting transients have been analyzed to determine the largest reduction in critical power ratio (CPR). The types of transients evaluated are loss of flow, increase in pressure and power, positive reactivity insertion, and coolant temperature decrease. The limiting transient yields the largest change in CPR ('CPR). When the largest 'CPR is combined with the MCPR99.9%, the required operating limit MCPR is obtained.
(continued)
CLINTON                              B 3.2-5                   Revision No. 20-8

MCPR B 3.2.2 BASES APPLICABLE        MCPR99.9% is determined to ensure more than 99.9% of the SAFETY ANALYSES   fuel rods in the core are not susceptible to boiling (continued)     transition using a statistical model that combines all the uncertainties in operating parameters and the procedures used to calculate critical power. The probability of the occurrence of boiling transition is determined using the approved Critical Power correlations. Details of the MCPR99.9% calculation are given in Reference 2. Reference 2 also includes a tabulation of the uncertainties and the nominal values of the parameters used in the MCPR99.9%
statistical analysis.
The MCPR operating limits are derived from the MCPR99.9%
value and the transient analysis, and are dependent on the operating core flow and power state (MCPRf and MCPRp, respectively) to ensure adherence to fuel design limits during the worst transient that occurs with moderate frequency (Refs. 3, 4, and 5).
Flow dependent MCPR limits (MCPRf) are determined by steady state thermal hydraulic methods using the three dimensional BWR simulator code (Ref. 7) and the multichannel thermal hydraulic code. MCPRf curves are provided based on the maximum credible flow runout transient. The result of a single failure or single operator error is the runout of only one loop because both recirculation loops are under independent control.
Power dependent MCPR limits (MCPRp) are determined by approved transient analysis models (Refs. 2, 8, and 9). Due to the sensitivity of the transient response to initial core flow levels at power levels below those at which the turbine stop valve closure and turbine control valve fast closure scram trips are bypassed, high and low flow MCPRp operating limits are provided for operating between 21.6% RTP and the previously mentioned bypass power level.
The MCPR satisfies Criterion 2 of the NRC Policy Statement.
LCO               The MCPR operating limits specified in the COLR (MCPR99.9%
value, MCPRf values, and MCPRp values) are the result of the Design Basis Accident (DBA) and transient analysis. The MCPR operating limits are determined by the larger of the MCPRf and MCPRp limits, which are based on the MCPR99.9% limit specified in the COLR.
APPLICABILITY     The MCPR operating limits are primarily derived from transient analyses that are assumed to occur at high power levels. Below 21.6% RTP, the reactor is operating at a slow recirculation pump speed and the moderator void ratio is small. Surveillance of thermal limits below 21.6% RTP is unnecessary due to the large inherent margin that ensures that the MCPR SL is not exceeded even if a limiting transient occurs.
(continued)
CLINTON                          B 3.2-6                       Revision No. 21-8

MCPR B 3.2.2 BASES APPLICABILITY     Studies of the variation of limiting transient behavior have (continued)     been performed over the range of power and flow conditions.
These studies encompass the range of key actual plant parameter values important to typically limiting transients.
The results of these studies demonstrate that a margin is expected between performance and the MCPR requirements, and that margins increase as power is reduced to 21.6% RTP.
This trend is expected to continue to the 5% to 15% power range when entry into MODE 2 occurs. When in MODE 2, the intermediate range monitor (IRM) provides rapid scram initiation for any significant power increase transient, which effectively eliminates any MCPR compliance concern.
Therefore, at THERMAL POWER levels < 21.6% RTP, the reactor is operating with substantial margin to the MCPR limits and this LCO is not required.
ACTIONS           A.1 If any MCPR is outside the required limit, an assumption regarding an initial condition of the design basis transient analyses may not be met. Therefore, prompt action should be taken to restore the MCPR(s) to within the required limit(s) such that the plant remains operating within analyzed conditions. The 2 hour Completion Time is normally sufficient to restore the MCPR(s) to within its limit and is acceptable based on the low probability of a transient or DBA occurring simultaneously with the MCPR out of specification.
B.1 If the MCPR cannot be restored to within the required limit within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 21.6% RTP within 4 hours. The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 21.6% RTP in an orderly manner and without challenging plant systems.
(continued)
CLINTON                        B 3.2-7                        Revision No. 7-5

MCPR B 3.2.2 BASES SURVEILLANCE SR  3.2.2.1 REQUIREMENTS The MCPR is required to be initially calculated within 12 hours after THERMAL POWER is t 21.6% RTP and periodically thereafter. It is compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 12 hour allowance after THERMAL POWER reaches t 21.6% RTP is acceptable given the large inherent margin to operating limits at low power levels. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to MCPR values obtained pursuant to this SR, as determined from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 10).
SR  3.2.2.2 Because the transient analyses may take credit for conservatism in the control rod scram speed performance, it must be demonstrated that the specific scram speed distribution is consistent with that used in the transient analyses. SR 3.2.2.2 determines the actual scram speed distribution and compares it with the assumed distribution.
The MCPR operating limit is then determined based either on the applicable limit associated with scram times of LCO 3.1.4, Control Rod Scram Times, or the realistic scram times. The scram time dependent MCPR limits are contained in the COLR. This determination must be preformed and any necessary changes must be implemented with in 72 hours after each set of control rod scram time tests required by SR 3.1.4.1, SR 3.1.4,2, and SR 3.1.4.4 because the effective scram speed distribution may change during the cycle or after maintenance that could affect scram times. The 72 hour Completion Time is acceptable due to the relatively minor changes in the actual control rod scram speed distribution expected during the fuel cycle.
(continued)
CLINTON                   B 3.2-8                       Revision No. 21-8

MCPR B 3.2.2 BASES   (continued)
REFERENCES          1. NUREG-0562, "Fuel Rod Failures As A Consequence of Nucleate Boiling or Dryout," June 1979.
: 2. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, GESTAR-II," (latest approved revision).
: 3. USAR, Section 15.0.
: 4. USAR, Appendix 15B.
: 5. USAR, Appendix 15C.
: 6. NEDC-31546-P, "Maximum Extended Operating Domain and Feedwater Heater Out-of-Service Analysis for Clinton Power Station," August 1988.
: 7. NEDE-30130-P-A, "Steady State Nuclear Methods," April 1985.
: 8. NEDO-24154-A, "Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors,"
General Electric Company, August 1986.
: 9. NEDE-32906P-A, Revision 3, "TRACG Application for Anticipated Operational Occurrences (AOO) Transient Analyses," September 2006, and Supplements.
: 10. Calculation IP-0-0002.
CLINTON                        B 3.2-8a                       Revision No. 21-8

This page intentionally left blank.
CLINTON          B 3.2-8b                   Revision No. 8-7

LHGR B 3.2.3 B 3.2   POWER DISTRIBUTION LIMITS B 3.2.3   LINEAR HEAT GENERATION RATE (LHGR)
BASES BACKGROUND         The LHGR is a measure of the heat generation rate of a fuel rod in a fuel assembly at any axial location. Limits on the LHGR are specified to ensure that fuel design limits are not exceeded anywhere in the core during normal operation, including anticipated operational occurrences (AOOs), and to ensure that the peak clad temperature (PCT) during a postulated design basis loss of coolant accident (LOCA) does not exceed the limits specified in 10 CFR 50.46. Exceeding the LHGR limit could potentially result in fuel damage and subsequent release of radioactive materials. Fuel design limits are specified to ensure that fuel system damage, fuel rod failure or inability to cool the fuel does not occur during the anticipated operating conditions identified in USAR Chapters 4 and 15.
APPLICABLE         The analytical methods and assumptions used in evaluating SAFETY ANALYSES    the fuel system design are presented in USAR Chapter 4. The analytical methods and assumptions used in evaluating AOOs and normal operation that determine the LHGR limits are presented in References 1 and 2. The fuel assembly is designed to ensure (in conjunction with the core nuclear and thermal hydraulic design, plant equipment, instrumentation, and protection system) that fuel damage will not result in the release of radioactive materials in excess of the guidelines of 10 CFR, Parts 20, 50, and 100. The mechanisms that could cause fuel damage during operational transients and that are considered in fuel evaluations are:
: a. Rupture of the fuel rod cladding caused by strain from the relative expansion of the UO2 pellet; and
: b. Severe overheating of the fuel rod cladding caused by inadequate cooling.
A value of 1% plastic strain of the fuel cladding has been defined as the limit below which fuel damage caused by overstraining of the fuel cladding is not expected to occur (Refs. 1 and 3).
Fuel design evaluations have been performed and demonstrate that the 1% fuel cladding plastic strain design limit is not exceeded during continuous operation with LHGRs up to the operating limit specified in the COLR. The analysis also (continued)
CLINTON                              B 3.2-9                   Revision No. 9-3

LHGR B 3.2.3 BASES APPLICABLE        includes allowances for short term transient operation above SAFETY ANALYSES   the operating limit to account for AOOs, plus an allowance (continued)     for densification power spiking.
LHGR limits are developed as a function of exposure and the various operating core flow and power states to ensure adherence to fuel design limits during the limiting AOOs (Ref. 2). Flow dependent LHGR limits are determined using the three dimensional BWR simulator code (Ref. 1) to analyze slow flow runout transients. The flow dependent multiplier, LHGRFACf, is dependent on the maximum core flow runout capability. LHGRFACf curves are provided based on the maximum credible flow runout transient. The result of a single failure or single operator error is the runout of only one loop because both recirculation loops are under independent control.
Based on analyses of limiting plant transients (other than core flow increases) over range of power and flow conditions, power dependent multipliers, LHGRFACp, are also generated. Due to the sensitivity of the transient response to initial core flow levels at power levels below those at which turbine control valve fast closure scram signals are bypassed, both high and low core flow LHGRFACp limits are provided for operation at power levels between 21.6% RTP and the previously mentioned bypass power level. The exposure dependent LHGR limits are reduced by LHGRFACf and LHGRFACp at various operating conditions to ensure that all fuel design criteria are met for normal operation and AOOs. A complete discussion of the analysis code is provided in References 1, 4, and 5.
The LHGRFAC multipliers are sufficient to provide adequate protection for the off-rated conditions from an ECCS-LOCA analysis perspective.
For single recirculation loop operation, the LHGRFAC multiplier is limited to a maximum value that is specified in the COLR. This maximum limit is due to the conservative analysis assumption of an earlier departure from nucleate boiling with one recirculation loop available, resulting in a more severe cladding heatup during a LOCA.
The LHGR satisfies Criterion 2 of the NRC Policy Statement.
LCO               The LHGR is a basic assumption in the fuel design analysis.
The fuel has been designed to operate at rated core power with sufficient design margin to the LHGR limit calculated to cause a 1% fuel cladding plastic strain. The operating limit to accomplish this objective is specified in the COLR.
The LHGR limits specified in the COLR are the result of fuel design and transient analyses. For two recirculation loops operating, the limit is determined by multiplying the smaller of the LHGRFACf and LHGRFACp factors times the exposure dependent LHGR limits.
(continued)
CLINTON                            B 3.2-10                   Revision No. 21-8

LHGR B 3.2.3 BASES LCO               With only one recirculation loop in operation, in (continued)     conformance with the requirements of LCO 3.4.1, Recirculation Loops Operating, the limit is determined by multiplying the exposure dependent LHGR limit by the smaller of either LHGRFACf, LHGRFACp, and the LHGR single loop operation multiplier, where the single loop operation multiplier has been determined by a specific single recirculation loop analysis (Refs. 6 and 7).
APPLICABILITY     The LHGR limits are derived from fuel design analysis that is limiting at high power level conditions. At core thermal power levels < 21.6% RTP, the reactor is operating with a substantial margin to the LHGR limits and, therefore, the Specification is only required when the reactor is operating at t 21.6% RTP.
ACTIONS           A.1 If any LHGR exceeds its required limit, an assumption regarding an initial condition of the fuel design analysis is not met. Therefore, prompt action should be taken to restore the LHGR(s) to within its required limit(s) such that the plant is operating within analyzed conditions and within the design limits of the fuel rods. The 2 hour Completion Time is normally sufficient to restore the LHGR(s) to within its limit and is acceptable based on the low probability of a transient occurring simultaneously with the LHGR out of specification.
B.1 If the LHGR cannot be restored to within its required limit within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 21.6% RTP within 4 hours. The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 21.6% RTP in an orderly manner and without challenging plant systems.
SURVEILLANCE      SR  3.2.3.1 REQUIREMENTS The LHGRs are required to be initially calculated within 12 hours after THERMAL POWER is t 21.6% RTP and periodically thereafter. They are compared with the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The 12 hour allowance after THERMAL POWER t 21.6% RTP is achieved is acceptable given the large inherent margin to operating limits at lower power levels.
___________________________________________________________________(continued)
CLINTON                            B 3.2-11                   Revision No. 14-2

LHGR B 3.2.3 BASES SURVEILLANCE      SR  3.2.3.1   (continued)
REQUIREMENTS With regard to LHGR values obtained pursuant to this SR, as determined from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).
REFERENCES        1. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, GESTAR-II," (latest approved revision).
: 2. USAR, Section 15.0.
: 3. NUREG-0800, "Standard Review Plan," Section 4.2, II.A.2(g), Revision 2, July 1981.
: 4. NEDO-24154-A, "Qualification of the One Dimensional Core Transient Model for Boiling Water Reactors,"
August 1986.
: 5. NEDE-32906P-A, Revision 3, "TRACG Application for Anticipated Operational Occurrences (AOO) Transient Analyses," September 2006, and Supplements.
: 6. USAR, Chapter 15, Appendix 15B
: 7.   "Clinton Power Station SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis," NEDC-32945P, June 2000.
: 8. Calculation IP-0-0002.
CLINTON                             B 3.2-12                  Revision No. 21-8

RPS Instrumentation B 3.3.1.1 B 3.3   INSTRUMENTATION B 3.3.1.1   Reactor Protection System (RPS) Instrumentation BASES BACKGROUND         The RPS initiates a reactor scram when one or more monitored parameters exceed their specified limit, to preserve the integrity of the fuel cladding and the Reactor Coolant System (RCS), and minimize the energy that must be absorbed following a loss of coolant accident (LOCA). This can be accomplished either automatically or manually.
The protection and monitoring functions of the RPS have been designed to ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters, and equipment performance. The LSSS are defined in this Specification as the Allowable Values except Function 6 in Technical Specification Table 3.3.1.1-1 (the Nominal Trip Setpoint defines the LSSS for this Function), which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs), during Design Basis Accidents (DBAs).
The RPS, as described in USAR, Section 7.2 (Ref. 1),
includes sensors, trip modules, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters. The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level; reactor vessel pressure; neutron flux; main steam line isolation valve position; turbine control valve (TCV) fast closure, trip oil pressure; turbine stop valve (TSV) closure; drywell pressure; and scram discharge volume (SDV) water level; as well as reactor mode switch in shutdown position and manual scram signals. There are at least four redundant sensor input signals from each of these parameters (with the exception of the reactor mode switch in shutdown scram signal). Most channels include electronic equipment (e.g.,
analog trip modules (ATMs) that compares measured input signals with pre-established setpoints. When a setpoint is exceeded, the ATM output changes state, providing an RPS trip signal to the trip logic.
(continued)
CLINTON                           B 3.3-1                     Revision No. 10-6

RPS Instrumentation B 3.3.1.1 BASES BACKGROUND     The RPS is comprised of four independent trip logic (continued)  divisions (1, 2, 3, and 4) as described in Reference 1.
Each RPS input for a variable is independently monitored by one instrument channel in each of the four divisions. Each instrument channel combines the four RPS Function inputs for that variable in a two-out-of-four logic. Each instrument channel in turn provides an input to all four RPS trip logic divisions. The four RPS trip logic divisions are also combined in a two-out-of-four arrangement. Each RPS trip logic division provides four output signals to load drivers which de-energize the scram pilot valve solenoids. Each trip logic division can be reset by use of a reset switch.
If a logic division trips or a full scram occurs (two-out-of-four trip logic divisions trip), a solid state time delay prevents reset of the trip logic division for 10 seconds after the signal is received. This 10 second delay on reset ensures that the scram function will be completed.
Two scram pilot valves are located in the hydraulic control unit (HCU) for each control rod drive (CRD). Each scram pilot valve is solenoid operated, with the solenoids normally energized. The scram pilot valves control the air supply to the scram inlet and outlet valves for the associated CRD. When either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram. The scram valves control the supply and discharge paths for the CRD water during a scram. One of the scram pilot valve solenoids for each CRD is controlled by two trip logic divisions, and the other solenoid is controlled by the other two trip logic divisions. De-energizing both solenoids results in the air bleeding off, scram valves opening, and control rod scram.
The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS. Additionally, the RPS System controls the SDV vent and drain valves such that when a scram signal is generated, the SDV vent and drain valves close to isolate the SDV.
APPLICABLE        The actions of the RPS are assumed in the safety analyses SAFETY ANALYSES,  of References 2, 3, and 4. The RPS initiates a reactor LCO, and          scram when monitored parameter values exceed the trip APPLICABILITY     setpoints specified by the setpoint methodology (continued)
CLINTON                          B 3.3-2                     Revision No. 10-6

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        to preserve the integrity of the fuel cladding, the reactor SAFETY ANALYSES,  coolant pressure boundary (RCPB), and the containment by LCO, and          minimizing the energy that must be absorbed following a APPLICABILITY     LOCA.
(continued)
RPS instrumentation satisfies Criterion 3 of the NRC Policy Statement. Functions not specifically credited in the accident analysis are retained for the RPS as required by the NRC approved licensing basis.
The OPERABILITY of the RPS is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.1.1-1. Each Function must have four OPERABLE channels, with their setpoints within the specified Allowable Value, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each channel must also respond within its assumed response time.
Allowable Values are specified for each RPS Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., analog trip module) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values and trip setpoints are derived from the analytic limits, accounting for applicable process errors, severe environment errors, instrument errors (e.g., drift),
and calibration errors in accordance with the setpoint methodology documented in the Operational Requirements Manual (ORM). The trip setpoints derived in this manner provide (continued)
CLINTON                          B 3.3-3                     Revision No. 10-6

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        adequate protection because instrumentation uncertainties, SAFETY ANALYSES,  process effects, calibration tolerances, instrument drift, LCO, and          and severe environment errors (for channels that must APPLICABILITY     function in harsh environments as defined by 10 CFR 50.49)
(continued)     are accounted for.
The OPERABILITY of scram pilot valves and associated solenoids, backup scram valves, and SDV valves, described in the Background section, are not addressed by this LCO.
The individual Functions are required to be OPERABLE  in the MODES specified in the Table that may require an RPS  trip to mitigate the consequences of a design basis accident  or transient. To ensure a reliable scram function, a combination of Functions is required in each MODE to  provide primary and diverse initiation signals.
RPS is required to be OPERABLE in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies. Control rods withdrawn from a core cell containing no fuel assemblies do not affect the reactivity of the core and therefore are not required to have the capability to scram. Provided all other control rods remain inserted, the RPS function is not required. In this condition, the required SDM (LCO 3.1.1, "Shutdown Margin (SDM)") and refuel position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") ensure that no event requiring RPS will occur. During normal operation in MODES 3 and 4, all control rods are fully inserted and the Reactor Mode Switch-Shutdown Position control rod withdrawal block (LCO 3.3.2.1, "Control Rod Block Instrumentation") does not allow any control rod to be withdrawn. Under these conditions, the RPS function is not required to be OPERABLE.
The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
1.a. Intermediate Range Monitor (IRM) Neutron Flux-High The IRMs monitor neutron flux levels from the upper range of the source range monitors (SRMs) to the lower range of the average power range monitors (APRMs). The IRMs are capable of generating trip signals that can be used to prevent fuel (continued)
CLINTON                          B 3.3-4                        Revision No. 0

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        1.a. Intermediate Range Monitor (IRM) Neutron Flux-High SAFETY ANALYSES,  (continued)
LCO, and APPLICABILITY     damage resulting from abnormal operating transients in the intermediate power range. In this power range, the most significant source of reactivity change is due to control rod withdrawal. The IRM provides diverse protection for the rod pattern controller (RPC), which monitors and controls the movement of control rods at low power. The RPC prevents the withdrawal of an out of sequence control rod during startup that could result in an unacceptable neutron flux excursion (Ref. 5). The IRM provides mitigation of the neutron flux excursion. To demonstrate the capability of the IRM System to mitigate control rod withdrawal events, generic analyses have been performed (Ref. 6) to evaluate the consequences of control rod withdrawal events during startup that are mitigated only by the IRM. This analysis demonstrates that the IRMs provide protection against local control rod withdrawal errors which results in peak fuel energy depositions below the 170 cal/gm fuel failure threshold criterion.
The IRMs are also capable of limiting other reactivity excursions during startup, such as cold water injection events, although no credit is specifically assumed.
The IRM System is divided into four groups of IRM channels, with two IRM channels inputting to each trip logic division.
Per the analysis of Reference 6, six IRM channels, including at least one IRM channel per trip logic division, are required for IRM OPERABILITY. The RPS logic ensures that no single instrument failure will preclude a scram from this Function on a valid signal. This trip is active in each of the 10 ranges of the IRM, which must be selected by the operator to maintain the neutron flux within the monitored level of an IRM range.
The analysis of Reference 6 has adequate conservatism to permit an IRM Allowable Value of 122 divisions of a 125 division scale.
The Intermediate Range Monitor Neutron Flux-High Function must be OPERABLE during MODE 2 when control rods may be withdrawn and the potential for criticality exists. In MODE 5, when a cell with fuel has its control rod withdrawn, the IRMs provide monitoring for and protection against unexpected reactivity excursions. In MODE 1, the APRM (continued)
CLINTON                          B 3.3-5                     Revision No. 10-8

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        1.a. Intermediate Range Monitor (IRM) Neutron Flux-High SAFETY ANALYSES,  (continued)
LCO, and APPLICABILITY     System, the rod withdrawal limiter (RWL), and the RPC (continued)       provide protection against control rod withdrawal error events and the IRMs are not required.
1.b. Intermediate Range Monitor-Inop This trip signal provides assurance that a minimum number of IRMs are OPERABLE. Anytime an IRM mode switch is moved to any position other than "Operate," the detector voltage drops below a preset level, or a module is not plugged in, an inoperative trip signal will be received by the RPS.
This Function was not specifically credited in the accident analysis, but it is retained for the RPS as required by the NRC approved licensing basis.
Both channels of Intermediate Range Monitor-Inop associated with an input to each of the four trip logic divisions are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.
Since this Function is not assumed in the safety analysis, there is no Allowable Value for this Function.
This Function is required to be OPERABLE when the Intermediate Range Monitor Neutron Flux-High Function is required.
2.a. Average Power Range Monitor Neutron Flux-High, Setdown The APRM channels receive input signals from the local power range monitors (LPRMs) within the reactor core to provide an indication of the power distribution and local power changes. The APRM channels average these LPRM signals to provide a continuous indication of average reactor power from a few percent to greater than RTP. For operation at low power (i.e., MODE 2), the Average Power Range Monitor Neutron Flux-High, Setdown Function is capable of generating a trip signal that prevents fuel damage resulting from abnormal operating transients in this power range. For most operation at low power levels, the Average Power Range Monitor Neutron Flux-High, Setdown Function will provide a secondary scram to the Intermediate Range Monitor Neutron Flux-High Function because of the relative setpoints.
(continued)
CLINTON                          B 3.3-6                      Revision No. 5-6

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        2.a. Average Power Range Monitor Neutron Flux-High, SAFETY ANALYSES,  Setdown (continued)
LCO, and APPLICABILITY     With the IRMs at Range 9 or 10, it is possible that the Average Power Range Monitor Neutron Flux-High, Setdown Function will provide the primary trip signal for a corewide increase in power.
No specific safety analyses take direct credit for the Average Power Range Monitor Neutron Flux-High, Setdown Function. However, this Function indirectly ensures that, before the reactor mode switch is placed in the run position, reactor power does not exceed 21.6% RTP (SL 2.1.1.1) when operating at low reactor pressure and low core flow. Therefore, it indirectly prevents fuel damage during significant reactivity increases with THERMAL POWER
                  < 21.6% RTP.
The APRM System is composed of four channels, each providing an input to each of the four RPS trip logic divisions. All four Average Power Range Monitor Neutron Flux-High, Setdown channels are required to be OPERABLE to ensure that no single failure will preclude a scram from this Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 16 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the four axial levels at which the LPRMs are located.
The Allowable Value is based on preventing significant increases in power when THERMAL POWER is < 21.6% RTP.
The Average Power Range Monitor Neutron Flux-High, Setdown Function must be OPERABLE during MODE 2 when control rods may be withdrawn since the potential for criticality exits.
In MODE 1, the Average Power Range Monitor Neutron Flux-High Function provides protection against reactivity transients and the RWL and RPC protect against control rod withdrawal error events.
2.b. Average Power Range Monitor Flow Biased Simulated Thermal Power-High The Average Power Range Monitor Flow Biased Simulated Thermal Power-High Function monitors neutron flux to approximate the THERMAL POWER being transferred to the reactor coolant. The APRM neutron flux is electronically filtered with a time constant representative of the fuel (continued)
CLINTON                          B 3.3-7                      Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        2.b. Average Power Range Monitor Flow Biased Simulated SAFETY ANALYSES,  Thermal Power-High (continued)
LCO, and APPLICABILITY     heat transfer dynamics to generate a signal proportional to the THERMAL POWER in the reactor. The trip level is varied as a function of recirculation drive flow (i.e., at lower core flows the setpoint is reduced proportional to the reduction in power experienced as core flow is reduced with a fixed control rod pattern) but is clamped at an upper limit that is always lower than the Average Power Range Monitor Fixed Neutron Flux-High Function Allowable Value.
The Average Power Range Monitor Flow Biased Simulated Thermal Power-High Function provides protection against transients where THERMAL POWER increases slowly (such as the loss of feedwater heating event) and protects the fuel cladding integrity by ensuring that the MCPR SL is not exceeded. During these events, the THERMAL POWER increase does not significantly lag the neutron flux response and, because of a lower trip setpoint, will initiate a scram before the high neutron flux scram. For rapid neutron flux increase events, the THERMAL POWER lags the neutron flux and the Average Power Range Monitor Fixed Neutron Flux-High Function will provide a scram signal before the Average Power Range Monitor Flow Biased Simulated Thermal Power-High Function setpoint is exceeded.
During continued operation with only one recirculation loop in service, the APRM flow biased setpoint is required to be conservatively set (refer to the Bases for LCO 3.4.1, "Recirculation Loops Operating," for more detailed discussion). The setpoint modification may be delayed for up to 12 hours in accordance with the allowances of LCO 3.4.1. After this time, the LCO 3.3.1.1 requirement for APRM OPERABILITY will enforce the more conservative setpoint.
The APRM System is composed of four channels, each providing an input to each of the four RPS trip logic divisions. All Four Average Power Range Monitor Flow Biased Simulated Thermal Power-High channels are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 16 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the four axial levels at (continued)
CLINTON                          B 3.3-8                         Revision No. 0

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        2.b. Average Power Range Monitor Flow Biased Simulated SAFETY ANALYSES,  Thermal Power-High (continued)
LCO, and APPLICABILITY     which the LPRMs are located. Each APRM channel receives one total drive flow signal representative of total core flow.
The recirculation loop drive flow signals are generated by eight flow units. One flow unit from each recirculation loop is provided to each APRM channel. Total drive flow is determined by each APRM by summing up the flow signals provided to the APRM from the two recirculation loops.
The clamped Allowable Value is based on analyses that take credit for the Average Power Range Monitor Flow Biased Simulated Thermal Power-High Function for the mitigation of the loss of feedwater heater event. The THERMAL POWER time constant provided in the CORE OPERATING LIMITS REPORT is based on the fuel heat transfer dynamics and provides a signal that is proportional to the THERMAL POWER.
The Average Power Range Monitor Flow Biased Simulated Thermal Power-High Function is required to be OPERABLE in MODE 1 when there is the possibility of generating excessive THERMAL POWER and potentially exceeding the SL applicable to high pressure and core flow conditions (MCPR SL). During MODES 2 and 5, other IRM and APRM Functions provide protection for fuel cladding integrity.
2.c. Average Power Range Monitor Fixed Neutron Flux-High The APRM channels provide the primary indication of neutron flux within the core and respond almost instantaneously to neutron flux increases. The Average Power Range Monitor Fixed Neutron Flux-High Function is capable of generating a trip signal to prevent fuel damage or excessive RCS pressure. For the overpressurization protection analysis of Reference 2, the Average Power Range Monitor Fixed Neutron Flux-High Function is assumed to terminate the main steam isolation valve (MSIV) closure event and, along with the safety/relief valves (S/RVs), limits the peak reactor pressure vessel (RPV) pressure to less than the ASME Code limits. The control rod drop accident (CRDA) analysis (Ref. 7) takes credit for the Average Power Range Monitor Fixed Neutron Flux-High Function to terminate the CRDA.
(continued)
CLINTON                          B 3.3-9                        Revision No. 0

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        2.c. Average Power Range Monitor Fixed Neutron Flux-High SAFETY ANALYSES,  (continued)
LCO, and APPLICABILITY     The APRM System is comprised of four channels, each providing an input to each of the four RPS trip logic divisions. All four Average Power Range Monitor Fixed Neutron Flux-High channels are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 16 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the four axial levels at which the LPRMs are located.
The Allowable Value is based on the Analytical Limit assumed in the CRDA analyses.
The Average Power Range Monitor Fixed Neutron Flux-High Function is required to be OPERABLE in MODE 1 where the potential consequences of the analyzed transients could result in the SLs (e.g., MCPR and RCS pressure) being exceeded. Although the Average Power Range Monitor Fixed Neutron Flux-High Function is assumed in the CRDA analysis that is applicable in MODE 2, the Average Power Range Monitor Neutron Flux-High, Setdown Function conservatively bounds the assumed trip and, together with the assumed IRM trips, provides adequate protection. Therefore, the Average Power Monitor Fixed Neutron Flux-High Function is not required in MODE 2.
2.d. Average Power Range Monitor-Inop This signal provides assurance that a minimum number of APRMs are OPERABLE. Anytime an APRM mode switch is moved to any position other than Operate, an APRM module is unplugged, the electronic operating voltage is low, or the APRM has too few LPRM inputs (< 16), an inoperative trip signal will be received by the RPS. This Function was not specifically credited in the accident analysis, but it is retained for the RPS as required by the NRC approved licensing basis.
(continued)
CLINTON                         B 3.3-10                        Revision No. 0

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        2.d. Average Power Range Monitor-Inop  (continued)
SAFETY ANALYSES, LCO, and          The Average Power Range Monitor-Inop channel associated APPLICABILITY     with each of the trip logic divisions is required to be OPERABLE to ensure that no single failure will preclude a scram from this Function on a valid signal.
There is no Allowable Value for this Function.
This Function is required to be OPERABLE in the MODES where the APRM Functions are required.
: 3. Reactor Vessel Steam Dome Pressure-High An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This causes the neutron flux and THERMAL POWER transferred to the reactor coolant to increase, which could challenge the integrity of the fuel cladding and the RCPB. No specific safety analysis takes direct credit for this Function. However, the Reactor Vessel Steam Dome Pressure-High Function initiates a scram for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power. For the overpressurization protection analysis of Reference 2, the reactor scram (the analyses conservatively assume scram on the Average Power Range Monitor Fixed Neutron Flux-High signal, not the Reactor Vessel Steam Dome Pressure-High signal), along with the S/RVs, limits the peak RPV pressure to less than the ASME Section III Code limits.
High reactor pressure signals are initiated from four pressure transmitters that sense reactor pressure. The Reactor Vessel Steam Dome Pressure-High Allowable Value is chosen to provide a sufficient margin to the ASME Section III Code limits during the event.
One channel of Reactor Vessel Steam Dome Pressure-High Function associated with each of the four trip logic divisions is required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is required to be OPERABLE in MODES 1 and 2 when the RCS is pressurized and the potential for pressure increase exists.
(continued)
CLINTON                          B 3.3-11                        Revision No. 0

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE       4. Reactor Vessel Water Level-Low, Level 3 SAFETY ANALYSES, LCO, and         Low RPV water level indicates the capability to cool the APPLICABILITY    fuel may be threatened. Should RPV water level decrease too (continued)    far, fuel damage could result. Therefore, a reactor scram is initiated at Level 3 to substantially reduce the heat generated in the fuel from fission. The Reactor Vessel Water Level-Low, Level 3 Function is assumed in the analysis of the recirculation line break (Ref. 3). The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the Emergency Core Cooling Systems (ECCS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
Reactor Vessel Water Level-Low, Level 3 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
One channel of Reactor Vessel Water Level-Low, Level 3 Function associated with each of the four trip logic divisions is required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.
The Reactor Vessel Water Level-Low, Level 3 Allowable Value is selected to ensure that, for transients involving loss of all normal feedwater flow, initiation of the low pressure ECCS at RPV Water Level 1 will not be required. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero. The Function is required in MODES 1 and 2 where considerable energy exists in the RCS resulting in the limiting transients and accidents. ECCS initiations at Reactor Vessel Water Level-Low Low, Level 2 and Low Low Low, Level 1 provide sufficient protection for level transients in all other MODES.
: 5. Reactor Vessel Water Level-High, Level 8 High RPV water level indicates a potential problem with the feedwater level control system, resulting in the addition of reactivity associated with the introduction of a significant amount of relatively cold feedwater. Therefore, a scram is (continued)
CLINTON                        B 3.3-12                         Revision No. 0

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        5. Reactor Vessel Water Level-High, Level 8   (continued)
SAFETY ANALYSES, LCO, and          initiated at Level 8 to ensure that MCPR is maintained above APPLICABILITY     the MCPR SL. The Reactor Vessel Water Level-High, Level 8 Function is one of the many Functions assumed to be OPERABLE and capable of providing a reactor scram during transients analyzed in Reference 3. It is directly assumed in the analysis of feedwater controller failure, maximum demand (Ref. 4).
Reactor Vessel Water Level-High, Level 8 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water Level-High, Level 8 Allowable Value is specified to ensure that the MCPR SL is not violated during the assumed transient. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
One channel of the Reactor Vessel Water Level-High, Level 8 Function associated with each of the four trip logic divisions is required to be OPERABLE when THERMAL POWER is
                  > 21.6% RTP to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. With THERMAL POWER < 21.6% RTP, this Function is not required since MCPR is not a concern below 21.6% RTP.
: 6. Main Steam Isolation Valve-Closure MSIV closure results in loss of the main turbine and the condenser as a heat sink for the Nuclear Steam Supply System and indicates a need to shut down the reactor to reduce heat generation. Therefore, a reactor scram is initiated on a Main Steam Isolation Valve-Closure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization transient. However, for the overpressurization protection analysis of Reference 2, the Average Power Range Monitor Fixed Neutron Flux-High Function, along with the S/RVs, limits the peak RPV pressure to less than the ASME Code limits. That is, the direct scram on position switches for MSIV closure events is not assumed in the overpressurization analysis. Additionally, MSIV closure is assumed in the transients analyzed in Reference 4 (e.g., low steam line pressure, manual closure of MSIVs, high steam line flow).
(continued)
CLINTON                         B 3.3-13                       Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        6. Main Steam Isolation Valve-Closure  (continued)
SAFETY ANALYSES, LCO, and          The reactor scram reduces the amount of energy required to APPLICABILITY     be absorbed and, along with the actions of the ECCS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The reactor scram resulting from an MSIV closure due to a Low Main Steam Line Pressure Isolation also ensures reactor power is less than 21.6% RTP before reactor pressure decreases below the Safety Limit 2.1.1.1 Low Pressure Limit of 700 psia.
MSIV closure signals are initiated from position switches located on each of the eight MSIVs. Each MSIV has one position switch. The logic for the Main Steam Isolation Valve-Closure Function is arranged such that either the inboard or outboard valve on two or more of the main steam lines (MSLs) must close in order for a scram to occur.
The Main Steam Isolation Valve-Closure Allowable Value is specified to ensure that a scram occurs prior to a significant reduction in steam flow, thereby reducing the severity of the subsequent pressure transient.
Both channels of the Main Steam Isolation Valve-Closure Function associated with an input to the trip logic division are required to be OPERABLE to ensure that no single instrument failure will preclude the scram from this Function on a valid signal. This Function is only required in MODE 1 since, with the MSIVs open and the heat generation rate high, a pressurization transient can occur if the MSIVs close. In MODE 2, the heat generation rate is low enough so that the other diverse RPS functions provide sufficient protection.
: 7. Drywell Pressure-High High pressure in the drywell could indicate a break in the RCPB. A reactor scram is initiated to minimize the possibility of fuel damage and to reduce the amount of energy being added to the coolant and the drywell. The Drywell Pressure-High Function is a secondary scram signal to Reactor Vessel Water Level-Low, Level 3 for large break LOCA events inside the drywell. This Function was not specifically credited in the accident analysis, but it is retained for the RPS as required by the NRC approved licensing basis.
(continued)
CLINTON                         B 3.3-14                     Revision No. 18-1

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        7. Drywell Pressure-High  (continued)
SAFETY ANALYSES, LCO, and          High drywell pressure signals are initiated from four APPLICABILITY     pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.
One channel of Drywell Pressure-High Function associated with each of the four trip logic divisions is required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is required in MODES 1 and 2 where considerable energy exists in the RCS, resulting in the limiting transients and accidents.
8.a, b. Scram Discharge Volume Water Level-High The SDV receives the water displaced by the motion of the CRD pistons during a reactor scram. Should this volume fill to a point where there is insufficient volume to accept the displaced water, control rod insertion would be hindered.
Therefore, a reactor scram is initiated when the remaining free volume is still sufficient to accommodate the water from a full core scram. However, even though the two types of Scram Discharge Volume Water Level-High Functions are an input to the RPS logic, no credit is taken for a scram initiated from these Functions for any of the design basis accidents or transients analyzed in the USAR. However, they are retained to ensure that the RPS remains OPERABLE.
SDV water level is measured by two diverse methods. The level in the SDV is measured by four float type level switches and four transmitters and associated analog trip modules for a total of eight level signals. The outputs of these devices are arranged so that there is a signal from a level switch and a transmitter and associated analog trip module to each trip logic division. The level measurement instrumentation satisfies the recommendations of Reference 8.
The Allowable Value is chosen low enough to ensure that there is sufficient volume in the SDV to accommodate the water from a full scram. The Allowable Value for 1C11-N601A and B is referenced from an instrument zero of 759 ft 11 inches mean sea level; for 1C11-N601C and D an instrument zero of 759 ft 10.5 inches mean sea level.
(continued)
CLINTON                         B 3.3-15                        Revision No. 0

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        8.a, b. Scram Discharge Volume Water Level-High SAFETY ANALYSES,  (continued)
LCO, and APPLICABILITY     One channel of each type of Scram Discharge Volume Water Level-High Function associated with each of the four trip logic divisions is required to be OPERABLE to ensure that no single instrument failure will preclude a scram from these Functions on a valid signal. These Functions are required in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn. At all other times, this Function may be bypassed.
: 9. Turbine Stop Valve Closure Closure of the TSVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated at the start of TSV closure in anticipation of the transients that would result from the closure of these valves. The Turbine Stop Valve Closure Function is the primary scram signal for the turbine trip event analyzed in Reference 4. For this event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the End of Cycle Recirculation Pump Trip (EOC-RPT) System, ensures that the MCPR SL is not exceeded.
Turbine Stop Valve Closure signals are initiated by valve stem position switches mounted on the four turbine stop valves. Each trip logic division receives an input from one Turbine Stop Valve Closure position switch. The logic for the Turbine Stop Valve Closure Function is such that two or more TSVs must be closed to produce a scram.
This Function must be enabled at THERMAL POWER > 33.3% RTP.
This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure. Because an increase in the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must not cause the trip Function to be bypassed when THERMAL POWER is t 33.3% RTP. The setpoint is feedwater temperature dependent as a result of the subcooling changes that affect the turbine first stage pressure/reactor power relationship.
The Turbine Stop Valve Closure Allowable Value is selected to be low enough to detect imminent TSV closure thereby (continued)
CLINTON                         B 3.3-16                       Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        9. Turbine Stop Valve Closure SAFETY ANALYSES,  (continued)
LCO, and APPLICABILITY     reducing the severity of the subsequent pressure transient.
One channel of Turbine Stop Valve Closure Function associated with each of the four trip logic divisions is required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function if any two TSVs should close. This Function is required, consistent with analysis assumptions, whenever THERMAL POWER is
                  > 33.3% RTP. This Function is not required when THERMAL POWER is < 33.3% RTP since the Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor Fixed Neutron Flux-High Functions are adequate to maintain the necessary safety margins.
: 10. Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Fast closure of the TCVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated on TCV fast closure in anticipation of the transients that would result from the closure of these valves. The Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Function is the primary scram signal for the generator load rejection event analyzed in Reference 4. For this event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the EOC-RPT System, ensures that the MCPR SL is not exceeded.
Turbine Control Valve Fast Closure, Trip Oil Pressure-Low signals are initiated by the electrohydraulic control (EHC) fluid pressure at each control valve. There is one pressure transmitter associated with each control valve, the signal from each transmitter being assigned to a separate RPS trip logic division. This Function must be enabled at THERMAL POWER > 33.3% RTP. This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure. Because an increase in the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must not cause the trip Function to be bypassed when THERMAL POWER is t 33.3% RTP. The basis for the setpoint of this automatic bypass is identical to that described for the Turbine Stop Valve Closure Function.
(continued)
CLINTON                         B 3.3-17                      Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        10. Turbine Control Valve Fast Closure, Trip Oil SAFETY ANALYSES,  Pressure-Low (continued)
LCO, and APPLICABILITY     The Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Allowable Value is selected high enough to detect imminent TCV fast closure.
One channel of Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Function associated with each of the four trip logic divisions is required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This Function is required, consistent with the analysis assumptions, whenever THERMAL POWER is > 33.3% RTP. This Function is not required when THERMAL POWER is < 33.3% RTP since the Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor Fixed Neutron Flux-High Functions are adequate to maintain the necessary safety margins.
: 11. Reactor Mode Switch-Shutdown Position The Reactor Mode Switch-Shutdown Position Function provides signals, via the manual scram logic channels, that are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis, but it is retained for the RPS as required by the NRC approved licensing basis.
The reactor mode switch is a single switch with four channels, each of which inputs into one of the RPS trip logic divisions.
There is no Allowable Value for this Function since the channels are mechanically actuated based solely on reactor mode switch position.
One channel of Reactor Mode Switch-Shutdown Position Function, associated with each of the four trip logic divisions, is required to be OPERABLE. The Reactor Mode-Switch Shutdown Position Function is required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.
(continued)
CLINTON                         B 3.3-18                      Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE        12. Manual Scram SAFETY ANALYSES, LCO, and          The Manual Scram push button channels provide signals, via APPLICABILITY     the manual scram logic channels, to each of the four RPS (continued)     trip logic divisions that are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis, but it is retained for the RPS as required by the NRC approved licensing basis.
There is one Manual Scram push button channel for each of the four RPS trip logic divisions. In order to cause a scram it is necessary that at least two channels be actuated.
There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
One channel of Manual Scram associated with each of the four RPS trip logic divisions is required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.
ACTIONS           Note 1 has been provided to modify the ACTIONS related to RPS instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RPS instrumentation channels provide appropriate compensatory measures for separate, inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RPS instrumentation channel.
Note 2 has been provided to modify the ACTIONS for the RPS instrumentation functions of APRM Flow Biased Neutron-Flux High (Function 2.b) and APRM Fixed Neutron Flux-High (Function 2.c) when they are inoperable due to failure of SR 3.3.1.1.2 and gain adjustments are necessary. Note 2 allows entry into associated Conditions and Required Actions to be delayed for up to 2 hours if the APRM is indicating a lower power value than the calculated power (i.e., the gain adjustment factor (GAF) is high (non-conservative)). The (continued)
CLINTON                         B 3.3-19                     Revision No. 20-6

RPS Instrumentation B 3.3.1.1 BASES ACTIONS           GAF for any channel is defined as the power value determined (continued)     by the heat balance divided by the APRM reading for that channel. Upon completion of the gain adjustment, or expiration of the allowed time, the channel must be returned to OPERABLE status or the applicable Condition entered and the Required Actions taken. This Note is based on the time required to perform gain adjustments on multiple channels.
A.1 Because of the diversity of sensors available to provide trip signals and the redundancy of the RPS design, an allowable out of service time of 48 hours has been shown to be acceptable (Ref. 9) to permit restoration of any inoperable channel to OPERABLE status. However, this out of service time is only acceptable provided the associated Function's inoperable channel is the only inoperable channel and the Function still maintains RPS trip capability (refer to Required Actions B.1 and C.1 Bases.) Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate two failures, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in a full scram), Condition D must be entered and its Required Action taken.
B.1 Condition B exists when, for any one or more Functions, two required channels are inoperable. In this condition, the RPS still maintains trip capability for that Function, but cannot accommodate a single failure in that Function.
Required Action B.1 limits the time the RPS scram logic for any Function would not accommodate single failure. Within the 6 hour allowance, the associated Function will have at least one inoperable channel in trip.
Completing this Required Action restores RPS to an equivalent reliability level as that evaluated in Reference 9, which justified a 48 hour allowable out of service time.
The 6 hour Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of a scram. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
(continued)
CLINTON                         B 3.3-20                     Revision No. 21-7

RPS Instrumentation B 3.3.1.1 BASES ACTIONS           B.1  (continued)
Placing one of the two inoperable channels in trip satisfies both Required Actions A.1 and B.1 for that Function. If one channel is already in trip for the Function when a second channel is determined to be inoperable, Required Action B.1 is met by the one channel already in trip for that Function and no additional action is required.
Alternately, if it is not desired to place one inoperable channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in a scram or RPT),
Condition D must be entered and its Required Action taken.
C.1 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels for the same Function result in the Function not being able to accommodate a single failure and maintain RPS trip capability. A Function is considered to be maintaining RPS trip capability when sufficient channels are OPERABLE or in trip, such that the Function will generate a trip signal on a valid signal. For the Function with two-out-of-four logic, this would require the Function to have three channels, each OPERABLE or in trip.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
D.1 Required Action D.1 directs entry into the appropriate Condition referenced in Table 3.3.1.1-1. The applicable Condition specified in the table is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A, B, or C, and the associated Completion Time has expired, Condition D will be entered for that channel and provides for transfer to the appropriate subsequent Condition.
(continued)
CLINTON                         B 3.3-21                        Revision No. 0

RPS Instrumentation B 3.3.1.1 BASES ACTIONS           E.1, F.1, G.1, and H.1 (continued)
If the channel(s) is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. With respect to Required Action E.1, inoperability of Turbine Stop Valve Closure and Turbine Control Valve Fast Closure Functions could impact the MCPR SL in the event of a design basis transient. Thus, prompt action should be taken to reduce THERMAL POWER to
                  < 33.3% RTP within 8 hours. The Completion Times are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems.
I.1 If the channel(s) is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies.
Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are, therefore, not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.
SURVEILLANCE      As noted at the beginning of the SRs, the SRs for each RPS REQUIREMENTS      instrumentation Function are located in the SRs column of Table 3.3.1.1-1.
The Surveillances are modified by a Note to indicate that, when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the RPS reliability analysis (Ref. 9) assumption of the average time required to perform channel surveillance. That (continued)
CLINTON                         B 3.3-22                      Revision No. 7-5

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE      analysis demonstrated that the 6 hour testing allowance does REQUIREMENTS      not significantly reduce the probability that the RPS will (continued)     trip when necessary.
SR  3.3.1.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Significant deviations between the instrument channels could be an indication of excessive instrument drift on one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
SR  3.3.1.1.2 To ensure that the APRMs are accurately indicating the true core average power, the APRMs are adjusted to the reactor power calculated from a heat balance if the heat balance calculated reactor power exceeds the APRM channel output by more than 2% RTP.
This Surveillance does not preclude making APRM channel adjustments, if desired, when the heat balance calculated reactor power is less than the APRM channel output. To provide close agreement between the APRM indicated power and to preserve operating margin, the APRM channels are normally adjusted to within +/- 2% of the heat balance calculated reactor power. However, this agreement is not required for OPERABILITY when APRM output indicates a higher reactor power than the heat balance calculated reactor power.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-23                      Revision No. 20-6

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE      SR  3.3.1.1.2  (continued)
REQUIREMENTS A restriction to satisfying this SR when < 21.6% RTP is provided that requires the SR to be met only at > 21.6% RTP because it is difficult to accurately maintain APRM indication of core THERMAL POWER consistent with a heat balance when < 21.6% RTP. At low power levels, a high degree of accuracy is unnecessary because of the large inherent margin to thermal limits (MCPR and APLHGR). At
                  > 21.6% RTP, the Surveillance is required to have been satisfactorily performed in accordance with SR 3.0.2. A Note is provided which allows an increase in THERMAL POWER above 21.6% if the Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours after reaching or exceeding 21.6% RTP. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.
With regard to core thermal power values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).
SR  3.3.1.1.3 The Average Power Range Monitor Flow Biased Simulated Thermal Power-High Function uses the recirculation loop drive flows to vary the trip setpoint. This SR ensures that the APRM Function accurately reflects the required setpoint as a function of flow.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.1.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests.
Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
(continued)
CLINTON                         B 3.3-24                     Revision No. 21-4

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE      SR  3.3.1.1.4  (continued)
REQUIREMENTS As noted, SR 3.3.1.1.4 is not required to be performed when entering MODE 2 from MODE 1 since testing of the MODE 2 required IRM and APRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This allows entry into MODE 2 if the Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours after entering MODE 2 from MODE 1.
Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.1.1.5 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.1.1.6 and SR  3.3.1.1.7 These Surveillances are established to ensure that no gaps in neutron flux indication exist from subcritical to power operation for monitoring core reactivity status.
The overlap between SRMs and IRMs is required to be demonstrated to ensure that reactor power will not be increased into a region without adequate neutron flux indication. This is required prior to withdrawing SRMs from the fully inserted position since indication is being transitioned from the SRMs to the IRMs.
The overlap between IRMs and APRMs is of concern when reducing power into the IRM range. On power increases, the system design will prevent further increases (initiate a rod block) if adequate overlap is not maintained.
Overlap between IRMs and APRMs exists when sufficient IRMs and APRMs concurrently have onscale readings such that the (continued)
CLINTON                         B 3.3-25                     Revision No. 21-4

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE      SR  3.3.1.1.6 and SR  3.3.1.1.7  (continued)
REQUIREMENTS transition between MODE 1 and MODE 2 can be made without either an APRM downscale rod block or an IRM upscale rod block. Overlap between SRMs and IRMs similarly exists when, prior to withdrawing the SRMs from the fully inserted position, IRMs are above the downscale value of 5 and increasing as neutron flux increases, prior to the SRMs indication reaching their upscale limit.
As noted, SR 3.3.1.1.7 is only required to be met during entry into MODE 2 from MODE 1. That is, after the overlap requirement has been met and indication has transitioned to the IRMs, maintaining overlap is not required (APRMs may be reading downscale once in MODE 2).
If overlap for a group of channels is not demonstrated (e.g., IRM/APRM overlap), the reason for the failure of the Surveillance should be determined and the appropriate channel(s) declared inoperable. Only those appropriate channel(s) that are required in the current MODE or condition should be declared inoperable.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.1.1.8 LPRM gain settings are determined from the local flux profiles measured by the Traversing Incore Probe (TIP)
System. This establishes the relative local flux profile for appropriate representative input to the APRM System.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.1.1.9 and SR  3.3.1.1.12 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-26                     Revision No. 21-4

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE      SR  3.3.1.1.10 REQUIREMENTS (continued)     The calibration of analog trip modules provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.1.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.1.1.11 and SR   3.3.1.1.13 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The SR 3.3.1.1.13 calibration for selected Functions is modified by a Note as identified in Table 3.3.1.1-1. This Note, which applies only to those Functions identified in Table 3.3.1.1-1, is divided into three parts. Part 1 of the Note requires evaluation of instrument performance for the condition where the as-found setting for these instrument channels is outside its As-Found Tolerance (AFT) but conservative with respect to the Allowable Value.
(continued)
CLINTON                          B 3.3-27                    Revision No. 14-2

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE      SR  3.3.1.1.11 and SR   3.3.1.1.13 (continued)
REQUIREMENTS Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. Initial evaluation will be performed by the technician performing the surveillance who will evaluate the instruments ability to maintain a stable setpoint within the As-Left Tolerance (ALT). The technicians evaluation will be reviewed by on-shift operations personnel during the approval of the surveillance data. Subsequent to returning the instrument to service, the deviation is entered into the Corrective Action Program. In accordance with procedures, entry into the Corrective Action Program will require review and documentation of the condition for operability by on-shift operations personnel. Additional evaluation and potential corrective actions as necessary will ensure that any as-found setting found outside the AFT is evaluated for long-term operability trends. If the as-found channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable. Part 2 of the Note requires that the instrument channel setpoint shall be reset to within the ALT of the Actual Trip Setpoint (ATSP). The ATSP is equivalent to or more conservative than the Nominal Trip Setpoint (NTSP). The NTSP is the limiting value of the sensed process variable at which a trip may be set in accordance with the methodology documented in the ORM.
Therefore, the NTSP is equivalent to the Limiting Safety System Setting (LSSS) required by 10 CFR 50.36, Technical specifications. The Actual Trip Setpoint is also calculated in accordance with the plant-specific setpoint methodology as documented in the CPS ORM and may include additional margin. The ATSP will ensure that sufficient margin to the safety and/or analytical limit is maintained.
If the as-left instrument channel setpoint cannot be returned to within the ALT of the Actual Trip Setpoint, then the channel shall be declared inoperable. Part 3 of the Note indicates that the Nominal Trip Setpoint and the methodology used to determine the Nominal Trip Setpoint, the As-Found Tolerance and the As-Left Tolerance bands are specified in the ORM.
Note 1 states that neutron detectors are excluded from CHANNEL CALIBRATION because of the difficulty of simulating a meaningful signal. Changes in neutron detector sensitivity are compensated for by performing the calorimetric calibration (SR 3.3.1.1.2) and the LPRM calibration against the TIPs (SR 3.3.1.1.8). A second Note is provided that requires the APRM and the IRM SRs to be performed within 12 hours of entering MODE 2 from MODE 1.
(continued)
CLINTON                         B 3.3-27a                    Revision No. 14-2

This page intentionally left blank.
CLINTON           B 3.3-27b                 Revision No. 10-6

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE      SR  3.3.1.1.11 and SR   3.3.1.1.13 (continued)
REQUIREMENTS Testing of the MODE 2 APRM and IRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2.
Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.1.1.14 The Average Power Range Monitor Flow Biased Simulated Thermal Power-High Function uses an electronic filter circuit to generate a signal proportional to the core THERMAL POWER from the APRM neutron flux signal. This filter circuit is representative of the fuel heat transfer dynamics that produce the relationship between the neutron flux and the core THERMAL POWER. The filter time constant is specified in the COLR and must be verified to ensure that the channel is accurately reflecting the desired parameter.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to filter time constant values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).
SR  3.3.1.1.15 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The functional testing of control rods, in LCO 3.1.3, "Control Rod OPERABILITY," and SDV vent and drain valves, in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," overlaps this Surveillance to provide complete testing of the assumed safety function.
The Self Test System may be utilized to perform this testing for those components that it is designed to monitor.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                          B 3.3-28                     Revision No. 14-2

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE      SR  3.3.1.1.16 REQUIREMENTS (continued)     This SR ensures that scrams initiated from the Turbine Stop Valve Closure and Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Functions will not be inadvertently bypassed when THERMAL POWER is > 33.3% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodology are incorporated into the actual setpoint.
If any bypass channel setpoint is nonconservative such that the Functions are bypassed at > 33.3% RTP (e.g., due to open main steam line drain(s), main turbine bypass valve(s) or other reasons), then the affected Turbine Stop Valve Closure and Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Functions are considered inoperable. Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel is considered OPERABLE.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.1.1.17 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The RPS RESPONSE TIME acceptance criteria are included in plant Surveillance procedures.
As noted, neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time. In addition, for Functions 3, 4, and 5, the associated sensors are not required to be response time tested. For these Functions, response time testing for the remaining channel components, including the ATMs, is required. This allowance is supported by Reference 10.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to RPS RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 12).
(continued)
CLINTON                          B 3.3-29                     Revision No. 14-2

RPS Instrumentation B 3.3.1.1 BASES (continued)
REFERENCES        1. USAR, Section 7.2.
: 2. USAR, Section 5.2.2.
: 3. USAR, Section 6.3.3.
: 4. USAR, Chapter 15.
: 5. USAR, Section 15.4.1.2.
: 6. NEDO-23842, "Continuous Control Rod Withdrawal in the Startup Range," April 18, 1978.
: 7. USAR, Section 15.4.9.
: 8. Letter, P. Check (NRC) to G. Lainas (NRC), "BWR Scram Discharge System Safety Evaluation," December 1, 1980, as attached to NRC Generic Letter dated December 9, 1980.
: 9. NEDO-30851-P-A, "Technical Specification Improvement Analyses for BWR Reactor Protection System,"
March 1988.
: 10. NEDO-32291-A, "System Analyses for Elimination of Selected Response Time Testing Requirements," January 1994.
: 11. Calculation IP-0-0002.
: 12. Calculation IP-0-0024.
: 13. Risk Management Document No. 1073, "Scram Discharge Volume Level Instrument Surveillance Interval Extension Risk Assessment," dated November 17, 2006.
CLINTON                          B 3.3-30                     Revision No. 14-2

SRM Instrumentation B 3.3.1.2 B 3.3   INSTRUMENTATION B 3.3.1.2   Source Range Monitor (SRM) Instrumentation BASES BACKGROUND         The SRMs provide the operator with information relative to the neutron level at very low flux levels in the core. As such, the SRM indication is used by the operator to monitor the approach to criticality and to determine when criticality is achieved. The SRMs are maintained fully inserted until the count rate is greater than a minimum allowed count rate (a control rod block is set at this condition). After SRM to intermediate range monitor (IRM) overlap is demonstrated (as required by SR 3.3.1.1.6), the SRMs are normally fully withdrawn from the core.
The SRM subsystem of the Neutron Monitoring System (NMS) consists of four channels. Each of the SRM channels can be bypassed, but only one at any given time, by the operation of a bypass switch. Each channel includes one detector that can be physically positioned in the core. Each detector assembly consists of a miniature fission chamber with associated cabling, signal conditioning equipment, and electronics associated with the various SRM functions. The signal conditioning equipment converts the current pulses from the fission chamber to analog DC currents that correspond to the count rate. Each channel also includes indication, alarm, and control rod blocks. However, this LCO specifies OPERABILITY requirements only for the monitoring and indication functions of the SRMs.
During refueling, shutdown, and low power operations, the primary indication of neutron flux levels is provided by the SRMs or special movable detectors connected to the normal SRM circuits. The SRMs provide monitoring of reactivity changes during fuel or control rod movement and give the control room operator early indication of unexpected subcritical multiplication that could be indicative of an approach to criticality.
APPLICABLE         Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES    during refueling and low power operation are provided by LCO 3.9.1, "Refueling Equipment Interlocks"; LCO 3.1.1, "SHUTDOWN MARGIN (SDM)"; LCO 3.3.1.1, "Reactor Protection (continued)
CLINTON                          B 3.3-31                        Revision No. 0

SRM Instrumentation B 3.3.1.2 BASES APPLICABLE        System (RPS) Instrumentation," Intermediate Range Monitor SAFETY ANALYSES   (IRM) Neutron Flux High and Average Power Range Monitor (continued)     (APRM) Neutron Flux-High, Setdown Functions; and LCO 3.3.2.1, "Control Rod Block Instrumentation."
The SRMs have no safety function and are not assumed to function during any design basis accident or transient analysis. However, the SRMs provide the only on scale monitoring of neutron flux levels during startup and refueling. Therefore, they are being retained in the Technical Specifications.
LCO               During startup in MODE 2, three of the four SRM channels are required to be OPERABLE to monitor the reactor flux level prior to and during control rod withdrawal, to monitor subcritical multiplication and reactor criticality, and to monitor neutron flux level and reactor period until the flux level is sufficient to maintain the IRM on Range 3 or above.
All channels but one are required in order to provide a representation of the overall core response during those periods when reactivity changes are occurring throughout the core.
In MODES 3 and 4, with the reactor shut down, two SRM channels provide redundant monitoring of flux levels in the core.
In MODE 5, during a spiral offload or reload, an SRM outside the fueled region will no longer be required to be OPERABLE, since it is not capable of monitoring neutron flux in the fueled region of the core. Thus, CORE ALTERATIONS are allowed in a quadrant with no OPERABLE SRM in an adjacent quadrant, as provided in the Table 3.3.1.2-1, footnote (b),
requirement that the bundles being spiral reloaded or spiral offloaded are all in a single fueled region containing at least one OPERABLE SRM is met. Spiral reloading and offloading encompass reloading or offloading a cell on the edges of a continuous fueled region (the cell can be reloaded or offloaded in any sequence).
In nonspiral routine operations, two SRMs are required to be OPERABLE to provide redundant monitoring of reactivity changes occurring in the reactor core. Because of the local nature of reactivity changes during refueling, adequate coverage is provided by requiring one SRM to be OPERABLE in (continued)
CLINTON                         B 3.3-32                        Revision No. 0

SRM Instrumentation B 3.3.1.2 BASES LCO               the quadrant of the reactor core where CORE ALTERATIONS are (continued)     being performed and the other SRM to be OPERABLE in an adjacent quadrant containing fuel. These requirements ensure that the reactivity of the core will be continuously monitored during CORE ALTERATIONS.
Special movable detectors, according to Table 3.3.1.2-1, footnote (c), may be used during CORE ALTERATIONS in place of the normal SRM nuclear detectors. These special detectors must be connected to the normal SRM circuits in the NMS such that the applicable neutron flux indication can be generated. These special detectors provide more flexibility in monitoring reactivity changes during fuel loading, since they can be positioned anywhere within the core during refueling. They must still meet the location requirements of SR 3.3.1.2.2, and all other required SRs for SRMs.
For an SRM channel to be considered OPERABLE, it must be providing neutron flux monitoring indication.
APPLICABILITY     The SRMs are required to be OPERABLE in MODES 2, 3, 4, and 5, prior to the IRMs being on scale on Range 3 to provide for neutron monitoring. In MODE 1, the APRMs provide adequate monitoring of reactivity changes in the core; therefore, the SRMs are not required. In MODE 2, with IRMs on Range 3 or above, the IRMs provide adequate monitoring and the SRMs are not required.
ACTIONS           A.1 and B.1 In MODE 2, with the IRMs on Range 2 or below, SRMs provide the means of monitoring core reactivity and criticality.
With any number of the required SRMs inoperable, the ability to monitor is degraded. Therefore, a limited time is allowed to restore the inoperable channels to OPERABLE status.
Providing that at least one SRM remains OPERABLE, Required Action A.1 allows 4 hours to restore the required SRMs to OPERABLE status. This is a reasonable time since there is adequate capability remaining to monitor the core, limited risk of an event during this time, and sufficient time to take corrective actions to restore the required SRMs to OPERABLE status or to establish alternate IRM monitoring (continued)
CLINTON                         B 3.3-33                         Revision No. 0

SRM Instrumentation B 3.3.1.2 BASES ACTIONS           A.1 and B.1  (continued) capability. During this time, control rod withdrawal and power increase are not precluded by this Required Action.
Having the ability to monitor the core with at least one SRM, proceeding to IRM Range 3 or greater (with overlap required by SR 3.3.1.1.6) and thereby exiting the Applicability of this LCO, is acceptable for ensuring adequate core monitoring and allowing continued operation.
With three required SRMs inoperable, Required Action B.1 allows no positive changes in reactivity (control rod withdrawal must be immediately suspended) due to the inability to monitor the changes. Required Action A.1 still applies and allows 4 hours to restore monitoring capability prior to requiring control rod insertion. This allowance is based on the limited risk of an event during this time, provided that no control rod withdrawals are allowed, and the desire to concentrate efforts on repair, rather than to immediately shut down, with no SRMs OPERABLE.
C.1 In MODE 2, if the required number of SRMs is not restored to OPERABLE status within the allowed Completion Time, the reactor shall be placed in MODE 3. With all control rods fully inserted, the core is in its least reactive state with the most margin to criticality. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 in an orderly manner and without challenging plant systems.
D.1 and D.2 With one or more required SRM channels inoperable in MODE 3 or 4, the neutron flux monitoring capability is degraded or nonexistent. The requirement to fully insert all insertable control rods ensures that the reactor will be at its minimum reactivity level while no neutron monitoring capability is available. Placing the reactor mode switch in the shutdown position prevents subsequent control rod withdrawal by maintaining a control rod block. The mode switch should be locked (i.e., the key removed) to preclude inadvertent operation of the mode switch. The allowed Completion Time of 1 hour is sufficient to accomplish the Required Action, and takes into account the low probability of an event requiring the SRM occurring during this time.
(continued)
CLINTON                          B 3.3-34                     Revision No. 1-1

SRM Instrumentation B 3.3.1.2 BASES ACTIONS           E.1 and E.2 (continued)
With one or more required SRMs inoperable in MODE 5, the capability to detect local reactivity changes in the core during refueling is degraded. CORE ALTERATIONS must be immediately suspended, and action must be immediately initiated to fully insert all insertable control rods in core cells containing one or more fuel assemblies.
Suspending CORE ALTERATIONS prevents the two most probable causes of reactivity changes, fuel loading and control rod withdrawal, from occurring. Inserting all insertable control rods ensures that the reactor will be at its minimum reactivity, given that fuel is present in the core.
Suspension of CORE ALTERATIONS shall not preclude completion of the movement of a component to a safe, conservative position.
Action (once required to be initiated) to insert control rods must continue until all insertable rods in core cells containing one or more fuel assemblies are inserted.
SURVEILLANCE      The SRs for each SRM Applicable MODE or other specified REQUIREMENTS      condition are found in the SRs column of Table 3.3.1.2-1.
SR  3.3.1.2.1 and SR  3.3.1.2.3 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to the same parameter indicated on other similar channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
(continued)
CLINTON                         B 3.3-35                      Revision No. 13-1

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE      SR  3.3.1.2.1 and SR  3.3.1.2.3  (continued)
REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
SR  3.3.1.2.2 To provide adequate coverage of potential reactivity changes in the core, one SRM is required to be OPERABLE in the quadrant where CORE ALTERATIONS are being performed, and the other OPERABLE SRM must be in an adjacent quadrant containing fuel. Note 1 states that this SR is required to be met only during CORE ALTERATIONS. It is not required to be met at other times in MODE 5 since core reactivity changes are not occurring. This Surveillance consists of a review of plant logs to ensure that SRMs required to be OPERABLE for given CORE ALTERATIONS are, in fact, OPERABLE.
In the event that only one SRM is required to be OPERABLE, per Table 3.3.1.2-1, footnote (b), only the a. portion of this SR is required. Note 2 clarifies that more than one of the three requirements can be met by the same OPERABLE SRM.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.1.2.4 This Surveillance consists of a verification of the SRM instrument readout to ensure that the SRM reading is greater than a specified minimum count rate. This ensures that the detectors are indicating count rates indicative of neutron flux levels within the core. Verification of the signal to noise ratio also ensures that the detectors are inserted to a normal operating level. In a fully withdrawn condition, the detectors are sufficiently removed from the fueled (continued)
CLINTON                         B 3.3-36                     Revision No. 14-2

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE      SR  3.3.1.2.4  (continued)
REQUIREMENTS region of the core to essentially eliminate neutrons from reaching the detector. Any count rate obtained while fully withdrawn is assumed to be "noise" only. With few fuel assemblies loaded, the SRMs will not have a high enough count rate to satisfy the SR. Therefore, allowances are made for loading sufficient "source" material, in the form of irradiated fuel assemblies, to establish the minimum count rate.
To accomplish this, the SR is modified by a Note that states that the count rate is not required to be met on an SRM that has less than or equal to four fuel assemblies adjacent to the SRM and no other fuel assemblies are in the associated core quadrant. With four or less fuel assemblies loaded around each SRM and no other fuel assemblies in the associated quadrant, even with a control rod withdrawn the configuration will not be critical.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to count rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 1).
SR  3.3.1.2.5 Performance of a CHANNEL FUNCTIONAL TEST demonstrates the associated channel will function properly. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-37                     Revision No. 21-4

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE      SR  3.3.1.2.5 (continued)
REQUIREMENTS The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours of entering MODE 2 with IRMs on Range 2 or below.
The allowance to enter the Applicability with the Frequency not met is reasonable, based on the limited time of 12 hours allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels.
Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances.
SR  3.3.1.2.6 Performance of a CHANNEL CALIBRATION verifies the performance of the SRM detectors and associated circuitry.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The neutron detectors are excluded from the CHANNEL CALIBRATION because they cannot readily be adjusted. The detectors are fission chambers that are designed to have a relatively constant sensitivity over the range, and with an accuracy specified for a fixed useful life.
The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours of entering MODE 2 with IRMs on Range 2 or below. The allowance to enter the Applicability with the Frequency not met is reasonable, based on the limited time of 12 hours allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels.
Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily (continued CLINTON                         B 3.3-38                     Revision No. 14-2

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE      SR  3.3.1.2.6  (continued)
REQUIREMENTS performing the CHANNEL CHECK) and the time required to perform the Surveillances.
REFERENCES        1. Calculation IP-0-0002.
CLINTON                         B 3.3-39                      Revision No. 4-6

OPRM Instrumentation B 3.3.1.3 B 3.3   INSTRUMENTATION B 3.3.1.3   Oscillation Power Range Monitor (OPRM) Instrumentation BASES BACKGROUND         General Design Criterion 10 (GDC 10) requires the reactor core and associated coolant, control, and protection systems to be designed with appropriate margin to assure that acceptable fuel design limits are not exceeded during any condition of normal operation, including the affects of anticipated operational occurrences. Additionally, GDC 12 requires the reactor core and associated coolant, control, and protection systems to be designed to assure that power oscillations which can result in conditions exceeding acceptable fuel design limits are either not possible or can be reliably and readily detected and suppressed. The OPRM System provides compliance with GDC 10 and GDC 12, thereby providing protection from exceeding the fuel Minimum Critical Power Ratio (MCPR) safety limit.
References 1, 2, and 3 describe three separate algorithms for detecting stability related oscillations: the period based detection algorithm, the amplitude based algorithm, and the growth rate algorithm. The OPRM System hardware implements these algorithms in microprocessor based modules.
These modules execute the algorithms based on Local Power Range Monitor (LPRM) inputs and generate alarms and trips based on these calculations. These trips result in tripping the Reactor Protection System (RPS) when the appropriate RPS trip logic is satisfied, as described in the Bases for LCO 3.3.1.1, Reactor Protection System (RPS) Instrumentation.
Only the period based detection algorithm is used in the safety analysis (Ref. 1, 2, 6, and 7). The remaining algorithms provide defense in depth and additional protection against unanticipated oscillations.
The period based detection algorithm detects a stability related oscillation based on the occurrence of a fixed number of consecutive LPRM signal period confirmations coincident with the LPRM signal peak to average amplitude exceeding a specified setpoint.
Upon detection of a stability related oscillation, a trip is generated for that OPRM channel.
The OPRM System consists of 4 OPRM trip channels, each channel consisting of two OPRM modules. Each OPRM module receives input from LPRMs. Each OPRM module also receives input from the Neutron Monitoring System (NMS) Average Power Range Monitor (APRM) power and flow signals to automatically enable the trip function of the OPRM module.
Each OPRM module is continuously tested by a self-test function. On detection of any OPRM module failure, either a (continued)
CLINTON                          B 3.3-39a                     Revision No. 11-1

OPRM Instrumentation B 3.3.1.3 BASES BACKGROUND      Trouble alarm or INOP alarm is activated. The OPRM module (continued)    provides an INOP alarm when the self-test feature indicates that the OPRM module may not be capable of meeting its functional requirements.
APPLICABLE      It has been shown that BWR cores may exhibit thermal-SAFETY ANALYSES hydraulic reactor instabilities in high power and low flow portions of the core power to flow operating domain (Reference 4). GDC 10 requires the reactor core and associated coolant, control, and protection systems to be designed with appropriate margin to assure that acceptable fuel design limits are not exceeded during any condition of normal operation, including the affects of anticipated operational occurrences. GDC 12 requires assurance that power oscillations which can result in conditions exceeding acceptable fuel design limits are either not possible or can be reliably and readily detected and suppressed. The OPRM System provides compliance with GDC 10 and GDC 12 by detecting the onset of oscillations and suppressing them by initiating a reactor scram. This assures that the MCPR safety limit will not be violated for anticipated oscillations.
The OPRM Instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
The OPERABILITY of the OPRM System is dependent on the OPERABILITY of the four individual instrumentation channels with their setpoints within the specified nominal setpoint.
Each channel must also respond within its assumed response time.
The nominal setpoints for the OPRM Period Based Trip Function are specified in the Core Operating Limits Report.
The trip setpoints are treated as nominal setpoints and do not require additional allowances for uncertainty.
Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter value and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state.
The OPRM period based setpoint is determined by cycle specific analysis based on positive margin between the Safety Limit MCPR and the Operating Limit MCPR minus the change in CPR (CPR). This methodology was approved for use by the NRC in Reference 6.
(continued)
CLINTON                       B 3.3-39b                    Revision No. 11-1

OPRM Instrumentation B 3.3.1.3 BASES   (continued)
LCO                 Four channels of the OPRM System are required to be OPERABLE to ensure that stability related oscillations are detected and suppressed prior to exceeding the MCPR safety limit.
Only one of the two OPRM modules (with an active period based detection algorithm) is required for OPRM channel OPERABILITY. The minimum number of LPRMs required OPERABLE to maintain an OPRM channel OPERABLE is consistent with the minimum number of LPRMs required to maintain the APRM System OPERABLE per LCO 3.3.1.1.
APPLICABILITY       The OPRM instrumentation is required to be OPERABLE in order to detect and suppress neutron flux oscillations in the event of thermal-hydraulic instability. As described in References 1, 2, 3, and 10, the region of anticipated oscillation is defined by THERMAL POWER t 25% Rated Thermal Power (RTP) and recirculation drive flow is d the value corresponding to 60% of rated core flow. The OPRM trip is required to be enabled in this region, and the OPRM must be capable of enabling the trip function as a result of anticipated transients that place the core in that power/flow condition. Therefore, the OPRM instrumentation is required to be OPERABLE with THERMAL POWER t 21.6% RTP.
It is not necessary for the OPRM instrumentation to be OPERABLE with THERMAL POWER  21.6% RTP because the MCPR safety limit is not applicable below 21.6% RTP.
ACTIONS             A Note has been provided to modify the ACTIONS related to the OPRM instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable OPRM instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable OPRM instrumentation channel.
With respect to this Technical Specification, an RPS trip system is equivalent to an RPS division.
A.1, A.2, and A.3 Because of the reliability and on-line self-testing of the OPRM instrumentation and the redundancy of the RPS design, an allowable out of service time of 30 days has been shown to be acceptable (Ref. 7) to permit restoration of any
___________________________________________________________________(continued)
CLINTON                           B 3.3-39c                     Revision No. 11-1

OPRM Instrumentation B 3.3.1.3 BASES ACTIONS           A.1, A.2, and A.3  (continued) inoperable channel to OPERABLE status. However, this out of service time is only acceptable provided the OPRM instrumentation still maintains OPRM trip capability (refer to Required Actions B.1 and B.2). The remaining OPERABLE OPRM channels continue to provide trip capability (see Condition B) and provide operator information relative to stability activity. The remaining OPRM modules have high reliability. With this high reliability, there is a low probability of a subsequent channel failure within the allowable out of service time. In addition, the OPRM modules continue to perform on-line self-testing and alert the operator if any further system degradation occurs.
If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the OPRM channel or associated RPS trip system must be placed in the tripped condition per Required Actions A.1 and A.2. Placing the inoperable OPRM channel in trip (or the associated RPS trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the OPRM channel (or RPS trip system) in trip (e.g., as in the case where placing the inoperable channel in trip would result in a full scram),
the alternate method of detecting and suppressing thermal-hydraulic instability oscillations is required (Required Action A.3). This alternate method is described in Reference 5. It consists of avoidance of the region where oscillations are possible, exiting this region if it is entered due to unforeseen circumstances, and increased operator awareness and monitoring for neutron flux oscillations while taking action to exit the region. If indications of oscillation, as described in Reference 5, are observed by the operator, the operator will take the actions described by procedures, which include initiating a manual scram of the reactor. Continued operation with one OPRM channel inoperable, but not tripped, is permissible if the OPRM System maintains trip capability, since the combination of the alternate method and the OPRM trip capability provides adequate protection against oscillations.
B.1 and B.2 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped OPRM channels result in not maintaining OPRM trip capability.
OPRM trip capability is considered to be maintained when sufficient OPRM channels are OPERABLE or in trip (or the associated RPS Division is in trip), such that a valid OPRM signal will generate a full RPS scram. This would require either 1) 2 OPERABLE OPRM channels capable of processing a trip thru to the RPS system, or 2) 1 OPERABLE OPRM channel and either 1 OPRM channel in trip or an RPS Division in (continued)
CLINTON                         B 3.3-39d                    Revision No. 11-1

OPRM Instrumentation B 3.3.1.3 BASES ACTIONS      B.1 and B.2   (continued) trip. These must be in a combination that will ultimately provide the required 2 inputs to RPS needed to initiate a full scram signal.
Because of the low probability of the occurrence of an instability, 12 hours is an acceptable time to initiate the alternate method of detecting and suppressing thermal-hydraulic instability oscillations described in the Bases for Action A.3 above. The alternate method of detecting and suppressing thermal-hydraulic instability oscillations avoids the region where oscillations are possible and would adequately address detection and mitigation in the event of instability oscillations. Based on industry operating experience with actual instability oscillations, the operator would be able to recognize instabilities during this time and take action to suppress them through a manual scram. In addition, the OPRM System may still be available to provide alarms to the operator if the onset of oscillations were to occur. Since plant operation is minimized in areas where oscillations may occur, operation for 120 days without OPRM trip capability is considered acceptable with implementation of an alternate method of detecting and suppressing thermal-hydraulic instability oscillations.
C.1 With any Required Action and associated Completion Time not met, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to  21.6% RTP within 4 hours. Reducing THERMAL POWER to  21.6% RTP places the plant in a region where instabilities cannot occur. The 4 hours is reasonable, based on operating experience, to reduce THERMAL POWER  21.6% RTP from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE The Surveillances are modified by a Note to indicate REQUIREMENTS that, when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.
This Note is based on the RPS reliability analysis (Ref. 9) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the RPS will trip when necessary.
(continued)
CLINTON                     B 3.3-39e                   Revision No. 11-1

OPRM Instrumentation B 3.3.1.3 BASES SURVEILLANCE  For the following OPRM instrumentation Surveillances, REQUIREMENTS  both OPRM modules are tested, although only one is required (continued) to satisfy the Surveillance Requirement.
SR 3.3.1.3.1 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.3.2 LPRM gain settings are determined from the local flux profiles measured by the Traversing Incore Probe (TIP)
System. This establishes the relative local flux profile for appropriate representative input to the APRM System. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.3.3 The CHANNEL CALIBRATION is a complete check of the instrument loop. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations, consistent with the plant specific setpoint methodology. Calibration of the channel provides a check of the internal reference voltage and the internal processor clock frequency. It also compares the desired trip setpoint with those in the processor memory. Since the OPRM is a digital system, the internal reference voltage and processor clock frequency are, in turn, used to automatically calibrate the internal analog to digital converters. The nominal setpoints for the period based detection algorithm are specified in the Core Operating Limits Report (COLR). As noted, neutron detectors are excluded from CHANNEL CALIBRATION because of the difficulty of simulating a meaningful signal. Changes in neutron detector sensitivity are compensated for by performing the LPRM calibration against the TIPs (SR 3.3.1.1.8). SR 3.3.1.1.8 thus also ensures the operability of the OPRM instrumentation.
The nominal setpoints for the OPRM trip function for the period based detection algorithm (PBDA) are specified in the COLR. The PBDA trip setpoints are the number of confirmation counts required to permit a trip signal and the peak to average amplitude required to generate a trip signal.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                     B 3.3-39f                    Revision No. 14-2

OPRM Instrumentation B 3.3.1.3 BASES SURVEILLANCE  SR 3.3.1.3.4 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The functional testing of control rods in LCO 3.1.3, Control Rod OPRABILITY, and scram discharge volume (SDV) vent and drain valves in LCO 3.1.8, Scram Discharge Volume (SDV) Vent and Drain Valves," overlaps this Surveillance to provide complete testing of the assumed safety function. The OPRM self-test function may be utilized to perform this testing for those components that it is designed to monitor.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.3.5 This SR ensures that trips initiated from the OPRM System will not be inadvertently bypassed when THERMAL POWER is t 25% RTP and recirculation drive flow is d the value corresponding to 60% of rated core flow. This normally involves calibration of the bypass channels. The 25% RTP value is the plant specific value for the enable region, as described in Reference 10.
These values have been conservatively selected so that specific, additional uncertainty allowances need not be applied. Specifically, for the THERMAL POWER, the Average Power Range Monitor (APRM) establishes the reference signal to enable the OPRM System at 25% RTP. Thus, the nominal setpoints corresponding to the values listed above (25% RTP and the value corresponding to 60% of rated core flow) will be used to establish the enabled region of the OPRM System trips. (References 1, 2, 6, 10, and 11)
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.3.1.3.6 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis (Reference 6). The OPRM self-test function may be utilized to perform this testing for those components it is designed to monitor. The RPS RESPONSE TIME acceptance criteria are included in plant Surveillance procedures.
As noted, neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                     B 3.3-39g                    Revision No. 14-2

OPRM Instrumentation B 3.3.1.3 BASES   (continued)
REFERENCES          1. NEDO-31960, BWR Owners Group Long-Term Stability Solutions Licensing Methodology, June 1991.
: 2. NEDO-31960, BWR Owners Group Long-Term Stability Solutions Licensing Methodology, Supplement 1, March 1992.
: 3. NRC Letter, A. Thadani to L. A. England, Acceptance for Referencing of Topical Reports NEDO-31960, Supplement 1, BWR Owners Group Long-Term Stability Solutions Licensing Methodology, July 12, 1994.
: 4. Generic Letter 94-02, Long-Term Solutions and Upgrade of Interim Operating Recommendations for Thermal-Hydraulic Instabilities in Boiling Water Reactors, July 11, 1994.
: 5. BWROG Letter BWROG-94079, Guidelines for Stability Interim Corrective Action, June 6, 1994.
: 6. NEDO-32465-A, BWR Owners Group Reactor Stability Detect and Suppress Solution Licensing Basis Methodology and reload Application, August 1996.
: 7. CENPD-400-P, Rev. 01, Generic Topical Report for the ABB Option III Oscillation Power Range Monitor (OPRM),
May 1995.
: 8. NRC Letter, B. Boger to R. Pinelli, Acceptance of Licensing Topical Report CENPD-400-P, Generic Topical Report for the ABB Option III Oscillation Power Range Monitor (OPRM), August 16, 1995.
: 9. NEDO-30851-P-A, Technical Specification Improvement Analyses for BWR Reactor Protection System, March 1988.
: 10. NEDC-32989P, Safety Analysis Report for Clinton Power Station Extended Power Uprate, dated June 2001.
: 11. Letter from K. P. Donovan (BWR Owners Group) to U. S.
NRC, Guidelines for Stability Option III Enabled Region, dated September 17, 1996.
CLINTON                           B 3.3-39h                    Revision No. 14-2

Control Rod Block Instrumentation B 3.3.2.1 B 3.3   INSTRUMENTATION B 3.3.2.1   Control Rod Block Instrumentation BASES BACKGROUND         Control rods provide the primary means for control of reactivity changes. Control rod block instrumentation includes channel sensors, logic circuitry, switches, indicators, and alarm devices that are designed to ensure that specified fuel design limits are not exceeded for postulated transients and accidents. During high power operation, the rod withdrawal limiter (RWL) provides protection for control rod withdrawal error events. During low power operations, control rod blocks from the rod pattern controller (RPC) enforce specific control rod sequences designed to mitigate the consequences of the control rod drop accident (CRDA). During shutdown conditions, control rod blocks from the Reactor Mode Switch-Shutdown Position ensure that all control rods remain inserted to prevent inadvertent criticalities.
The purpose of the RWL is to limit control rod withdrawal to preclude a MCPR Safety Limit (SL) violation. The RWL supplies a trip signal to the Rod Control and Information System (RCIS) to appropriately inhibit control rod withdrawal during power operation equal to or greater than the low power setpoint (LPSP). The RWL has two channels, either of which can initiate a control rod block when the control rod movement limits are reached. The rod block logic circuitry in the RCIS is arranged as two redundant and separate logic circuits. These circuits are enabled when control rod movement is allowed. The output of each logic circuit is coupled to a comparator by the use of isolation devices in the rod drive control cabinet. The two logic circuit signals are compared and rod blocks are applied when either circuit trip signal is present. Control rod withdrawal is permitted only when the two signals agree.
Each rod block logic circuit receives control rod position indication from a separate channel of the Rod Position Information System, each with a set of reed switches for control rod position indication. Control rod position is the primary data input for the RWL. First stage turbine pressure is used to determine reactor power level, with an LPSP and a high power setpoint (HPSP) used to determine allowable control rod withdrawal distances. Below the LPSP, the RWL is automatically bypassed (Ref. 1).
(continued)
CLINTON                          B 3.3-40                        Revision No. 0

Control Rod Block Instrumentation B 3.3.2.1 BASES BACKGROUND        The purpose of the RPC is to ensure control rod patterns (continued)     during startup are such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 16.7% RTP.
The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA. The RPC, in conjunction with the RCIS, will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the specified sequence. The rod block logic circuitry is the same as that described above. The RPC also uses the turbine first stage pressure to determine when reactor power is above the power at which the RPC is automatically bypassed (Ref. 1).
With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This function prevents criticality resulting from inadvertent control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. The reactor mode switch has two channels, with each providing inputs into a separate rod block circuit. A rod block in either circuit will provide a control rod block to all control rods.
APPLICABLE        1.a. Rod Withdrawal Limiter SAFETY ANALYSES, LCO, and          The RWL is designed to prevent violation of the MCPR SL APPLICABILITY     and the cladding 1% plastic strain fuel design limit that may result from a single control rod withdrawal error (RWE) event. The analytical methods and assumptions used in evaluating the RWE event are summarized in Reference 2. A statistical analysis of RWE events was performed to deter-mine the MCPR response as a function of withdrawal distance and initial operating conditions. From these responses, the fuel thermal performance was determined as a function of RWL allowable control rod withdrawal distance and power level.
The RWL satisfies Criterion 3 of the NRC Policy Statement.
Two channels of the RWL are available and are required to be OPERABLE to ensure that no single instrument failure can preclude a rod block from this Function. The RWL high power function channels are considered OPERABLE when control rod withdrawal is limited to no more than two notches from the original position of the selected control rod. The RWL low (continued)
CLINTON                         B 3.3-41                      Revision No. 7-5

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE        1.a. Rod Withdrawal Limiter  (continued)
SAFETY ANALYSES, LCO, and          power function channels are considered OPERABLE when APPLICABILITY     control rod withdrawal is limited to no more than four notches from the original position of the selected control rod. (By design, a single control rod that has been inserted for scram time testing, for example, can be continuously withdrawn to its previous position without establishing a new withdrawal limit.)
Nominal trip set points are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Values between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.
Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor power), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,
analog trip module) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drive, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
The RWL is assumed to mitigate the consequences of an RWE event when operating > 29.2% RTP. Below this power level, the consequences of an RWE event will not exceed the MCPR, and therefore the RWL is not required to be OPERABLE (Ref. 3).
1.b. Rod Pattern Controller The RPC enforces the banked position withdrawal sequence (BPWS) to ensure that the initial conditions of the CRDA analysis are not violated. The analytical methods and assumptions used in evaluating the CRDA are summarized in References 4, 5, and 6. The standard BPWS requires that control rods be moved in groups, with all control rods assigned to a specific group required to be within specified banked positions. Requirements that the control rod sequence is in compliance with BPWS are specified in LCO 3.1.6, "Control Rod Pattern."
(continued)
CLINTON                         B 3.3-42                    Revision No. 20-11

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE        1.b. Rod Pattern Controller  (continued)
SAFETY ANALYSES, LCO, and          When performing a shutdown of the plant, an option BPWS APPLICABILITY     control rod sequence (Ref. 6) may be used if the coupling of each withdrawn control rod has been confirmed. The rods may be inserted without the need to stop at intermediate positions. When using the Reference 6 control rod insertion sequence for shutdown, the rod pattern controller may be bypassed if it is not programmed to reflect the optional BPWS shutdown sequence, as permitted by the Applicability Note for the RPC in Table 3.3.2.1-1.
The Rod Pattern Controller Function satisfies Criterion 3 of the NRC Policy Statement. Since the RPC is a backup to operator control of control rod sequences, only a single channel would be required to be OPERABLE to satisfy Criterion 3 (Ref. 5). However, the RPC is designed as a dual channel system and will not function without two OPERABLE channels. Required Actions of LCO 3.1.3, "Control Rod OPERABILITY," and LCO 3.1.6 may necessitate bypassing individual control rods in the Rod Action Control System (RACS) to allow continued operation with inoperable control rods or to allow correction of a control rod pattern not in compliance with the BPWS. The individual control rods may be bypassed as required by the conditions, and the RPC is not considered inoperable provided SR 3.3.2.1.9 is met.
Compliance with the standard BPWS, and therefore OPERABILITY of the RPC, is required in MODES 1 and 2 with THERMAL POWER
                  < 16.7% RTP. An exception is taken to RPC OPERABILITY when complying with the optional BPWS control rod sequence during the reactor shutdown process if the coupling of each withdrawn control rod has been confirmed. When THERMAL POWER is > 16.7% RTP, there is no possible control rod configuration that results in a control rod worth that could exceed the 280 cal/gm fuel damage limit during a CRDA. In MODES 3 and 4, all control rods are required to be inserted in the core. In MODE 5, since only a single control rod can be withdrawn from a core cell containing fuel assemblies, adequate SDM ensures that the consequences of a CRDA are acceptable, since the reactor will be subcritical.
: 2. Reactor Mode Switch-Shutdown Position During MODES 3 and 4, and during MODE 5 when the reactor mode switch is required to be in the shutdown position, the core is assumed to be subcritical; therefore, no positive reactivity insertion events are analyzed. The Reactor Mode Switch-Shutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking control rod withdrawal, thereby preserving the assumptions of the safety analysis.
(continued)
CLINTON                          B 3.3-43                    Revision No. 20-11

Control Rod Block Instrumentation B 3.3.2.1 BASES APPLICABLE        2. Reactor Mode Switch-Shutdown Position  (continued)
SAFETY ANALYSES, LCO, and          The Reactor Mode Switch-Shutdown Position Function satisfies APPLICABILITY     Criterion 3 of the NRC Policy Statement.
Two channels are required to be OPERABLE to ensure that no single channel failure will preclude a rod block when required. No Allowable Value is applicable for this Function since the channels are mechanically actuated based solely on reactor mode switch position.
During shutdown conditions (MODE 3, 4, or 5) no positive reactivity insertion events are analyzed because assumptions are that control rod withdrawal blocks are provided to prevent criticality. Therefore, when the reactor mode switch is in the shutdown position, the control rod withdrawal block is required to be OPERABLE. During MODE 5, with the reactor mode switch in the refueling position, the required position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") provides the required control rod withdrawal blocks.
ACTIONS           A.1 If either RWL channel is inoperable, the RWL may not be capable of performing its intended function. In most cases, with an inoperable channel, the RWL will initiate a control rod withdrawal block because the two channels will not agree. To ensure erroneous control rod withdrawal does not occur, however, Required Action A.1 requires that further control rod withdrawal be suspended immediately.
B.1 If either RPC channel is inoperable, the RPC may not be capable of performing its intended function even though, in most cases, all control rod movement will be blocked. All control rod movement should be suspended under these conditions until the RPC is restored to OPERABLE status.
This action does not preclude a reactor scram. The RPC is not considered inoperable if individual control rods are bypassed in the RACS as required by LCO 3.1.3 or LCO 3.1.6.
Under these conditions, continued operation is allowed if the bypassing of control rods and movement of control rods is verified by a second licensed operator or other qualified member of the technical staff per SR 3.3.2.1.9.
(continued)
CLINTON                         B 3.3-44                    Revision No. 20-11

Control Rod Block Instrumentation B 3.3.2.1 BASES ACTIONS           C.1 and C.2 (continued)
If one Reactor Mode Switch-Shutdown Position control rod withdrawal block channel is inoperable, the remaining OPERABLE channel is adequate to perform the control rod withdrawal block function. Required Action C.1 and Required Action C.2 are consistent with the normal action of an OPERABLE Reactor Mode Switch-Shutdown Position Function to maintain all control rods inserted. Therefore, there is no distinction between Required Actions for the Conditions of one or two channels inoperable. In both cases (one or both channels inoperable), suspending all control rod withdrawal immediately, and immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies will ensure that the core is subcritical, with adequate SDM ensured by LCO 3.1.1, "SHUTDOWN MARGIN (SDM)." Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are therefore not required to be inserted.
Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.
SURVEILLANCE      As noted at the beginning of the SR, the SRs for each REQUIREMENTS      Control Rod Block instrumentation Function are found in the SRs column of Table 3.3.2.1-1.
The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains control rod block capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.
This Note is based on the reliability analysis (Ref. 8) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that a control block will be initiated when necessary.
(continued)
CLINTON                         B 3.3-45                    Revision No. 20-11

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE      SR  3.3.2.1.1, SR  3.3.2.1.2, SR  3.3.2.1.3, and REQUIREMENTS      SR  3.3.2.1.4 (continued)
The CHANNEL FUNCTIONAL TESTS for the RPC and RWL are performed by attempting to withdraw a control rod not in compliance with the prescribed sequence and verifying that a control rod block occurs. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. SR 3.3.2.1.1 verifies proper operation of the two-notch withdrawal limit of the RWL and SR 3.3.2.1.2 verifies proper operation of the four-notch withdrawal limit of the RWL. SR 3.3.2.1.3 and SR 3.3.2.1.4 verify proper operation of the RPC. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. As noted, the SRs are not required to be performed until 1 hour after specified conditions are met (e.g., after any control rod is withdrawn in MODE 2). This allows entry into the appropriate conditions needed to perform the required SRs. The 1 hour allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.2.1.5 The LPSP is the point at which the RPCS makes the transition between the function of the RPC and the RWL. This transition point is automatically varied as a function of power. This power level is inferred from the first stage turbine pressure (one channel to each trip system). These power setpoints must be verified periodically to be within the Allowable Values.
If any LPSP is nonconservative such that the RPC is bypassed at d 16.7% RTP, then the RPC is considered inoperable.
Similarly, if the LPSP is nonconservative such that the RWL low power Function is bypassed at > 29.2% RTP, (e.g., due to open main steam line drain(s), main turbine bypass valve(s),
or other reasons), then the RWL is considered inoperable.
Since this channel has both upper and lower required limits, it is not allowed to be placed in a condition to enable either the RPC or RWL Function.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-46                     Revision No. 21-4

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE      SR  3.3.2.1.6 REQUIREMENTS (continued)     This SR ensures the high power function of the RWL is not bypassed when power is > 70% RTP. The power level is inferred from turbine first stage pressure signals.
Periodic testing of the HPSP channels is required to verify the HPSP to be less than or equal to the limit. This involves calibration of the HPSP. Adequate margins in accordance with setpoint methodologies are included.
If the HPSP is nonconservative such that the RWL high power Function is bypassed at > 70% RTP, (e.g., due to open main steam line drain(s), main turbine bypass valve(s), or other reasons), then the RWL is considered inoperable.
Alternatively, the HPSP can be placed in the conservative condition (nonbypass). If placed in the nonbypassed condition, the SR is met and the RWL would not be considered inoperable.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.2.1.7 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.2.1.8 The CHANNEL FUNCTIONAL TEST for the Reactor Mode Switch-Shutdown Position Function is performed by attempting to withdraw any control rod with the reactor mode switch in the shutdown position and verifying a control rod block occurs.
A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests.
As noted in the SR, the Surveillance is not required to be performed until 1 hour after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be (continued)
CLINTON                         B 3.3-47                     Revision No. 21-4

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE      SR  3.3.2.1.8   (continued)
REQUIREMENTS performed without using jumpers, lifted leads, or movable limits. This allows entry into MODES 3 and 4 if the Frequency is not met per SR 3.0.2. The 1 hour allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.2.1.9 LCO 3.1.3 and LCO 3.1.6 may require individual control rods to be bypassed in RACS to allow insertion of an inoperable control rod or correction of a control rod pattern not in compliance with BPWS. With the control rods bypassed in the RACS, the RPC will not control the movement of these bypassed control rods. Individual control rods may also be required to be bypassed to allow continuous withdrawal for determining the location of leaking fuel assemblies or adjustment of control rod speed. To ensure the proper bypassing and movement of those affected control rods, a second licensed operator or other qualified member of the technical staff must verify the bypassing and movement of these control rods is in conformance with applicable analyses. Compliance with this SR allows the RPC and RWL to be OPERABLE with these control rods bypassed.
REFERENCES        1. USAR, Section 7.6.1.7.
: 2. USAR, Section 15.4.2.
: 3. NEDE-24011-P-A, "General Electric Standard Application for Reload Fuel" (latest approved revision).
: 4. NEDO-21231, "Banked Position Withdrawal Sequence,"
January 1977.
: 5. NRC SER, Acceptance of Referencing of Licensing Topical Report NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17," December 27, 1987.
: 6. NEDO-33091-A, Revision 2, "Improved BPWS Control Rod Insertion Process," July 2004.
: 7. NEDC-30851-P-A, "Technical Specification Improvement Analysis for BWR Control Rod Block Instrumentation,"
October 1988.
: 8. GENE-770-06-1, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.
CLINTON                          B 3.3-48                    Revision No. 20-11

PAM Instrumentation B 3.3.3.1 B 3.3   INSTRUMENTATION B 3.3.3.1   Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND         The primary purpose of the PAM instrumentation is to display plant variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Events.
The instruments that monitor these variables are designated as Type A, Category I, and non-Type A, Category I in accordance with Regulatory Guide 1.97 (Ref. 1).
The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected plant parameters to monitor and assess plant status and behavior following an accident. This capability is consistent with the recommendations of Reference 1.
APPLICABLE         The PAM instrumentation LCO ensures the OPERABILITY of SAFETY ANALYSES    Regulatory Guide 1.97, Type A, variables so that the control room operating staff can:
x    Perform the diagnosis specified in the Emergency Operating Procedures (EOP). These variables are restricted to preplanned actions for the primary success path of Design Basis Accidents (DBAs)
(e.g., loss of coolant accident (LOCA)); and x    Take the specified, preplanned, manually controlled actions for which no automatic control is provided, which are required for safety systems to accomplish their safety function.
The PAM instrumentation LCO also ensures OPERABILITY of Category I, non-Type A, variables. This ensures the control room operating staff can:
x    Determine whether systems important to safety are performing their intended functions; (continued)
CLINTON                          B 3.3-49                        Revision No. 0

PAM Instrumentation B 3.3.3.1 BASES APPLICABLE             Determine the potential for causing a gross breach of SAFETY ANALYSES         the barriers to radioactivity release; (continued) x     Determine whether a gross breach of a barrier has occurred; and x     Initiate action necessary to protect the public and to obtain an estimate of the magnitude of any impending threat.
The plant specific Regulatory Guide 1.97 analysis (Ref. 2) documents the process that identified Type A and Category I, non-Type A, variables.
PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of the NRC Policy Statement. Category I, non-Type A, instrumentation is retained in the Technical Specifications (TS) because it is intended to assist operators in minimizing the consequences of accidents. Therefore, these Category I, non-Type A, variables are important for reducing public risk.
LCO               LCO 3.3.3.1 requires at least two OPERABLE channels for all but one Function to ensure no single failure prevents the operators from being presented with the information necessary to determine the status of the unit and to bring the unit to, and maintain it in, a safe condition following that accident. Furthermore, provision of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information.
The exception to the two channel requirement is primary containment isolation valve (PCIV) position. In this case, the important information is the status of the primary containment penetrations. The LCO requires two position indicators for each penetration flow path. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the automatic valve and prior knowledge of passive valve or via system boundary status. If a normally automatic PCIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE. In addition, Note (b) of Table 3.3.3.1-1 requires (continued)
CLINTON                          B 3.3-50                        Revision No. 0

PAM Instrumentation B 3.3.3.1 BASES LCO               only one position indication for those penetrations which (continued)     only have one position indication provided to the control room.
Listed below is a discussion of the specified instrument Functions listed in Table 3.3.3.1-1, in the accompanying LCO.
: 1. Reactor Steam Dome Pressure Reactor steam dome pressure is a Category I variable provided to support monitoring of Reactor Coolant System (RCS) integrity and to verify operation of the Emergency Core Cooling Systems (ECCS). Two independent pressure transmitters with a range of 0 psig to 1500 psig monitor pressure. Wide range recorders are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
: 2. Reactor Vessel Water Level Reactor vessel water level is a Category I variable provided to support monitoring of core cooling and to verify operation of the ECCS. The wide range water level channels provide the PAM Reactor Vessel Water Level Function. The wide range water level channels measure from 60 inches above instrument zero to 160 inches below instrument zero.
Instrument zero is 520.62 inches above RPV zero. Wide range water level is measured by two independent differential pressure transmitters. The output from these channels is recorded on two independent pen recorders. These recorders are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
The wide range water level instruments are uncompensated for variation in reactor water density and are calibrated to be most accurate at operational pressure and temperature.
: 3. Suppression Pool Water Level Suppression pool water level is a Category I variable provided to detect a breach in the reactor coolant pressure boundary (RCPB). This variable is also used to verify and provide long term surveillance of ECCS function. The wide (continued)
CLINTON                          B 3.3-51                       Revision No. 0

PAM Instrumentation B 3.3.3.1 BASES LCO               3. Suppression Pool Water Level  (continued) range suppression pool water level measurement provides the operator with sufficient information to assess the status of the RCPB and to assess the status of the water supply to the ECCS. The wide range water level indicators monitor the suppression pool level from the center line of the ECCS suction lines to the top of the pool. Four wide range suppression pool water level signals are transmitted from separate differential pressure transmitters and are continuously recorded on four recorders in the control room.
Two of these channels monitor the suppression pool from 8 ft 0 inches to 16 ft 4 inches (low range). The remaining two channels monitor suppression pool level from 15 ft 8 inches to 24 ft 0 inches (high range). The recorders are the primary indication used by the operator during an accident.
Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
: 4. Drywell Pressure Drywell pressure is a Category I variable provided to detect breach of the RCPB and to verify ECCS functions that operate to maintain RCS integrity. Two wide range drywell pressure signals are transmitted from separate pressure transmitters and are continuously recorded and displayed on two control room recorders. These recorders are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
: 5. Primary Containment Area Radiation Primary containment area radiation (high range) is a Category I variable provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. Two high range radiation detectors are provided to monitor the primary containment area gross gamma radiation levels. These detectors monitor the range 1 to 10E7 R/hr and provide inputs to monitors in the main control room. These monitors are the primary indication used by the operator during an accident.
Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
(continued)
CLINTON                         B 3.3-52                        Revision No. 0

PAM Instrumentation B 3.3.3.1 BASES LCO               6. Drywell Area Radiation (continued)
Drywell area radiation (high range) is a Category I variable provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. Two high range radiation detectors are provided to monitor the drywell area gross gamma radiation levels. These detectors monitor the range 1 to 10E7 R/hr and provide inputs to monitors in the main control room.
The monitors are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
: 7. Primary Containment Isolation Valve (PCIV) Position PCIV position is provided for verification of containment integrity. In the case of PCIV position, the important information is the status of the containment penetration.
The LCO requires one channel of valve position indication in the control room to be OPERABLE for each automatic PCIV in a containment penetration flow path; i.e., two total channels of PCIV position indication for a penetration flow path with two automatic valves. For containment penetrations with only one automatic PCIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE. This is sufficient to verify redundantly the isolation status of each isolable penetration via indicated status of the automatic valve and, as applicable, prior knowledge of passive valve or system boundary status.
If a penetration is isolated by at least one closed and de-activated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured, position indication for the PCIV(s) in the associated penetration flow path is not needed to determine status.
Therefore, the position indication for valves in an isolated penetration is not required to be OPERABLE.
: 8.  (Deleted)
(continued)
CLINTON                         B 3.3-53                      Revision No. 10-2

PAM Instrumentation B 3.3.3.1 BASES LCO               9. Primary Containment Pressure Primary containment pressure is a Category I variable provided to verify RCS and containment integrity and to verify the effectiveness of ECCS actions taken to prevent containment breach. Four wide range primary containment pressure signals are transmitted from separate pressure transmitters and are continuously recorded and displayed on four control room recorders. Two of these instruments monitor containment pressure from -5 psig to 10 psig (low range). The remaining two instruments monitor containment pressure from 5 psig to 45 psig (high range). These recorders are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
: 10. Suppression Pool Water Bulk Average Temperature Suppression pool water bulk average temperature is a Type A variable provided to detect a condition that could potentially lead to containment breach, and to verify the effectiveness of ECCS actions taken to prevent containment breach. The suppression pool water temperature instrumentation allows operators to detect trends in suppression pool water temperature in sufficient time to take action to prevent steam quenching vibrations in the suppression pool. Eight temperature sensors are arranged in two channels (i.e., divisions), located such that there is one sensor from each channel (division) within each quadrant of the suppression pool. These instruments provide the capability to monitor suppression pool water temperature (continued)
CLINTON                         B 3.3-54                     Revision No. 10-2

PAM Instrumentation B 3.3.3.1 BASES LCO           10. Suppression Pool Water Bulk Average Temperature (continued) when pool water level is below the instruments addressed by the Operational Requirements Manual.
The outputs for the PAM sensors are recorded on two independent recorders in the control room. These recorders average the output from the four Division 1 sensors and the four Division 2 sensors. Both of these recorders must be OPERABLE to furnish two channels of PAM suppression pool water bulk average temperature. These recorders are the primary indication used by the operator during an accident.
Therefore, the PAM Specification deals specifically with this portion of the instrument channels(Reference 4).
APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1 and 2.
These variables are related to the diagnosis and preplanned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1 and 2. In MODES 3, 4, and 5, plant conditions are such that the likelihood of an event that would require PAM instrumentation is extremely low; therefore, PAM instrumentation is not required to be OPERABLE in these MODES.
ACTIONS       A Note has been provided to modify the ACTIONS related to PAM instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for (continued)
CLINTON                     B 3.3-55                     Revision No. 10-3

PAM Instrumentation B 3.3.3.1 BASES ACTIONS           inoperable PAM instrumentation channels provide appropriate (continued)     compensatory measures for separate inoperable functions. As such, a Note has been provided that allows separate Condition entry for each inoperable PAM Function.
A.1 When one or more Functions have one required channel that is inoperable, the required inoperable channel must be restored to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel (or in the case of a Function that has only one required channel, other non-Regulatory Guide 1.97 instrument channels to monitor the Function), the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.
B.1 If a channel has not been restored to OPERABLE status in 30 days, this Required Action specifies initiation of actions to prepare and submit a Special Report to the NRC.
This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions. This Special Report shall be submitted in accordance with 10 CFR 50.4 within 14 days of entering Condition B. This Action is appropriate in lieu of a shutdown requirement since alternative Actions are identified before loss of functional capability, and given the likelihood of plant conditions that would require information provided by this instrumentation.
C.1 When one or more Functions have two required channels inoperable (i.e., two or more channels inoperable in the same Function), one channel in the Function should be restored to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance (continued)
CLINTON                         B 3.3-56                      Revision No. 4-1

PAM Instrumentation B 3.3.3.1 BASES ACTIONS           C.1 (continued) qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.
D.1 This Required Action directs entry into the appropriate Condition referenced in Table 3.3.3.1-1. The applicable Condition referenced in the Table is Function dependent.
Each time an inoperable channel has not met any Required Action of Condition C and the associated Completion Time has expired, Condition D is entered for that channel and provides for transfer to the appropriate subsequent Condition.
E.1 For the majority of Functions in Table 3.3.3.1-1, if any Required Action and associated Completion Time of Condition C is not met, the plant must be placed in a MODE in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.
F.1 Since alternate means of monitoring primary containment and drywell area radiation have been developed and tested, the Required Action is not to shut down the plant but rather to initiate actions to prepare and submit a Special Report to the NRC. These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the (continued)
CLINTON                         B 3.3-57                      Revision No. 4-1

PAM Instrumentation B 3.3.3.1 BASES ACTIONS           F.1  (continued) installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels. The Special Report shall be submitted in accordance with 10 CFR 50.4 within 14 days of entering Condition F.
SURVEILLANCE      The following SRs apply to each PAM instrumentation Function REQUIREMENTS      in Table 3.3.3.1-1, except as noted below.
SR  3.3.3.1.1 Performance of the CHANNEL CHECK ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared to similar plant instruments located throughout the plant.
Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of those displays associated with the required channels of this LCO.
(continued)
CLINTON                         B 3.3-58                      Revision No. 14-2

PAM Instrumentation B 3.3.3.1 BASES SURVEILLANCE      SR 3.3.3.1.2 (Deleted)
REQUIREMENTS (continued)      SR 3.3.3.1.3 CHANNEL CALIBRATION is a complete check of the instrument loop including the sensor. The test verifies that the channel responds to the measured parameter with the necessary range and accuracy. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
The CHANNEL CALIBRATION of the Primary Containment and Drywell Area Radiation Functions consists of an electronic calibration of the channel, not including the detector, for range decades above 10 R per hour and a one point calibration check of the detector below 10 R per hour with an installed or portable gamma source.
REFERENCES        1. Regulatory Guide 1.97, "Instrumentation for Light-Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," Revision 3, May 1983.
: 2. SSER 5, Section 7.5.3.1.
: 3. USAR, Table 7.1-13.
: 4. USAR Section 7.5.1.4.2.4.
CLINTON                         B 3.3-59                     Revision No. 14-2

Remote Shutdown System B 3.3.3.2 B 3.3   INSTRUMENTATION B 3.3.3.2   Remote Shutdown System BASES BACKGROUND         The Remote Shutdown System provides the control room operator with sufficient instrumentation and controls to place and maintain the plant in a safe shutdown condition from a location other than the control room. This capability is necessary to protect against the possibility of the control room becoming inaccessible. A safe shutdown condition is defined as MODE 3. With the plant in MODE 3, the Reactor Core Isolation Cooling (RCIC) System, the safety/relief valves, and the Residual Heat Removal Shutdown Cooling System can be used to remove core decay heat and meet all safety requirements. The long term supply of water for the RCIC and the ability to operate shutdown cooling from outside the control room allow extended operation in MODE 3.
In the event that the control room becomes inaccessible, the operators can establish control at the remote shutdown panel and place and maintain the plant in MODE 3. Not all controls and necessary transfer switches are located at the remote shutdown panel. Some controls and transfer switches will have to be operated locally at the switchgear, motor control panels, or other local stations. The plant automatically reaches MODE 3 following a plant shutdown and can be maintained safely in MODE 3 for an extended period of time.
The OPERABILITY of the Remote Shutdown System control and instrumentation Functions ensures that there is sufficient information available on selected plant parameters to place and maintain the plant in MODE 3 should the control room become inaccessible.
APPLICABLE         The Remote Shutdown System is required to provide equipment SAFETY ANALYSES    at appropriate locations outside the control room with a design capability to promptly shut down the reactor to MODE 3, including the necessary instrumentation and controls, to maintain the plant in a safe condition in MODE 3.
(continued)
CLINTON                          B 3.3-60                        Revision No. 0

Remote Shutdown System B 3.3.3.2 BASES APPLICABLE        The criteria governing the design and the specific system SAFETY ANALYSES   requirements of the Remote Shutdown System are located in (continued)     10 CFR 50, Appendix A, GDC 19 (Ref. 1).
The Remote Shutdown System is considered an important contributor to reducing the risk of accidents; as such, it has been retained in the Technical Specifications (TS) as indicated in the NRC Policy Statement.
LCO               The Remote Shutdown System LCO provides the requirements for the OPERABILITY of the instrumentation and controls necessary to place and maintain the plant in MODE 3 from a location other than the control room. The instrumentation and controls required are listed in the Operational Requirements Manual (Ref. 2).
The controls, instrumentation, and transfer switches are those required for:
x    Reactor pressure vessel (RPV) pressure control; x    Decay heat removal; x    RPV inventory control; and x    Safety support systems for the above functions, including service water, component cooling water, and onsite power, including the diesel generators.
The Remote Shutdown System instruments and control circuits covered by this LCO ensure a redundant safety-grade capability to achieve and maintain hot shutdown from a location or locations remote from the control room, assuming no fire damage to any required systems and equipment and assuming no accident has occurred (Ref. 3).
The Remote Shutdown System instruments and control circuits covered by this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure that the instruments and control circuits will be OPERABLE if plant conditions require that the Remote Shutdown System be placed in operation.
(continued)
CLINTON                         B 3.3-61                       Revision No. 2-2

Remote Shutdown System B 3.3.3.2 BASES LCO           The scope of this LCO does not include those controls (continued) associated with the steam condensing mode of the Residual Heat Removal System.
APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1 and 2. This is required so that the plant can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room.
This LCO is not applicable in MODES 3, 4, and 5. In these MODES, the plant is already subcritical and in a condition of reduced Reactor Coolant System energy. Under these conditions, considerable time is available to restore necessary instrument control Functions if control room instruments or control becomes unavailable. Consequently, the TS does not require OPERABILITY in MODES 3, 4, and 5.
ACTIONS       A Note has been provided to modify the ACTIONS related to Remote Shutdown System Functions. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable Remote Shutdown System Functions provide appropriate compensatory measures for separate Functions.
As such, a Note has been provided that allows separate Condition entry for each inoperable Remote Shutdown System Function.
(continued)
CLINTON                     B 3.3-62                     Revision No. 10-3

Remote Shutdown System B 3.3.3.2 BASES ACTIONS       A.1 (continued)
Condition A addresses the situation where one or more required Functions of the Remote Shutdown System is inoperable. This includes the control and transfer switches for any required Function.
The Required Action is to restore the Function (both divisions, if applicable) to OPERABLE status within 30 days.
The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.
B.1 If the Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time is reasonable, based on operating experience, to reach the required MODE from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE  SR  3.3.3.2.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is (continued)
CLINTON                     B 3.3-63                     Revision No. 14-2

Remote Shutdown System B 3.3.3.2 BASES SURVEILLANCE      SR  3.3.3.2.1   (continued)
REQUIREMENTS outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. As specified in the Surveillance, a CHANNEL CHECK is only required for those channels that are normally energized.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.3.2.2 SR 3.3.3.2.2 verifies each required Remote Shutdown System transfer switch and control circuit performs the intended function. This verification is performed from the remote shutdown panel and locally, as appropriate. Operation of the equipment from the remote shutdown panel and the local control stations are not necessary. The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the plant can be placed and maintained in MODE 3 from the remote shutdown panel and the local control stations. However, this Surveillance is not required to be performed only during a plant outage. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.3.2.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies the channel responds to measured parameter values with the necessary range and accuracy.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. 10 CFR 50, Appendix A, GDC 19.
: 2. Operational Requirements Manual, Attachment 1.
: 3. NUREG-0853, "Safety Evaluation Report Related to the Operation of Clinton Power Station, Unit No. 1,"
Supplement No. 6, July 1986, Section 7.4.3.1.
CLINTON                          B 3.3-64                     Revision No. 14-2

EOC-RPT Instrumentation B 3.3.4.1 B 3.3   INSTRUMENTATION B 3.3.4.1   End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation BASES BACKGROUND         The EOC-RPT instrumentation initiates a recirculation pump trip (RPT) to reduce the peak reactor pressure and power resulting from turbine trip or generator load rejection transients to provide additional margin to core thermal MCPR Safety Limits (SLs).
The need for the additional negative reactivity in excess of that normally inserted on a scram reflects end of cycle reactivity considerations. Flux shapes at the end of cycle are such that the control rods may not be able to ensure that thermal limits are maintained by inserting sufficient negative reactivity during the first few feet of rod travel upon a scram caused by Turbine Control Valve (TCV) Fast Closure, Trip Oil Pressure-Low, or Turbine Stop Valve (TSV)
Closure. The physical phenomenon involved is that the void reactivity feedback due to a pressurization transient can add positive reactivity at a faster rate than the control rods can add negative reactivity.
The EOC-RPT instrumentation as described in Reference 1 is comprised of sensors that detect initiation of closure of the TSVs, or fast closure of the TCVs, combined with logic circuits, load drivers, and fast acting circuit breakers that interrupt the fast speed power supply to each of the recirculation pump motors. The channels consist of pressure switches and limit switches. When the setpoint is exceeded, the switch closes which then inputs a signal to the EOC-RPT trip logic. Actuation of the EOC-RPT system causes each division of the RPS to energize a trip coil in its associated RPT breaker. When the EOC-RPT breakers trip open, the safety function is completed. The recirculation pumps may coast to stop or downshift to slow speed.
Negative reactivity is provided in either case.
The EOC-RPT system is a two-out-of-four logic for each Function; thus, either two TSV Closure or two TCV Fast Closure, Trip Oil Pressure-Low signals are required to actuate tripping both recirculation pumps from fast speed operation. There are two EOC-RPT breakers in series per recirculation pump. A trip in Division 1 (or 4) will cause a trip of the A recirculation pump. A trip in Division 2 (or 3) will cause a trip of the B recirculation pump.
Both EOC-RPT breakers for each recirculation pump trip upon actuation of the EOC-RPT system. Placing an EOC-RPT bypass switch in bypass will allow the EOC-RPT trip capability to be maintained, however, an additional single failure cannot be accommodated (refer to Required Action B.1 Bases).
(continued)
CLINTON                          B 3.3-65                     Revision No. 14-5

EOC-RPT Instrumentation B 3.3.4.1 BASES (continued)_____________________________________________________________
APPLICABLE        The TSV Closure and the TCV Fast Closure, Trip Oil SAFETY ANALYSES,  Pressure-Low Functions are designed to trip the LCO, and          recirculation pumps from fast speed operation in the event APPLICABILITY     of a turbine trip or generator load rejection to mitigate the neutron flux, heat flux, and pressure transients, and to increase the margin to the MCPR SL. The analytical methods and assumptions used in evaluating the turbine trip and generator load rejection, as well as other safety analyses that assume EOC-RPT, are summarized in References 2, 3, 4, and 5.
To mitigate pressurization transient effects, the EOC-RPT must trip the recirculation pumps from fast speed operation after initiation of initial closure movement of either the TSVs or the TCVs. The combined effects of this trip and a scram reduce fuel bundle power more rapidly than does a scram alone, resulting in an increased margin to the MCPR SL. The EOC-RPT function is automatically disabled when turbine first stage pressure is < 33.3% RTP.
EOC-RPT instrumentation satisfies Criterion 3 of the NRC Policy Statement.
The OPERABILITY of the EOC-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have a required number of OPERABLE channels with their setpoints within the specified Allowable Value of SR 3.3.4.1.2. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated EOC-RPT breakers. Each channel (including the associated EOC-RPT breakers) must also respond within its assumed response time.
Allowable Values are specified for each EOC-RPT Function specified in the LCO. Nominal trip setpoints are specified in the setpoint calculations. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The nominal setpoints are selected to ensure the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.
Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., TSV (continued)
CLINTON                         B 3.3-66                       Revision No. 7-5

EOC-RPT Instrumentation B 3.3.4.1 BASES_________________________________________________________________________
APPLICABLE        position), and when the measured output value of the process SAFETY ANALYSES,  parameter exceeds the setpoint, the associated device (e.g.,
LCO, and          limit switch) changes state. The analytic limits are APPLICABILITY     derived from the limiting values of the process parameters (continued)     obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
The specific Applicable Safety Analysis, LCO, and Applicability discussions are listed below on a Function by Function basis.
Turbine Stop Valve Closure Closure of the TSVs and a main turbine trip result in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited.
Therefore, an EOC-RPT is initiated on TSV Closure in anticipation of the transients that would result from closure of these valves. EOC-RPT decreases reactor power and aids the reactor scram in ensuring the MCPR SL is not exceeded during the worst case transient. Closure of the TSVs is determined by use of limit switches on each stop valve. There is one limit switch associated with each stop valve, each assigned to a separate channel. The logic for the TSV Closure is such that two or more TSVs must be closed to produce an EOC-RPT. This Function must be enabled at THERMAL POWER > 33.3% RTP. This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure. Because an increase in the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must not cause the trip Function to be bypassed when THERMAL POWER is t 33.3% RTP. Four channels of TSV Closure, arranged in a two-out-of-four logic, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal.
The TSV Closure Allowable Value is selected low enough to detect imminent TSV closure.
(continued)
CLINTON                         B 3.3-67                      Revision No. 7-5

EOC-RPT Instrumentation B 3.3.4.1 BASES_________________________________________________________________________
APPLICABLE        Turbine Stop Valve Closure  (continued)
SAFETY ANALYSES, LCO, and          This protection is required, consistent with the safety APPLICABILITY     analysis assumptions, whenever THERMAL POWER is > 33.3% RTP with any recirculating pump in fast speed. Below 33.3% RTP or with the recirculation in slow speed, the Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor (APRM) Fixed Neutron Flux-High Functions of the Reactor Protection System (RPS) are adequate to maintain the necessary safety margins.
The automatic enable setpoint is feedwater temperature dependent as a result of the subcooling changes that affect the turbine first stage pressure/reactor power relationship.
TCV Fast Closure, Trip Oil Pressure-Low Fast closure of the TCVs during a generator load rejection results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, an RPT is initiated on TCV Fast Closure, Trip Oil Pressure-Low in anticipation of the transients that would result from the closure of these valves. The EOC-RPT decreases reactor power and aids the reactor scram in ensuring that the MCPR SL is not exceeded during the worst case transient.
Fast closure of the TCVs is determined by measuring the electrohydraulic control (EHC) fluid pressure at each control valve. There is one pressure switch associated with each control valve, and the signal from each switch is assigned to a separate channel. The logic for the TCV Fast Closure, Trip Oil Pressure-Low Function is such that two or more TCVs must be closed (pressure switch trips) to produce an EOC-RPT. This Function must be enabled at THERMAL POWER
                  > 33.3% RTP. This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure.
Because an increase in the main turbine bypass flow can affect this function nonconservatively (THERMAL POWER is derived from turbine first stage pressure), the main turbine bypass valves must not cause the trip Function to be bypassed when THERMAL POWER is t 33.3% RTP. Four channels of TCV Fast Closure, Trip Oil Pressure-Low, arranged in a two-out-of-four logic, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal.
The TCV Fast Closure, Trip Oil Pressure-Low Allowable Value is selected high enough to detect imminent TCV fast closure.
(continued)
CLINTON                         B 3.3-68                      Revision No. 7-5

EOC-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE        TCV Fast Closure, Trip Oil Pressure-Low  (continued)
SAFETY ANALYSES, LCO, and          This protection is required consistent with the analysis, APPLICABILITY     whenever the THERMAL POWER is t 33.3% RTP with any recirculating pump in fast speed. Below 33.3% RTP or with recirculation pumps in slow speed, the Reactor Vessel Steam Dome Pressure-High and the APRM Fixed Neutron Flux-High Functions of the RPS are adequate to maintain the necessary safety margins. The turbine first stage pressure/reactor power relationship for the setpoint of the automatic enable is identical to that described for TSV closure.
ACTIONS           A Note has been provided to modify the ACTIONS related to EOC-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable EOC-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable EOC-RPT instrumentation channel.
A.1 and A.2 With one channel for one or both Functions inoperable, but with EOC-RPT trip capability maintained (refer to Required Action B.1 Bases), the EOC-RPT System is capable of performing the intended function. However, the reliability and redundancy of the EOC-RPT instrumentation is reduced.
Therefore, a limited time is allowed to restore compliance with the LCO. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of an EOC-RPT, 48 hours is allowed to restore the inoperable channels (Required Action A.1). Alternately, the inoperable channels may be placed in trip (Required Action A.2) since this would conservatively compensate for the inoperability, (continued)
CLINTON                         B 3.3-69                      Revision No. 7-5

EOC-RPT Instrumentation B 3.3.4.1 BASES ACTIONS           A.1 and A.2  (continued) and allow operation to continue. As noted in Required Action A.2, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, since this may not adequately compensate for the inoperable breaker (e.g., the breaker may be inoperable such that it will not open).
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an EOC-RPT), Condition D must be entered and its Required Actions taken.
B.1 Condition B exists when, for any one or more Functions, two required channels are inoperable. In this condition, the EOC-RPT still maintains trip capability for that Function, but cannot accommodate a single failure in that Function.
Required Action B.1 limits the time the EOC-RPT logic for any Function would not accommodate single failure. Within the 6 hour allowance, the associated Function will have at least one inoperable channel in trip.
Completing this Required Action restorers EOC-RPT to an equivalent reliability level as that evaluated in Reference 6, which justified a 48 hour allowable out of service time.
The 6 hour Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of a recirculation pump trip.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
Placing one of the two inoperable channels in trip satisfies both Required Actions A.2 and B.1 for that Function. If one channel is already in trip for the Function when a second channel is determined to be inoperable, Required Action B.1 is met by the one channel already in trip for that function and no additional action is required.
(continued)
CLINTON                         B 3.3-70                      Revision No. 21-7

EOC-RPT Instrumentation B 3.3.4.1 BASES_________________________________________________________________________
ACTIONS           B.1  (continued)
Alternately, if it is not desired to place one inoperable channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an EOC-RPT),
Condition D must be entered and its Required Action taken.
C.1 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not being able to accommodate a single failure and maintain EOC-RPT trip capability. A Function is considered to be maintaining EOC-RPT trip capability when sufficient channels are OPERABLE or in trip, such that the EOC-RPT System will generate a trip signal from the given Function on a valid signal and both recirculation pumps can be tripped from fast speed operation. This requires three channels of the Function to be OPERABLE or in trip, and the associated EOC-RPT fast speed breakers to be OPERABLE or in trip.
The 2 hour Completion Time is sufficient for the operator to take corrective action, and takes into account the likelihood of an event requiring actuation of the EOC-RPT instrumentation during this period. It is also consistent with the 2 hour Completion Time provided in LCO 3.2.2, Required Action A.1, since this instrumentation's purpose is to preclude a MCPR violation.
D.1 and D.2 With any Required Action and associated Completion Time not met, THERMAL POWER must be reduced to < 33.3% RTP within 8 hours. Alternately, the associated recirculation pump fast speed breaker may be removed from service since this performs the intended function of the instrumentation. The allowed Completion Time of 8 hours is reasonable, based on operating experience, to reduce THERMAL POWER to < 33.3% RTP from full power conditions in an orderly manner and without challenging plant systems. In addition, this time is consistent with the shutdown time limits in LCO 3.3.1.1 for these Functions.
(continued)
CLINTON                         B 3.3-71                      Revision No. 7-5

EOC-RPT Instrumentation B 3.3.4.1 BASES (continued)
SURVEILLANCE      The Surveillances are modified by a Note to indicate that REQUIREMENTS      when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains EOC-RPT trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 6) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the recirculation pumps will trip when necessary.
SR  3.3.4.1.1 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.4.1.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-72                     Revision No. 21-4

EOC-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE      SR  3.3.4.1.3 REQUIREMENTS (continued)     The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers is included as a part of this test, overlapping the LOGIC SYSTEM FUNCTIONAL TEST, to provide complete testing of the associated safety function. Therefore, if a breaker is incapable of operating, the associated instrument channels would also be inoperable.
The Self Test System may be utilized to perform this testing for those components that it is designed to monitor.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.4.1.4 This SR ensures that an EOC-RPT initiated from the TSV Closure and TCV Fast Closure, Trip Oil Pressure-Low Functions will not be inadvertently bypassed when THERMAL POWER is > 33.3% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodologies are incorporated into the actual setpoint. If any bypass channel's setpoint is nonconservative such that the Functions are bypassed at t 33.3% RTP (e.g., due to open main steam line drain(s),
main turbine bypass valve(s) or other reasons), the affected TSV Closure and TCV Fast Closure, Trip Oil Pressure-Low Functions are considered inoperable. Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel considered OPERABLE.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-73                      Revision No. 14-2

EOC-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE      SR  3.3.4.1.5 REQUIREMENTS (continued)    This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The EOC-RPT SYSTEM RESPONSE TIME acceptance criteria are included in applicable plant procedures and include an assumed RPT breaker interruption time of 80 milliseconds. This assumed RPT breaker interruption time is validated by the performance of periodic mechanical timing checks, contact wipe and erosion checks, and high potential tests on each breaker in accordance with plant procedures at least once per 48 months. The acceptance criterion for the RPT breaker mechanical timing check shall be d 41 milliseconds (for trip coil TC2).
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to EOC-RPT SYSTEM RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 7).
(continued)
CLINTON                         B 3.3-74                     Revision No. 14-2

EOC-RPT Instrumentation B 3.3.4.1 BASES (continued)
REFERENCES        1. USAR, Section 7.6.1.8.
: 2. USAR, Section 5.2.2.
: 3. USAR, Sections 15.1.1, 15.1.2, and 15.1.3.
: 4. USAR, Sections 15.2.2, 15.2.3, and 15.2.5.
: 5. USAR, Sections 15.3.2 and 15.3.3.
: 6. GENE-770-06-1, "Bases for Changes To Surveillance Test Intervals And Allowed Out-Of-Service Times For Selected Instrumentation Technical Specifications,"
February 1991.
: 7. Calculation IP-0-0024.
CLINTON                         B 3.3-75                     Revision No. 14-2

ATWS-RPT Instrumentation B 3.3.4.2 B 3.3   INSTRUMENTATION B 3.3.4.2   Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation BASES BACKGROUND         The ATWS-RPT System initiates a recirculation pump trip, adding negative reactivity, following events in which a scram does not (but should) occur, to lessen the effects of an ATWS event. Tripping the recirculation pumps adds negative reactivity from the increase in steam voiding in the core area as core flow decreases. When Reactor Vessel Water Level-Low Low, Level 2 or Reactor Steam Dome Pressure-High setpoint is reached, the recirculation pump motor breakers trip.
The ATWS-RPT System (Ref. 1) includes sensors, relays, bypass capability, circuit breakers, and switches that are necessary to cause initiation of a recirculation pump trip.
The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an ATWS-RPT signal to the trip logic.
The ATWS-RPT consists of two independent trip systems, with two channels of Reactor Steam Dome Pressure-High and two channels of Reactor Vessel Water Level-Low Low, Level 2, in each trip system. Each ATWS-RPT trip system is a two-out-of-two logic for each Function. Thus, either two Reactor Vessel Water Level-Low Low, Level 2 or two Reactor Steam Dome Pressure-High signals are needed to trip a trip system. The outputs of the channels in a trip system are combined in a logic so that each trip system will trip one recirculation pump (by tripping the respective fast speed and low frequency motor generator (LFMG) motor breakers).
There is one fast speed motor breaker and one LFMG breaker provided for each of the two recirculation pumps for a total of four breakers. The output of each trip system is provided to both breakers of the associated recirculation pump.
(continued)
CLINTON                          B 3.3-76                      Revision No. 5-1

ATWS-RPT Instrumentation B 3.3.4.2 BASES (continued)
APPLICABLE        The ATWS-RPT meets the requirements of 10CFR50.62(c)(5).
SAFETY ANALYSES,  The ATWS-RPT initiates an RPT to aid in preserving the LCO, and          integrity of the fuel cladding following events in which APPLICABILITY     scram does not, but should, occur. Based on its contribution to the reduction of overall plant risk, the instrumentation is included as required by the NRC Policy Statement.
The OPERABILITY of the ATWS-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have a required number of OPERABLE channels in each trip system, with their setpoints within the specified Allowable Value of SR 3.3.4.2.4. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated recirculation pump drive motor breakers. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
Allowable Values are specified for each ATWS-RPT Function specified in the LCO. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,
trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
The individual Functions are required to be OPERABLE in MODE 1 to protect against common mode failures of the (continued)
CLINTON                         B 3.3-77                      Revision No. 4-1

ATWS-RPT Instrumentation B 3.3.4.2 BASES APPLICABLE        Reactor Protection System by providing a diverse trip to SAFETY ANALYSES,  mitigate the consequences of a postulated ATWS event. The LCO, and          Reactor Steam Dome Pressure-High and Reactor Vessel Water APPLICABILITY     Level-Low Low, Level 2 Functions are required to be (continued)     OPERABLE in MODE 1, since the reactor is producing significant power and the recirculation system could be at high flow. During this MODE, the potential exists for pressure increases or low water level, assuming an ATWS event. In MODE 2, the reactor is at low power and the recirculation system is at low flow; thus, the potential is low for a pressure increase or low water level, assuming an ATWS event. Therefore, the ATWS-RPT is not necessary. In MODES 3 and 4, the reactor is shut down with all control rods inserted; thus, an ATWS event is not significant and the possibility of a significant pressure increase or low water level is negligible. In MODE 5, the one-rod-out interlock ensures the reactor remains subcritical; thus, an ATWS event is not significant. In addition, the reactor pressure vessel (RPV) head is not fully tensioned and no pressure transient threat to the reactor coolant pressure boundary (RCPB) exists.
The specific Applicable Safety Analyses and LCO discussions are listed below on a Function by Function basis.
: a. Reactor Vessel Water Level-Low Low, Level 2 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the ATWS-RPT System is initiated at Level 2 to aid in maintaining level above the top of the active fuel. The reduction of core flow reduces the neutron flux and THERMAL POWER and, therefore, the rate of coolant boiloff.
Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
Four channels of Reactor Vessel Level-Low Low, Level 2, with two channels in each trip system, are available and required to be OPERABLE to ensure that an ATWS-RPT can be effected for both reactor recirculation pumps from this (continued)
CLINTON                         B 3.3-78                      Revision No. 5-1

ATWS-RPT Instrumentation B 3.3.4.2 BASES APPLICABLE        a. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES,  (continued)
LCO, and APPLICABILITY     Function on a valid signal. The Reactor Vessel Water Level-Low Low, Level 2, Allowable Value is chosen so that the system will not initiate after a Level 3 scram with feedwater still available, and for convenience with the reactor core isolation cooling (RCIC) initiation. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
: b. Reactor Steam Dome Pressure-High Excessively high RPV pressure may rupture the RCPB. An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This increases neutron flux and THERMAL POWER, which could potentially result in fuel failure and RPV overpressurization. The Reactor Steam Dome Pressure-High Function initiates an ATWS-RPT for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power generation.
For the overpressurization event, the ATWS-RPT aids in the termination of the ATWS event and, along with the safety/relief valves (S/RVs), limits the peak RPV pressure to less than the ASME Section III Code Service Level C limits (1500 psig).
The Reactor Steam Dome Pressure-High signals are initiated from four pressure transmitters that monitor reactor steam dome pressure. Four channels of Reactor Steam Dome Pressure-High, with two channels in each trip system, are available and required to be OPERABLE to ensure that an ATWS-RPT can be effected for both reactor recirculation pumps from this Function on a valid signal. The Reactor Steam Dome Pressure-High Allowable Value is chosen to provide an adequate margin to the ASME Section III Code Service Level C allowable Reactor Coolant System pressure.
ACTIONS           A Note has been provided to modify the ACTIONS related to ATWS-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into (continued)
CLINTON                         B 3.3-79                       Revision No. 5-1

ATWS-RPT Instrumentation B 3.3.4.2 BASES ACTIONS           the Condition. Section 1.3 also specifies that Required (continued)     Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable ATWS-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable ATWS-RPT instrumentation channel.
A.1 Required Action A.1 is intended to ensure that appropriate actions are taken when a single or multiple, inoperable, untripped channels within the same Function result in the Function not maintaining ATWS-RPT trip capability. A Function is considered to be maintaining ATWS-RPT trip capability when sufficient channels are OPERABLE or in trip such that the ATWS-RPT System will generate a trip signal from the given Function on a valid signal, and both recirculation pumps can be tripped. This requires all four channels of the Function (i.e., both channels in each trip system for the function) to be OPERABLE or in trip, and the four motor breakers (two fast speed and two LFMG) to be OPERABLE or in trip.
The 72 hour Completion Time is sufficient for the operator to take corrective action (e.g., restoration or tripping of channels) and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period and the fact that one Function is still maintaining ATWS-RPT trip capability.
(continued)
CLINTON                         B 3.3-80                      Revision No. 8-1

ATWS-RPT Instrumentation B 3.3.4.2 BASES ACTIONS           B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within both Functions result in both Functions not maintaining ATWS-RPT trip capability. The description of a Function maintaining ATWS-RPT trip capability is discussed in the Bases for Required Action A.1, above.
The 1 hour Completion Time is sufficient for the operator to take corrective action and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period.
C.1 and C.2 With any Required Action and associated Completion Time not met, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours (Required Action C.2). Alternately, the associated recirculation pump may be removed from service since this performs the intended Function of the instrumentation (Required Action C.1). The allowed Completion Time of 6 hours is reasonable, based on operating experience, both to reach MODE 2 from full power conditions and to remove a recirculation pump from service in an orderly manner and without challenging plant systems.
(continued)
CLINTON                         B 3.3-81                       Revision No. 8-1

ATWS-RPT Instrumentation B 3.3.4.2 BASES (continued)
SURVEILLANCE REQUIREMENTS      SR  3.3.4.2.1 Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of this LCO.
(continued)
CLINTON                         B 3.3-82                     Revision No. 14-2

ATWS-RPT Instrumentation B 3.3.4.2 BASES_________________________________________________________________________
SURVEILLANCE      SR  3.3.4.2.2 REQUIREMENTS (continued)     A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests.
Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.4.2.3 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.4.2.4. If the trip setting is discovered to be less conservative than the setting accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.4.2.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-83                     Revision No. 21-4

ATWS-RPT Instrumentation B 3.3.4.2 BASES SURVEILLANCE      SR  3.3.4.2.5 REQUIREMENTS (continued)     The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers, included as part of this Surveillance, overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel(s) would be inoperable.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. USAR, Section 7.7.1.25.2 CLINTON                          B 3.3-84                    Revision No. 14-2

ECCS Instrumentation B 3.3.5.1 B 3.3 INSTRUMENTATION B 3.3.5.1  Emergency Core Cooling System (ECCS) Instrumentation BASES BACKGROUND The purpose of the ECCS instrumentation is to initiate appropriate responses from the systems to ensure that fuel is adequately cooled in the event of a design basis accident or transient. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the ECCS instrumentation, as well as LCOs on other reactor system parameters, and equipment performance. The LSSS are defined in this Specification as the Allowable Values, except Functions 1.a, 1.d, 2.a, 2.d, 3.a, 3.c, 3.d, 3.e, 4.a, 4.e, 4.f, 5.a, and 5.e in Technical Specification Table 3.3.5.1-1 (the Nominal Trip Setpoint defines the LSSS for these Functions), which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs), during Design Basis Accidents (DBAs) and Anticipated Operational Occurrences (AOOs).
For most AOOs and DBAs, a wide range of dependent and independent parameters are monitored.
The ECCS instrumentation actuates low pressure core spray (LPCS), low pressure coolant injection (LPCI), high pressure core spray (HPCS), Automatic Depressurization System (ADS),
and the diesel generators (DGs). The equipment involved with each of these systems is described in the Bases for LCO 3.5.1, ECCS-Operating, and LCO 3.8.1, AC Sources-Operating. In addition, the ECCS instrumentation that actuates HPCS also actuates the Division 3 Shutdown Service Water (SX) subsystem, including automatic start of the Division 3 SX pump and automatic actuation of the associated subsystem isolation valves. The equipment involved with this subsystem is described in the Bases for LCO 3.7.2, Division 3 Shutdown Service Water (SX)
Subsystem.
Low Pressure Core Spray System The LPCS System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low Low, Level 1 or Drywell Pressure-High. Each of these diverse variables is monitored by two redundant transmitters, which are, in turn, connected to two analog trip modules (ATMs). The outputs of the four ATMs (two ATMs from each of the two variables) are connected to solid state logic which is arranged in a one-out-of-two taken twice configuration. The logic can also be initiated by use of a manual push button. The initiation signal is a sealed in signal and must be manually reset. Upon receipt of an initiation signal, the LPCS pump is started immediately after power is available.
(continued)
CLINTON                         B 3.3-85                      Revision No. 10-6

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND        Low Pressure Core Spray System (continued)
The LPCS test line isolation valve, which is also a primary containment isolation valve (PCIV), is closed on a LPCS initiation signal to allow full system flow assumed in the accident analysis and maintains containment isolation in the event LPCS is not operating.
The LPCS pump discharge flow is monitored by a flow transmitter. When the pump is running and discharge flow is low enough that pump overheating may occur, the minimum flow return line valve is opened. The valve is automatically closed if flow is above the minimum flow setpoint to allow the full system flow assumed in the accident analysis.
The LPCS System also monitors the pressure in the reactor vessel to ensure that, before the injection valve opens, the reactor pressure has fallen to a value below the LPCS Systems maximum design pressure. The variable is monitored by two redundant transmitters, which are, in turn, connected to ATMs. The outputs of the ATMs are connected to solid state logic arranged in a one-out-of-two taken twice configuration.
Low Pressure Coolant Injection Subsystems The LPCI is an operating mode of the Residual Heat Removal (RHR) System, with three LPCI subsystems. The LPCI subsystems may be initiated by automatic or manual means.
Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low Low, Level 1 or Drywell Pressure-High.
Each of these diverse variables is monitored by two redundant transmitters per Division, which are, in turn, connected to two ATMs. The outputs of the Division 2 LPCI (loops B and C) ATMs (two ATMs from each of the two variables) are connected to solid state logic which is arranged in a one-out-of-two taken twice configuration. The Division 1 LPCI (loop A) receives its initiation signal from the LPCS logic, which uses a similar one-out-of-two taken twice logic. The two Divisions can also be initiated by use of a manual push button (one per Division). Once an initiation signal is received by the LPCI control circuitry, the signal is sealed in until manually reset.
(continued)
CLINTON                          B 3.3-86                     Revision No. 4-8

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND        Low Pressure Coolant Injection Subsystems  (continued)
Upon receipt of an initiation signal, the LPCI Pump C is started immediately after power is available while LPCI A and LPCI B pumps are started after a 5 second delay, to limit the loading on the standby power sources.
Each LPCI subsystem's discharge flow is monitored by a flow transmitter. When a pump is running and discharge flow is low enough that pump overheating may occur, the respective minimum flow return line valve is opened. The valve is automatically closed if flow is above the minimum flow setpoint to allow the full system flow assumed in the analyses.
The RHR test line (suppression pool cooling) isolation valves (which are also PCIVs) are closed on a LPCI initiation signal to allow full system flow assumed in the accident analysis and maintain containment isolated in the event LPCI is not operating.
The LPCI subsystems monitor the pressure in the reactor vessel to ensure that, prior to an injection valve opening, the reactor pressure has fallen to a value below the LPCI subsystem's maximum design pressure. The variable is monitored by two redundant transmitters per Division, which are, in turn, connected to ATMs. The outputs of the four Division 2 LPCI (loops B and C) ATMs are connected to solid state logic which is arranged in a one-out-of-two taken twice configuration. The Division 1 LPCI (loop A) receives its signal from the LPCS logic, which uses a similar one-out-of-two taken twice configuration.
High Pressure Core Spray System The HPCS System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low, Level 2 or Drywell Pressure-High. The outputs of the ATMs are connected to solid state logic which is arranged in a one-out-of-two taken twice logic for each variable. The HPCS System initiation signal is a sealed in signal and must be manually reset.
(continued)
CLINTON                         B 3.3-87                      Revision No. 4-8

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND        High Pressure Core Spray System  (continued)
The HPCS pump discharge flow is monitored by a flow transmitter and a pressure transmitter. When the pump is running and discharge flow is low enough that pump overheating may occur, the minimum flow return line valve is opened. The valve is automatically closed if flow is above the minimum flow setpoint to allow full system flow assumed in the accident analyses.
The HPCS test line to the suppression pool isolation valve (which is also a PCIV) is closed on a HPCS initiation signal to allow full system flow assumed in the accident analyses and maintain containment isolated in the event HPCS is not operating.
The HPCS System also monitors the water levels in the Reactor Core Isolation Cooling (RCIC) Storage Tank and the suppression pool, since these are the two sources of water for HPCS operation. Reactor grade water in the RCIC Storage Tank is the normal and preferred source. Upon receipt of a HPCS initiation signal, the RCIC Storage Tank suction valve is automatically signaled to open (it is normally in the open position), unless the suppression pool suction valve is open. If the water level in the RCIC Storage Tank falls below a preselected level, first the suppression pool suction valve automatically opens, and then the RCIC Storage Tank suction valve automatically closes. Two level transmitters are used to detect low water level in the RCIC Storage Tank. Either transmitter and associated ATM can cause the suppression pool suction valve to open and the RCIC Storage Tank suction valve to close. The suppression pool suction valve also automatically opens and the RCIC Storage Tank suction valve closes if high water level is detected in the suppression pool. To prevent losing suction to the pump, the suction valves are interlocked so that one suction path must be open before the other automatically closes.
The HPCS System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (Level 8) trip, at which time the HPCS injection valve closes. The HPCS pump will continue to run on minimum flow.
The logic is two-out-of-two to provide high reliability of the HPCS System. The injection valve automatically reopens if a low low water level signal is subsequently received.
(continued)
CLINTON                         B 3.3-88                       Revision No. 4-8

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND        Automatic Depressurization System ADS may be initiated by either automatic or manual means.
Automatic initiation occurs when signals indicating Reactor Vessel Water Level-Low Low Low, Level 1; Drywell Pressure-High or ADS Drywell Pressure Bypass Timer; confirmed Reactor Vessel Water Level-Low, Level 3; and either LPCS or LPCI Pump Discharge Pressure-High are all present, and the ADS Initiation Timer has timed out. There are two transmitters each for Reactor Vessel Water Level-Low Low Low, Level 1 and Drywell Pressure-High, and one transmitter for confirmed Reactor Vessel Water Level-Low, Level 3 in each of the two ADS trip systems.
Each of these transmitters connects to an ATM, which then inputs to the solid state initiation logic.
Each ADS trip system (trip system 1 and trip system 2) includes a time delay between satisfying the initiation logic and the actuation of the ADS valves. The time delay chosen is long enough that the HPCS has time to operate to recover to a level above Level 1, yet not so long that the LPCI and LPCS systems are unable to adequately cool the fuel if the HPCS fails to maintain level. An alarm in the control room is annunciated when either of the timers is running. Resetting the ADS initiation signals resets the ADS Initiation Timers.
The ADS also monitors the discharge pressures of the three LPCI pumps and the LPCS pump. Each ADS trip system includes two discharge pressure permissive transmitters from each of the two low pressure ECCS pumps in the associated Division (i.e., Division 1 ECCS inputs to ADS trip system 1 and Division 2 ECCS inputs to ADS trip system 2). The signals are used as a permissive for ADS actuation, indicating that there is a source of core coolant available once the ADS has depressurized the vessel. Any one of the four low pressure pumps provides sufficient core coolant flow to permit automatic depressurization.
The ADS logic in each trip system is arranged in two solid state logic strings (A and E for trip system 1; and B and F for trip system 2). One logic string has an input from each of the following variables: Reactor Vessel Water Level-Low Low Low, Level 1; Drywell Pressure-High or ADS Drywell Pressure Bypass Timer; Reactor Vessel Water Level-Low, Level 3; ADS Initiation Timer; and two low pressure ECCS (continued)
CLINTON                         B 3.3-89                      Revision No. 4-8

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND        Automatic Depressurization System  (continued)
Discharge Pressure-High inputs. The other string has a contact from each of the following variables: Reactor Vessel Water Level-Low Low Low, Level 1; Drywell Pressure-High; ADS Drywell Pressure Bypass Timer; and two low pressure ECCS Discharge Pressure-High inputs. To initiate an ADS trip system, the following applicable inputs must be received in the associated logic string: Reactor Vessel Water Level-Low Low Low, Level 1; Drywell Pressure-High or ADS Drywell Pressure Bypass Timer; Reactor Vessel Water Level-Low, Level 3; ADS Initiation Timer; and one of the two low pressure ECCS Discharge Pressure-High inputs.
Either ADS trip system 1 or trip system 2 will cause all the ADS relief valves to open. Once the Drywell Pressure-High or ADS initiation signals are present, they are individually sealed in until manually reset.
The ADS can be initiated by use of manual push buttons, two each associated with trip system 1 (associated with logic A and E) and trip system 2 (associated with logic B and F).
Manual initiation can also be accomplished by operating the control switch for each safety/relief valve (S/RV) associated with the ADS. Manual inhibit switches are provided in the control room for ADS; however, their function is not required for ADS OPERABILITY (provided ADS is not inhibited when required to be OPERABLE).
Diesel Generators The Division 1, 2, and 3 DGs may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low Low, Level 1 or Drywell Pressure-High for DGs 1A and 1B, and Reactor Vessel Water Level-Low Low, Level 2 or Drywell Pressure-High for DG 1C. The DGs are also initiated upon loss of voltage signals. (Refer to Bases for LCO 3.3.8.1, "Loss of Power (LOP) Instrumentation," for a discussion of these signals.) The DGs receive their initiation signals from the associated Divisions' ECCS logic (i.e., DG 1A receives an initiation signal from Division 1 ECCS (LPCS and LPCI A); DG 1B receives an initiation signal from Division 2 ECCS (LPCI B and LPCI C); and DG 1C receives an initiation signal from Division 3 ECCS (HPCS)). The DGs can also be (continued)
CLINTON                         B 3.3-90                      Revision No. 4-8

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND        Diesel Generators  (continued) started manually from the control room and locally in the associated DG room. The DG initiation signal is a sealed in signal and must be manually reset. The DG initiation logic is reset by resetting the associated ECCS initiation logic.
Upon receipt of a LOCA initiation signal, each DG is automatically started, is ready to load in approximately 12 seconds, and will run in standby conditions (rated voltage and speed, with the DG output breaker open). The DGs will only energize their respective Engineered Safety Feature (ESF) buses if a loss of offsite power occurs.
(Refer to Bases for LCO 3.3.8.1.)
APPLICABLE        The actions of the ECCS are explicitly assumed in the safety SAFETY ANALYSES,  analyses of References 1, 2, and 3. The ECCS is initiated LCO, and          to preserve the integrity of the fuel cladding by limiting APPLICABILITY     the post LOCA peak cladding temperature to less than the 10 CFR 50.46 limits.
ECCS instrumentation satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.
The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
Each ECCS subsystem must also respond within its assumed response time. Table 3.3.5.1-1, footnote (a), is added to show that certain ECCS instrumentation Functions are also required to be OPERABLE to perform DG initiation.
Allowable Values are specified for each ECCS Function specified in the table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. A channel is inoperable if its actual trip (continued)
CLINTON                         B 3.3-91                     Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        setpoint is not within its required Allowable Value. Trip SAFETY ANALYSES,  setpoints are those predetermined values of output at which LCO, and          an action should take place. The setpoints are compared to APPLICABILITY     the actual process parameter (e.g., reactor vessel water (continued)     level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,
ATM) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values and trip setpoints are derived from the analytic limits, accounting for applicable process errors, severe environment errors, instrument errors (e.g., drift), and calibration errors in accordance with the setpoint methodology documented in the Operational Requirements Manual (ORM). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
Certain ECCS valves (e.g., minimum flow) also serve the dual function of automatic PCIVs. The signals that provide automatic initiation of the ECCS are also associated with the automatic isolation of these valves. Some instrumentation and ACTIONS associated with these signals are addressed in LCO 3.3.6.1, "Primary Containment and Drywell Isolation Instrumentation," and are not included in this LCO.
In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS initiation to mitigate the consequences of a design basis accident or transient. To ensure reliable ECCS and DG function, a combination of Functions is required to provide primary and secondary initiation signals.
The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
Low Pressure Core Spray and Low Pressure Coolant Injection Systems 1.a, 2.a  Reactor Vessel Water Level-Low Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should (continued)
CLINTON                         B 3.3-92                      Revision No. 10-6

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        1.a, 2.a Reactor Vessel Water Level-Low Low Low, Level 1 SAFETY ANALYSES,  (continued)
LCO, and APPLICABILITY     RPV water level decrease too far, fuel damage could result.
The low pressure ECCS and associated DGs are initiated at Level 1 to ensure that core spray and flooding functions are available to prevent or minimize fuel damage. The Reactor Vessel Water Level-Low Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ECCS during the transients analyzed in References 1 and 3. In addition, the Reactor Vessel Water Level-Low Low Low, Level 1 Function is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
Reactor Vessel Water Level-Low Low Low, Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
Two channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function per associated Division are only required to be OPERABLE when the associated ECCS is required to be OPERABLE, to ensure that no single instrument failure can preclude ECCS initiation. (Two channels input to LPCS and LPCI A, while the other two channels input to LPCI B and LPCI C.)
1.b, 2.b. Drywell Pressure-High High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB). The low pressure ECCS and associated DGs are initiated upon receipt of the Drywell Pressure-High Function in order to minimize the (continued)
CLINTON                         B 3.3-93                     Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        1.b, 2.b. Drywell Pressure-High  (continued)
SAFETY ANALYSES, LCO, and          possibility of fuel damage. The core cooling function of APPLICABILITY     the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment. Negative barometric fluctuations are accounted for in the Allowable Value.
The Drywell Pressure-High Function is required to be OPERABLE when the associated ECCS are required to be OPERABLE. Thus, four channels of the LPCS and LPCI Drywell Pressure-High Function are required to be OPERABLE in MODES 1, 2, and 3 to ensure that no single instrument failure can preclude ECCS initiation. (Two channels input to LPCS and LPCI A, while the other two channels input to LPCI B and LPCI C.) In MODES 4 and 5, the Drywell Pressure-High Function is not required since there is insufficient energy in the reactor to pressurize the primary containment to Drywell Pressure-High setpoint. Refer to LCO 3.5.1 for Applicability Bases for the low pressure ECCS subsystems and to LCO 3.8.1 for Applicability Bases for the DGs.
1.c, 2.c. Low Pressure Coolant Injection Pump A and Pump B Start-Time Delay Logic Card The purpose of this time delay is to stagger the start of the two ECCS pumps that are in each of Divisions 1 and 2, thus limiting the starting transients on the 4.16 kV emergency buses. This Function is only necessary when power is being supplied from the standby power sources (DG).
However, since the time delay does not degrade ECCS operation, it remains in the pump start logic at all times.
The LPCI Pump Start-Time Delay Logic Cards are assumed to be OPERABLE in the accident and transient analyses requiring ECCS initiation. That is, the analysis assumes that the pumps will initiate when required and excess loading will not cause failure of the power sources.
(continued)
CLINTON                         B 3.3-94                      Revision No. 1-1

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        1.c, 2.c. Low Pressure Coolant Injection Pump A and Pump B SAFETY ANALYSES,  Start-Time Delay Logic Card (continued)
LCO, and APPLICABILITY     There are two LPCI Pump Start-Time Delay Logic Cards, one in each of the RHR "A" and RHR "B" pump start logic circuits.
While each time delay is dedicated to a single pump start logic, a single failure of a LPCI Pump Start-Time Delay Logic Card could result in the failure of the two low pressure ECCS pumps, powered from the same ESF bus, to perform their intended function within the assumed ECCS RESPONSE TIMES (e.g., as in the case where both ECCS pumps on one ESF bus start simultaneously due to an inoperable time delay logic card). This still leaves two of the four low pressure ECCS pumps OPERABLE; thus, the single failure criterion is met (i.e., loss of one instrument does not preclude ECCS initiation). The Allowable Value for the LPCI Pump Start-Time Delay logic card is chosen to be long enough so that most of the starting transient of the first pump is complete before starting the second pump on the same 4.16 kV emergency bus and short enough so that ECCS operation is not degraded.
Each LPCI Pump Start-Time Delay Logic Card Function is only required to be OPERABLE when the associated LPCI subsystem is required to be OPERABLE.
1.d, 2.d. Reactor Vessel Pressure-Low (Injection Permissive)
Low reactor vessel pressure signals are used as permissives for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure. The Reactor Vessel Pressure-Low is one of the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS during the transients analyzed in References 1 and 3.
In addition, the Reactor Vessel Pressure-Low Function is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
The Reactor Vessel Pressure-Low signals are initiated from four pressure transmitters that sense the reactor dome (continued)
CLINTON                         B 3.3-95                     Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        1.d, 2.d. Reactor Vessel Pressure-Low (Injection SAFETY ANALYSES,  Permissive) (continued)
LCO, and APPLICABILITY     pressure. The four pressure transmitters each drive ATMs (with a total of eight trip channels).
The Allowable Value is low enough to prevent overpressurizing the equipment in the low pressure ECCS, but high enough to ensure that the ECCS injection prevents the fuel peak cladding temperature from exceeding the limits of 10 CFR 50.46.
Four channels of Reactor Vessel Pressure-Low Function per associated Division are only required to be OPERABLE when the associated ECCS is required to be OPERABLE to ensure that no single instrument failure can preclude ECCS initiation. (Four channels are required for LPCS and LPCI A, while four other channels are required for LPCI B and LPCI C.)
1.e, 1.f, 2.e. Low Pressure Coolant Injection and Low Pressure Core Spray Pump Discharge Flow-Low (Bypass)
The minimum flow instruments are provided to protect the associated low pressure ECCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow is sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump. The LPCI and LPCS Pump Discharge Flow-Low Functions are assumed to be OPERABLE and capable of closing the minimum flow valves to ensure that the low pressure ECCS flows assumed during the transients and accidents analyzed in References 1, 2, and 3 are met. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
One flow transmitter per ECCS pump is used to detect the associated subsystems' flow rates. The logic is arranged such that each transmitter causes its associated minimum flow valve to open. The logic will close the minimum flow valve once the closure setpoint is exceeded. The LPCI minimum flow valves are time delayed such that the valves will not open for 8 seconds after the ATMs detect low flow.
The time delay is provided to limit reactor vessel inventory (continued)
CLINTON                         B 3.3-96                     Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        1.e, 1.f, 2.e. Low Pressure Coolant Injection and Low SAFETY ANALYSES,  Pressure Core Spray Pump Discharge Flow-Low (Bypass)
LCO, and            (continued)
APPLICABILITY loss during the startup of the RHR shutdown cooling mode (for RHR A and RHR B). The Pump Discharge Flow-Low Allowable Values are high enough to ensure that the pump flow rate is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core.
Each channel of Pump Discharge Flow-Low Function (one LPCS channel and three LPCI channels) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE, to ensure that no single instrument failure can preclude the ECCS function. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure ECCS subsystems.
1.g, 2.f. Manual Initiation The Manual Initiation push button channels introduce signals into the appropriate ECCS logic to provide manual initiation capability and are redundant to the automatic protective instrumentation. There is one push button for each of the two Divisions of low pressure ECCS (i.e., Division 1 ECCS, LPCS and LPCI A; Division 2 ECCS, LPCI B and LPCI C).
The Manual Initiation Function is not assumed in any accident or transient analyses in the USAR. However, the Function is retained for the low pressure ECCS function as required by the NRC in the plant licensing basis.
There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons. Each channel of the Manual Initiation Function (one channel per Division) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE.
(continued)
CLINTON                          B 3.3-97                     Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        3.a. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES, LCO, and          Low RPV water level indicates that the capability to cool APPLICABILITY     the fuel may be threatened. Should RPV water level decrease (continued)     too far, fuel damage could result. Therefore, the HPCS System and associated DG are initiated at Level 2 to maintain level above the top of the active fuel. The Reactor Vessel Water Level-Low Low, Level 2 is one of the Functions assumed to be OPERABLE and capable of initiating HPCS during the transients analyzed in References 1 and 3.
The Reactor Vessel Water Level-Low Low, Level 2 Function associated with HPCS is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value is chosen such that for complete loss of feedwater flow, the Reactor Core Isolation Cooling (RCIC) System flow with HPCS assumed to fail will be sufficient to avoid initiation of low pressure ECCS at Reactor Vessel Water Level-Low Low Low, Level 1. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are only required to be OPERABLE when HPCS is required to be OPERABLE to ensure that no single instrument failure can preclude HPCS initiation. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.
3.b. Drywell Pressure-High High pressure in the drywell could indicate a break in the RCPB. The HPCS System and associated DG are initiated upon receipt of the Drywell Pressure-High Function in order to minimize the possibility of fuel damage.
(continued)
CLINTON                         B 3.3-98                       Revision No. 7-5

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        3.b. Drywell Pressure-High  (continued)
SAFETY ANALYSES, LCO, and          The core cooling function of the ECCS, along with the scram APPLICABILITY     action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
Drywell Pressure-High signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.
The Drywell Pressure-High Function is required to be OPERABLE when HPCS is required to be OPERABLE. Thus, four channels of the HPCS Drywell Pressure-High Function are required to be OPERABLE in MODES 1, 2, and 3, to ensure that no single instrument failure can preclude ECCS initiation.
In MODES 4 and 5, the Drywell Pressure-High Function is not required since there is insufficient energy in the reactor to pressurize the drywell to the Drywell Pressure-High Function's setpoint. Refer to LCO 3.5.1 for the Applicability Bases for the HPCS System.
3.c. Reactor Vessel Water Level-High, Level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal is used to close the HPCS injection valve to prevent overflow into the main steam lines (MSLs). The Reactor Vessel Water Level-High, Level 8 Function is not assumed in the accident and transient analyses. It was retained since it is a potentially significant contributor to risk.
Reactor Vessel Water Level-High, Level 8 signals for HPCS are initiated from two level transmitters from the wide range water level measurement instrumentation. Both Level 8 signals are required in order to close the HPCS injection valve. This ensures that no single instrument failure can preclude HPCS initiation. The Reactor Vessel Water Level-High, Level 8 Allowable Value is chosen to isolate flow from the HPCS System prior to water overflowing into the MSLs. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
(continued)
CLINTON                         B 3.3-99                       Revision No. 7-5

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        3.c. Reactor Vessel Water Level-High, Level 8 (continued)
SAFETY ANALYSES, LCO, and          The HPCS System is not considered to be inoperable with the APPLICABILITY     indicated reactor vessel water level on the wide range instrument greater than the Level 8 setpoint coincident with the reactor steam dome pressure < 600 psig since the HPCS System would provide the necessary injection if required (i.e., if the water level reaches the low water level initiation setpoint).
Two channels of Reactor Vessel Water Level-High, Level 8 Function are only required to be OPERABLE when HPCS is required to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.
3.d. RCIC Storage Tank Level-Low Low level in the RCIC Storage Tank indicates the unavailability of an adequate supply of makeup water from this normal source. Normally the suction valves between HPCS and the RCIC Storage Tank are open and, upon receiving a HPCS initiation signal, water for HPCS injection would be taken from the RCIC Storage Tank. However, if the water level in the RCIC Storage Tank falls below a preselected level, first the suppression pool suction valve automatically opens, and then the RCIC Storage Tank suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the HPCS pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the RCIC Storage Tank suction valve automatically closes. The Function is implicitly assumed in the accident and transient analyses (which take credit for HPCS) since the analyses assume that the HPCS suction source is the suppression pool.
RCIC Storage Tank Level-Low signals are initiated from two level transmitters. The logic is arranged such that either transmitter and associated ATM can cause the suppression pool suction valve to open and the RCIC Storage Tank suction valve to close. The RCIC Storage Tank Level-Low Function Allowable Value is high enough to ensure adequate pump suction head while water is being taken from the RCIC Storage Tank. The Allowable Value is referenced from an instrument zero of 739 ft. 10-3/4 inches mean sea level.
(continued)
CLINTON                         B 3.3-100                     Revision No. 1-1

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        3.d. RCIC Storage Tank Level-Low  (continued)
SAFETY ANALYSES, LCO, and          Two channels of the RCIC Storage Tank Level-Low Function APPLICABILITY     are only required to be OPERABLE when HPCS is required to be OPERABLE to ensure that no single instrument failure can preclude HPCS swap to suppression pool source. Thus, the Function is required to be OPERABLE in MODES 1, 2, and 3.
With RCIC Storage Tank water level within limits, a sufficient supply of water exists for injection to minimize the consequences of a vessel draindown event. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.
3.e. Suppression Pool Water Level-High Excessively high suppression pool water level could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the S/RVs. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of HPCS from the RCIC Storage Tank to the suppression pool to eliminate the possibility of HPCS continuing to provide additional water from a source outside containment. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the RCIC Storage Tank suction valve automatically closes. This Function is implicitly assumed in the accident and transient analyses (which take credit for HPCS) since the analyses assume that the HPCS suction source is the suppression pool.
Suppression Pool Water Level-High signals are initiated from two level transmitters. The logic is arranged such that either transmitter and associated ATM can cause the suppression pool suction valve to open and the RCIC Storage Tank suction valve to close. The Allowable Value for the Suppression Pool Water Level-High Function is chosen to ensure that HPCS will be aligned for suction from the suppression pool before the water level reaches the point at which suppression pool design loads would be exceeded. The Allowable Value is referenced from an instrument zero of 731 ft 5 inches mean sea level.
(continued)
CLINTON                         B 3.3-101                    Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        3.e. Suppression Pool Water Level-High  (continued)
SAFETY ANALYSES, LCO, and          Two channels of Suppression Pool Water Level-High Function APPLICABILITY     are only required to be OPERABLE in MODES 1, 2, and 3 when HPCS is required to be OPERABLE to ensure that no single instrument failure can preclude HPCS swap to suppression pool source. In MODES 4 and 5, the Function is not required to be OPERABLE since the reactor is depressurized and vessel blowdown, which could cause the design values of the containment to be exceeded, cannot occur. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.
3.f, 3.g. HPCS Pump Discharge Pressure-High (Bypass) and HPCS System Flow Rate-Low (Bypass)
The minimum flow instruments are provided to protect the HPCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow and high pump discharge pressure are sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump or the discharge pressure is low (indicating the HPCS pump is not operating). The HPCS System Flow Rate-Low and HPCS Pump Discharge Pressure-High Functions are assumed to be OPERABLE and capable of closing the minimum flow valve to ensure that the ECCS flow assumed during the transients and accidents analyzed in References 1, 2, and 3 is met. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
One flow transmitter is used to detect the HPCS System's flow rate. The logic is arranged such that the transmitter causes the minimum flow valve to open, provided the HPCS pump discharge pressure, sensed by another transmitter, is high enough (indicating the pump is operating). The logic will close the minimum flow valve once the closure setpoint is exceeded. (The valve will also close upon HPCS pump discharge pressure decreasing below the setpoint.)
The HPCS System Flow Rate-Low and HPCS Pump Discharge Pressure-High Allowable Value is high enough to ensure that pump flow rate is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core. The HPCS Pump Discharge Pressure-High Allowable Value is set high enough to ensure that the valve will not be open when the pump is not operating.
(continued)
CLINTON                         B 3.3-102                       Revision No. 0

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        3.f, 3.g. HPCS Pump Discharge Pressure-High (Bypass) and SAFETY ANALYSES,  HPCS System Flow Rate-Low (Bypass) (continued)
LCO, and APPLICABILITY     One channel of each Function is required to be OPERABLE when the HPCS is required to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.
3.h. Manual Initiation The Manual Initiation push button channel introduces a signal into the HPCS logic to provide manual initiation capability and is redundant to the automatic protective instrumentation. There is one push button for the HPCS System.
The Manual Initiation Function is not assumed in any accident or transient analysis in the USAR. However, the Function is retained for the HPCS function as required by the NRC in the plant licensing basis.
There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push button. One channel of the Manual Initiation Function is only required to be OPERABLE when the HPCS System is required to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.
Automatic Depressurization System 4.a, 5.a. Reactor Vessel Water Level-Low Low Low, Level 1 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, ADS receives one of the signals necessary for initiation from this Function. The Reactor Vessel Water Level-Low Low Low, Level 1 is one of the Functions assumed to be OPERABLE and (continued)
CLINTON                         B 3.3-103                     Revision No. 1-1

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        4.a, 5.a. Reactor Vessel Water Level-Low Low Low, Level 1 SAFETY ANALYSES,   (continued)
LCO, and APPLICABILITY     capable of initiating the ADS during the accidents analyzed in Reference 2. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
Reactor Vessel Water Level-Low Low Low, Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function are only required to be OPERABLE when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (Two channels (associated with logic A and E) input to ADS trip system 1 while the other two channels (associated with logic B and F) input to ADS trip system 2). Refer to LCO 3.5.1 for ADS Applicability Bases.
The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is high enough to allow time for the low pressure core flooding systems to initiate and provide adequate cooling. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
4.b, 5.b. Drywell Pressure - High High pressure in the drywell could indicate a break in the RCPB. Therefore, ADS receives one of the signals necessary for initiation from this Function in order to minimize the possibility of fuel damage. The Drywell Pressure-High is assumed to be OPERABLE and capable of initiating the ADS during the accidents analyzed in Reference 2. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
Drywell Pressure-High signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.
(continued)
CLINTON                         B 3.3-104                       Revision No. 0

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        4.b, 5.b Drywell Pressure-High  (continued)
SAFETY ANALYSES, LCO, and          Four channels of Drywell Pressure-High Function are only APPLICABILITY     required to be OPERABLE when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (Two channels (associated with logic A and E) input to ADS trip system 1 while the other two channels (associated with logic B and F) input to ADS trip system 2.)
Refer to LCO 3.5.1 for ADS Applicability Bases.
4.c, 5.c. ADS Initiation Timer The purpose of the ADS Initiation Timer is to delay depressurization of the reactor vessel to allow the HPCS System time to maintain reactor vessel water level. Since the rapid depressurization caused by ADS operation is one of the most severe transients on the reactor vessel, its occurrence should be limited. By delaying initiation of the ADS Function, the operator is given the chance to monitor the success or failure of the HPCS System to maintain water level, and then to decide whether or not to allow ADS to initiate, to delay initiation further by recycling the timer, or to inhibit initiation permanently. The ADS Initiation Timer Function is assumed to be OPERABLE for the accident analyses of Reference 2 that require ECCS initiation and assume failure of the HPCS System.
There are two ADS Initiation Timer relays, one in each of the two ADS trip systems. The Allowable Value for the ADS Initiation Timer is chosen to be short enough so that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.
Two channels of the ADS Initiation Timer Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (One channel inputs to ADS trip system 1 while the other channel inputs to ADS trip system 2.) Refer to LCO 3.5.1 for ADS Applicability Bases.
4.d, 5.d. Reactor Vessel Water Level-Low, Level 3 The Reactor Vessel Water Level-Low, Level 3 Function is used by the ADS only as a confirmatory low water level signal. ADS receives one of the signals necessary for initiation from Reactor Vessel Water Level-Low Low Low, Level 1 signals. In order to prevent spurious initiation of (continued)
CLINTON                         B 3.3-105                       Revision No. 0

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        4.d, 5.d. Reactor Vessel Water Level-Low, Level 3 SAFETY ANALYSES,  (continued)
LCO, and APPLICABILITY     the ADS due to spurious Level 1 signals, a Level 3 signal must also be received before ADS initiation commences.
Reactor Vessel Water Level-Low, Level 3 signals are initiated from two level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Allowable Value for Reactor Vessel Water Level-Low, Level 3 is selected at the RPS Level 3 scram Allowable Value for convenience. Refer to LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," for Bases discussion of this Function. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
Two channels of Reactor Vessel Water Level-Low, Level 3 Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (One channel inputs to ADS trip system 1 while the other channel inputs to ADS trip system 2.) Refer to LCO 3.5.1 for ADS Applicability Bases.
4.e, 4.f, 5.e. Low Pressure Core Spray and Low Pressure Coolant Injection Pump Discharge Pressure-High The Pump Discharge Pressure-High signals from the LPCS and LPCI pumps are used as permissives for ADS initiation, indicating that there is a source of low pressure cooling water available once the ADS has depressurized the vessel.
Pump Discharge Pressure-High is one of the Functions assumed to be OPERABLE and capable of permitting ADS initiation during the events analyzed in References 2 and 3 with an assumed HPCS failure. For these events, the ADS depressurizes the reactor vessel so that the low pressure ECCS can perform the core cooling functions. This core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
Pump discharge pressure signals are initiated from eight pressure transmitters, two on the discharge side of each of the four low pressure ECCS pumps. In order to generate an ADS permissive in one trip system, it is necessary that only one pump (both channels for the pump) indicate the high (continued)
CLINTON                         B 3.3-106                        Revision No. 0

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        4.e, 4.f, 5.e. Low Pressure Core Spray and Low Pressure SAFETY ANALYSES,  Coolant Injection Pump Discharge Pressure-High (continued)
LCO, and APPLICABILITY     discharge pressure condition. The Pump Discharge Pressure-High Allowable Value is less than the pump discharge pressure when the pump is operating in a full flow mode, and high enough to avoid any condition that results in a discharge pressure permissive when the LPCS and LPCI pumps are aligned for injection and the pumps are not running.
The actual operating point of this Function is not assumed in any transient or accident analysis.
Eight channels of LPCS and LPCI Pump Discharge Pressure-High Function (two LPCS and two LPCI A channels input to ADS trip system 1, while two LPCI B and two LPCI C channels input to ADS trip system 2) are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation.
Refer to LCO 3.5.1 for ADS Applicability Bases.
4.g, 5.f. ADS Drywell Pressure Bypass Timer One of the signals required for ADS initiation is Drywell Pressure-High. However, if the event requiring ADS initiation occurs outside the drywell (for example, main steam line break outside primary containment), a high drywell pressure signal may never be present. Therefore, the ADS Bypass Timer is used to bypass the Drywell Pressure-High Function after a certain time period has elapsed.
There are four solid state ADS Bypass Timers, two in each of the two ADS trip systems. The Allowable Value for the ADS Timer is chosen to be short enough so that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling.
Four channels of the ADS Bypass Timer Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can (continued)
CLINTON                         B 3.3-107                      Revision No. 7-5

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE        4.g, 5.f. ADS Drywell Pressure Bypass Timer   (continued)
SAFETY ANALYSES, LCO, and          preclude ADS initiation. Refer to LCO 3.5.1 for ADS APPLICABILITY     Applicability Bases.
4.h, 5.g. Manual Initiation The Manual Initiation push button channels introduce signals into the ADS logic to provide manual initiation capability and are redundant to the automatic protective instrumentation. There are two push buttons for each ADS trip system (total of four).
The Manual Initiation Function is not assumed in any accident or transient analyses in the USAR. However, the Function is retained for the ADS function as required by the NRC in the plant licensing basis.
There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push buttons. Four channels of the Manual Initiation Function (two channels per ADS trip system) are only required to be OPERABLE when the ADS is required to be OPERABLE. Refer to LCO 3.5.1 for ADS Applicability Bases.
ACTIONS           A Note has been provided to modify the ACTIONS related to ECCS instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable ECCS instrumentation channels provide appropriate compensatory measures for separate inoperable Condition entry for each inoperable ECCS instrumentation channel.
A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.1-1. The applicable Condition specified in the table is Function dependent.
Each time a channel is discovered to be inoperable, (continued)
CLINTON                         B 3.3-108                      Revision No. 1-1

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS       Condition A is entered for that channel and provides for (continued) transfer to the appropriate subsequent Condition.
B.1, B.2, and B.3 Required Actions B.1 and B.2 are intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function (or in some cases, within the same variable) result in redundant automatic initiation capability being lost for the feature(s). Required Action B.1 features would be those that are initiated by Functions 1.a, l.b, 2.a, and 2.b (e.g., low pressure ECCS). The Required Action B.2 feature would be HPCS. For Required Action B.1, redundant automatic initiation capability is lost if either (a) one or more Function 1.a channels and one or more Function 2.a channels are inoperable and untripped, or (b) one or more Function 1.b channels and one or more Function 2.b channels are inoperable and untripped.
For Divisions 1 and 2, since each inoperable channel would have Required Action B.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated Division of low pressure ECCS and DG to be declared inoperable. However, since channels in both Divisions are inoperable and untripped, and the Completion Times started concurrently for the channels in both Divisions, this results in the affected portions in both Divisions of ECCS and DG being concurrently declared inoperable.
For Required Action B.2, redundant automatic initiation capability is lost if two Function 3.a or two Function 3.b channels are inoperable and untripped in the same trip system. In this situation (loss of redundant automatic initiation capability), the 24 hour allowance of Required Action B.3 is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared inoperable within 1 hour. Notes are also provided (continued)
CLINTON                     B 3.3-109                    Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3  (continued)
(the Note to Required Action B.1 and Required Action B.2) to delineate which Required Action is applicable for each Function that requires entry into Condition B if an associated channel is inoperable. This ensures that the proper loss of initiation capability check is performed.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action B.1, the Completion Time only begins upon discovery that a redundant feature in both Divisions (e.g., any Division 1 ECCS and Division 2 ECCS) cannot be automatically initiated due to inoperable, untripped channels within the same variable as described in the paragraph above. For Required Action B.2, the Completion Time only begins upon discovery that the HPCS System cannot be automatically initiated due to two inoperable, untripped channels for the associated Function in the same trip system. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.3. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition H must be entered and its Required Action taken.
C.1 and C.2 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function (or in some cases, within the same variable) result in redundant automatic initiation capability being lost for the feature(s). Required (continued)
CLINTON               B 3.3-110                    Revision No. 21-7

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS C.1 and C.2  (continued)
Action C.1 features would be those that are initiated by Functions 1.c, l.d, 2.c, and 2.d (i.e., low pressure ECCS).
For Functions 1.c and 2.c, redundant automatic initiation capability is lost if the Function 1.c and Function 2.c channels are inoperable. For Functions 1.d and 2.d, redundant automatic initiation capability is lost if two Function 1.d channels in the same trip system and two Function 2.d channels in the same trip system (but not necessarily the same trip system as the Function 1.d channels) are inoperable. Since each inoperable channel would have Required Action C.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated Division to be declared inoperable. However, since channels in both Divisions are inoperable, and the Completion Times started concurrently for the channels in both Divisions, this results in the affected portions in both Divisions being concurrently declared inoperable. For Functions 1.c and 2.c, the affected portions of the Division are LPCI A and LPCI B, respectively. For Functions 1.d and 2.d, the affected portions of the Division are the low pressure ECCS pumps (Divisions 1 and 2, respectively).
In this situation (loss of redundant automatic initiation capability), the 24 hour allowance of Required Action C.2 is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour.
The Note states that Required Action C.1 is only applicable for Functions 1.c, 1.d, 2.c, and 2.d. The Required Action is not applicable to Functions 1.g, 2.f, and 3.h (which also require entry into this Condition if a channel in these Functions is inoperable), since they are the Manual Initiation Functions and are not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 24 hours (as allowed by Required Action C.2) is allowed. Required Action C.1 is also not applicable to Function 3.c (which also requires entry into this Condition (continued)
CLINTON               B 3.3-111                     Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS           C.1 and C.2  (continued) if a channel in this Function is inoperable), since the loss of one channel results in a loss of the Function (two-out-of-two logic). This loss was considered during the development of Reference 4 and considered acceptable for the 24 hours allowed by Required Action C.2.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action C.1, the Completion Time only begins upon discovery that the same feature in both Divisions (e.g., any Division 1 ECCS and Division 2 ECCS) cannot be automatically initiated due to inoperable channels within the same variable as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.
Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition H must be entered and its Required Action taken.
The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or would not necessarily result in a safe state for the channel in all events.
D.1, D.2.1, and D.2.2 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic component initiation capability for the HPCS System. Automatic component initiation capability is lost if two Function 3.d channels or two Function 3.e channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour allowance of Required Actions D.2.1 and D.2.2 is not appropriate and the HPCS System must be declared inoperable within 1 hour after discovery of loss of HPCS initiation capability. As noted, the Required Action is only applicable if the HPCS pump suction is not aligned to the suppression pool, since, if aligned, the Function is already performed.
(continued)
CLINTON                         B 3.3-112                     Revision No. 21-7

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS           D.1, D.2.1, and D.2.2   (continued)
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action D.1, the Completion Time only begins upon discovery that the HPCS System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1 or the suction source must be aligned to the suppression pool within 24 hours per Required Action D.2.2. Placing the inoperable channel in trip performs the intended function of the channel (shifting the suction source to the suppression pool). Performance of either of these two Required Actions will allow operation to continue. If Required Action D.2.1 or Required Action D.2.2 is performed, measures should be taken to ensure that the HPCS System piping remains filled with water. Alternately, if it is not desired to perform Required Actions D.2.1 and D.2.2, Condition H must be entered and its Required Action taken.
E.1 and E.2 Required Action E.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the LPCS and LPCI Pump Discharge Flow-Low (Bypass) Functions result in redundant automatic initiation capability being lost for the feature(s). For Required Action E.1, the features would be those that are initiated by Functions 1.e, 1.f, and 2.e (e.g., low pressure ECCS).
Redundant automatic initiation capability is lost if three of the four channels associated with Functions 1.e, 1.f, (continued)
CLINTON                         B 3.3-113                    Revision No. 21-7

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS E.1 and E.2  (continued) and 2.e are inoperable. Since each inoperable channel would have Required Action E.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected low pressure ECCS pump to be declared inoperable. However, since channels for more than one low pressure ECCS pump are inoperable, and the Completion Times started concurrently for the channels of the low pressure ECCS pumps, this results in the affected low pressure ECCS pumps being concurrently declared inoperable.
In this situation (loss of redundant automatic initiation capability), the 7 day allowance of Required Action E.2 is not appropriate and the feature(s) associated with each inoperable channel must be declared inoperable within 1 hour after discovery of loss of initiation capability for feature(s) in both Divisions. A Note is also provided (the Note to Required Action E.1) to delineate that Required Action E.1 is only applicable to low pressure ECCS Functions. Required Action E.1 is not applicable to HPCS Functions 3.f and 3.g since the loss of one channel results in a loss of the Function (one-out-of-one logic). This loss was considered during the development of Reference 4 and considered acceptable for the 7 days allowed by Required Action E.2.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action E.1, the Completion Time only begins upon discovery that three channels of the variable (Pump Discharge Flow-Low) cannot be automatically initiated due to inoperable channels. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.
(continued)
CLINTON               B 3.3-114                    Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS E.1 and E.2  (continued)
If the instrumentation that controls the pump minimum flow valve is inoperable such that the valve will not automatically open, pump operation with no injection path available could lead to pump overheating and failure. If there were a failure of the instrumentation   such that the valve would not automatically close, a portion of the pump flow could be diverted from the reactor injection path, causing insufficient core cooling. Other ECCS pumps would be sufficient to complete the assumed safety function if no additional single failure were to occur. The 7 day Completion Time of Required Action E.2 to restore the inoperable channel to OPERABLE status is reasonable based on the remaining capability of the associated ECCS subsystems, the redundancy available in the ECCS design, and the low probability of a DBA occurring during the allowed out of service time. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition H must be entered and its Required Action taken.
The Required Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained.
F.1 and F.2 Required Action F.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within similar ADS trip system Functions result in automatic initiation capability being lost for the ADS.
Automatic initiation capability is lost if either (a) more than one Function 4.a channel and one Function 5.a channel are inoperable and untripped, (b) one Function 4.b channel and one Function 5.b channel are inoperable and untripped, or (c) one Function 4.d channel and one Function 5.d channel are inoperable and untripped.
In this situation (loss of automatic initiation capability),
the 96 hour or 8 day allowance, as applicable, of Required Action F.2 is not appropriate, and all ADS valves must be declared inoperable within 1 hour after discovery of loss of ADS initiation capability in both trip systems.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal (continued)
CLINTON               B 3.3-115                    Revision No. 21-7

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS F.1 and F.2   (continued)
        "time zero" for beginning the allowed outage time "clock."
For Required Action F.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable, untripped channels within similar ADS trip system Functions as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status if both HPCS and RCIC are OPERABLE. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If either HPCS or RCIC is inoperable, the time is shortened to 96 hours.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
If the status of HPCS or RCIC changes such that the Completion Time changes from 8 days to 96 hours, the 96 hours begins upon discovery of HPCS or RCIC inoperability.
However, total time for an inoperable, untripped channel cannot exceed 8 days. If the status of HPCS or RCIC changes such that the Completion Time changes from 96 hours to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable, untripped channel.
If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action F.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition H must be entered and its Required Action taken.
G.1 and G.2 Required Action G.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within similar ADS trip system Functions result in automatic initiation capability being lost for the ADS. Automatic initiation capability is lost if either (a) one Function 4.c (continued)
CLINTON                B 3.3-116                   Revision No. 21-7

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS G.1 and G.2  (continued) channel and one Function 5.c channel are inoperable, (b) one or more Function 4.e channels and one or more Function 5.e channels are inoperable, (c) one or more Function 4.f channels and one or more Function 5.e channels are inoperable, or (d) one or more Function 4.g channels and one or more Function 5.f channels are inoperable.
In this situation (loss of automatic initiation capability),
the 96 hour or 8 day allowance, as applicable, of Required Action G.2 is not appropriate, and all ADS valves must be declared inoperable within 1 hour after discovery of loss of ADS initiation capability in both trip systems. The Note to Required Action G.1 states that Required Action G.1 is only applicable for Functions 4.c, 4.e, 4.f, 4.g, 5.c, 5.e, and 5.f. Required Action G.1 is not applicable to Functions 4.h, and 5.g (which also require entry into this Condition if a channel in these Functions is inoperable),
since they are the Manual Initiation Functions and are not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 96 hours or 8 days (as allowed by Required Action G.2) is allowed.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action G.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable channels within similar ADS trip system Functions, as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status if both HPCS and RCIC are OPERABLE (Required Action G.2). Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If either HPCS or RCIC is inoperable, the time is reduced to (continued)
CLINTON               B 3.3-117                    Revision No. 21-7

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS      G.1 and G.2  (continued) 96 hours. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. If the status of HCPS or RCIC changes such that the Completion Time changes from 8 days to 96 hours, the 96 hours begins upon discovery of HPCS or RCIC inoperability. However, total time for an inoperable channel cannot exceed 8 days. If the status of HPCS or RCIC changes such that the Completion Time changes from 96 hours to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable channel. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition H must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.
H.1 With any Required Action and associated Completion Time not met, the associated feature(s) may be incapable of performing the intended function and the supported feature(s) associated with the inoperable untripped channels must be declared inoperable immediately.
SURVEILLANCE As noted at the beginning of the SRs, the SRs for each ECCS REQUIREMENTS instrumentation Function are found in the SRs column of Table 3.3.5.1-1.
The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours as follows: (a) for Functions 3.c, 3.f, 3.g, and 3.h; and (b) for Functions other than 3.c, 3.f, 3.g, and 3.h provided the associated Function or the redundant Function maintains ECCS initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions (continued)
CLINTON                    B 3.3-118                     Revision No. 21-7

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE      taken. This Note is based on the reliability analysis REQUIREMENTS      (Ref. 4) assumption of the average time required to perform (continued)     channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the ECCS will initiate when necessary.
SR  3.3.5.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
SR  3.3.5.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. For series Functions, a separate CHANNEL FUNCTIONAL TEST is not required for each Function, provided each Function is tested. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests.
(continued)
CLINTON                         B 3.3-119                    Revision No. 21-4

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE      SR  3.3.5.1.2  (continued)
REQUIREMENTS Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.5.1.3 The calibration of ATMs provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be not within its required Allowable Value specified in Table 3.3.5.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analyses. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than the setting accounted for in the appropriate setpoint methodology.
The SR 3.3.5.1.3 calibration for selected Functions is modified by a Note as identified in Table 3.3.5.1-1. This Note, which applies only to those Functions identified in Table 3.3.5.1-1, is divided into three parts. Part 1 of the Note requires evaluation of instrument performance for the condition where the as-found setting for these instrument channels is outside its As-Found Tolerance (AFT) but conservative with respect to the Allowable Value.
Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. Initial evaluation will be performed by the technician performing the surveillance who will evaluate the instruments ability to maintain a stable setpoint within the As-Left Tolerance (ALT). The technicians evaluation will be reviewed by on-shift operations personnel during the approval of the surveillance data. Subsequent to returning the instrument to service, the deviation is entered into the Corrective Action Program. In accordance with procedures, entry into the Corrective Action Program will require review and documentation of the condition for operability by on-shift operations personnel. Additional evaluation and potential corrective actions as necessary will ensure that any as-found setting found outside the AFT is evaluated for long-term operability trends. If the as-found channel setpoint is not conservative with respect to the Allowable Value, the (continued)
CLINTON                         B 3.3-120                     Revision No. 14-2

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE      SR  3.3.5.1.3   (continued)
REQUIREMENTS channel shall be declared inoperable. Part 2 of the Note requires that the instrument channel setpoint shall be reset to within the ALT of the Actual Trip Setpoint (ATSP). The ATSP is equivalent to or more conservative than the Nominal Trip Setpoint (NTSP). The NTSP is the limiting value of the sensed process variable at which a trip may be set in accordance with the methodology documented in the ORM.
Therefore, the NTSP is equivalent to the Limiting Safety System Setting (LSSS) required by 10 CFR 50.36, Technical specifications. The Actual Trip Setpoint is also calculated in accordance with the plant-specific setpoint methodology as documented in the CPS ORM and may include additional margin. The ATSP will ensure that sufficient margin to the safety and/or analytical limit is maintained.
If the as-left instrument channel setpoint cannot be returned to within the ALT of the Actual Trip Setpoint, then the channel shall be declared inoperable. Part 3 of the Note indicates that the Nominal Trip Setpoint and the methodology used to determine the Nominal Trip Setpoint, the As-Found Tolerance and the As-Left Tolerance bands are specified in the ORM.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.5.1.4 and SR 3.3.5.1.6 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The SR 3.3.5.1.4 and SR 3.3.5.1.6 calibrations for selected Functions are modified by a Note as identified in Table 3.3.5.1-1. This Note, which applies only to those Functions identified in Table 3.3.5.1-1, is divided into three parts.
Part 1 of the Note requires evaluation of instrument performance for the condition where the as-found setting for these instrument channels is outside its As-Found Tolerance (AFT) but conservative with respect to the Allowable Value.
Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. Initial evaluation will be performed by the technician performing the surveillance who will evaluate the instruments ability to maintain a stable setpoint within the As-Left Tolerance (ALT). The technicians evaluation will be reviewed by on-shift operations personnel during the approval of the (continued)
CLINTON                         B 3.3-120a                   Revision No. 14-2

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE      SR  3.3.5.1.4 and SR 3.3.5.1.6  (continued)
REQUIREMENTS surveillance data. Subsequent to returning the instrument to service, the deviation is entered into the Corrective Action Program. In accordance with procedures, entry into the Corrective Action Program will require review and documentation of the condition for operability by on-shift operations personnel. Additional evaluation and potential corrective actions as necessary will ensure that any as-found setting found outside the AFT is evaluated for long-term operability trends. If the as-found channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable. Part 2 of the Note requires that the instrument channel setpoint shall be reset to within the ALT of the Actual Trip Setpoint (ATSP). The ATSP is equivalent to or more conservative than the Nominal Trip Setpoint (NTSP). The NTSP is the limiting value of the sensed process variable at which a trip may be set in accordance with the methodology documented in the ORM.
Therefore, the NTSP is equivalent to the Limiting Safety System Setting (LSSS) required by 10 CFR 50.36, Technical specifications. The Actual Trip Setpoint is also calculated in accordance with the plant-specific setpoint methodology as documented in the CPS ORM and may include additional margin. The ATSP will ensure that sufficient margin to the safety and/or analytical limit is maintained.
If the as-left instrument channel setpoint cannot be returned to within the ALT of the Actual Trip Setpoint, then the channel shall be declared inoperable. Part 3 of the Note indicates that the Nominal Trip Setpoint and the methodology used to determine the Nominal Trip Setpoint, the As-Found Tolerance and the As-Left Tolerance bands are specified in the ORM.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                        B 3.3-120b                     Revision No. 14-2

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE      SR  3.3.5.1.5 REQUIREMENTS (continued)     The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.1, LCO 3.5.2, LCO 3.7.2, LCO 3.8.1, and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety function.
The Self Test System may be utilized to perform this testing for those components that it is designed to monitor.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. USAR, Section 5.2.2.
: 2. USAR, Section 6.3.
: 3. USAR, Chapter 15.
: 4. NEDC-30936-P-A, "BWR Owners' Group Technical Specification Improvement Analyses for ECCS Actuation Instrumentation, Part 2," December 1988.
CLINTON                         B 3.3-121                     Revision No. 14-2

This page intentionally left blank CLINTON           B 3.3-122                Revision No. 1-1

RPV Water Inventory Control Instrumentation B 3.3.5.2 B 3.3   INSTRUMENTATION B 3.3.5.2   Reactor Pressure Vessel (RPV) Water Inventory Control Instrumentation BASES BACKGROUND         The RPV contains penetrations below the top of the active fuel (TAF) that have the potential to drain the reactor coolant inventory to below the TAF. If the water level should drop below the TAF, the ability to remove decay heat is reduced, which could lead to elevated cladding temperatures and clad perforation. Safety Limit 2.1.1.3 requires the RPV water level to be above the top of the active irradiated fuel at all times to prevent such elevated cladding temperatures.
Technical Specifications are required by 10 CFR 50.36 to include limiting safety system settings (LSSS) for variables that have significant safety functions. LSSS are defined by the regulation as "Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded."
The Analytical Limit is the limit of the process variable at which a safety action is initiated to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
The actual settings for the automatic isolation channels are the same as those established for the same functions in MODES 1, 2, and 3 in LCO 3.3.6.1, "Primary Containment Isolation instrumentation."
With the unit in MODE 4 or 5, RPV water inventory control is not required to mitigate any events or accidents evaluated in the safety analyses. RPV water inventory control is required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material should a draining event occur. Under the definition of DRAIN TIME, some penetration flow paths may be excluded from the DRAIN TIME calculation if they will be isolated by valves that will close automatically without offsite power prior to the RPV water level being equal to the TAF when actuated by RPV water level isolation instrumentation.
(continued)
CLINTON                         B 3.3-122a                    Revision No. 21-9

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES BACKGROUND        The purpose of the RPV Water Inventory Control (continued)    Instrumentation is to support the requirements of LCO 3.5.2, RPV Water Inventory Control, and the definition of DRAIN TIME. There are functions that support automatic isolation of Residual Heat Removal subsystem and Reactor Water Cleanup system penetration flow path(s) on low RPV water level.
APPLICABLE        With the unit in MODE 4 or 5, RPV water inventory control is SAFETY            not required to mitigate any events or accidents evaluated ANALYSES, LCO,    in the safety analyses. RPV water inventory control is and APPLICABILITY required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material should a draining event occur.
A double-ended guillotine break of the Reactor Coolant System (RCS) is not considered in MODES 4 and 5 due to the reduced RCS pressure, reduced piping stresses, and ductile piping systems. Instead, an event is considered in which an initiating event allows draining of the RPV water inventory through a single penetration flow path with the highest flow rate, or the sum of the drain rates through multiple penetration flow paths susceptible to a common mode failure.
It is assumed, based on engineering judgment, that while in MODES 4 and 5, one ECCS injection/spray subsystem can be manually initiated to maintain adequate reactor vessel water level.
As discussed in References 1, 2, 3, 4, and 5, operating experience has shown RPV water inventory to be significant to public health and safety. Therefore, RPV Water Inventory Control satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
Permissive and interlock setpoints are generally considered as nominal values without regard to measurement accuracy.
The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
(continued)
CLINTON                        B 3.3-122b                    Revision No. 21-9

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE        RHR System Isolation SAFETY ANALYSES, LCO,    1.a - Reactor Vessel Water Level - Low. Level 3 and APPLICABILITY (continued)    The definition of DRAIN TIME allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level being equal to the TAF. The Reactor Vessel Water Level - Low, Level 3 Function is only required to be OPERABLE when automatic isolation of the associated RHR penetration flow path is credited in calculating DRAIN TIME.
Reactor Vessel Water Level - Low, Level 3 signals are initiated from four level transmitters (two per trip system) that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
While four channels (two channels per trip system) of the Reactor Vessel Water Level - Low, Level 3 Function are available, only two channels (all in the same trip system) are required to be OPERABLE.
The Reactor Vessel Water Level - Low, Level 3 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level - Low, Level 3 Allowable Value (LCO 3.3.1.1),
since the capability to cool the fuel may be threatened.
(continued)
CLINTON                        B 3.3-122c                    Revision No. 21-9

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE        Reactor Water Cleanup (RWCU) System Isolation SAFETY ANALYSES, LCO,    2.a - Reactor Vessel Water level - Low Low, Level 2 and APPLICABILITY (continued)    The definition of DRAIN TIME allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level being equal to the TAF. The Reactor Vessel Water Level - Low Low, Level 2 Function associated with RWCU System isolation may be credited for automatic isolation of penetration flow paths associated with the RWCU System.
Reactor Vessel Water Level - Low Low, Level 2 is initiated from two channels per trip system that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. While four channels (two channels per trip system) of the Reactor Vessel Water Level - Low, Level 2 Function are available, only two channels (all in the same trip system) are required to be OPERABLE.
The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low, Level 2 Allowable Value (LCO 3.3.5.1), since the capability to cool the fuel may be threatened.
The Reactor Vessel Water Level - Low Low, Level 2 Function is only required to be OPERABLE when automatic isolation of the associated penetration flow path is credited in calculating DRAIN TIME.
ACTIONS           A Note has been provided to modify the ACTIONS related to RPV Water Inventory Control instrumentation channels.
Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.
Section 1.3 also specifies that Required Actions continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RPV Water Inventory Control instrumentation channels provide appropriate compensatory measures for separate inoperable Condition entry for each inoperable RPV Water Inventory Control instrumentation channel.
(continued)
CLINTON                        B 3.3-122d                    Revision No. 21-9

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES ACTIONS       A.1, A.2.1, and A.2.2 (continued)
RHR System Isolation, Reactor Vessel Water Level - Low Level 3, and Reactor Water Cleanup System, Reactor Vessel Water Level - Low Low, Level 2 functions are applicable when automatic isolation of the associated penetration flow path is credited in calculating Drain Time. If the instrumentation is inoperable, Required Action A.1 directs immediate action to place the channel in trip. With the inoperable channel in the tripped condition, the remaining channel will isolate the penetration flow path on low water level. If both channels are inoperable and placed in trip, the penetration flow path will be isolated. Alternatively, Required Action A.2.1 requires that the associated penetration flow path(s) to be immediately declared incapable of automatic isolation. Required Action A.2.2 directs initiating action to calculate DRAIN TIME. The calculation cannot credit automatic isolation of the affected penetration flow path(s).
(continued)
CLINTON                    B 3.3-122e                    Revision No. 21-9

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES   (continued)
SURVEILLANCE        The following SRs apply to each RPV Water Inventory Control REQUIREMENTS        instrument Function in Table 3.3.5.2-1.
SR   3.3.5.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK guarantees that undetected outright channel failure is limited; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL FUNCTIONAL TEST.
Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
(continued)
CLINTON                            B 3.3-122f                    Revision No. 21-9

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES SURVEILLANCE  SR  3.3.5.2.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests.
Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES    1. Information Notice 84-81 "Inadvertent Reduction in Primary Coolant Inventory in Boiling Water Reactors During Shutdown and Startup," November 1984.
: 2. Information Notice 86-74, "Reduction of Reactor Coolant Inventory Because of Misalignment of RHR Valves,"
August 1986.
: 3. Generic Letter 92-04, "Resolution of the Issues Related to Reactor Vessel Water Level Instrumentation in BWRs Pursuant to 10 CFR 50.54(f)," August 1992.
: 4. NRC Bulletin 93-03, "Resolution of Issues Related to Reactor Vessel Water Level Instrumentation in BWRs,"
May 1993.
: 5. Information Notice 94-52, "Inadvertent Containment Spray and Reactor Vessel Draindown at Millstone 1,"
July 1994.
CLINTON                     B 3.3-122g                    Revision No. 21-9

RCIC System Instrumentation B 3.3.5.3 B 3.3   INSTRUMENTATION B 3.3.5.3   Reactor Core Isolation Cooling (RCIC) System Instrumentation BASES BACKGROUND         The purpose of the RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is unavailable, such that initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur. A more complete discussion of RCIC System operation is provided in the Bases of LCO 3.5.3, "RCIC System."
The RCIC System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low, Level 2. The variable is monitored by four transmitters that are connected to four Analog Trip Modules (ATMs). The outputs of the ATMs are connected to solid state logic arranged in a one-out-of-two taken twice configuration. Once initiated, the RCIC logic seals in and can be reset by the operator only when the reactor vessel water level signals have cleared.
The RCIC test line isolation valves close on a RCIC initiation signal to allow full system flow.
The RCIC System also monitors the water levels in the RCIC Storage Tank and the suppression pool, since these are the two sources of water for RCIC operation. Reactor grade water in the RCIC Storage Tank is the normal source. Upon receipt of a RCIC initiation signal, the RCIC Storage Tank suction valve is automatically signaled to open (it is normally in the open position) unless the pump suction from the suppression pool valve is open. If the water level in the RCIC Storage Tank falls below a preselected level, first the suppression pool suction valve automatically opens and then the RCIC Storage Tank suction valve automatically closes. Two level transmitters are used to detect low water level in the RCIC Storage Tank. Either switch can cause the suppression pool suction valve to open and the RCIC Storage Tank suction valve to close. The suppression pool suction valve also automatically opens and the RCIC Storage Tank suction valve closes if high water level is detected in the (continued)
CLINTON                          B 3.3-123                    Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES BACKGROUND       suppression pool (one-out-of-two logic similar to the RCIC (continued)    Storage Tank water level logic). To prevent losing suction to the pump, the suction valves are interlocked so that one suction path must be open before the other automatically closes.
The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (Level 8) trip (two-out-of-two logic), at which time the RCIC steam supply, and cooling water supply valves close (the injection valve also closes due to the closure of the steam supply valve). The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2).
APPLICABLE       The function of the RCIC System is to provide makeup SAFETY ANALYSES, coolant to the reactor in response to transient events.
LCO, and         The RCIC System is not an Engineered Safety Feature System APPLICABILITY    and no credit is taken in the safety analyses for RCIC System operation. The RCIC System satisfies Criterion 4 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.
The OPERABILITY of the RCIC System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.3-1. Each Function must have a required number of OPERABLE channels with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
Allowable Values are specified for each RCIC System instrumentation Function specified in the table. Nominal trip setpoints are specified in the setpoint calculations.
The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less (continued)
CLINTON                        B 3.3-124                    Revision No. 21-6

RCIC System Instrumentation B 3.3.5.3 BASES APPLICABLE       conservative than the nominal trip setpoint, but within its SAFETY ANALYSES, Allowable Value, is acceptable. Each Allowable Value LCO, and         specified accounts for instrument uncertainties appropriate APPLICABILITY    to the Function. These uncertainties are described in the (continued)    setpoint methodology.
Certain RCIC valves (e.g., minimum flow) also serve the dual function of automatic primary containment isolation valves.
The signals that provide automatic initiation of the RCIC are also associated with the automatic isolation of these valves. Some instrumentation and ACTIONS associated with these signals are addressed in LCO 3.3.6.1, "Primary Containment and Drywell Isolation Instrumentation," and are not included in this LCO.
The individual Functions are required to be OPERABLE in MODE 1, and in MODES 2 and 3 with reactor steam dome pressure > 150 psig, since this is when RCIC is required to be OPERABLE. (Refer to LCO 3.5.3 for Applicability Bases for the RCIC System.)
The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
: 1. Reactor Vessel Water Level-Low Low, Level 2 Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the RCIC System is initiated at Level 2 to assist in maintaining water level above the top of the active fuel.
Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value is set high enough such that for complete loss of feedwater flow, the RCIC System flow (with high pressure (continued)
CLINTON                        B 3.3-125                     Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES APPLICABLE       1. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES, (continued)
LCO, and APPLICABILITY    core spray assumed to fail) will be sufficient to avoid initiation of low pressure ECCS at Level 1. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation.
Refer to LCO 3.5.3 for RCIC Applicability Bases.
: 2. Reactor Vessel Water Level-High, Level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal is used to close the RCIC steam supply, and cooling water supply valves to prevent overflow into the main steam lines (MSLs).
(The injection valve also closes due to the closure of the steam supply valve.)
Reactor Vessel Water Level-High, Level 8 signals for RCIC are initiated from two level transmitters from the narrow range water level measurement instrumentation, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
The Reactor Vessel Water Level-High, Level 8 Allowable Value is high enough to preclude isolating the injection valve of the RCIC during normal operation, yet low enough to trip the RCIC System prior to water overflowing into the MSLs. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
Two channels of Reactor Vessel Water Level-High, Level 8 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.
(continued)
CLINTON                        B 3.3-126                    Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES APPLICABLE       3. RCIC Storage Tank Level-Low SAFETY ANALYSES, LCO, and         Low level in the RCIC Storage Tank indicates the APPLICABILITY    unavailability of an adequate supply of makeup water from (continued)    this normal source. Normally the suction valve between the RCIC pump and the RCIC Storage Tank is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the RCIC Storage Tank. However, if the water level in the RCIC Storage Tank falls below a preselected level, first the suppression pool suction valve automatically opens and then the RCIC Storage Tank suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the RCIC pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the RCIC Storage Tank suction valve automatically closes.
Two level transmitters are used to detect low water level in the RCIC Storage Tank. The RCIC Storage Tank Level-Low Function Allowable Value is set high enough to ensure adequate pump suction head while water is being taken from the RCIC Storage Tank. The Allowable Value is referenced from an instrument zero of 739 ft 10-3/4 inches mean sea level.
Two channels of RCIC Storage Tank Level-Low Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source.
Refer to LCO 3.5.3 for RCIC Applicability Bases.
: 4. Suppression Pool Water Level-High Excessively high suppression pool water level could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the safety/relief valves. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of RCIC from the RCIC Storage Tank to the suppression pool to eliminate the possibility of RCIC continuing to provide additional water from a source outside primary containment. To prevent losing suction to (continued)
CLINTON                        B 3.3-127                    Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES (continued)
APPLICABLE        4. Suppression Pool Water Level-High   (continued)
SAFETY ANALYSES, LCO, and          the pump, the suction valves are interlocked so that the APPLICABILITY     suppression pool suction valve must be open before the RCIC Storage Tank suction valve automatically closes.
Suppression pool water level signals are initiated from two level transmitters. The Allowable Value for the Suppression Pool Water Level-High Function is set low enough to ensure that RCIC will be aligned to take suction from the suppression pool before the water level reaches the point at which suppression design loads would be exceeded. The Allowable Value is referenced from an instrument indicated zero of 732 ft 8 inches mean sea level.
Two channels of Suppression Pool Water Level-High Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source.
Refer to LCO 3.5.3 for RCIC Applicability Bases.
: 5. Manual Initiation The Manual Initiation push button switch introduces a signal into the RCIC System initiation logic that is redundant to the automatic protective instrumentation and provides manual initiation capability. There is one push button for the RCIC System.
The Manual Initiation Function is not assumed in any accident or transient analyses in the USAR. However, the Function is retained for the RCIC function as required by the NRC in the plant licensing basis.
There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push button. One channel of Manual Initiation is required to be OPERABLE when RCIC is required to be OPERABLE.
ACTIONS           A Note has been provided to modify the ACTIONS related to RCIC System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or (continued)
CLINTON                         B 3.3-128                     Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS        variables expressed in the Condition discovered to be (continued) inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RCIC System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RCIC System instrumentation channel.
A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.3-1 in the accompanying LCO. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.
B.1 and B.2 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the RCIC System. In this case, automatic initiation capability is lost if two Function 1 channels in the same trip system are inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour allowance of Required Action B.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour after discovery of loss of RCIC initiation capability.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action B.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically initiated due to two inoperable, untripped Reactor Vessel (continued)
CLINTON                      B 3.3-129                    Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS B.1 and B.2 (continued)
Water Level-Low Low, Level 2 channels in the same trip system. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
Because of the redundancy of sensors available to provide initiation signals, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.
Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition E must be entered and its Required Action taken.
C.1 A risk based analysis was performed and determined that an allowable out of service time of 24 hours (Ref. 1) is acceptable to permit restoration of any inoperable channel to OPERABLE status (Required Action C.1). A Required Action (similar to Required Action B.1), limiting the allowable out of service time if a loss of automatic RCIC initiation capability exists, is not required. This Condition applies to the Reactor Vessel Water Level-High, Level 8 Function, whose logic is arranged such that any inoperable channel will result in a loss of automatic RCIC initiation capability. As stated above, this loss of automatic RCIC initiation capability was analyzed and determined to be acceptable. This Condition also applies to the Manual Initiation Function. Since this Function is not assumed in any accident or transient analysis, a total loss of manual initiation capability (Required Action C.1) for 24 hours is (continued)
CLINTON               B 3.3-130                    Revision No. 21-7

RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS C.1  (continued) allowed. The Required Action does not allow placing a channel in trip since this action would not necessarily result in the safe state for the channel in all events.
D.1, D.2.1, and D.2.2 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple inoperable, untripped channels within the same Function result in automatic component initiation capability being lost for the feature(s). For Required Action D.1, the RCIC System is the only associated feature. In this case, automatic component initiation capability is lost if two Function 3 channels or two Function 4 channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour allowance of Required Actions D.2.1 and D.2.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour from discovery of loss of RCIC initiation capability. As noted, Required Action D.1 is only applicable if the RCIC pump suction is not aligned to the suppression pool since, if aligned, the Function is already performed.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action D.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
(continued)
CLINTON               B 3.3-131                    Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS       D.1, D.2.1, and D.2.2 (continued)
(continued)
Because of the redundancy of sensors available to provide initiation signals, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1, which performs the intended function of the channel (shifting the suction source to the suppression pool). Alternatively, Required Action D.2.2 allows the manual alignment of the RCIC suction to the suppression pool within 24 hours, which also performs the intended function. If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the RCIC System piping remains filled with water. If it is not desired to perform Required Actions D.2.1 and D.2.2, Condition E must be entered and its Required Action taken.
E.1 With any Required Action and associated Completion Time not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.
SURVEILLANCE  As noted in the beginning of the SRs, the SRs for each RCIC REQUIREMENTS  System instrumentation Function are found in the SRs column of Table 3.3.5.3-1.
The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed as follows:
(continued)
CLINTON                    B 3.3-131a                     Revision No. 21-7

RCIC System Instrumentation B 3.3.5.3 BASES SURVEILLANCE  (a) for up to 6 hours for Functions 2 and 5; and (b) for up REQUIREMENTS  to 6 hours for Functions 1, 3, and 4 provided the associated (continued) Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.
This Note is based on the reliability analysis (Ref. 1) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the RCIC will initiate when necessary.
SR  3.3.5.3.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with the channels required by the LCO.
SR  3.3.5.3.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. Any setpoint adjustment shall (continued)
CLINTON                     B 3.3-132                    Revision No. 21-6

RCIC System Instrumentation B 3.3.5.3 BASES SURVEILLANCE SR  3.3.5.3.2   (continued)
REQUIREMENTS be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.5.3.3 The calibration of analog trip modules provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.5.3-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be re-adjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.5.3.4 and SR   3.3.5.3.6 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter with the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.5.3.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.3 overlaps this Surveillance to provide complete testing of the safety function.
(continued)
CLINTON                    B 3.3-133                    Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES SURVEILLANCE SR  3.3.5.3.5  (continued)
REQUIREMENTS The Self Test System may be utilized to perform this testing for those components that it is designed to monitor.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES   1. NEDE-770-06-2, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.
CLINTON                    B 3.3-134                     Revision No. 21-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 B 3.3   INSTRUMENTATION B 3.3.6.1   Primary Containment and Drywell Isolation Instrumentation BASES BACKGROUND         The primary containment and drywell isolation instrumentation automatically initiates closure of appropriate primary containment isolation valves (PCIVs) and drywell isolation valves. The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA. The isolation of drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.
The isolation instrumentation includes the sensors, relays, timers, trip modules, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation. Most channels include electronic equipment (e.g., analog trip modules (ATMs)) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the ATM trips, which then outputs a primary containment isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logic are (a) reactor vessel water level, (b) ambient temperatures, (c) main steam line (MSL) flow measurement, (d) Standby Liquid Control (SLC) System initiation, (e) condenser vacuum loss, (f) main steam line pressure, (g) reactor core isolation cooling (RCIC) steam line flow, (h) ventilation exhaust radiation, (i) RCIC steam line pressure, (j) RCIC turbine exhaust diaphragm pressure, (k) reactor water cleanup (RWCU) differential flow, (l) reactor steam dome pressure, (m) drywell pressure, and (n) containment pressure.
Redundant sensor input signals are provided from each such isolation initiation parameter. The only exception is SLC System initiation. In addition, manual isolation of the logics is provided.
(continued)
CLINTON                          B 3.3-135                     Revision No. 2-8

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND        The primary containment and drywell isolation (continued)     instrumentation has inputs to the trip logic from the isolation Functions listed below.
: 1. Main Steam Line Isolation Most Main Steam Line Isolation Functions receive inputs from four channels. The four channels input to four separate two-out-of-four logic divisions. The outputs from these logic divisions are combined into two two-out-of-two logic trip systems to isolate all main steam isolation valves (MSIVs) and MSL drain valves. Each MSL drain line has two isolation valves with one two-out-of-two logic system associated with each valve.
The exception to this arrangement is the Main Steam Line Flow-High Function. This Function uses 16 flow channels, four for each steam line. The four flow channels associated with a steam line are combined in a two-out-of-four logic configuration. The outputs of the high steam flow logic for each of the steam lines are combined in the two two-out-of-two logic trip systems described above.
: 2. Primary Containment and Drywell Isolation Each Primary Containment Isolation and Drywell Function receives inputs from four channels. The outputs from these channels are arranged into two logic trip systems. One trip system initiates isolation of all inboard PCIVs and drywell isolation valves, while the other trip system initiates isolation of all outboard PCIVs and drywell isolation valves. Each trip system logic closes one of the two valves on each penetration so that operation of either trip system isolates the penetration. This logic configuration also provides automatic actuation capability for the Division 1 and 2 Shutdown Service Water (SX) subsystems.
: 3. Reactor Core Isolation Cooling System Isolation Most Functions receive input from two channels, with each channel in one trip system. Each of the two trip systems is connected to one of the two valves on each RCIC penetration so that operation of either trip system isolates the penetration. The exception to this arrangement is the RCIC Turbine Exhaust Diaphragm Pressure-High Function. The Reactor Vessel Water Level - Low Low, Level 2 RCIC initiation function receives inputs from four channels. The outputs from these channels are arranged into two logic trip systems. Each trip system logic closes one of the two valves on the RCIC penetration so that operation of either trip system isolates the penetration.
The RCIC Turbine Exhaust Diaphragm Pressure - High Function receives input from four turbine exhaust diaphragm (continued)
CLINTON                         B 3.3-136                      Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND        3. Reactor Core Isolation Cooling System Isolation (continued) pressure channels. The outputs from the turbine exhaust diaphragm pressure channels are connected into two two-out-of-two trip systems, each trip system isolating two RCIC valves. There is one manual isolation switch which can isolate only the outboard RCIC System containment isolation valves.
: 4. Reactor Water Cleanup System Isolation Most Functions receive input from two channels with each channel in one trip system using one-out-of-one logic.
Functions 4.c and 4.d (RWCU Heat Exchanger Room Temperature and RWCU Pump Room Temperature) have one channel in each trip system in each room for a total of four channels for Function 4.c and six channels for Function 4.d, but the logic is the same (one-out-of-one). Each of the two trip systems is connected to one of the two valves on each RWCU penetration so that operation of either trip system isolates the penetration. The exception to this arrangement is the Reactor Vessel Water Level-Low Low, Level 2 Function. This Function receives input from four reactor vessel water level channels. The outputs from the reactor vessel water level channels are connected into two two-out-of-two trip systems, each trip system isolating one of the two RWCU valves.
: 5. RHR System Isolation The RHR System Isolation Function receives input signals from instrumentation for the Reactor Vessel Water Level-Low Low Low, Level 1; Reactor Vessel Water Level - Low, Level 3; Drywell Pressure - High; Reactor Vessel Pressure - High; RHR Equipment Room Ambient Temperature - High; and Manual Initiation Functions. The Reactor Vessel Water Level-Low Low Low, Level 1; Reactor Vessel Water Level-Low, Level 3; Reactor Steam Dome Pressure-High; and Drywell Pressure-High Functions each have four channels. The outputs from the reactor vessel water level (level 1) and drywell pressure channels are connected in two one-out-of-two twice trip systems. The reactor vessel water level (level 3) is combined with the drywell pressure channels in two one-out-of-two twice trip systems and with the reactor vessel pressure channels in two one-out-of-two twice trip systems.
(continued)
CLINTON                          B 3.3-137                     Revision No. 2-8

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES BACKGROUND        5. RHR System Isolation  (continued)
The RHR Heat Exchanger Room Ambient Temperature Function receives input from four channels with each channel in one trip system in one room using one-out-of-one logic. Each of the two trip systems is connected to one of the two valves on each shutdown cooling penetration so that operation of either trip system isolates the penetration.
APPLICABLE        The isolation signals generated by the primary containment SAFETY ANALYSES   and drywell isolation instrumentation are implicitly assumed LCO, and          in the safety analyses of References 1 and 2 to initiate APPLICABILITY     closure of PCIVs to limit offsite doses. Refer to LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs),"
Applicable Safety Analyses Bases, for more detail. The isolation of drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell. Refer to LCO 3.6.5.3, "Drywell Isolation Valves," Applicable Safety Analyses Bases, for more detail.
Primary containment and drywell isolation instrumentation satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.
The OPERABILITY of the primary containment and drywell isolation instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.6.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
Each channel must also respond within its assumed response time, where appropriate.
Allowable Values are specified for each Primary Containment and Drywell Isolation Function specified in the Table.
Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less (continued)
CLINTON                         B 3.3-138                       Revision No. 0

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE       conservative than the nominal trip setpoint, but within its SAFETY ANALYSES, Allowable Value, is acceptable. Trip setpoints are those LCO, and         predetermined values of output at which an action should APPLICABILITY    take place. The setpoints are compared to the actual (continued)    process parameter(e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., ATM) changes state. The analytic limits are derived from the limiting values of the process parameters obtained the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
Certain Emergency Core Cooling Systems (ECCS) and RCIC valves (e.g., minimum flow) also serve the dual function of automatic PCIVs. The signals that isolate these valves are also associated with the automatic initiation of the ECCS and RCIC. Some instrumentation and ACTIONS associated with these signals are addressed in LCO 3.3.5.1, "ECCS Instrumentation," and LCO 3.3.5.3, "RCIC Instrumentation,"
and are not included in this LCO.
In general, the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, "Primary Containment," or LCO 3.6.5.1, "Drywell," as applicable. Functions that have different Applicabilities are discussed below in the individual Functions discussion.
The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
: 1. Main Steam Line Isolation 1.a. Reactor Vessel Water Level-Low Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should (continued)
CLINTON                         B 3.3-139                    Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        1.a. Reactor Vessel Water Level-Low Low Low, Level 1 SAFETY ANALYSES,  (continued)
LCO, and APPLICABILITY     RPV water level decrease too far, fuel damage could result.
Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level-Low Low Low, Level 1 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals. The Reactor Vessel Water Level-Low Low Low, Level 1 Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 1). The isolation of the MSL on Level 1 supports actions to ensure that offsite dose limits are not exceeded for a DBA.
Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Level 1 Allowable Value (LCO 3.3.5.1) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite doses from exceeding 10 CFR 100 limits. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
1.b. Main Steam Line Pressure-Low Low MSL pressure indicates that there may be a problem with the turbine pressure regulation, which could result in a low reactor vessel water level condition and the RPV cooling down more than 100&deg;F/hour if the pressure loss is allowed to continue. The Main Steam Line Pressure-Low Function is directly assumed in the analysis of the pressure regulator failure (Ref. 2). For this event, the closure of the MSIVs ensures that the RPV temperature change limit (100&deg;F/hour) is not reached. In addition, this Function supports actions to ensure that Safety Limit 2.1.1.1 is not exceeded. (This Function closes the MSIVs during the depressurization transient in order to maintain reactor steam dome pressure
                  > 700 psia. The MSIV closure results in a scram, thus reducing reactor power to < 21.6% RTP.)
(continued)
CLINTON                         B 3.3-140                    Revision No. 18-1

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        1.b. Main Steam Line Pressure-Low  (continued)
SAFETY ANALYSES, LCO, and          The MSL low pressure signals are initiated from four APPLICABILITY     transmitters that are connected to the MSL header. The transmitters are arranged such that, even though physically separated from each other, each transmitter is able to detect low MSL pressure. Four channels of Main Steam Line Pressure-Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Value was selected to be high enough to prevent excessive RPV depressurization.
The Main Steam Line Pressure-Low Function is only required to be OPERABLE in MODE 1 since this is when the assumed transient can occur (Ref. 2).
1.c. Main Steam Line Flow-High Main Steam Line Flow-High is provided to detect a break of the MSL and to initiate closure of the MSIVs. If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover. If the RPV water level decreases too far, fuel damage could occur. Therefore, the isolation is initiated on high flow to prevent or minimize core damage. The Main Steam Line Flow-High Function is directly assumed in the analysis of the main steam line break (MSLB) accident (Ref. 1). The isolation action, along with the scram function of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 and offsite doses do not exceed the 10 CFR 100 limits.
The MSL flow signals are initiated from 16 transmitters that are connected to the four MSLs. The transmitters are arranged such that, even though physically separated from each other, all four connected to one steam line would be able to detect the high flow. Four channels of Main Steam Line Flow-High Function for each unisolated MSL are available and are required to be OPERABLE so that no single instrument failure will preclude detecting a break in any individual MSL.
The Allowable Value is chosen to ensure that offsite dose limits are not exceeded due to the break.
(continued)
CLINTON                         B 3.3-141                       Revision No. 0

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        1.d. Condenser Vacuum-Low SAFETY ANALYSES, LCO, and          The Condenser Vacuum-Low Function is provided to prevent APPLICABILITY     overpressurization of the main condenser in the event of a (continued)     loss of the main condenser vacuum. Since the integrity of the condenser is an assumption in offsite dose calculations, the Condenser Vacuum-Low Function is assumed to be OPERABLE and capable of initiating closure of the MSIVs. The closure of the MSIVs is initiated to prevent the addition of steam that would lead to additional condenser pressurization and possible rupture of the diaphragm installed to protect the turbine exhaust hood, thereby preventing a potential radiation leakage path following an accident.
Condenser vacuum pressure signals are derived from four pressure transmitters that sense the pressure in the condenser. Four channels of Condenser Vacuum-Low Function are available and are required to be OPERABLE to ensure no single instrument failure can preclude the isolation function.
The Allowable Value is chosen to prevent damage to the condenser due to pressurization, thereby ensuring its integrity for offsite dose analysis. As noted (footnote (a) to Table 3.3.6.1-1), the channels are not required to be OPERABLE in MODES 2 and 3, when all turbine stop valves (TSVs) are closed, since the potential for condenser overpressurization is minimized. Switches are provided to manually bypass the channels when all TSVs are closed.
1.e, 1.f. Main Steam Tunnel Ambient Temperature-High and Main Steam Line Turbine Building Temperature-High Ambient Temperature-High is provided to detect a leak in the RCPB, and provides diversity to the high flow instrumentation. The isolation occurs when a very small leak has occurred. If the small leak is allowed to continue without isolation, offsite dose limits may be reached.
However, credit for these instruments is not taken in any transient or accident analysis in the USAR, since bounding analyses are performed for large breaks such as MSLBs.
Ambient temperature signals are initiated from thermocouples located in the area being monitored. Four channels of Main Steam Tunnel Temperature-High Function are available and are required to be OPERABLE to ensure that no single (continued)
CLINTON                          B 3.3-142                      Revision No. 0

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        1.e, 1.f. Main Steam Tunnel Ambient Temperature-High SAFETY ANALYSES,  and Main Steam Line Turbine Building Temperature-LCO, and          High (continued)
APPLICABILITY instrument failure can preclude the isolation function.
Each Function has one temperature element.
Twenty temperature modules (1E31-N559A, B, C, D; 1E31-N560A, B, C, D; 1E31-N561A, B, C, D; 1E31-N562A, B, C, D; and 1E31-N563A, B, C, D) and sensors are provided for monitoring the temperature of the main steam tunnel in the turbine building. Each channel consists of five temperature modules (those modules designated as "A" comprise one channel, those modules designated as "B" comprise a second channel, etc.)
and their associated sensors. The channel is considered OPERABLE only if all five temperature modules and associated sensors are OPERABLE.
The ambient temperature monitoring Allowable Value is chosen to detect a leak equivalent to 25 gpm.
1.g. Manual Initiation The Manual Initiation push button channels introduce signals into the MSL isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in the plant licensing basis.
There are four push buttons for the logic, one manual initiation push button per division. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
Four channels of Manual Initiation Function are available and are required to be OPERABLE.
(continued)
CLINTON                         B 3.3-143                     Revision No. 1-1

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        2. Primary Containment and Drywell Isolation SAFETY ANALYSES, LCO, and          2.a, and 2.e. Reactor Vessel Water Level-Low Low, APPLICABILITY     Level 2 (continued)
Low RPV water level indicates the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 2 supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded.
The Reactor Vessel Water Level-Low Low, Level 2 Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA. In addition, Function 2.a provides an isolation signal to certain drywell isolation valves. The isolation of drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.
In addition to providing automatic isolation capability for primary containment and drywell isolation valves, Function 2.a provides signals for automatic actuation of the Division 1 and 2 SX subsystems, including automatic start of the Division 1 and 2 SX pumps and automatic actuation of the associated subsystem isolation valves (as required to support automatic operation of the SX subsystems). The equipment involved with the SX subsystems is described in LCO 3.7.1, Division 1 and 2 SX Subsystems.
Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE to ensure no single instrument failure can preclude the isolation function.
The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level-Low Low, Level 2 Allowable Value (LCO 3.3.5.1),
(continued)
CLINTON                         B 3.3-144                      Revision No. 9-7

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE       2.a, and 2.e. Reactor Vessel Water Level-Low Low, SAFETY ANALYSES, Level 2 (continued)
LCO, and APPLICABILITY    since isolation of these valves is not critical to orderly (continued)    plant shutdown. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment. Thus, this Function is also required under those conditions in which a low reactor water level signal could be generated when secondary containment is required to be OPERABLE.
2.b, 2.d, 2.f. Drywell Pressure-High High drywell pressure can indicate a break in the RCPB. The isolation of some of the PCIVs on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded. The Drywell Pressure-High Function associated with isolation of the primary containment is implicitly assumed in the USAR accident analysis as these leakage paths are assumed to be isolated post LOCA. In addition, Functions 2.b and 2.d provide isolation signals to certain drywell isolation valves. The isolation of drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.
In addition to providing automatic isolation capability for primary containment and drywell isolation valves, Function 2.b provides signals for automatic actuation of the Division 1 and 2 SX subsystems, including automatic start of the Division 1 and 2 SX pumps and automatic actuation of the associated subsystem isolation valves (as required to support automatic operation of the SX subsystems). The equipment involved with the SX subsystems is described in LCO 3.7.1, Division 1 and 2 SX Subsystems.
(continued)
CLINTON                        B 3.3-145                    Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        2.b, 2.d, 2.f. Drywell Pressure-High  (continued)
SAFETY ANALYSES, LCO, and          High drywell pressure signals are initiated from pressure APPLICABILITY     transmitters that sense the pressure in the drywell. Four channels of Drywell Pressure-High per Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Value was selected to be the same as the ECCS Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.
2.g., 2.h and 2.i. Containment Building Fuel Transfer Pool Ventilation Plenum, Containment Building, and Containment Building Continuous Containment Purge (CCP) Exhaust Radiation-High High ventilation exhaust radiation is an indication of possible gross failure of the fuel cladding. The release may have originated from the primary containment due to a break in the RCPB. When Exhaust Radiation-High is detected, valves whose penetrations communicate with the primary containment atmosphere are isolated to limit the release of fission products. Additionally, the Exhaust Radiation-High is assumed to initiate isolation of the primary containment penetrations which bypass secondary containment during a fuel handling accident (Ref. 2). In addition, these Functions provide an isolation signal to certain drywell isolation valves. The isolation of drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.
The Exhaust Radiation-High signals are initiated from radiation detectors that are located on the ventilation exhaust piping coming from the drywell and containment. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel.
Four channels of Containment and Drywell Ventilation Exhaust-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
(continued)
CLINTON                         B 3.3-146                     Revision No. 4-8

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE       2.g., 2.h and 2.i. Containment Building Fuel Transfer Pool SAFETY ANALYSES, Ventilation Plenum, Containment Building, and Containment LCO,and          Building Continuous Containment Purge (CCP) Exhaust APPLICABILITY    Radiation-High (continued)
The Allowable Values are chosen to promptly detect gross failure of the fuel cladding and to ensure offsite doses remain below 10 CFR 20 and 10 CFR 100 limits.
These Functions are required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) in the primary or secondary containment because the capability of detecting radiation releases due to fuel failures due to dropped fuel assemblies must be provided to ensure offsite dose limits are not exceeded.
2.j. Reactor Vessel Water Level-Low Low Low, Level 1 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the primary containment occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level-Low Low Low, Level 1 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals.
The Reactor Vessel Water Level-Low Low Low, Level 1 Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA. In addition, this Function provides an isolation signal to certain drywell isolation valves. The isolation of drywell isolation (continued)
CLINTON                       B 3.3-146a                    Revision No. 20-2

This page intentionally left blank.
CLINTON           B 3.3-146b                Revision No. 4-8

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE       2.j. Reactor Vessel Water Level-Low Low Low, Level 1 SAFETY ANALYSES,   (continued)
LCO, and APPLICABILITY    valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.
Reactor vessel water level signals are initiated from level transmitters that sense the difference between the pressure LCO, and due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value (LCO 3.3.5.1) to ensure the valves are isolated to prevent offsite doses from exceeding 10 CFR 100 limits. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment. Thus, this Function is also required under those conditions in which a low reactor water level signal could be generated when secondary containment is required to be OPERABLE.
2.k. Containment Pressure-High The Containment Pressure-High Function is provided for monitoring containment differential pressure and providing a permissive to open the containment ventilation supply and exhaust isolation bypass valves when the Standby Gas Treatment (SGT) System is used as a backup to the Drywell Purge System in the post LOCA containment purge mode. If these valves are open and the setpoint is exceeded, the opening permissive would no longer be satisfied and, in this case, the high pressure trip signal acts as an isolation signal to close these valves. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC.
(continued)
CLINTON                        B 3.3-147                    Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE       2.k. Containment Pressure-High  (continued)
SAFETY ANALYSES, LCO, and         The Allowable Value was chosen to prevent opening of the APPLICABILITY    containment ventilation supply and exhaust isolation bypass valves when excessive differential pressure could result in damage to the associated ductwork.
Two channels of the Containment Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
2.l. Manual Initiation The Manual Initiation push button channels introduce signals into the primary containment and drywell isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability.
There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in the plant licensing basis.
There are two push buttons for the logic, one manual initiation push button per trip system (i.e., 1B21H-S25A and 1B21H-S25B). There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
Two channels of the Manual Initiation Function are available and are required to be OPERABLE. This Function is also required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) in primary or secondary containment. This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment.
Thus, this Function is also required under those conditions in which secondary containment is required to be OPERABLE.
: 3. Reactor Core Isolation Cooling System Isolation 3.a. Auxiliary Building RCIC Steam Line Flow-High Auxiliary Building RCIC Steam Line Flow-High Function is provided to detect a break of the RCIC steam lines and initiates closure of the steam line isolation valves. If the steam is allowed to continue flowing out of the break, (continued)
CLINTON                         B 3.3-148                    Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        3.a. Auxiliary Building RCIC Steam Line Flow-High SAFETY ANALYSES,  continued)
LCO, and APPLICABILITY     the reactor will depressurize and core uncovery can occur.
Therefore, the isolation is initiated on high flow to prevent or minimize core damage. The isolation action, along with the scram function of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
Specific credit for this Function is not assumed in any USAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks.
However, these instruments prevent the RCIC steam line break from becoming bounding.
The Auxiliary Building RCIC Steam Line Flow-High signals are initiated from two transmitters that are connected to the system steam lines in the Auxiliary Building. Two channels of Auxiliary Building RCIC Steam Line Flow-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Value is chosen to be low enough to ensure that the trip occurs to prevent fuel damage and maintains the MSLB event as the bounding event.
3.b. RCIC Steam Line Flow-High Time Delay The RCIC Steam Line Flow-High Time Delay is provided to prevent false isolations on RCIC Steam Line Flow-High during system startup transients and therefore improves system reliability. This Function is not assumed in any USAR transient or accident analyses.
The Allowable Value was chosen to be long enough to prevent false isolations due to system starts but not so long as to impact offsite dose calculations.
Two channels for RCIC Steam Line Flow-High Time Delay Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
3.c. RCIC Steam Supply Line Pressure-Low Low RCIC steam supply line pressure indicates that the pressure of the steam may be too low to continue operation of the RCIC turbine. This isolation is for equipment (continued)
CLINTON                         B 3.3-149                     Revision No. 5-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        3.c. RCIC Steam Supply Line Pressure-Low  (continued)
SAFETY ANALYSES, LCO, and          protection and is not assumed in any transient or accident APPLICABILITY     analysis in the USAR. However, it also provides a diverse signal to indicate a possible system break. These instruments are included in the Technical Specifications (TS) because of the potential for risk due to possible failure of the instruments preventing RCIC initiations.
The RCIC Steam Supply Line Pressure-Low signals are initiated from two transmitters that are connected to the system steam line. Isolation of the RCIC vacuum breaker isolation valves requires RCIC Steam Supply Line Pressure-Low coincident with Drywell Pressure-High signals. Two channels of RCIC Steam Supply Line Pressure-Low Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Value is selected to be high enough to prevent damage to the system turbine.
3.d. RCIC Turbine Exhaust Diaphragm Pressure-High High turbine exhaust diaphragm pressure indicates that the pressure may be too high to continue operation of the associated system turbine. That is, one of two exhaust diaphragms has ruptured and pressure is reaching turbine casing pressure limits. This isolation is for equipment protection and is not assumed in any transient or accident analysis in the USAR. These instruments are included in the TS because of the potential for risk due to possible failure of the instruments preventing RCIC initiations (Ref. 3).
The RCIC Turbine Exhaust Diaphragm Pressure-High signals are initiated from four transmitters that are connected to the area between the rupture diaphragms on each system's turbine exhaust line. Four channels of RCIC Turbine Exhaust Diaphragm Pressure-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Values are low enough to prevent damage to the system turbine.
(continued)
CLINTON                         B 3.3-150                      Revision No. 2-4

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        3.e. Ambient Temperature-High SAFETY ANALYSES, LCO, and          Ambient Temperatures are provided to detect a leak from APPLICABILITY     the associated system steam piping. The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. These Functions are not assumed in any USAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.
Ambient Temperature-High signals are initiated from thermocouples that are appropriately located to protect the system that is being monitored. Two instruments monitor each area. Two channels for RCIC Ambient Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Values are set low enough to detect a leak equivalent to 25 gpm.
3.f. Main Steam Line Tunnel Ambient Temperature-High Ambient Temperature-High is provided to detect a leak in the RCPB and provides diversity to the high flow instrumentation. The isolation occurs when a very small leak has occurred. If the small leak is allowed to continue without isolation, offsite limits may be reached. However, credit for these instruments is not taken in any transient or accident analysis in the USAR, since bounding analyses are performed for large breaks such as MSLBs.
Ambient temperature signals are initiated from thermocouples located in the area being monitored. Two channels of Main Steam Tunnel Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
Each Function has one temperature element.
The Allowable Values are chosen to detect a leak equivalent to 25 gpm.
(continued)
CLINTON                         B 3.3-151                     Revision No. 2-4

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        3.g. Main Steam Line Tunnel Temperature Timer SAFETY ANALYSES, LCO, and          The Main Steam Line Tunnel Temperature Timer is provided to APPLICABILITY     allow all the other systems that may be leaking in the main (continued)     steam tunnel (as indicated by the high temperature) to be isolated before RCIC is automatically isolated. This ensures maximum RCIC System operation by preventing isolations due to leaks in other systems. This Function is not assumed in any USAR transient or accident analysis; however, maximizing RCIC availability is an important function.
Two channels for RCIC Main Steam Line Tunnel Timer Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Values are based on maximizing the availability of the RCIC System; that is, providing sufficient time to isolate all other potential leakage sources in the main steam tunnel before RCIC is isolated.
3.h. Reactor Vessel Water Level - Low Low, Level 2 Low RPV water level indicates the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 2 supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded.
The Reactor Vessel Water Level - Low Low, Level 2 Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA. The Function isolates the following RCIC valves:
1E51F031 (RCIC suppression pool suction valve) and 1E51F064 (RCIC steam supply outboard isolation valve).
The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low, Level 2 Allowable Value (LCO 3.3.5.1), since isolation of these valves is not critical to orderly plant shutdown.
3.i. Drywell RCIC Steam Line Flow-High Drywell RCIC high steam line flow is provided to detect a break of the common steam line of RCIC and RHR and initiates closure of the isolation valves for both systems. If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover.
Therefore, the isolation is initiated at high flow to prevent or minimize core damage. Specific credit for this Function is not assumed in any USAR accident or transient analysis since the bounding analysis is performed for large breaks such as recirculation and MSL breaks.
(continued)
CLINTON                         B 3.3-152                      Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        3.i. Drywell RCIC Steam Line Flow-High (continued)
SAFETY ANALYSES, LCO, and          However, these instruments prevent the Drywell RCIC steam APPLICABILITY     line break from becoming bounding.
(continued)
The Drywell RCIC steam line flow signals are initiated from two transmitters that are connected to the steam line in the drywell. Two channels are available and required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Value is selected to ensure that the trip occurs to prevent fuel damage and maintains the MSLB as the boundary event.
(continued)
CLINTON                        B 3.3-152a                     Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 This Page Intentionally Blank CLINTON            B 3.3-152b                    Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        3.j. Drywell Pressure-High SAFETY ANALYSES, LCO, and          High drywell pressure can indicate a break in the RCPB. The APPLICABILITY     RCIC isolation of the turbine exhaust is provided to prevent (continued)     communication with the drywell when high drywell pressure exists. A potential leakage path exists via the turbine exhaust. The isolation is delayed until the system becomes unavailable for injection (i.e., low steam line pressure).
The isolation of the RCIC turbine exhaust by Drywell Pressure-High is indirectly assumed in the USAR accident analysis because the turbine exhaust leakage path is not assumed to contribute to offsite doses.
High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell.
Isolation of the RCIC vacuum breaker isolation valves requires RCIC Steam Supply Line Pressure-Low coincident with Drywell Pressure-High signals. Two channels of RCIC Drywell Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Value was selected to be the same as the ECCS Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since this is indicative of a LOCA inside primary containment.
3.k. Manual Initiation The Manual Initiation push button channel introduces a signal into the RCIC System isolation logic that is redundant to the automatic protective instrumentation and provide manual isolation capability if an initiation signal is present. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in the plant licensing basis.
There is only one push button for RCIC, in a single trip system. There is no Allowable Value for this Function since the channel are mechanically actuated based solely on the position of the push button.
One channel of RCIC Manual Initiation is required to be OPERABLE.
(continued)
CLINTON                         B 3.3-153                      Revision No. 7-6

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        4. Reactor Water Cleanup System Isolation SAFETY ANALYSES, LCO, and          4.a. Differential Flow-High APPLICABILITY (continued)     The high differential flow signal is provided to detect a break in the RWCU System. This will detect leaks in the RWCU System when area or differential temperature would not provide detection (i.e., a cold leg break). Should the reactor coolant continue to flow out of the break, offsite dose limits may be exceeded. Therefore, isolation of the RWCU System is initiated when high differential flow is sensed to prevent exceeding offsite doses. A time delay is provided to prevent spurious trips during most RWCU operational transients. This Function is assumed to mitigate breaks in the RWCU piping inside containment to preclude subcompartment overpressurization which could lead to containment failure (Ref. 1). This Function is not assumed in any USAR transient or accident analysis for pipe breaks outside containment, since bounding analyses are performed for large breaks such as MSLBs.
The high differential flow signals are initiated from two transmitters that are connected to the inlet (from the reactor vessel) and four transmitters from the outlets (to condenser and feedwater) of the RWCU System. The outputs of the transmitters are compared (in two different summers) and the outputs are sent to two high flow trip units. If the difference between the inlet and outlet flow is too large, each trip unit generates an isolation signal. Two channels of Differential Flow-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Reactor Water Cleanup Differential Flow-High Allowable Value ensures that the break of the RWCU piping is detected.
4.b. Differential Flow-Timer The Differential Flow-Timer is provided to avoid RWCU System isolations due to operational transients (such as pump starts and mode changes). During these transients the inlet and return flows become unbalanced for short time periods and Differential Flow-High will be sensed without an RWCU System break being present. This function is assumed to mitigate breaks in the RWCU piping inside containment to preclude subcompartment overpressurization which could lead to containment failure (Ref. 1). Credit for this Function is not assumed in the USAR accident or transient analysis for pipe breaks outside containment, since bounding analyses are performed for large breaks such as MSLBs.
(continued)
CLINTON                          B 3.3-154                    Revision No. 19-1

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        4.b. Differential Flow-Timer   (continued)
SAFETY ANALYSES, LCO, and          The Differential Flow Timer Allowable Value is selected to APPLICABILITY     ensure that the MSLB outside containment remains the limiting break for USAR analysis for offsite dose calculations.
Two channels for Differential Flow-Timer Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
4.c, 4.d. Ambient Temperature-High Ambient Temperature-High is provided to detect a leak from the RWCU System. The isolation occurs even when very small leaks have occurred and is diverse to the high differential flow instrumentation for the hot portions of the RWCU System. If the small leak continues without isolation, offsite dose limits may be reached. Credit for these instruments is not taken in any transient or accident analysis in the USAR, since bounding analyses are performed for large breaks such as MSLBs.
Ambient temperature signals are initiated from temperature elements that are located in the room that is being monitored (three pump rooms and two heat exchanger rooms).
There are ten thermocouples that provide input to the Area Temperature-High Functions (two per area). Ten channels are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Ambient Temperature-High Allowable Values are set low enough to detect a leak equivalent to 25 gpm.
4.e. Main Steam Line Tunnel Ambient Temperature-High Ambient Temperature-High is provided to detect a leak in the RCPB and provides diversity to the high flow instrumentation. The isolation occurs when a very small leak has occurred. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. However, credit for these instruments is not taken in any transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.
Ambient temperature signals are initiated from thermocouples located in the area being monitored. Two channels of Main (continued)
CLINTON                         B 3.3-155                       Revision No. 0

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        4.e. Main Steam Line Tunnel Ambient Temperature-High SAFETY ANALYSES,    (continued)
LCO, and APPLICABILITY     Steam Tunnel Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
Each Function has one temperature element.
The Allowable Values are chosen to detect a leak equivalent to 25 gpm.
4.f. Reactor Vessel Water Level-Low Low, Level 2 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some reactor vessel interfaces occurs to isolate the potential sources of a break. The isolation of the RWCU System on Level 2 supports actions to ensure that fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The Reactor Vessel Water Level-Low Low, Level 2 Function associated with RWCU isolation is not directly assumed in any transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.
Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level-Low Low, Level 2 Allowable Value (LCO 3.3.5.1),
since the capability to cool the fuel may be threatened.
The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary (continued)
CLINTON                         B 3.3-156                    Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        4.f. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES,  (continued)
LCO, and APPLICABILITY     containment. Thus, this Function is also required under those conditions in which a low reactor water level signal could be generated when secondary containment is required to be OPERABLE.
4.g. SLC System Initiation The isolation of the RWCU System is required when the SLC System has been initiated to prevent dilution and removal of the boron solution by the RWCU System (Ref. 4). SLC System initiation signals are initiated from the two SLC pump start signals.
There is no Allowable Value associated with this Function since the channels are mechanically actuated based solely on the position of the SLC System initiation switch.
Two channels (one from each pump) of SLC System Initiation Function are available and are required to be OPERABLE in MODES 1 and 2, since these are the only MODES where the reactor can be critical. Both channels are also required to be OPERABLE in MODES 1, 2, and 3, since the SLC System is also used to maintain suppression pool pH at or above 7 following a LOCA to ensure that iodine will be retained in the suppression pool water. These MODES are consistent with the Applicability for the SLC System (LCO 3.1.7).
4.h. Manual Initiation The Manual Initiation push button channels introduce signals into the RWCU System isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in plant licensing basis.
There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function, since the channels are mechanically actuated based solely on the position of the push buttons.
Two channels of the Manual Initiation Function are available and are required to be OPERABLE. This Function is also required to be OPERABLE during movement of recently (continued)
CLINTON                         B 3.3-157                    Revision No. 10-5

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE       4.h. Manual Initiation (continued)
SAFETY ANALYSES, LCO, and         irradiated fuel assemblies (i.e., fuel that has occupied APPLICABILITY    part of a critical reactor core within the previous 24 hours) in primary or secondary containment. This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment.
Thus, this Function is also required under those conditions in which secondary containment is required to be operable.
: 5. RHR System Isolation 5.a. Ambient Temperature-High Ambient Temperature-High is provided to detect a leak from the associated system steam piping. The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. This Function is not assumed in any USAR transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.
Ambient Temperature-High signals are initiated from thermocouples that are appropriately located to protect the system that is being monitored. Two instruments monitor each area. Four channels for RHR Ambient Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Values are set low enough to detect a leak equivalent to 25 gpm.
The RHR Equipment Room Ambient Temperature-High Function is only required to be OPERABLE in MODES 1, 2, and 3. In MODES 4 and 5, insufficient pressure and temperature are available to develop a significant steam leak in this piping and significant water leakage is protected by the Reactor Vessel Water Level-Low, Level 3 Function.
5.b, 5.c. Reactor Vessel Water Level-Low, Level 3 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some reactor or vessel interfaces occurs to begin isolating the (continued)
CLINTON                         B 3.3-158                    Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE       5.b, 5.c. Reactor Vessel Water Level-Low, Level 3 SAFETY ANALYSES,   (continued)
LCO, and APPLICABILITY    potential sources of a break. The Reactor Vessel Water Level-Low, Level 3 Function associated with RHR System isolation is not directly assumed in any transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs. The RHR System isolation on Level 3 supports actions to ensure that the RPV water level does not drop below the top of the active fuel during a vessel draindown event through the 1E12-F008 and 1E12-F009 valves caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR System. The Reactor Vessel Water level-Low, Level 3 channels required to be OPERABLE by Function 5.c are only those channels which are combined with the Reactor Vessel Pressure-High Function to provide isolation of the RHR Shutdown Cooling System suction from the reactor vessel (i.e., 1E12-F008 and 1E12-F009).
Reactor Vessel Water Level-Low, Level 3 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels (two channels per trip system) of the Reactor Vessel Water Level-Low, Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Reactor Vessel Water Level-Low, Level 3 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level-Low, Level 3 Allowable Value (LCO 3.3.1.1) since the capability to cool the fuel may be threatened. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
(continued)
CLINTON                        B 3.3-159                    Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        5.b, 5.c. Reactor Vessel Water Level-Low, Level 3 SAFETY ANALYSES     (continued)
LCO, and APPLICABILITY     The Reactor Vessel Water Level-Low, Level 3 Function is required to be OPERABLE in MODE 3 with the reactor vessel pressure less than the RHR cut in permissive pressure to prevent this potential flow path from lowering reactor vessel level to the top of the fuel. This instrumentation is required to be OPERABLE in MODES 1, 2, and 3 with reactor vessel pressure greater than the RHR cut-in permissive pressure to support actions to ensure offsite dose limits of 10 CFR 100 are not exceeded.
5.d. Reactor Vessel Water Level - Low Low Low, Level 1 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the primary containment occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level - Low Low Low, Level 1 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals. The Reactor Vessel Water Level - Low Low Low, Level 1 Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA.
Reactor vessel water level signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level - Low Low Low, Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low Low, Level 1 Allowable Value (LCO 3.3.5.1) to ensure the valves are isolated to prevent offsite doses from exceeding 10 CFR 100 limits. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
(continued)
CLINTON                         B 3.3-160                    Revision No. 20-9

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        5.e. Reactor Vessel Pressure - High SAFETY ANALYSES, LCO, and          The Shutdown Cooling System Reactor Vessel Pressure-High APPLICABILITY     Function is provided to isolate the shutdown cooling portion (continued)     of the RHR System. This interlock (RHR cut in permissive) is provided only for equipment protection to prevent an intersystem LOCA scenario and credit for the interlock is not assumed in the accident or transient analysis in the USAR.
The Reactor Vessel Pressure-High signals are initiated from four transmitters. Four channels of Reactor Vessel Pressure - High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Allowable Value was chosen to be low enough to protect the system equipment from overpressurization. Additionally, determination of the Allowable Value includes conservatisms to ensure closure of the RHR Shutdown Cooling System suction isolation valves (1E12-F008 and 1E12-F009) consistent with the requirements of NRC Generic Letter 89-10.
5.f. Drywell Pressure - High High drywell pressure can indicate a break in the RCPB. The isolation of some of the PCIVs on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded. The Drywell Pressure-High Function associated with isolation of the RHR System is not modeled in any USAR accident or transient analysis because other leakage paths (e.g., MSIVs) are more limiting.
High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Four channels of Drywell Pressure-High Function are available and are required to be OPERABLE for isolation of the RHR test return lines to ensure that no single instrument failure can preclude the isolation function. In addition, four channels of Drywell Pressure-High Function are available and are required to be OPERABLE for isolation of the Fuel Pool Cooling Assist mode to ensure that no single instrument failure can preclude the isolation function.
The Allowable Value was selected to be the same as the ECCS Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.
(continued)
CLINTON                         B 3.3-161                      Revision No. 2-4

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE        5.g. Manual Initiation SAFETY ANALYSES, LCO, and          The Manual Initiation push button channels introduce signals APPLICABILITY     into the RHR System isolation logic that are redundant to (continued)     the automatic protective instrumentation and provide manual isolation capability. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in the plant licensing basis.
There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
Two channels of the Manual Initiation Function are available and are required to be OPERABLE.
ACTIONS           A Note has been provided to modify the ACTIONS related to primary containment and drywell isolation instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.
Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable primary containment and drywell isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable primary containment and drywell isolation instrumentation channel.
A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 48 hours has been shown to be acceptable (Ref. 6) to permit restoration of any MSL Function inoperable channel to OPERABLE status.
This out of service time is only acceptable provided the associated Function's inoperable channel is the only (continued)
CLINTON                          B 3.3-162                       Revision No. 0

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS A.1   (continued) inoperable channel and the Function still maintains isolation capability (refer to Required Action B.1 and C.1 Bases). Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate two failures, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an undesired isolation), Condition F must be entered and its Required Action taken.
B.1 Condition B exists when, for any one or more MSL isolation Functions, two required channels are inoperable. (For example, a failure of a coincidence logic card (i.e., a two-out-of-four logic card) in one division may affect two channels). In this condition, the MSL isolation system still maintains isolation capability for that Function, but cannot accommodate an additional single failure in that Function.
Required Action B.1 limits the time the MSL isolation logic for any Function would not accommodate a single failure.
Within the 6 hour allowance, the associated Function will have at least one inoperable channel in trip. Completing this Required Action restores the MSL isolation system to an equivalent reliability level as that evaluated in Reference 6, which justified a 48 hour allowable out of service time.
The 6 hour Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of MSL isolation. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. Placing one of the two inoperable channels in trip satisfies both Required Actions A.1 and B.1 for that Function. If one channel is already in trip for the Function when a second channel is determined to be inoperable, Required Action B.1 is met by the one channel already in trip for that Function and no additional action is required.
Alternately, if it is not desired to place one inoperable channel in trip (e.g., as in the case where placing the (continued)
CLINTON                B 3.3-163                    Revision No. 21-7

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS B.1   (continued) inoperable channel in trip would result in an undesired isolation, scram, or RPT), Condition F must be entered and its Required Action taken.
C.1 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels for the same Function result in the Function not being able to accommodate a single failure and maintain MSL isolation capability. A Function is considered to be maintaining MSL isolation capability when sufficient channels are OPERABLE or in trip such that the Function will generate a trip signal on a valid signal. For a Function with two-out-of-four logic, this would require the Function to have three channels OPERABLE or in trip.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
D.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 24 hours has been shown to be acceptable (Refs. 5 and 6) to permit restoration of any inoperable channel to OPERABLE status for any Function other than MSL isolation. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action E.1 Bases). Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.1. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation), Condition F must be entered and its Required Action taken.
(continued)
CLINTON                B 3.3-164                    Revision No. 21-7

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS           D.1   (continued)
(continued)
The provisions of Required Action D.1 also apply to the automatic actuation functions provided by Functions 2.a and 2.b (Reactor Vessel Water Level - Low Low, Level 2 and Drywell Pressure - High) for the Division 1 and 2 SX subsystems. Because the same instrumentation is used for these functions as is used for the Function 2.a and 2.b isolation functions, as well as the same combinational logic, Required Action D.1 (and E.1) imposes appropriate limitations with regard to the tripping of inoperable channels and allowed instrument channel outage times for the SX subsystem automatic actuation functions.
E.1 Required Action E.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function (other than the MSL isolation Functions) result in redundant automatic isolation capability being lost for the associated penetration flow path(s) (and in the case of Functions 2.a and 2.b, in redundant automatic actuation capability being lost for the Division 1 or 2 SX subsystems). Automatic isolation capability for the MSL isolation Functions is assured by Required Actions A.1, B.1, and C.1. The other isolation Functions not associated with isolation of the MSLs are considered to be maintaining isolation capability when sufficient channels are OPERABLE or in trip such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two automatic isolation valves in the associated penetration flow path can receive an isolation signal from the given Function. For Functions 2.a, 2.b, 2.c, 2.d, 2.e, 2.f, 2.g, 2.h, 2.i, 2.j, 3.d, 4.f, 5.b, 5.c, 5.d, 5.e, and 5.f, this would require one trip system to have two channels, each OPERABLE or in trip. For Functions 2.k, 3.a, 3.b, 3.c, 3.e, 3.f, 3.g, 3.i, 3.j, 4.a, 4.b, and 4.g, this would require one trip system to have one channel OPERABLE or in trip.
For Functions 3.h, 4.c, 4.d, 4.e, and 5.a, each Function consists of channels that monitor several different locations. Therefore, this would require one channel per location to be OPERABLE or in trip (the channels are not required to be in the same trip system). The Condition does not include the Manual Initiation Functions (Functions 1.g, 2.l, 3.k, 4.h, and 5.g), since they are not assumed in any accident or transient analysis. Thus, a total loss of (continued)
CLINTON                          B 3.3-165                     Revision No. 4-8

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS           E.1   (continued) manual initiation capability for 24 hours (as allowed by Required Action D.1) is allowed.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
F.1 For all applicable automatic isolation functions, Required Action F.1 directs entry into the appropriate Condition referenced in Table 3.3.6.1-1 when instrument channel inoperability for a given Function(s) results in entry into Condition F. The applicable Condition specified in Table 3.3.6.1-1 is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A, B, C, D, or E and the associated Completion has expired, Condition F will be entered for that channel and provide for transfer to the appropriate subsequent Condition. For Functions 2.a and 2.b, compliance Required Action F.1 also necessitates declaring the associated SX subsystem(s) inoperable (i.e., Divisions 1 or 2, or both), resulting in entry into the Required Action(s) under LCO 3.7.1.
G.1, G.2.1, and G.2.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours and in MODE 4 within 36 hours (Required Actions G.2.1 and G.2.2). Alternately, the associated MSLs may be isolated (Required Action G.1),
and if allowed (i.e., plant safety analysis allows operation with an MSL isolated), plant operation with the MSL isolated may continue. Isolating the affected MSL accomplishes the safety function of the inoperable channel. The Completion (continued)
CLINTON                          B 3.3-166                     Revision No. 4-8

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS           G.1, G.2.1, and G.2.2   (continued)
Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
H.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 2 within 6 hours.
The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.
I.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operation may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels.
(continued)
CLINTON                         B 3.3-166a                     Revision No. 4-8

This page intentionally left blank.
CLINTON           B 3.3-166b                Revision No. 4-8

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS           I.1   (continued)
For some of the Ambient Temperature Functions, the affected penetration flow path(s) may be considered isolated by isolating only that portion of the system in the associated room monitored by the inoperable channel. That is, if the RWCU pump room A ambient channel is inoperable, the A pump room area can be isolated while allowing continued RWCU operation utilizing the B RWCU pump.
Alternatively, if it is not desired to isolate the affected penetration flow path(s) (e.g., as in the case where isolating the penetration flow path(s) could result in a reactor scram), Condition K must be entered and its Required Actions taken.
The Completion Time is acceptable because it minimizes risk while allowing sufficient time for plant operations personnel to isolate the affected penetration flow path(s).
J.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels.
The 24 hour Completion Time is acceptable due to the fact that these Functions (Manual Initiation) are not assumed in any accident or transient analysis in the USAR.
Alternately, if it is not desired to isolate the affected penetration flow path(s) (e.g., as in the case where isolating the penetration flow path(s) could result in a reactor scram), Condition K must be entered and its Required Actions taken.
(continued)
CLINTON                          B 3.3-167                       Revision No. 0

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS           K.1 and K.2 (continued)
If the channel is not restored to OPERABLE status or placed in trip, or any Required Action of Condition I or J is not met and the associated Completion Time has expired, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
L.1 and L.2 If the channel is not restored to OPERABLE status within the allowed Completion Time, the associated SLC subsystem(s) is declared inoperable or the RWCU System is isolated. Since this Function is required to ensure that the SLC System performs its intended function, sufficient remedial measures are provided by declaring the associated SLC subsystem inoperable or isolating the RWCU System.
The Completion Time of 1 hour is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System. RWCU isolation is achieved by closing 1G33F001 or 1G33F004, which are the containment isolation valves associated with this isolation function.
M.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path should be isolated (i.e., closing either 1E12-F008 or 1E12-F009). However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status. Actions must continue until the channel is restored to OPERABLE status.
(continued)
CLINTON                         B 3.3-168                     Revision No. 21-9

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS       N.1, N.2.1, and N.2.2 (continued)
If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path(s) should be isolated (Required Action N.1). Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable instrumentation. Alternately, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) must be immediately suspended.
Suspension of these activities shall not preclude completion of movement of a component to a safe condition.
(continued)
CLINTON                     B 3.3-169                    Revision No. 21-9

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES (continued)
SURVEILLANCE      As noted at the beginning of the SRs, the SRs for each REQUIREMENTS      Primary Containment and Drywell Isolation Instrumentation Function are found in the SRs column of Table 3.3.6.1-1.
The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours provided the associated Function maintains isolation capability. Isolation capability may be maintained by ensuring that a sufficient number or arrangement of channels is maintained OPERABLE to effect the trip function, or by maintaining the affected primary containment and drywell isolation valves closed during performance of the surveillance. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.
This Note is based on the reliability analysis (Refs. 5 and
: 6) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the isolation valves will isolate the penetration flow path(s) when necessary.
SR  3.3.6.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-170                    Revision No. 14-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE      SR   3.3.6.1.1  (continued)
REQUIREMENTS The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
SR   3.3.6.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. For series Functions, a separate CHANNEL FUNCTIONAL TEST is not required for each Function, provided each Function is tested. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests.
Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR   3.3.6.1.3 The calibration of analog trip modules consists of a test to provide a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.6.1.4, SR   3.3.6.1.5, and SR 3.3.6.1.8 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel (continued)
CLINTON                          B 3.3-171                   Revision No. 21-4

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE      SR  3.3.6.1.4, SR  3.3.6.1.5, and SR  3.3.6.1.8   (continued)
REQUIREMENTS responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.6.1.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing performed on PCIVs in LCO 3.6.1.3 and on drywell isolation valves in LCO 3.6.5.3 overlaps this Surveillance to provide complete testing of the assumed safety function. (Likewise, system functional testing performed pursuant to LCO 3.7.1 overlaps this Surveillance to provide complete testing for verifying automatic actuation capability for the Division 1 and 2 SX subsystems.) The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
The Self Test System may be utilized to perform this testing for those components that it is designed to monitor.
SR  3.3.6.1.7 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. Testing is performed only on channels where the assumed response time does not correspond to the diesel generator (DG) start time. For channels assumed to respond within the DG start time, sufficient margin exists in the 12 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test. The instrument response times must be added to the MSIV closure times to obtain the ISOLATION SYSTEM RESPONSE TIME.
ISOLATION SYSTEM RESPONSE TIME acceptance criteria are included in applicable plant procedures.
(continued)
CLINTON                         B 3.3-172                     Revision No. 14-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE      SR  3.3.6.1.7 (continued)
REQUIREMENTS As noted, the associated sensors are not required to be response time tested. Response time testing for the remaining channel components, including the ATMs, is required. This is supported by Reference 7.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to ISOLATION SYSTEM RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).
REFERENCES        1. USAR, Section 6.2.
: 2. USAR, Chapter 15.
: 3. NEDO-31466, "Technical Specification Screening Criteria Application and Risk Assessment," November 1987.
: 4. USAR, Section 9.3.5.
: 5. NEDC-31677-P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"
June 1989.
: 6. NEDC-30581-P-A, Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation," March 1989.
: 7. NEDO-32291-A, "System Analyses for Elimination of Selected Response Time Testing Requirements," January 1994.
: 8. Calculation IP-0-0028.
CLINTON                         B 3.3-173                     Revision No. 14-2

Secondary Containment Isolation Instrumentation B 3.3.6.2 B 3.3   INSTRUMENTATION B 3.3.6.2   Secondary Containment Isolation Instrumentation BASES BACKGROUND         The secondary containment isolation instrumentation automatically initiates closure of appropriate secondary containment isolation dampers (SCIDs) and starts the Standby Gas Treatment (SGT) System. The function of these systems, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Ref. 1), such that offsite radiation exposures are maintained within the requirements of 10 CFR 100 that are part of the NRC staff approved licensing basis. Secondary containment isolation and establishment of vacuum with the SGT System within the assumed time limits ensures that fission products that leak from primary containment following a DBA, or are released outside primary containment or during certain operations when primary containment is not required to be OPERABLE are maintained within applicable limits.
The isolation instrumentation includes the sensors, monitors, channels, transmitters, relays, and switches that are necessary to cause initiation of secondary containment isolation. Most channels include electronic equipment (e.g., analog trip modules (ATMs) or radiation monitors) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the ATM trips, which then inputs an isolation signal to the solid state isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logic are (a) reactor vessel water level, (b) drywell pressure, (c) containment building fuel transfer pool ventilation plenum radiation, (d) containment building exhaust duct radiation, (e) containment continuous containment purge (CCP) exhaust duct radiation, and (f) fuel building exhaust duct radiation. Redundant sensor input signals from each parameter are provided for initiation of isolation parameters. In addition, manual initiation of the logic is provided.
For all Secondary Containment Isolation instrumentation Functions, two channels in a trip system are required to trip the associated trip system. In addition to the isolation function, the SGT subsystems are initiated. There (continued)
CLINTON                          B 3.3-174                       Revision No. 0

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES BACKGROUND        are two SGT subsystems with one subsystem being initiated by (continued)     each trip system. Typically, automatically isolated secondary containment penetrations are isolated by two isolation dampers. One trip system initiates isolation of each damper so that operation of either trip system isolates the penetrations.
APPLICABLE        The isolation signals generated by the secondary containment SAFETY ANALYSES,  isolation instrumentation are implicitly assumed in the LCO, and          safety analyses of References 1 and 2 to initiate closure of APPLICABILITY     valves and start the SGT System to limit offsite doses.
Refer to LCO 3.6.4.2, "Secondary Containment Isolation Dampers (SCIDs)," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System," Applicable Safety Analyses Bases for more detail of the safety analyses.
The secondary containment isolation instrumentation satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.
The OPERABILITY of the secondary containment isolation instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions. Each Function must have the required number of OPERABLE channels with their setpoints set within the specified Allowable Values, as shown in Table 3.3.6.2-1. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
Allowable Values are specified for each Function specified in the Table. Nominal trip setpoints are specified in setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Values between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.
Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated (continued)
CLINTON                         B 3.3-175                        Revision No. 0

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE        device (e.g., ATM or radiation monitor) changes state. The SAFETY ANALYSES,  analytic limits are derived from the limiting values of the LCO, and          process parameters obtained from the safety analysis. The APPLICABILITY     Allowable Values are derived from the analytic limits, (continued)     corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g.,
drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions when SCIDs and the SGT System are required.
The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
: 1. Reactor Vessel Water Level-Low Low, Level 2 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result.
An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The Reactor Vessel Water Level-Low Low, Level 2 Function is one of the Functions assumed to be OPERABLE and capable of providing isolation and initiation signals. The isolation and initiation of systems on Reactor Vessel Water Level-Low Low, Level 2 support actions to ensure that any offsite releases are within the limits calculated in the safety analysis.
Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water (continued)
CLINTON                         B 3.3-176                       Revision No. 0

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE       1. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES,    (continued)
LCO, and APPLICABILITY    level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the High Pressure Core Spray (HPCS)/Reactor Core Isolation Cooling (RCIC) Reactor Vessel Water Level-Low Low, Level 2 Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling System (ECCS)
Instrumentation," and LCO 3.3.5.3, "Reactor Core Isolation Cooling (RCIC) System Instrumentation"), since this could indicate the capability to cool the fuel is being threatened. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
The Reactor Vessel Water Level-Low Low, Level 2 Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the Reactor Coolant System (RCS); thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, this Function is not required.
: 2. Drywell Pressure-High High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The isolation of high drywell pressure supports actions to ensure that any offsite releases are within the limits calculated in the safety analysis.
However, the Drywell Pressure-High Function associated with isolation is not assumed in any USAR accident or transient analysis. It is retained for the secondary containment (continued)
CLINTON                         B 3.3-177                    Revision No. 20-2

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE        2. Drywell Pressure-High   (continued)
SAFETY ANALYSES, LCO, and          isolation instrumentation as required by the NRC approved APPLICABILITY     licensing basis.
High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Four channels of Drywell Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Value was chosen to be the same as the ECCS Drywell Pressure-High Function Allowable Value (LCO 3.3.5.1) since this is indicative of a loss of coolant accident.
The Drywell Pressure-High Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the RCS; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. This Function is not required in MODES 4 and 5 because the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES.
3, 4, 5, 6. Containment Building Fuel Transfer Pool Ventilation Plenum, Containment Building, Containment Building Continuous Containment Purge (CCP), and Fuel Building Exhaust Radiation-High High primary or secondary containment exhaust radiation is an indication of possible gross failure of the fuel cladding. The release may have originated from the primary containment due to a break in the RCPB, the fuel building, or the refueling floor due to a fuel handling accident.
When Exhaust Radiation-High is detected, secondary containment isolation and actuation of the SGT System are initiated to limit the release of fission products as assumed in the USAR safety analyses (Ref. 1).
The Exhaust Radiation-High signals are initiated from radiation detectors that are located on the ventilation exhaust piping coming from the containment building fuel transfer pool, containment building, containment building CCP, and fuel building, respectively. The signal from each (continued)
CLINTON                         B 3.3-178                        Revision No. 0

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE       3, 4, 5, 6. Containment Building Fuel Transfer Pool SAFETY ANALYSES, Ventilation Plenum, Containment Building, Containment LCO, and         Building Continuous Containment Purge (CCP), and Fuel APPLICABILITY    Building Exhaust Radiation-High (continued) detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Four channels of each of these Exhaust Radiation-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.
The Allowable Values are chosen to promptly detect gross failure of the fuel cladding.
The Exhaust Radiation-High High Functions are required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, these Functions are not required. In addition, the Functions are required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) in the primary containment or fuel building, as applicable, because the capability of detecting radiation releases due to fuel failures due to dropped fuel assemblies must be provided to ensure that offsite dose limits are not exceeded.
: 7. Manual Initiation The Manual Initiation push button channels introduce signals into the secondary containment isolation logic that are redundant to the automatic protective instrumentation channels, and provide manual isolation capability. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the secondary containment isolation instrumentation as required by the NRC approved licensing basis.
There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
(continued)
CLINTON                         B 3.3-179                    Revision No. 20-2

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE       7. Manual Initiation   (continued)
SAFETY ANALYSES, LCO, and         Two channels of the Manual Initiation Function are APPLICABILITY    available and are required to be OPERABLE in MODES 1, 2, and 3 and during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) in the primary containment or Fuel Building, since these are the MODES and other specified conditions in which the Secondary Containment Isolation automatic Functions are required to be OPERABLE.
ACTIONS          A Note has been provided to modify the ACTIONS related to secondary containment isolation instrumentation channels.
Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.
Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable secondary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable secondary containment isolation instrumentation channel.
A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 24 hours has been shown to be acceptable (Refs. 3 and 4) to permit restoration of any inoperable channel to OPERABLE status.
This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1.
Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the (continued)
CLINTON                        B 3.3-180                    Revision No. 20-2

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES ACTIONS           A.1  (continued) channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation),
Condition C must be entered and its Required Actions taken.
B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic isolation capability for the associated penetration flow path(s) or a complete loss of automatic initiation capability for the SGT System. A Function is considered to be maintaining secondary containment isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two SCIDs in the associated penetration flow path and one SGT subsystem can be initiated on an isolation signal from the given Function. The Condition does not include the Manual Initiation Function (Function 7), since it is not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 24 hours (as allowed by Required Action A.1) is allowed.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
C.1.1, C.1.2, C.2.1, and C.2.2 If any Required Action and associated Completion Time of Condition A or B are not met, the ability to isolate the secondary containment and start the SGT System cannot be ensured. Therefore, further actions must be performed to ensure the ability to maintain the secondary containment function. Isolating the associated penetration flow path(s) and starting the associated SGT subsystem (Required Actions C.1.1 and C.2.1) performs the intended function of the instrumentation and allows operations to continue.
(continued)
CLINTON                         B 3.3-181                       Revision No. 0

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES ACTIONS           C.1.1, C.1.2, C.2.1, and C.2.2   (continued)
Alternatively, declaring the associated SCID(s) or SGT subsystem inoperable (Required Actions C.1.2 and C.2.2) is also acceptable since the Required Actions of the respective LCOs (LCO 3.6.4.2 and LCO 3.6.4.3) provide appropriate actions for the inoperable components.
One hour is sufficient for plant operations personnel to establish required plant conditions or to declare the associated components inoperable without challenging plant systems.
SURVEILLANCE      As noted at the beginning of the SRs, the SRs for each REQUIREMENTS      Secondary Containment Isolation instrumentation Function are located in the SRs column of Table 3.3.6.2-1.
The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains secondary containment isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Action(s) taken. This Note is based on the reliability analysis (Refs. 3 and 4) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the SCIDs will isolate the associated penetration flow paths and the SGT System will initiate when necessary.
SR  3.3.6.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the indicated parameter for one instrument channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of (continued)
CLINTON                          B 3.3-182                     Revision No. 14-2

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE      SR  3.3.6.2.1   (continued)
REQUIREMENTS excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
SR  3.3.6.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.6.2.3 Calibration of analog trip modules provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.2-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                          B 3.3-183                    Revision No. 21-4

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE      SR  3.3.6.2.4 and SR   3.3.6.2.6 REQUIREMENTS (continued)     CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.6.2.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing, performed on SCIDs and the SGT System in LCO 3.6.4.2 and LCO 3.6.4.3, respectively, overlaps this Surveillance to provide complete testing of the assumed safety function.
The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                          B 3.3-184                    Revision No. 14-2

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES   (continued)
REFERENCES        1. USAR, Section 6.2.3.
: 2. USAR, Chapter 15.
: 3. NEDO-31677-P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"
July 1990.
: 4. NEDC-30851-P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentations Common to RPS and ECCS Instrumentation," March 1989.
: 5. USAR, Section 7.3.1.1.2.
: 6. USAR, Section 7.1.2.1.11.
: 7. USAR, Section 7.3.1.1.9.2.
: 8. USAR, Section 7.6.1.2.
CLINTON                          B 3.3-185                    Revision No. 14-2

RHR Containment Spray System Instrumentation B 3.3.6.3 B 3.3   INSTRUMENTATION B 3.3.6.3   Residual Heat Removal (RHR) Containment Spray System Instrumentation BASES BACKGROUND         The RHR Containment Spray System is an operating mode of the RHR System that is initiated to condense steam in the containment atmosphere. This ensures that containment pressure is maintained within its limits following a loss of coolant accident (LOCA). The RHR Containment Spray System can be initiated either automatically or manually.
The RHR Containment Spray System is automatically initiated by Reactor Vessel Water Level-Low Low Low, Level 1, Drywell Pressure-High, and Containment Pressure-High signals.
Most channels include electronic equipment (e.g., analog trip modules (ATMs)) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the ATM actuates, which then outputs a signal to the solid state trip logic. The channels provide inputs to two trip systems; one trip system initiates one containment spray subsystem while the second trip system initiates the other containment spray subsystem (Ref. 1). For a trip system to initiate the associated subsystem, it must receive one signal from each of the following inputs: Drywell Pressure-High, Containment Pressure-High, and a System Timer. The Drywell Pressure-High and Containment Pressure-High Functions each have two channels, which are arranged in a one-out-of-two logic to provide the necessary signal. The System Timer is initiated by a one-out-of-two taken twice logic consisting of two channels each of the Reactor Vessel Water Level-Low Low Low, Level 1 and Drywell Pressure-High Functions. When the System Timer has timed out, the trip system receives the System Timer signal.
Manual initiation of the system is accomplished with the use of manual initiation push buttons. The system can be manually initiated using the manual initiation push buttons only if a Drywell Pressure-High signal is present. There is no time delay when using the manual initiation push buttons.
(continued)
CLINTON                          B 3.3-186                        Revision No. 0

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES (continued)
APPLICABLE        Operation of the RHR Containment Spray System may be SAFETY ANALYSES,  required to maintain containment pressure within design LCO, and          limits after a LOCA. Safety analyses in Reference 2 APPLICABILITY     implicitly assume that sufficient instrumentation and controls, described below, are available to initiate the RHR Containment Spray System.
The RHR Containment Spray System instrumentation satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.
The OPERABILITY of the RHR Containment Spray System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.6.3-1. Each Function must have the required number of OPERABLE channels with their setpoints within the specified Allowable Values. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
Allowable Values are specified for each Function in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.
Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., ATM) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments, as defined by 10 CFR 50.49) are accounted for.
(continued)
CLINTON                         B 3.3-187                        Revision No. 0

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES APPLICABLE        These uncertainties are described in the setpoint SAFETY ANALYSES,  methodology.
LCO, and APPLICABILITY     The RHR Containment Spray System instrumentation is required (continued)     to be OPERABLE in MODES 1, 2, and 3, when considerable energy exists in the Reactor Coolant System and a Design Basis Accident (DBA) could cause pressurization of the primary containment. In MODES 4 and 5, the reactor is shut down, and any LOCA would not cause pressurization of the drywell or containment.
The specific Applicable Safety Analyses and LCO discussions are listed below on a Function by Function basis.
: 1. Drywell Pressure-High High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB). The RHR Containment Spray System mitigates the consequences of steam leaking from the drywell directly into containment airspace, bypassing the suppression pool.
Four Drywell Pressure-High transmitters (two per trip system) are available and are required to be OPERABLE and capable of automatically initiating the RHR Containment Spray System. This ensures that no single instrument failure can preclude the RHR containment spray function.
The Drywell Pressure-High Allowable Value is chosen to be the same as the Emergency Core Cooling Systems (ECCS)
Drywell Pressure-High Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling Systems (ECCS) Instrumentation")
since this could be indicative of a LOCA.
: 2. Containment Pressure-High High pressure in the containment could indicate a break in the RCPB. The RHR Containment Spray System mitigates the consequences of steam leaking from the drywell directly into the containment airspace, bypassing the suppression pool.
Four Containment Pressure-High transmitters are available, but only two Containment Pressure-High transmitters (one per trip system) are required to be OPERABLE and capable of automatically initiating the RHR Containment Spray System.
(continued)
CLINTON                         B 3.3-188                        Revision No. 0

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES APPLICABLE        2. Containment Pressure-High  (continued)
SAFETY ANALYSES, LCO, and          This ensures that no single instrument failure can preclude APPLICABILITY     the RHR containment spray function.
The Containment Pressure-High Allowable Value is chosen to ensure the primary containment design pressure is not exceeded.
: 3. Reactor Vessel Water Level-Low Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that a break of the RCPB may have occurred and the capability to maintain the primary containment pressure within design limits may be threatened. The RHR Containment Spray System mitigates the consequences of the steam leaking from the drywell directly into the containment airspace, bypassing the suppression pool.
Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 (two per trip system) are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the RHR containment spray function.
The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value (LCO 3.3.5.1) since this could be indicative of a LOCA. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
4, 5. System A and System B Timers The purpose of the System A and System B timers is to delay automatic initiation of the RHR Containment Spray System for approximately 600 seconds after low pressure coolant injection (LPCI) initiation to give the LPCI System time to fulfill its ECCS function in response to a LOCA. The time delay is needed since the RHR Containment Spray System utilizes the same pumps as the LPCI subsystem (RHR pumps).
(continued)
CLINTON                         B 3.3-189                    Revision No. 10-7

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES APPLICABLE        4, 5. System A and System B Timers   (continued)
SAFETY ANALYSES, LCO, and          There are two Function 4 timers, one for each subsystem, APPLICABILITY     designated System A Timer and System B Timer. Since each subsystem of the RHR Containment Spray System has a timer, a single failure of a timer will cause the failure of only one RHR containment spray subsystem. The other subsystem will still be available to perform the RHR containment spray cooling function. The Allowable Value for the time delay is chosen to be long enough to allow the LPCI System to fulfill its function, but short enough to prevent containment pressure from exceeding the design limit.
In addition to the two Function 4 timers discussed above, subsystem B has an additional timer (Function 5) of approximately 90 seconds. This timer is included to prevent both containment spray subsystems from actuating at the same time. The Allowable Value for this time delay is chosen to be long enough for the operator to take action if containment spray subsystem A has already actuated to prevent subsystem B from also actuating, but short enough to prevent containment pressure from exceeding the design limit if subsystem A does not actuate.
: 6. Manual Initiation The Manual Initiation Function introduces signals into the RHR containment spray logic and is redundant to all automatic protective instrumentation except Drywell Pressure-High. There is no specific USAR analysis that takes credit for this Function. It is retained for the initiation Function as required by the NRC approved licensing basis. Each trip system has a manual push button, for a total of two push buttons, both of which are required to be OPERABLE.
There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
ACTIONS           A Note has been provided to modify the ACTIONS related to RHR Containment Spray System instrumentation channels.
Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the (continued)
CLINTON                         B 3.3-190                        Revision No. 0

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES ACTIONS           Condition discovered to be inoperable or not within limits (continued)     will not result in separate entry into the Condition.
Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RHR Containment Spray System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR Containment Spray System instrumentation channel.
A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.6.3-1. The applicable Condition specified in the table is Function dependent.
Each time a channel is discovered inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.
B.1 and B.2 Required Action B.1 is intended to ensure appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the RHR Containment Spray System. Automatic initiation capability is lost if one Function 1 channel in both trip systems is inoperable and untripped, or one Function 3 channel in both trip systems is inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour allowance of Required Action B.2 is not appropriate and both RHR Containment Spray subsystems, made inoperable by RHR Containment Spray System instrumentation, must be declared inoperable within 1 hour after discovery of loss of RHR Containment Spray System initiation capability for both trip systems.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action B.1, the Completion Time only begins upon discovery that the RHR Containment Spray System cannot (continued)
CLINTON                         B 3.3-191                        Revision No. 0

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES ACTIONS B.1 and B.2  (continued) be automatically initiated due to inoperable, untripped channels within the same Function, as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
Because of the redundancy of sensors available to provide initiation signals, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition, per Required Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore the capability to accommodate a single failure, and allow operation to continue.
Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition D must be entered and its Required Action taken.
C.1 and C.2 Required Action C.1 is intended to ensure appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in automatic initiation capability being lost for the RHR Containment Spray System. Automatic initiation capability is lost if two Function 4 channels are inoperable. In this situation (loss of automatic initiation capability), the 24 hour allowance of Required Action C.2 is not appropriate and both of the associated RHR containment spray subsystems must be declared inoperable within 1 hour after discovery of loss of RHR Containment Spray System initiation capability for both trip systems. As noted, Required Action C.1 is only applicable for Functions 2 and 4. The Required Action is not applicable to Function 5 or 6 (which also requires entry into this Condition if a channel in one of these Functions is inoperable). Function 5 does not have a corresponding channel in both subsystems. Function 6 is the Manual Initiation Function and is not assumed in any USAR accident (continued)
CLINTON               B 3.3-192                    Revision No. 21-7

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES ACTIONS      C.1 and C.2  (continued) or transient analysis. Thus, a total loss of manual initiation capability for 24 hours (as allowed by Required Action C.2) is allowed.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action C.1, the Completion Time only begins upon discovery that the RHR Containment Spray System cannot be automatically initiated due to two inoperable channels within the same Function. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.
Because of the redundancy of sensors available to provide initiation signals, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition D must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action could either cause the initiation or it would not necessarily result in a safe state for the channel in all events.
D.1 With any Required Action and associated Completion Time not met, the associated RHR containment spray subsystem may be incapable of performing the intended function and the RHR containment spray subsystem associated with inoperable untripped channels must be declared inoperable immediately.
SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RHR REQUIREMENTS Containment Spray System Function are located in the SRs column of Table 3.3.6.3-1.
The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into (continued)
CLINTON                    B 3.3-193                    Revision No. 21-7

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES SURVEILLANCE  associated Conditions and Required Actions may be delayed REQUIREMENTS  for up to 6 hours, provided the associated Function (continued) maintains RHR containment spray initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the RHR containment spray will initiate when necessary.
SR  3.3.6.3.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
(continued)
CLINTON                     B 3.3-194                    Revision No. 14-2

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES SURVEILLANCE      SR  3.3.6.3.2 REQUIREMENTS (continued)     A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure the entire channel will perform the intended function. For Series Functions, a separate CHANNEL FUNCTIONAL TEST is not required for each Function, provided each Function is tested. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests.
Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.6.3.3 The calibration of analog trip modules provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.3-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.6.3.4 and SR  3.3.6.3.6 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-195                    Revision No. 21-4

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES SURVEILLANCE      SR  3.3.6.3.5 REQUIREMENTS (continued)     The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.6.1.7, "Residual Heat Removal (RHR) Containment Spray," overlaps this Surveillance to provide complete testing of the assumed safety function.
The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. USAR, Section 7.3.1.1.4.
: 2. USAR, Section 6.2.1.1.5.
: 3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications,"
February 1991.
CLINTON                         B 3.3-196                     Revision No. 14-2

SPMU System Instrumentation B 3.3.6.4 B 3.3   INSTRUMENTATION B 3.3.6.4   Suppression Pool Makeup (SPMU) System Instrumentation BASES BACKGROUND         The SPMU System provides water from the upper containment pool to the suppression pool, by gravity flow, after a loss of coolant accident (LOCA) to ensure that primary containment temperature and pressure design limits are met.
The SPMU System is automatically initiated by signals generated by Reactor Vessel Water LevelLow Low Low, Level 1; Drywell PressureHigh; and Suppression Pool Water LevelLow Low channels. The channels include electronic equipment (e.g., analog trip modules (ATMs)) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the ATM trips, which then inputs a signal to the solid state trip logic. The channels provide inputs to two trip systems; one trip system initiates one SPMU subsystem while the second trip system initiates the other SPMU subsystem (Ref. 1). Two separate initiation logics are provided for each trip system.
One initiation logic for a trip system will initiate the associated subsystem if a LOCA signal coincident with a Suppression Pool Water LevelLow Low signal is received.
The LOCA signal is received from the associated division of low pressure Emergency Core Cooling Systems (ECCS) initiation signal (i.e., two channels of Reactor Vessel Water LevelLow Low Low, Level 1 and two channels of Drywell PressureHigh are arranged in a one-out-of-two taken twice logic). Two channels of Suppression Pool Water LevelLow Low are arranged in a one-out-of-two logic, which generates the Suppression Pool Water LevelLow Low signal.
The associated low pressure ECCS division's Manual Initiation push button (one per division) also supplies a signal, which manually performs the same function as the automatic LOCA signal (i.e., ECCS Manual Initiation coincident with a Suppression Pool Water LevelLow Low will initiate the trip system).
The second initiation logic for a trip system will initiate after a time delay of approximately 30 minutes. The LOCA or the associated low pressure ECCS division's manual initiation signal starts the timer, and once the timer times out, the trip system initiates the associated SPMU subsystem. Each SPMU dump valve (two in series in each dump (continued)
CLINTON                          B 3.3-197                        Revision No. 0

SPMU System Instrumentation B 3.3.6.4 BASES BACKGROUND        line) can be manually opened from the main control room to (continued)     manually initiate an associated SPMU subsystem. Mode switch permissive switches are provided for the SPMU to disable the system during refueling operations; however, their function is not required for SPMU OPERABILITY (provided the SPMU is not inhibited when required to be OPERABLE).
APPLICABLE        The SPMU System is relied upon to dump upper containment SAFETY ANALYSES,  pool water to the suppression pool to maintain drywell LCO, and          horizontal vent coverage and an adequate suppression pool APPLICABILITY     heat sink volume to ensure that the primary containment internal pressure and temperature stay within design limits (Ref. 2).
The SPMU System instrumentation satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described in the individual Functions discussion.
The OPERABILITY of the SPMU System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.6.4-1. Each Function must have the required number of OPERABLE channels with their setpoints within the specified Allowable Value, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
Allowable Values are specified for each Function in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure the setpoints do not exceed the Allowable Values between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal setpoint, but within the Allowable Value, is acceptable.
Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., ATM) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are (continued)
CLINTON                         B 3.3-198                        Revision No. 0

SPMU System Instrumentation B 3.3.6.4 BASES APPLICABLE        derived from the analytic limits, corrected for calibration, SAFETY ANALYSES,  process, and some of the instrument errors. The trip LCO, and          setpoints are then determined accounting for the remaining APPLICABILITY     instrument errors (e.g., drift). The trip setpoints derived (continued)     in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
The SPMU System instrumentation is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the Reactor Coolant System and a DBA could cause pressurization and heatup of the primary containment. In MODES 4 and 5, the reactor is shut down; therefore, any LOCA would not cause pressurization of the drywell, and the SPMU System would not be needed to maintain suppression pool water level. Furthermore, in MODES 4 and 5, the SPMU System is not required since there is insufficient energy to heat up the suppression pool in the event of a LOCA.
The specific Applicable Safety Analyses and LCO discussions are listed below on a Function by Function basis.
: 1. Drywell PressureHigh High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB). The Drywell PressureHigh is one of the Functions required to be OPERABLE and capable of initiating the SPMU System during the postulated accident. This protection is required to ensure primary containment temperature and pressure design limits are not exceeded during a LOCA. Accident analysis assumes that the suppression pool vents remain covered during a LOCA. Therefore, this signal is used to dump water from the upper containment pool into the suppression pool as assumed in the large break LOCA analysis.
High drywell pressure signals are initiated from pressure transmitters that sense the pressure at four different locations in the drywell. Four channels of Drywell PressureHigh Function (two channels per trip system) are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the SPMU System function.
(continued)
CLINTON                         B 3.3-199                       Revision No. 0

SPMU System Instrumentation B 3.3.6.4 BASES APPLICABLE        1. Drywell PressureHigh  (continued)
SAFETY ANALYSES, LCO, and          The Allowable Value is chosen to be the same as the ECCS APPLICABILITY     Drywell PressureHigh Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling Systems (ECCS) Instrumentation"),
since this could be indicative of a LOCA.
: 2. Reactor Vessel Water LevelLow Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that a LOCA may have occurred and the capability to maintain the primary containment temperature and pressure and suppression pool level design limits may be threatened. Accident analysis assumes that the suppression pool vents remain covered during a LOCA. Therefore, this signal is used to dump water from the upper containment pool into the suppression pool as assumed in the large break LOCA analysis.
Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of reactor vessel water level (two channels per trip system) are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the SPMU System function. The Reactor Vessel Water LevelLow Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Reactor Vessel Water LevelLow Low Low, Level 1 Allowable Value (LCO 3.3.5.1),
since this could be indicative of a LOCA. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.
: 3. Suppression Pool Water LevelLow Low The Suppression Pool Water LevelLow Low signal provides assurance that the water level in the suppression pool will not drop below that required to keep the suppression pool vents covered for all LOCA break sizes. Accident analyses assume that the suppression pool vents remain covered during a LOCA. Therefore, the signal indicating low suppression pool water level is used to dump water from the upper containment pool into the suppression pool as assumed in the large break LOCA analysis.
___________________________________________________________________(continued)
CLINTON                         B 3.3-200                     Revision No. 1-1

SPMU System Instrumentation B 3.3.6.4 BASES APPLICABLE        3. Suppression Pool Water LevelLow Low  (continued)
SAFETY ANALYSES LCO, and          Suppression pool water level signals are from four APPLICABILITY     transmitters that sense pool level at four different locations (two per trip system). Four Suppression Pool Water LevelLow Low channels (two per trip system) are required to be OPERABLE to ensure that no single instrument failure can preclude the SPMU System function.
The Allowable Value is set high enough to ensure coverage of the suppression pool vents. The Allowable Value is referenced from an instrument zero of 727 ft. 0 inches mean sea level.
: 4. Timer The SPMU System valves open on a Drywell PressureHigh and/or Reactor Vessel Water LevelLow Low Low, Level 1 signal after about a 30 minute timer delay, where the timer itself is started by these signals. The minimum suppression pool volume, without an upper pool dump, is adequate to meet all heat sink requirements for 30 minutes during a small break LOCA.
There are two SPMU System timers (one per trip system). Two timers are available and are required to be OPERABLE to ensure that no single timer failure can preclude the SPMU System function. The Allowable Value is chosen to be short enough to ensure that the suppression pool will serve as an adequate heat sink during a small break LOCA.
: 5. Manual Initiation The SPMU System Manual Initiation hand switch channels produce signals to provide manual initiation capabilities that are redundant to the automatic protective instrumentation. The Manual Initiation Function is not assumed in any transient or accident analysis in the USAR.
However, the Function is retained for the SPMU System as required by the NRC in the approved licensing basis.
Four manual initiation hand switches (one per SPMU dump valve) are available and required to be OPERABLE. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the hand switches.
(continued)
CLINTON                         B 3.3-201                     Revision No. 3-4

SPMU System Instrumentation B 3.3.6.4 BASES (continued)
ACTIONS           A Note has been provided to modify the ACTIONS related to SPMU System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable SPMU System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable SPMU System instrumentation channel.
A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.6.4-1. The applicable Condition specified in the Table is Function dependent.
Each time a channel is discovered inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.
B.1 and B.2 Required Action B.1 is intended to ensure appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the SPMU System. In this case, automatic initiation capability is lost if (a) one Function 1 channel in both trip systems is inoperable and untripped, (b) one Function 2 channel in both trip systems is inoperable and untripped, or (c) one Function 3 channel in both trip systems is inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour allowance of Required Action B.2 is (continued)
CLINTON                         B 3.3-202                      Revision No. 3-4

SPMU System Instrumentation B 3.3.6.4 BASES ACTIONS B.1 and B.2  (continued) not appropriate and both SPMU subsystems must be declared inoperable within 1 hour after discovery of loss of SPMU initiation capability for both trip systems.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action B.1, the Completion Time only begins upon discovery that the SPMU System cannot be automatically initiated due to inoperable, untripped channels within the same Function as described in the paragraph above. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
Because of the redundancy of sensors available to provide initiation signals, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.
Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition D must be entered and its Required Action taken.
C.1 and C.2 Required Action C.1 is intended to ensure appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the SPMU System. In this case, automatic initiation capability is lost if two Function 4 channels are inoperable. In this situation (loss of automatic initiation capability), the 24 hour allowance of Required Action C.2 is not appropriate and the SPMU System must be declared inoperable within 1 hour after discovery of loss of SPMU initiation capability for both (continued)
CLINTON               B 3.3-203                    Revision No. 21-7

SPMU System Instrumentation B 3.3.6.4 BASES ACTIONS C.1 and C.2  (continued) trip systems. As noted, Required Action C.1 is only applicable for Function 4. Required Action C.1 is not applicable to Function 5 (which also requires entry into this Condition if a channel in this Function is inoperable),
since it is the Manual Initiation Function and is not assumed in any USAR accident or transient analysis. Thus, a total loss of manual initiation capability for 24 hours (as allowed by Required Action C.2) is allowed.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
For Required Action C.1, the Completion Time only begins upon discovery that the SPMU System cannot be automatically initiated due to two inoperable channels within the same Function. The 1 hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.
Because of the redundancy of sensors available to provide initiation signals, an allowable out of service time of 24 hours has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition D must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action could either cause the initiation or it would not necessarily result in a safe state for the channel in all events.
D.1 With any Required Action and associated Completion Time not met, the associated SPMU subsystem may be incapable of performing the intended function and the SPMU subsystem associated with inoperable, untripped channels must be declared inoperable immediately.
(continued)
CLINTON               B 3.3-204                    Revision No. 21-7

SPMU System Instrumentation B 3.3.6.4 BASES (continued)
SURVEILLANCE      As noted at the beginning of the SRs, the SRs for each SPMU REQUIREMENTS      System Function are located in the SRs column of Table 3.3.6.4-1.
The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains suppression pool makeup initiation capability.
Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the SPMU will initiate when necessary.
SR  3.3.6.4.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.
Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of the LCO.
(continued)
CLINTON                         B 3.3-205                     Revision No. 14-2

SPMU System Instrumentation B 3.3.6.4 BASES SURVEILLANCE      SR  3.3.6.4.2 REQUIREMENTS (continued)     A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure the entire channel will perform the intended function. For Series Functions, a separate CHANNEL FUNCTIONAL TEST is not required for each Function, provided each Function is tested. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests.
Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.6.4.3 and SR  3.3.6.4.4 The calibration of analog trip modules and analog comparator units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.4-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.6.4.5, SR  3.3.6.4.6, and SR  3.3.6.4.8 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-206                    Revision No. 21-4

SPMU System Instrumentation B 3.3.6.4 BASES SURVEILLANCE      SR  3.3.6.4.7 REQUIREMENTS (continued)     The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.6.2.4, "Suppression Pool Makeup (SPMU) System,"
overlaps this Surveillance to provide complete testing of the assumed safety function.
The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. USAR, Section 7.3.1.1.10
: 2. USAR, Section 6.2.7.
: 3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications,"
February 1991.
CLINTON                         B 3.3-207                    Revision No. 14-2

Relief and LLS Instrumentation B 3.3.6.5 B 3.3   INSTRUMENTATION B 3.3.6.5   Relief and Low-Low Set (LLS) Instrumentation BASES BACKGROUND         The safety/relief valves (S/RVs) prevent overpressurization of the nuclear steam system. Instrumentation is provided to support two modes (in addition to the automatic depressurization system (ADS) mode of operation for selected valves) of S/RV operationthe relief function (all valves) and the LLS function (selected valves). Refer to LCO 3.4.4, "Safety/Relief Valves (S/RVs)," and LCO 3.6.1.6, "Low-Low Set (LLS) Safety/Relief Valves (S/RVs)," Applicability Bases for additional information on these modes of S/RV operation.
For the ADS mode of operation and associated instrumentation, refer to LCO 3.5.1, "Emergency Core Cooling Systems (ECCS)Operating," and LCO 3.3.5.1, "ECCS Instrumentation," respectively.
The relief function of the S/RVs prevents overpressurization of the nuclear steam system. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the S/RV relief function instrumentation, as well as LCOs on other reactor system parameters, and equipment performance. The LSSS are defined in this Specification as the Allowable Values, except for the relief Function (the Nominal Trip Setpoint defines the LSSS for this function), which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs), during Anticipated Operational Occurrences (AOOs) and Design Basis Accidents (DBAs).
The LLS function of the S/RVs is designed to mitigate the effects of postulated pressure loads on the containment by preventing multiple actuations in rapid succession of the S/RVs subsequent to their initial actuation. Upon any S/RV actuation, the LLS logic assigns preset opening setpoints to two preselected S/RVs and reclosing setpoints to five preselected S/RVs. These setpoints are selected to override the normal relief setpoints such that the LLS S/RVs will stay open longer, thus releasing more steam (energy) to the suppression pool; hence more energy (and time) is required for repressurization and subsequent S/RV openings. The LLS logic is divided into three logic groups (the low and medium setpoint groups each control one valve (i.e., valves 1B21-F051D and 1B21-F051C, respectively) and the high setpoint group controls the remaining three valves (i.e., valves 1B21-F047F, 1B21-F051B, and 1B21-F051G)). The LLS logic increases the time between (or prevents) subsequent actuations to limit S/RV subsequent actuations to one valve, so that containment loads will also be reduced.
(continued)
CLINTON                          B 3.3-208                    Revision No. 10-6

Relief and LLS Instrumentation B 3.3.6.5 BASES BACKGROUND        The relief instrumentation consists of two trip systems, (continued)     with each trip system actuating one solenoid for each S/RV.
There are two solenoids per S/RV, and each solenoid can open its respective S/RV. The relief mode (S/RVs and associated trip systems) is divided into three setpoint groups (the low with one S/RV, the medium with eight S/RVs, and the high with seven S/RVs). The S/RV relief function is actuated by four transmitters that monitor reactor steam dome pressure.
The reactor steam dome pressure transmitters send signals to one analog trip module (ATM) in each of three separate setpoint groups (e.g., the medium group of eight S/RVs opens when at least one of the associated trip systems trips at its assigned setpoint). The outputs of the ATMs are arranged in a two-out-of-two logic for each trip system in each setpoint group. Once an S/RV has been opened, it will reclose when reactor steam dome pressure decreases below the opening pressure setpoint (unless the associated valve is an LLS S/RV as discussed below). This logic arrangement ensures that no single instrument failure can preclude the S/RV relief function.
Similar to the S/RV relief function, either trip system can actuate the LLS S/RVs by energizing the associated solenoids. Each LLS trip system is enabled and sealed in upon initial S/RV actuation from the existing reactor steam dome pressure sensors of any of the normal relief setpoint groups. The reactor steam dome pressure channels that control the opening and closing of the LLS S/RVs are arranged in either a one-out-of-one or a two-out-of-two logic depending on which LLS S/RV group is being controlled.
This logic arrangement ensures that no single instrument failure can preclude the LLS S/RV function.
APPLICABLE        The relief and LLS instrumentation are designed to prevent SAFETY ANALYSES   overpressurization of the nuclear steam system and to ensure that the containment loads remain within the primary containment design basis (Ref. 1).
Relief and LLS instrumentation satisfies Criterion 3 of the NRC Policy Statement.
(continued)
CLINTON                         B 3.3-209                       Revision No. 0

Relief and LLS Instrumentation B 3.3.6.5 BASES (continued)
LCO               The LCO requires OPERABILITY of sufficient relief and LLS instrumentation channels to provide adequate assurance of successfully accomplishing the relief and LLS function, assuming any single instrumentation channel failure within the LLS logic. Therefore, two trip systems are required to be OPERABLE. The OPERABILITY of each trip system is dependent upon the OPERABILITY of the reactor steam dome pressure channels associated with required relief and LLS S/RVs. Each required channel shall have its setpoint within the specified Allowable Value. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
Allowable Values are specified for each channel in SR 3.3.6.5.3. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel pressure), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., ATM) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values and trip setpoints are derived from the analytic limits, accounting for applicable process errors, severe environment errors, instrument errors (e.g., drift), and calibration errors in accordance with the setpoint methodology documented in the Operational Requirements Manual (ORM).
The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
For relief, the actuating Allowable Values are based on the transient event of main steam isolation valve (MSIV) closure with an indirect scram (i.e., neutron flux). This analysis is described in Reference 1. For LLS, the actuating and reclosing Allowable Values are based on the transient event (continued)
CLINTON                         B 3.3-210                    Revision No. 10-6

Relief and LLS Instrumentation B 3.3.6.5 BASES LCO           of MSIV closure with a direct scram (i.e., MSIV position (continued) switches). This analysis is also described in Reference 1.
APPLICABILITY The relief and LLS instrumentation is required to be OPERABLE in MODES 1, 2, and 3, since considerable energy exists in the nuclear steam system and the S/RVs may be needed to provide pressure relief. If the S/RVs are needed, then the relief and LLS functions are required to ensure that the primary containment design basis is maintained. In MODES 4 and 5, the reactor pressure is low enough that the overpressure limit cannot be approached by assumed operational transients or accidents. Thus, pressure relief and LLS instrumentation are not required.
ACTIONS       A.1 and A.2 Because the failure of any reactor steam dome pressure instrument channels in one trip system will not prevent the associated S/RV from performing its relief and LLS functions, 7 days is allowed to restore a trip system to OPERABLE status (Required Action A.1). Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. In this condition, the remaining OPERABLE trip system is adequate to perform the relief and LLS initiation functions. However, the overall reliability is reduced because a single failure in the OPERABLE trip system could result in a loss of relief or LLS function.
Alternatively, declaring the associated relief and LLS valve(s) inoperable (Required Action A.2) is also acceptable since the Required Actions of the respective LCOs (LCO 3.4.4 and LCO 3.6.1.6) provide appropriate actions for the inoperable components.
The 7 day Completion Time is considered appropriate for the relief and LLS functions because of the redundancy of sensors available to provide initiation signals and the redundancy of the relief and LLS design. In addition, the probability of multiple relief or LLS instrumentation channel failures, which renders the remaining trip system inoperable, occurring together with an event requiring the relief or LLS function during the 7 day Completion Time is very low.
(continued)
CLINTON                     B 3.3-211                    Revision No. 21-7

Relief and LLS Instrumentation B 3.3.6.5 BASES ACTIONS           B.1 and B.2 (continued)
If the inoperable trip system is not restored to OPERABLE status within 7 days, per Condition A, or if two trip systems are inoperable, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE      The Surveillances are modified by a Note to indicate that REQUIREMENTS      when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains relief or LLS initiation capability, as applicable. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel surveillance. That analysis demonstrated the 6 hour testing allowance does not significantly reduce the probability that the relief and LLS valves will initiate when necessary.
SR  3.3.6.5.1 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-212                     Revision No. 21-4

Relief and LLS Instrumentation B 3.3.6.5 BASES SURVEILLANCE      SR  3.3.6.5.2 REQUIREMENTS (continued)     The calibration of analog trip modules provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.6.5.3. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.
The SR 3.3.6.5.2 calibration is modified by a Note. This Note is divided into three parts. Part 1 of the Note requires evaluation of instrument performance for the condition where the as-found setting for these instrument channels is outside its As-Found Tolerance (AFT) but conservative with respect to the Allowable Value.
Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. Initial evaluation will be performed by the technician performing the surveillance who will evaluate the instruments ability to maintain a stable setpoint within the As-Left Tolerance (ALT). The technicians evaluation will be reviewed by on-shift operations personnel during the approval of the surveillance data. Subsequent to returning the instrument to service, the deviation is entered into the Corrective Action Program. In accordance with procedures, entry into the Corrective Action Program will require review and documentation of the condition for operability by on-shift operations personnel. Additional evaluation and potential corrective actions as necessary will ensure that any as-found setting found outside the AFT is evaluated for long-term operability trends. If the as-found channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable. Part 2 of the Note requires that the instrument channel setpoint shall be reset to within the ALT of the Actual Trip Setpoint (ATSP). The ATSP is equivalent to or more conservative than the Nominal Trip Setpoint (NTSP). The NTSP is the limiting value of the sensed process variable at which a trip may be set in accordance with the methodology documented in the ORM.
Therefore, the NTSP is equivalent to the Limiting Safety System Setting (LSSS) required by 10 CFR 50.36, Technical specifications. The Actual Trip Setpoint is also calculated in accordance with the plant-specific setpoint methodology as documented in the CPS ORM and may include additional margin. The ATSP will ensure that sufficient margin to the safety and/or analytical limit is maintained.
(continued)
CLINTON                         B 3.3-213                    Revision No. 10-6

Relief and LLS Instrumentation B 3.3.6.5 BASES SURVEILLANCE      SR  3.3.6.5.2   (continued)
REQUIREMENTS If the as-left instrument channel setpoint cannot be returned to within the ALT of the Actual Trip Setpoint, then the channel shall be declared inoperable. Part 3 of the Note indicates that the Nominal Trip Setpoint and the methodology used to determine the Nominal Trip Setpoint, the As-Found Tolerance and the As-Left Tolerance bands are specified in the ORM.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.6.5.3 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The SR 3.3.6.5.3 calibration is modified by a Note. This Note is divided into three parts. Part 1 of the Note requires evaluation of instrument performance for the condition where the as-found setting for these instrument channels is outside its As-Found Tolerance (AFT) but conservative with respect to the Allowable Value.
Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. Initial evaluation will be performed by the technician performing the surveillance who will evaluate the instruments ability to maintain a stable setpoint within the As-Left Tolerance (ALT). The technicians evaluation will be reviewed by on-shift operations personnel during the approval of the surveillance data. Subsequent to returning the instrument to service, the deviation is entered into the Corrective Action Program. In accordance with procedures, entry into the Corrective Action Program will require review and documentation of the condition for operability by on-shift operations personnel. Additional evaluation and potential corrective actions as necessary will ensure that any as-found setting found outside the AFT is evaluated for long-term operability trends. If the as-found channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable. Part 2 of the Note requires that the instrument channel setpoint shall be reset to within the ALT of the Actual Trip Setpoint (ATSP). The ATSP is equivalent to or more conservative than the Nominal (continued)
CLINTON                         B 3.3-213a                   Revision No. 14-2

Relief and LLS Instrumentation B 3.3.6.5 BASES SURVEILLANCE      SR  3.3.6.5.3   (continued)
REQUIREMENTS Trip Setpoint (NTSP). The NTSP is the limiting value of the sensed process variable at which a trip may be set in accordance with the methodology documented in the ORM.
Therefore, the NTSP is equivalent to the Limiting Safety System Setting (LSSS) required by 10 CFR 50.36, Technical specifications. The Actual Trip Setpoint is also calculated in accordance with the plant-specific setpoint methodology as documented in the CPS ORM and may include additional margin. The ATSP will ensure that sufficient margin to the safety and/or analytical limit is maintained.
If the as-left instrument channel setpoint cannot be returned to within the ALT of the Actual Trip Setpoint, then the channel shall be declared inoperable. Part 3 of the Note indicates that the Nominal Trip Setpoint and the methodology used to determine the Nominal Trip Setpoint, the As-Found Tolerance and the As-Left Tolerance bands are specified in the ORM.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.6.5.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed for S/RVs in LCO 3.4.4 and LCO 3.6.1.6 overlaps this Surveillance to provide complete testing of the assumed safety function.
The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. USAR, Section 5.2.2.
: 2. USAR, Section 7.3.1.1.1.4.2.
: 3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications,"
February 1991.
CLINTON                         B 3.3-213b                   Revision No. 14-2

This page intentionally left blank CLINTON           B 3.3-214                Revision No. 14-2

CRV System Instrumentation B 3.3.7.1 B 3.3   INSTRUMENTATION B 3.3.7.1   Control Room Ventilation (CRV) System Instrumentation BASES BACKGROUND         The CRV System is designed to provide a radiologically controlled environment to ensure the habitability of the control room for the safety of control room operators under all plant conditions. Two independent CRV subsystems are each capable of fulfilling the stated safety function. The instrumentation and controls for the CRV System automatically initiate action to route makeup air to the main control room (MCR) through emergency filter units to minimize the consequences of radioactive material in the control room environment.
In the event of a Control Room Ventilation Radiation Monitor signal, the CRV System is automatically started in the high radiation mode. The makeup air is then routed through the charcoal filter and is kept slightly pressurized with respect to adjacent areas.
The CRV System instrumentation has two trip systems: one trip system initiates one CRV subsystem, while the second trip system initiates the other CRV subsystem (Ref. 1).
Each trip system receives input from the Functions listed above. The Functions are arranged as follows for each trip system. The Control Room Ventilation Radiation Monitors are arranged in a one-out-of-two taken twice logic. Each trip system receives a signal from the radiation monitors in both divisions. The channels include electronic equipment (e.g.,
radiation monitors) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a CRV high radiation initiation signal to the initiation logic.
APPLICABLE         The ability of the CRV System to maintain the habitability SAFETY ANALYSES,   of the MCR is explicitly assumed for certain accidents as LCO, and           discussed in the USAR safety analyses (Refs. 2 and 3).
APPLICABILITY      CRV System operation ensures that the radiation exposure of control room personnel, through the duration of any one of the postulated accidents, does not exceed the limits set by GDC 19 of 10 CFR 50, Appendix A.
(continued)
CLINTON                          B 3.3-215                        Revision No. 0

CRV System Instrumentation B 3.3.7.1 BASES APPLICABLE        CRV System instrumentation satisfies Criterion 3 of the NRC SAFETY ANALYSES,  Policy Statement.
LCO, and APPLICABILITY     The OPERABILITY of the CRV System instrumentation is (continued)     dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.7.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
Allowable Values are specified for each CRV System instrumentation Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations.
These nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint that is less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.
Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., radiation level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,
radiation monitor) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined, accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
The specific Applicable Safety Analyses, LCO, and Applicability discusses are listed below.
(continued)
CLINTON                         B 3.3-216                        Revision No. 0

CRV System Instrumentation B 3.3.7.1 BASES APPLICABLE        1. Control Room Air Intake Radiation Monitors SAFETY ANALYSES, LCO, and          The Control Room Air Intake Radiation Monitors measure APPLICABILITY     radiation levels exterior to the inlet ducting of the MCR.
(continued)     A high radiation level may pose a threat to MCR personnel; thus, a detector indicating this condition automatically signals initiation of the CRV System high radiation mode.
The Control Room Air Intake Radiation Monitors Function consists of four independent monitors, two monitors (one from each division) at each of the normal air intakes. Four channels of Control Room Ventilation Radiation Monitors are available and are required to be OPERABLE to ensure that no single instrument failure can preclude CRV System high radiation mode initiation. The Allowable Value was selected to ensure protection of the control room personnel.
The Control Room Air Intake Radiation Monitors Function is required to be OPERABLE in MODES 1, 2, and 3, and during CORE ALTERATIONS, and movement of irradiated fuel in the primary or secondary containment to ensure that control room personnel are protected during a LOCA or a fuel handling event. During MODES 4 and 5, when these specified conditions are not in progress (e.g., CORE ALTERATIONS), the probability of a LOCA or fuel damage is low; thus, the Function is not required.
ACTIONS           A Note has been provided to modify the ACTIONS related to CRV instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into (continued)
CLINTON                         B 3.3-217                    Revision No. 20-2

CRV System Instrumentation B 3.3.7.1 BASES ACTIONS           the Condition. However, the Required Actions for inoperable (continued)     CRV instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable CRV instrumentation channel.
A.1 and A.2 Because of the diversity of sensors available to provide initiation signals and the redundancy of the CRV System design, an allowable out of service time of 6 hours is provided to permit restoration of any inoperable channel to OPERABLE status. However, this out of service time is only acceptable provided the associated Function is still maintaining CRV System high radiation mode initiation capability. A Function is considered to be maintaining CRV System high radiation mode initiation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate an initiation signal from the given Function on a valid signal. This would require one trip system to have two channels, each OPERABLE or in trip.
In this situation (loss of CRV System high radiation mode initiation capability), the 6 hour allowance of Required Action D.2 is not appropriate. If the Function is not maintaining CRV System high radiation mode initiation capability, both CRV subsystems must be declared inoperable within 1 hour of discovery of loss of CRV System high radiation mode initiation capability in both trip systems.
If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition, per Required Action A.2. Placing the inoperable channel in trip performs the intended function of the channel (starts the associated CRV subsystem in the high radiation mode). Alternately, if it is not desired to place the channel in trip (e.g., as in the case where it is not desired to start the subsystem),
Condition B must be entered and its Required Actions taken.
The 6 hour Completion Time is based on the consideration that this Function provides the primary signal to start the CRV System, thus ensuring that the design basis of the CRV System is met.
(continued)
CLINTON                         B 3.3-218                       Revision No. 0

CRV System Instrumentation B 3.3.7.1 BASES ACTIONS           B.1 and B.2 (continued)
With any Required Action and associated Completion Time not met, one CRV subsystem must be placed in the high radiation mode of operation (Required Action B.1) to ensure that control room personnel will be protected in the event of a Design Basis Accident. The method used to place the CRV subsystem in operation must provide for automatically reinitiating the subsystem upon restoration of power following a loss of power to the CRV subsystem(s).
Alternately, if it is not desired to start the subsystem in the high radiation mode, the CRV subsystem associated with inoperable, untripped channels must be declared inoperable within 1 hour.
The 1 hour Completion Time is intended to allow the operator time to place the CRV subsystem in operation. The 1 hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels, or for placing the associated CRV subsystem in operation.
SURVEILLANCE      As noted at the beginning of the SRs, the SRs for each CRV REQUIREMENTS      System Instrumentation Function are located in the SRs column of Table 3.3.7.1-1.
The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours, provided the associated Function maintains CRV System high radiation mode initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 4 and 5) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour testing allowance does not significantly reduce the probability that the CRV System will initiate when necessary.
SR  3.3.7.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A (continued)
CLINTON                         B 3.3-219                    Revision No. 14-2

CRV System Instrumentation B 3.3.7.1 BASES SURVEILLANCE      SR  3.3.7.1.1  (continued)
REQUIREMENTS CHANNEL CHECK is normally a comparison of the indicated parameter for one instrument channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with channels required by the LCO.
SR  3.3.7.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.7.1.3 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel (continued)
CLINTON                         B 3.3-220                    Revision No. 21-4

CRV System Instrumentation B 3.3.7.1 BASES SURVEILLANCE      SR  3.3.7.1.3  (continued)
REQUIREMENTS adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. USAR, Section 7.3.1.1.6.
: 2. USAR, Section 6.4.
: 3. USAR, Chapter 15.
: 4. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications,"
February 1991.
: 5. NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"
July 1990.
: 6. USAR, Section 7.6.1.2.5.
: 7. USAR, Section 7.6.2.2.5.
CLINTON                         B 3.3-221                    Revision No. 14-2

LOP Instrumentation B 3.3.8.1 B 3.3   INSTRUMENTATION B 3.3.8.1   Loss of Power (LOP) Instrumentation BASES BACKGROUND         Successful operation of the required safety functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power sources for energizing the various components such as pump motors, motor operated valves, and the associated control components. The LOP instrumentation monitors the 4.16 kV emergency buses.
Offsite power is the preferred source of power for the 4.16 kV emergency buses. If the monitors determine that insufficient power is available, the buses are disconnected from the offsite power sources and connected to the onsite diesel generator (DG) power sources.
Each 4.16 kV emergency bus has its own independent LOP instrumentation and associated trip logic. The voltage for the Division 1, 2, and 3 buses is monitored at two levels, which can be considered as two different undervoltage functions: loss of voltage and degraded voltage.
The LOP instrumentation causes various bus transfers and disconnects. Each Division 1 and 2 emergency bus Loss of Voltage Function is monitored by two undervoltage relays on the emergency bus and two undervoltage relays on each of the two offsite power sources. The outputs of these relays are arranged in a two-out-of-two taken three times logic configuration. Each of these relays is an inverse time delay relay. The Division 3 emergency bus Loss of Voltage Function is monitored by four undervoltage relays whose outputs are arranged in a one-out-of-two taken twice logic configuration. The output of this logic inputs to a time delay relay. Each Division 1, Division 2, and Division 3 emergency bus Degraded Voltage Function is monitored by two undervoltage relays for each emergency bus whose outputs are arranged in a two-out-of-two logic configuration. The output of this logic inputs to a time delay relay or each emergency bus.
(continued)
CLINTON                          B 3.3-222                     Revision No. 4-3

LOP Instrumentation B 3.3.8.1 BASES   (continued)
APPLICABLE          The LOP instrumentation is required for the Engineered SAFETY ANALYSES,    Safety Features to function in any accident with a loss of LCO, and            offsite power. The required channels of LOP instrumentation APPLICABILITY       ensure that the ECCS and other assumed systems powered from the DGs provide plant protection in the event of any of the analyzed accidents in References 2, 3, and 4 in which a loss of offsite power is assumed. The initiation of the DGs on loss of offsite power, and subsequent initiation of the ECCS, ensure that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
Accident analyses credit the loading of the DG based on the loss of offsite power during a loss of coolant accident (LOCA). The diesel starting and loading times have been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power.
The LOP instrumentation satisfies Criterion 3 of the NRC Policy Statement.
The OPERABILITY of the LOP instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.8.1-1. Each Function must have a required number of OPERABLE channels per 4.16 kV emergency bus, with their setpoints within the specified Allowable Values. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
The Allowable Values are specified for each Function in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoint does not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within the Allowable Value, is acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., bus voltage), and when (continued)
CLINTON                           B 3.3-223                     Revision No. 4-3

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE        the measured output value of the process parameter exceeds SAFETY ANALYSES,  the setpoint, the associated device (e.g., undervoltage LCO, and          relay) changes state. The analytic limits are derived from APPLICABILITY     the limiting values of the process parameters obtained from (continued)   the safety analysis. The Allowable Values and trip setpoints are derived from the analytic limits, accounting for applicable process errors, severe environment errors, instrument errors (e.g., drift), and calibration errors.
The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
4.16 kV Emergency Bus Undervoltage 1.a, 1.b, 2.a, 2.b. 4.16 kV Emergency Bus Undervoltage (Loss of Voltage)
Loss of voltage on a 4.16 kV emergency bus indicates that offsite power may be completely lost to the respective emergency bus and is unable to supply sufficient power for proper operation of the applicable equipment. Therefore, the power supply to the bus is transferred from offsite power to DG power when the voltages on the bus and the two offsite power supplies drop below the Loss of Voltage Function Allowable Values (loss of voltage with a short time delay). This ensures that adequate power will be available to the required equipment.
The Bus Undervoltage Allowable Values are low enough to prevent inadvertent power supply transfer, but high enough to ensure power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that power is available to the required equipment. The time delay specified for the Divisions 1 and 2 4.16 kV Emergency Bus Loss of Voltage Functions corresponds to a voltage of 0 volts. Higher voltage conditions will result in increased trip times.
(continued)
CLINTON                         B 3.3-224                   Revision No. 21-10

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE        1.a, 1.b, 2.a, 2.b. 4.16 kV Emergency Bus Undervoltage SAFETY ANALYSES,  (Loss of Voltage) (continued)
LCO, and APPLICABILITY     The Division 3 4.16 kV Emergency Bus Loss of Voltage Function 120-volt Basis trip setpoint is t 67 volts and d 78 volts.
Six channels of 4.16 kV Emergency Bus Undervoltage (Loss of Voltage) Function per associated emergency bus for Divisions 1 and 2 and four channels for Division 3 are only required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no single instrument failure can preclude the DG function. (Six channels input to each of the Division 1 and Division 2 DGs and four channels input to the Division 3 DG. Each of the six channels for Division 1 and six channels for Division 2 is an inverse time delay relay. Each of these time delays are considered to be separate channels. For Division 3, the Loss of Voltage Function logic inputs to a single time delay relay. Thus, only one time delay channel is associated with Division 3.)
Refer to LCO 3.8.1, "AC Sources-Operating," for Applicability Bases for the DGs.
1.c, 1.d, 1.e, 2.c, 2.d, 2.e. 4.16 kV Emergency Bus Undervoltage (Degraded Voltage)
A reduced voltage condition on a 4.16 kV emergency bus indicates that while offsite power may not be completely lost to the respective emergency bus, power may be insufficient for starting large motors without risking damage to the motors that could disable the ECCS function.
Therefore, power supply to the bus is transferred from offsite power to onsite DG power when the voltage on the bus drops below the Degraded Voltage Function Allowable Values (degraded voltage with a time delay). This ensures that adequate power will be available to the required equipment.
The Bus Undervoltage Allowable Values are low enough to prevent inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment. As stated above, the purpose of this instrumentation is to ensure that sufficient power will be available to support the ECCS function during a LOCA.
During a LOCA, the ECCS and other safety systems will be initiated at the start of the event. This large loading of the safety buses results in a voltage transient of (continued)
CLINTON                         B 3.3-225                    Revision No. 21-9

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE        1.c, 1.d, 1.e, 2.c, 2.d, 2.e. 4.16 kV Emergency Bus SAFETY ANALYSES,  Undervoltage (Degraded Voltage) (continued)
LCO, and APPLICABILITY     sufficient magnitude to start the degraded voltage timers.
If the degraded voltage relays do not reset, which requires the voltage to be restored to a level above the relay reset setpoint, the bus undervoltage time delay relays will trip, resulting in bus transfer to the DGs. Thus, the relay reset (pick-up) setpoint must be high enough to ensure adequate voltage for the safety-related loads.
The Allowable Values are as determined within IP Calculation 19-AN-19 (Ref. 5) and IP Calculation IP-E-0032 (Ref. 6).
The basis for the reset Allowable Value upper limit is the avoidance of shifting to the onsite source when the offsite source is acceptable as specified within GDC 17. The basis for the reset Allowable Value lower limit is the minimum voltage required to support the LOCA loads. The basis for the dropout Allowable Value lower limit ensures adequate voltage to start plant equipment under non-LOCA loading conditions. Because of the voltage transient experienced at the start of a LOCA, the specified Degraded Voltage drop-out Allowable Value lower limit provides significant margin to the setting required to mitigate a LOCA. This value was selected based on other licensing basis events discussed in USAR, Section 8.3.1.1.2 (Ref. 1) and calculated in IP Calculation 19-AN-19 and IP Calculation IP-E-0032.
The upper and lower Allowable Values specified for the degraded voltage reset (pick-up) function constitute an allowable band for this function. These solid-state relays are designed with a fixed but adjustable deadband. (The reset is set first, then the drop-out is set via a potentiometer.) Allowable values are specified to allow for drift in either direction, but the drop-out and reset points cannot overlap.
(continued)
CLINTON                        B 3.3-225a                   Revision No. 21-10

This page intentionally left blank.
CLINTON           B 3.3-225b                Revision No. 2-11

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE        1.c, 1.d, 1.e, 2.c, 2.d, 2.e. 4.16 kV Emergency Bus SAFETY ANALYSES,  Undervoltage (Degraded Voltage) (continued)
LCO, and APPLICABILITY     The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that sufficient power is available to the required equipment.
Two channels of 4.16 kV Emergency Bus Undervoltage (Degraded Voltage) Function per associated emergency bus for Divisions 1, 2, and 3 are only required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no single instrument failure can preclude the DG function.
(Two channels input to each of the Division 1, 2, and 3 DGs.
The Degraded Voltage Function logic for each Division inputs to a single time delay relay. Thus, only one time delay channel is associated with each Division.) Refer to LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs.
ACTIONS           A Note has been provided to modify the ACTIONS related to LOP instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable LOP instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable LOP instrumentation channel.
(continued)
CLINTON                         B 3.3-226                     Revision No. 10-7

LOP Instrumentation B 3.3.8.1 BASES ACTIONS        A.1 and A.2 (continued)
With one or more channels of a Function inoperable, the Function may not be capable of performing the intended function. Therefore, only 1 hour is allowed to restore the inoperable channel to OPERABLE status. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. For Loss of Voltage Functions, placing the inoperable channel in trip would conservatively compensate for the inoperability and allow operation to continue. However, for Degraded Voltage Functions, placing the inoperable channel in trip may not conservatively compensate for the inoperability. Because of the assumptions used in the setpoint calculations, the setpoint(s) for the remaining OPERABLE channel(s) may not ensure reset of the relay within the required voltage range.
As a result, operation with an inoperable Degraded Voltage channel(s) in trip is limited to 7 days or in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable when trip capability is not maintained.
Thus, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in a DG initiation) or if the inoperable channel(s) is not restored to OPERABLE status within the allowable out of service time, Condition B must be entered and its Required Action taken.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The Completion Times are acceptable because they minimize risk while allowing time for restoration or tripping of channels.
Required Action A.2 is modified by a Note which states that the Required Action is only applicable for Functions 1.c, 1.d, 1.e, 2.c, 2.d, and 2.e. The 7-day limitation is imposed as a result of assumptions associated with the setpoint calculations for the modified Degraded Voltage Function instrumentation.
(continued)
CLINTON                      B 3.3-227                    Revision No. 21-7

LOP Instrumentation B 3.3.8.1 BASES ACTIONS        B.1 (continued)
If any Required Action and associated Completion Time is not met, the associated Function may not be capable of performing the intended function. Therefore, the associated DG(s) are declared inoperable immediately. This requires entry into applicable Conditions and Required Actions of LCO 3.8.1, which provides appropriate actions for the inoperable DG(s).
SURVEILLANCE   As noted at the beginning of the SRs, the SRs for each LOP REQUIREMENTS   Instrumentation Function are located in the SRs column of Table 3.3.8.1-1.
The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 2 hours provided the associated Function maintains DG initiation capability. Upon completion of the Surveillance, or expiration of the 2 hour allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.
SR  3.3.8.1.1 This SR has been deleted.
SR  3.3.8.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. For series Functions, i.e., for the degraded voltage relays in series with their associated delay timers, a separate CHANNEL FUNCTIONAL TEST is not required for each Function, provided each Function is tested. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests.
Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                      B 3.3-228                    Revision No. 21-9

LOP Instrumentation B 3.3.8.1 BASES SURVEILLANCE      SR  3.3.8.1.3 REQUIREMENTS (continued)     A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.8.1.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed in LCO 3.8.1 overlaps this Surveillance to provide complete testing of the assumed safety functions.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. USAR, Section 8.3.1.1.2.
: 2. USAR, Section 5.2.2.
: 3. USAR, Section 6.3.3.
: 4. USAR, Chapter 15.
: 5. IP Calculation 19-AN-19.
: 6. IP Calculation IP-E-0032.
CLINTON                         B 3.3-229                   Revision No. 21-10

RPS Electric Power Monitoring B 3.3.8.2 B 3.3   INSTRUMENTATION B 3.3.8.2   Reactor Protection System (RPS) Electric Power Monitoring BASES BACKGROUND         The RPS Electric Power Monitoring System is provided to isolate the RPS bus from the normal uninterruptible power supply (UPS) or alternate power supply in the event of overvoltage, undervoltage, or underfrequency. This system protects the loads connected to the RPS bus against unacceptable voltage and frequency conditions (Ref. 1) and forms an important part of the primary success path for the essential safety circuits. The essential equipment powered from the RPS solenoid buses includes the RPS scram solenoids and the mainsteam isolation valve solenoids.
The RPS Electric Power Monitoring assembly will detect any abnormal high or low voltage or low frequency condition in the outputs of the two UPSs or the alternate power supplies and will de-energize its respective RPS bus, thereby causing all safety functions normally powered by this bus to de-energize.
In the event of failure of an RPS Electric Power Monitoring System and the Class 1E UPS, the RPS loads may experience significant effects from the alternate power supply.
Deviation from the nominal conditions, such as an unregulated power supply, can cause damage to the scram solenoids and other Class 1E devices.
In the event of a low voltage condition for an extended period of time, the scram solenoids can chatter and potentially lose their pneumatic control capability, resulting in a loss of primary scram action.
In the event of an overvoltage condition, the RPS scram solenoids, as well as the main steam isolation valve solenoids, may experience a voltage higher than their design (continued)
CLINTON                          B 3.3-230                       Revision No. 0

RPS Electric Power Monitoring B 3.3.8.2 BASES BACKGROUND        voltage. If the overvoltage condition persists for an (continued)     extended time period, it may cause equipment degradation and the loss of plant safety function.
One Class 1E power monitor and an associated circuit breakers are connected between each RPS bus and the power supply. The circuit breakers have an associated independent set of Class 1E overvoltage, undervoltage, and underfrequency sensing logic. Together, a circuit breaker and its sensing logic constitute an electric power monitoring assembly. If the output of the inservice power supply exceeds the predetermined limits of overvoltage, undervoltage, or underfrequency, a trip coil driven by this logic circuitry opens the circuit breaker, which removes the associated power supply from service.
APPLICABLE        RPS electric power monitoring is necessary to meet the SAFETY ANALYSES   assumptions of the safety analyses by ensuring that the equipment powered from the RPS buses can perform its intended function. RPS electric power monitoring provides protection to the RPS and other systems that receive power from the RPS buses, by disconnecting the RPS from the power supply under specified conditions that could damage the RPS bus powered equipment.
RPS electric power monitoring satisfies Criterion 3 of the NRC Policy Statement.
LCO               The OPERABILITY of each RPS electric power monitoring assembly is dependent upon the OPERABILITY of the overvoltage, undervoltage, and underfrequency logic, as well as the OPERABILITY of the associated circuit breaker. One electric power monitoring assembly is required to be OPERABLE for each inservice power supply. This provides redundant protection to the UPS against any abnormal voltage or frequency conditions to ensure that no single failure can preclude the function of RPS bus powered components. Each inservice electric power monitoring assembly's trip logic setpoints are required to be within the specific Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.
Allowable Values are specified for each RPS electric power monitoring assembly trip logic (refer to SR 3.3.8.2.2).
Nominal trip setpoints are specified in the setpoint (continued)
CLINTON                         B 3.3-231                        Revision No. 0

RPS Electric Power Monitoring B 3.3.8.2 BASES LCO               calculations. The nominal setpoints are selected to ensure (continued)     that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., overvoltage), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors.
The trip setpoints are then determined, accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
The Allowable Values for the instrument settings are based on the RPS providing t 57 Hz, 120 V +/- 10% (to MSIV solenoids) and 115 V +/- 10 V (to scram solenoids). The most limiting voltage requirement and associated line losses determine the settings of the electric power monitoring instrument channels. The settings are calculated based on the loads on the buses and the associated UPS or alternate power supply being 120 VAC and 60 Hz.
APPLICABILITY     The operation of the RPS electric power monitoring assemblies is essential to disconnect the RPS bus powered components from the inservice UPS or alternate power supply during abnormal voltage or frequency conditions. Since the degradation of a nonclass 1E source supplying power to the RPS bus can occur as a result of any random single failure, the OPERABILITY of the RPS electric power monitoring assemblies is required when the RPS bus powered components are required to be OPERABLE. This results in the RPS Electric Power Monitoring System OPERABILITY being required (continued)
CLINTON                         B 3.3-232                     Revision No. 1-1

RPS Electric Power Monitoring B 3.3.8.2 BASES APPLICABILITY     in MODES 1, 2, and 3, and MODES 4 and 5 with any control rod (continued)     withdrawn from a core cell containing one or more fuel assemblies.
ACTIONS           A.1 If the power monitoring assembly for an inservice power supply (UPS or alternate) is inoperable, or the power monitoring assembly in each inservice power supply is inoperable, the system protective function is lost. In this condition, 1 hour is allowed to restore the assembly to OPERABLE status for each inservice power supply. If the inoperable assembly for each inservice power supply cannot be restored to OPERABLE status, the associated power supplies must be removed from service within 1 hour (Required Action A.1). An alternate power supply with OPERABLE assemblies may then be used to power one RPS bus.
The 1 hour Completion Time is sufficient for the plant operations personnel to take corrective actions and is acceptable because it minimizes risk while allowing time for restoration or removal from service of the electric power monitoring assemblies.
Alternately, if it is not desired to remove the power supply(s) from service (e.g., as in the case where removing the power supply(s) from service would result in a scram or isolation), Condition B or C, as applicable, must be entered and its Required Actions taken.
In addition to the actions identified in Condition A, if the frequency of the supply to the RPS solenoid bus is d 57 Hz, the OPERABILITY of all Class 1E equipment which could have been subjected to the abnormal frequency on the associated RPS solenoid bus must be demonstrated by the performance of a CHANNEL FUNCTIONAL TEST or CHANNEL CALIBRATION, as required. These tests should be performed within 24 hours of discovering the underfrequency condition.
B.1 If any Required Action and associated Completion Time of Condition A is not met in MODE 1, 2, or 3, the plant must be brought to a MODE in which overall plant risk is minimized.
(continued)
CLINTON                         B 3.3-233                     Revision No. 13-2

RPS Electric Power Monitoring B 3.3.8.2 BASES ACTIONS           B.1 (continued)
The plant shutdown is accomplished by placing the plant in MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref.
: 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
Required Action B.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
C.1 If any Required Action and associated Completion Time of Condition A is not met in MODE 4 or 5, with any control rod withdrawn from a core cell containing one or more fuel assemblies, the operator must immediately initiate action to fully insert all insertable control rods in core cells containing one or more fuel assemblies (Required Action C.1). This Required Action results in the least reactive condition for the reactor core and ensures that the safety function of the RPS (e.g., scram of control rods) is not required.
SURVEILLANCE      SR  3.3.8.2.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each overvoltage, undervoltage, and underfrequency channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay.
(continued)
CLINTON                         B 3.3-234                    Revision No. 13-2

RPS Electric Power Monitoring B 3.3.8.2 BASES SURVEILLANCE      SR  3.3.8.2.1 (continued)
REQUIREMENTS This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST is only required to be performed while the plant is in a condition in which the loss of the RPS bus will not jeopardize steady state power operation (the design of the system is such that the power source must be removed from service to conduct the Surveillance). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Note in the Surveillance is based on guidance provided in Generic Letter 91-09 (Ref. 3).
SR  3.3.8.2.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.3.8.2.3 Performance of a system functional test demonstrates a required system actuation (simulated or actual) signal. The logic of the system will automatically trip open the associated power monitoring assembly circuit breaker. Only one signal per power monitoring assembly is required to be tested. This Surveillance overlaps with the CHANNEL CALIBRATION to provide complete testing of the safety function. The system functional test of the Class 1E circuit breakers is included as part of this test to provide complete testing of the safety function. If the breakers are incapable of operating, the associated electric power monitoring assembly would be inoperable.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.3-235                    Revision No. 21-4

RPS Electric Power Monitoring B 3.3.8.2 BASES   (continued)
REFERENCES          1. USAR, Section 8.3.1.1.3.1.
: 2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
3  NRC Generic Letter 91-09, "Modification of Surveillance Interval for the Electric Protective Assemblies in Power Supplies for the Reactor Protection System."
CLINTON                         B 3.3-236                     Revision No. 14-2

Recirculation Loops Operating B 3.4.1 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.1   Recirculation Loops Operating BASES BACKGROUND         The Reactor Coolant Recirculation System is designed to provide a forced coolant flow through the core to remove heat from the fuel. The forced coolant flow removes more heat from the fuel than would be possible with just natural circulation. The forced flow, therefore, allows operation at significantly higher power than would otherwise be possible. The recirculation system also controls reactivity over a wide span of reactor power by varying the recirculation flow rate to control the void content of the moderator. The Reactor Coolant Recirculation System consists of two recirculation pump loops external to the reactor vessel. These loops provide the piping path for the driving flow of water to the reactor vessel jet pumps. Each external loop contains a two speed motor driven recirculation pump, a flow control valve, and associated piping, jet pumps, valves, and instrumentation. The recirculation loops are part of the reactor coolant pressure boundary and are located inside the drywell structure. The jet pumps are reactor vessel internals.
The recirculated coolant consists of saturated water from the steam separators and dryers that has been subcooled by incoming feedwater. This water passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold, from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the driving flow. The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core.
(continued)
CLINTON                              B 3.4-1                      Revision No. 0

Recirculation Loops Operating B 3.4.1 BASES BACKGROUND      The subcooled water enters the bottom of the fuel channels (continued)   and contacts the fuel cladding, where heat is transferred to the coolant. As it rises, the coolant begins to boil, creating steam voids within the fuel channel that continue until the coolant exits the core. Because of reduced moderation, the steam voiding introduces negative reactivity that must be compensated for to maintain or to increase reactor power. The recirculation flow control allows operators to increase recirculation flow and sweep some of the voids from the fuel channel, overcoming the negative reactivity void effect. Thus, the reason for having variable recirculation flow is to compensate for reactivity effects of boiling over a wide range of power generation (i.e., 55 to 100% RTP) without having to move control rods and disturb desirable flux patterns.
Each recirculation loop is manually started from the control room. The recirculation flow control valves provide regulation of individual recirculation loop drive flows.
The flow in each loop is manually controlled.
APPLICABLE      The operation of the Reactor Coolant Recirculation System is SAFETY ANALYSES an initial condition assumed in the design basis loss of coolant accident (LOCA) (Ref. 1). During a LOCA caused by a recirculation loop pipe break, the intact loop is assumed to provide coolant flow during the first few seconds of the accident. The initial core flow decrease is rapid because the recirculation pump in the broken loop ceases to pump reactor coolant to the vessel almost immediately. The pump in the intact loop coasts down relatively slowly. This pump coastdown governs the core flow response for the next several seconds until the jet pump suction is uncovered (Ref. 1). The analyses assume that both loops are operating at the same flow prior to the accident. However, the LOCA analysis was reviewed for the case with a flow mismatch between the two loops with the pipe break assumed to be in the loop with the higher flow. While the flow coastdown and core response are potentially more severe in this assumed case (since the intact loop starts at a lower flow rate and the core response is the same as if both loops were (continued)
CLINTON                           B 3.4-2                   Revision No. 1-1

Recirculation Loops Operating B 3.4.1 BASES APPLICABLE      operating at the lower flow rate), a small mismatch has been SAFETY ANALYSES determined to be acceptable based on engineering judgement.
(continued)   The recirculation system is also assumed to have sufficient flow coastdown characteristics to maintain fuel thermal margins during abnormal operational occurrences (AOOs)
(Ref. 2), which are analyzed in Chapter 15 of the USAR.
A plant specific LOCA analysis has been performed assuming only one operating recirculation loop. This analysis has demonstrated that, in the event of a LOCA caused by a pipe break in the operating recirculation loop, the Emergency Core Cooling System response will provide adequate core cooling, provided the APLHGR requirements are modified accordingly (Refs. 3 and 5).
The transient analyses of Chapter 15 of the USAR have also been performed for single recirculation loop operation (Ref. 3) and demonstrate sufficient flow coastdown characteristics to maintain fuel thermal margins during the abnormal operational transients analyzed provided the MCPR, APLHGR and LHGR requirements are modified. During single recirculation loop operation, modification to the Reactor Protection System average power range monitor (APRM) instrument setpoints is also required to account for the different relationships between recirculation drive flow and reactor core flow. The MCPR, APLHGR and LHGR limits for single loop operation are specified in the COLR. The APRM flow biased simulated thermal power setpoint is in LCO 3.3.1.1, "Reactor Protection System (RPS)
Instrumentation."
Recirculation loops operating satisfies Criterion 2 of the NRC Policy Statement.
LCO             Two recirculation loops are normally required to be in operation with their flows matched within the limits specified in SR 3.4.1.1 to ensure that during a LOCA caused by a break of the piping of one recirculation loop the assumptions of the LOCA analysis are satisfied.
Alternatively, with only one recirculation loop in operation, THERMAL POWER must be d 58% RTP, (continued)
CLINTON                           B 3.4-3                   Revision No. 11-1

Recirculation Loops Operating B 3.4.1 BASES LCO           and modifications to the required APLHGR limits (LCO 3.2.1, (continued) "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"),
LHGR limits (LCO 3.2.3, LINEAR HEAT GENERATION RATE (LHGR)), and APRM Flow Biased Simulated Thermal Power 
High setpoint (LCO 3.3.1.1) must be applied to allow continued operation consistent with the assumptions of References 3 and 5.
APPLICABILITY In MODES 1 and 2, requirements for operation of the Reactor Coolant Recirculation System are necessary since there is considerable energy in the reactor core and the limiting AOOs and LOCAs are assumed to occur.
In MODES 3, 4, and 5, the consequences of an accident or AOO are reduced and the coastdown characteristics of the recirculation loops are not important.
ACTIONS       A.1 With both recirculation loops operating but the flows not matched, the recirculation loops must be restored to operation with matched flows within 2 hours. If the flow mismatch cannot be restored to within limits within 2 hours, one recirculation loop must be shut down.
(continued)
CLINTON                         B 3.4-4                  Revision No. 11-1

Recirculation Loops Operating B 3.4.1 BASES ACTIONS A.1  (continued)
Alternatively, if the single loop requirements of the LCO are applied to operating limits and RPS setpoints, operation with only one recirculation loop would satisfy the requirements of the LCO and the initial conditions of the accident sequence.
The 2 hour Completion Time is based on the low probability of an accident occurring during this time period, on a reasonable time to complete the Required Action, and on frequent core monitoring by operators allowing abrupt changes in core flow conditions to be quickly detected.
(continued)
CLINTON                   B 3.4-5                  Revision No. 11-1

Recirculation Loops Operating B 3.4.1 BASES ACTIONS       B.1 (continued)
Should a LOCA occur with THERMAL POWER > 58% RTP during single loop operation, the core response may not be bounded by the LOCA analyses. Therefore, only a  limited time is allowed to reduce THERMAL POWER TO d 58% RTP.
The 4 hour Completion Time is based on the low probability of an accident occurring during this time period, on a reasonable time to complete the Required Action, and on frequent core monitoring by the operators allowing changes in THERMAL POWER conditions to be quickly detected.
C.1 If the required limit or setpoint modifications for single loop operation (i.e., LCO requirements B.2 and B.3) are not met after transition from two recirculation loop operation to single recirculation loop operation, then the requirements of the LCO must be satisfied within 24 hours.
The 24 hour Completion Time of the Condition provides time before the required modifications to required limits and setpoints have to be in effect after a change in the reactor operating conditions from two recirculation loops operating to single recirculation loop operation. This time is provided due to the need to stabilize operation with one recirculation loop, including the procedural steps necessary to limit flow and adjust the flow control mode in the operating loop, and the complexity and detail required to fully implement and confirm the required limit and setpoint modifications. The 24 hour Completion Time is also based on the low probability of an accident occurring during this period, on a reasonable time to complete the Required Action, and on frequent monitoring by operators allowing abrupt changes in core flow conditions to be quickly detected.
(continued)
CLINTON                         B 3.4-6                  Revision No. 11-1

Recirculation Loops Operating B 3.4.1 BASES ACTIONS       D.1 (continued)
With no recirculation loops in operation, or the Required Action and associated Completion Time of Conditions A, B, or C not met, the unit is required to be brought to a MODE in which the LCO does not apply. The plant is required to be placed in MODE 3 in 12 hours. In this condition, the recirculation loops are not required to be operating because of the reduced severity of DBAs and minimal dependence on the recirculation loop coastdown characteristics. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE  SR  3.4.1.1 REQUIREMENTS This SR ensures the recirculation loop flows are within the allowable limits for mismatch. At low core flow (i.e.,
              < 70% of rated core flow), the MCPR requirements provide larger margins to the fuel cladding integrity Safety Limit such that the potential adverse effect of early boiling transition during a LOCA is reduced. A larger flow mismatch can therefore be allowed when core flow is < 70% of rated core flow. The recirculation loop jet pump flow, as used in this Surveillance, is the summation of the flows from all of the jet pumps associated with a single recirculation loop.
The mismatch is measured in terms of percent of rated core flow. This SR is not required when both loops are not in operation since the mismatch limits are meaningless during single loop or natural circulation operation. The Surveillance must be performed within 24 hours after both loops are in operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to recirculation loop flow values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).
(continued)
CLINTON                         B 3.4-7                  Revision No. 14-2

Recirculation Loops Operating B 3.4.1 BASES (continued)
REFERENCES        1. USAR, Section 6.3.3.7.
: 2. USAR, Section 5.4.1.1.
: 3. USAR, Chapter 15, Appendix 15B.
: 4. Calculation IP-0-0029.
: 5. Clinton Power Station SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis, NEDC-32945P, June 2000 CLINTON                           B 3.4-8                  Revision No. 11-1

FCVs B 3.4.2 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.2   Flow Control Valves (FCVs)
BASES BACKGROUND         The Reactor Coolant Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating," which discusses the operating characteristics of the system and how this affects the design basis transient and accident analyses. The jet pumps and the FCVs are part of the Reactor Coolant Recirculation System. The jet pumps are described in the Bases for LCO 3.4.3, "Jet Pumps."
The Recirculation Flow Control System consists of the electronic and hydraulic components necessary for the positioning of the two hydraulically actuated FCVs. The recirculation loop flow rate can be rapidly changed within the expected flow range, in response to rapid changes in system demand. Limits on the system response are required to minimize the impact on core flow response during certain accidents and transients. Solid state control logic will generate an FCV "motion inhibit" signal in response to any one of several hydraulic power unit or analog control circuit failure signals. The "motion inhibit" signal causes hydraulic power unit shutdown and hydraulic isolation such that the FCVs fail "as is."
APPLICABLE         The FCV stroke rate is hydraulically limited to d 30% per SAFETY ANALYSES    second in the opening direction and d 60% per second in the closing direction on a control signal failure of maximum demand. These stroke rates are assumptions of the analysis of the recirculation flow control failures on decreasing and increasing flow (Refs. 1 and 2).
In addition, the LOCA analysis of Reference 3 assumes that the initial core flow response is governed by the pump coastdown in the unbroken loop. Implicit in this assumption is that the FCV position does not change, i.e., fails "as is" with the exception that some FCV movement (drift) may be expected to occur due, for example, to hydraulic seal leakage. Such movement or drift is acceptable if it is within established design limits for the FCV(s), as such movement does not adversely impact the assumptions of the LOCA analysis, and is well within the rates assumed in the above-noted controller failure transient analyses.
Flow control valves satisfy Criterion 2 of the NRC Policy Statement.
(continued)
CLINTON                              B 3.4-9                   Revision No. 5-8

FCVs B 3.4.2 BASES   (continued)
LCO                 An FCV in each operating recirculation loop must be OPERABLE to ensure that the assumptions of the design basis transient and accident analyses are satisfied.
APPLICABILITY       In MODES 1 and 2, the FCVs are required to be OPERABLE, since during these conditions there is considerable energy in the reactor core, and the limiting design basis transients and accidents are assumed to occur. In MODES 3, 4, and 5, the consequences of a transient or accident are reduced and OPERABILITY of the flow control valves is not important.
ACTIONS             A Note has been provided to modify the ACTIONS related to FCVs. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition.
Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.
However, the Required Actions for inoperable FCVs provide appropriate compensatory measures for separate inoperable FCVs. As such, a Note has been provided that allows separate Condition entry for each inoperable FCV.
A.1 With one or two required FCVs inoperable, the assumptions of the design basis transient and accident analyses may not be met and each inoperable FCV must be returned to OPERABLE status or hydraulically locked within 4 hours.
Closing an FCV during a design basis LOCA could affect the recirculation flow coastdown for the unbroken loop, resulting in higher peak clad temperatures. Therefore, if an FCV is inoperable, deactivating the valve (motion inhibit) will essentially lock the valve in position, which will prohibit the FCV from adversely affecting the DBA analyses. Continued operation is allowed in this Condition.
(Note: Locking the FCV in position does not preclude nominal valve movement or drift due, for example, to hydraulic seal leakage. Such movement or drift is acceptable if it is within established design limits for the FCV(s), as such movement does not adversely impact the assumptions of the LOCA analysis, and is well within the rates assumed in the FCV controller failure transient analyses.)
The 4 hour Completion Time is a reasonable time period to complete the Required Action, while limiting the time of operation with an inoperable FCV.
(continued)
CLINTON                              B 3.4-10                   Revision No. 5-8

FCVs B 3.4.2 BASES ACTIONS           B.1 (continued)
If the FCVs are not deactivated, (locked up) and cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours. This brings the unit to a condition where the flow coastdown characteristics of the recirculation loop are not important. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE      SR  3.4.2.1 REQUIREMENTS Hydraulic power unit pilot operated isolation valves located between the servo valves and the common "open" and "close" lines are required to close in the event of a loss of hydraulic pressure. When closed, these valves inhibit FCV motion by blocking hydraulic pressure from the servo valve to the common open and close lines as well as to the alternate subloop. This Surveillance verifies FCV lockup on a loss of hydraulic pressure as assumed in the design basis LOCA analyses.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                            B 3.4-11                  Revision No. 14-2

FCVs B 3.4.2 BASES (continued)
REFERENCES        1. USAR, Section 15.3.2.
: 2. USAR, Section 15.4.5.
: 3. USAR, Section 6.3.3.
: 4. USAR, Section 5.4.1.
CLINTON                          B 3.4-12  Revision No. 2-3

Jet Pumps B 3.4.3 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.3   Jet Pumps BASES BACKGROUND          The Reactor Coolant Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating," which discusses the operating characteristics of the system and how these characteristics affect the Design Basis Accident (DBA) analyses.
The jet pumps are part of the Reactor Coolant Recirculation System and are designed to provide forced circulation through the core to remove heat from the fuel. The jet pumps are located in the annular region between the core shroud and the vessel inner wall. Because the jet pump suction elevation is at two thirds core height, the vessel can be reflooded and coolant level maintained at two thirds core height even with the complete break of the recirculation loop pipe that is located below the jet pump suction elevation.
Each reactor coolant recirculation loop contains 10 jet pumps. Recirculated coolant passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the drive flow.
The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core.
APPLICABLE          Jet pump OPERABILITY is an explicit assumption in the design SAFETY ANALYSES     basis loss of coolant accident (LOCA) analysis evaluated in Reference 1.
(continued)
CLINTON                              B 3.4-13                      Revision No. 0

Jet Pumps B 3.4.3 BASES APPLICABLE        The capability of reflooding the core to two-thirds core SAFETY ANALYSES   height is dependent upon the structural integrity of the jet (continued)     pumps. If the structural system, including the beam holding a jet pump in place, fails, jet pump displacement and performance degradation could occur, resulting in an increased flow area through the jet pump and a lower core flooding elevation. This could adversely affect the water level in the core during the reflood phase of a LOCA as well as the assumed blowdown flow during a LOCA.
Jet pumps satisfy Criterion 2 of the NRC Policy Statement.
LCO               The structural failure of any of the jet pumps could cause significant degradation in the ability of the jet pumps to allow reflooding to two thirds core height during a LOCA.
OPERABILITY of all jet pumps is required to ensure that operation of the Reactor Coolant Recirculation System will be consistent with the assumptions used in the licensing basis analysis (Ref. 1).
APPLICABILITY     In MODES 1 and 2, the jet pumps are required to be OPERABLE since there is a large amount of energy in the reactor core and since the limiting DBAs are assumed to occur in these MODES. This is consistent with the requirements for operation of the Reactor Coolant Recirculation System (LCO 3.4.1).
In MODES 3, 4, and 5, the Reactor Coolant Recirculation System is not required to be in operation, and when not in operation sufficient flow is not available to evaluate jet pump OPERABILITY.
ACTIONS           A.1 An inoperable jet pump can increase the blowdown area and reduce the capability of reflooding during a design basis LOCA. If one or more of the jet pumps are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                             B 3.4-14                    Revision No. 0

Jet Pumps B 3.4.3 BASES   (continued)
SURVEILLANCE        SR  3.4.3.1 REQUIREMENTS This SR is designed to detect significant degradation in jet pump performance that precedes jet pump failure (Ref. 2).
This SR is required to be performed only when the loop has forced recirculation flow since surveillance checks and measurements can only be performed during jet pump operation. The jet pump failure of concern is a complete mixer displacement due to jet pump beam failure. Jet pump plugging is also of concern since it adds flow resistance to the recirculation loop. Significant degradation is indicated if the specified criteria confirm unacceptable deviations from established patterns or relationships. The allowable deviations from the established patterns have been developed based on the variations experienced at plants during normal operation and with jet pump assembly failures (Refs. 2 and 3). Since refueling activities (fuel assembly replacement or shuffle, as well as any modifications to fuel support orifice size or core plate bypass flow) can affect the relationship between core flow, jet pump flow, and recirculation loop flow, these relationships may need to be re-established each cycle. Similarly, initial entry into extended single recirculation loop operation may also require establishment of these relationships. During the initial weeks of operation under such conditions, while baselining new "established patterns", engineering judgment of the daily surveillance results is used to detect significant abnormalities which could indicate a jet pump failure.
The recirculation flow control valve (FCV) operating characteristics (loop flow versus FCV position) are determined by the flow resistance from the loop suction through the jet pump nozzles. A change in the relationship indicates a flow restriction, loss in pump hydraulic performance, leak, or new flow path between the recirculation pump discharge and jet pump nozzle. For this criterion, the loop flow versus FCV position relationship must be verified.
Total core flow can be determined from measurements of the recirculation loop drive flows. Once this relationship has been established, increased or reduced total core flow for the same recirculation loop drive flow may be an indication of failures in one or several jet pumps.
(continued)
CLINTON                               B 3.4-15                    Revision No. 0

Jet Pumps B 3.4.3 BASES SURVEILLANCE SR  3.4.3.1  (continued)
REQUIREMENTS Individual jet pumps in a recirculation loop typically do not have the same flow. The unequal flow is due to the drive flow manifold, which does not distribute flow equally to all risers. The flow (or jet pump diffuser to lower plenum differential pressure) pattern or relationship of one jet pump to the loop average is repeatable. An appreciable change in this relationship is an indication that increased (or reduced) resistance has occurred in one of the jet pumps. This may be indicated by an increase in the relative flow for a jet pump that has experienced beam cracks.
The deviations from normal are considered indicative of a potential problem in the recirculation drive flow or jet pump system (Ref. 2). Normal flow ranges and established jet pump flow and differential pressure patterns are established by plotting historical data as discussed in Reference 2.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by two Notes. Note 1 allows this Surveillance not to be performed until 4 hours after the associated recirculation loop is in operation, since these checks can only be performed during jet pump operation. The 4 hours is an acceptable time to establish conditions appropriate for data collection and evaluation.
Note 2 allows this SR not to be performed when THERMAL POWER is d 21.6% RTP. During low flow conditions, jet pump noise approaches the threshold response of the associated flow instrumentation and precludes the collection of repeatable and meaningful data.
With regard to drive flow and differential pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).
REFERENCES   1. USAR, Section 6.3.3.
: 2. GE Service Information Letter No. 330, "Jet Pump Beam Cracks," June 9, 1990.
: 3. NUREG/CR-3052, "Closeout of IE Bulletin 80-07:   BWR Jet Pump Assembly Failure," November 1984.
: 4. Calculation IP-0-0031.
CLINTON                       B 3.4-16                  Revision No. 14-2

S/RVs B 3.4.4 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.4   Safety/Relief Valves (S/RVs)
BASES BACKGROUND         The American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (Ref. 1) requires the Reactor Pressure Vessel be protected from overpressure during upset conditions by self actuated safety valves. As part of the nuclear pressure relief system, the size and number of safety/relief valves (S/RVs) are selected such that peak pressure in the nuclear system will not exceed the ASME Code limits for the reactor coolant pressure boundary (RCPB).
The S/RVs are located on the main steam lines between the reactor vessel and the first isolation valve within the drywell. Each S/RV discharges steam through a discharge line to a point below the minimum water level in the suppression pool.
The S/RVs can actuate by either of two modes: the safety mode or the relief mode. In the safety mode (or spring mode of operation), the direct action of the steam pressure in the main steam lines will act against a spring loaded disk that will pop open when the valve inlet pressure exceeds the spring force. In the relief mode (or power actuated mode of operation), a pneumatic piston or cylinder and mechanical linkage assembly are used to open the valve by overcoming the spring force, even with the valve inlet pressure equal to 0 psig. The pneumatic operator is arranged so that its malfunction will not prevent the valve disk from lifting if steam inlet pressure reaches the spring lift set pressures.
In the relief mode, valves may be opened manually or automatically at the selected preset pressure. Five of the S/RVs providing the relief function also provide the low-low set relief function specified in LCO 3.6.1.6, "Low-Low Set (LLS) Valves." Seven of the S/RVs that provide the relief function are part of the Automatic Depressurization System specified in LCO 3.5.1, "ECCS  Operating." The instrumentation associated with the relief valve function and low-low set relief function is discussed in the Bases for LCO 3.3.6.5, "Relief and Low-Low Set (LLS)
Instrumentation," and instrumentation for the ADS function is discussed in LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation."
(continued)
CLINTON                              B 3.4-17                     Revision No. 0

S/RVs B 3.4.4 BASES   (continued)
APPLICABLE          The overpressure protection system must accommodate the SAFETY ANALYSES     most severe pressure transient. Evaluations have determined that the most severe transient is the closure of all main steam isolation valves (MSIVs) followed by reactor scram on high neutron flux (i.e., failure of the direct scram associated with MSIV position) (Ref. 2). For the purpose of the analyses, five of the S/RVs are assumed to operate in the relief mode, and six in the safety mode. The analysis results demonstrate that the design S/RV capacity is capable of maintaining reactor pressure below the ASME Code limit of 110% of vessel design pressure (110% x 1250 psig =
1375 psig). This LCO helps to ensure that the acceptance limit of 1375 psig is met during the design basis event.
References 3 and 4 discuss additional events that are expected to actuate the S/RVs. From an overpressure standpoint, the design basis events are bounded by the MSIV closure with flux scram event described above. However, Reference 4 evaluated plant response to other plant events, including abnormal operational occurrences, ECCS/Loss of Coolant Accident performance, and anticipated transient without scram (ATWS) performance. Reference 4 provides an analytical basis for the plant remaining in an analyzed condition as long as 14 of the 16 S/RVs (including the Technical Specification-required low-low set function and the ADS function) are operable and safety-mode opening setpoints are within the +/- 3% tolerance band of the corresponding nominal trip setpoints. Operation in the maximum extended operating domain (MEOD) region and concurrent with feedwater heaters out of service (FWHOS) has also been included in these evaluations.
S/RVs satisfy Criterion 3 of the NRC Policy Statement.
LCO                 The safety function of six S/RVs is required to be OPERABLE in the safety mode, and an additional five S/RVs (other than the six S/RVs that satisfy the safety function) must be OPERABLE in the relief mode. The requirements of this LCO are applicable only to the capability of the S/RVs to mechanically open to relieve excess pressure. In Reference 2, an evaluation was performed to establish the parametric relationship between the peak vessel pressure and the number of OPERABLE S/RVs. The results show that with a minimum of six S/RVs in the safety mode and five S/RVs in (continued)
CLINTON                              B 3.4-18                     Revision No. 0

S/RVs B 3.4.4 BASES LCO           the relief mode OPERABLE, the ASME Code limit of 1375 psig (continued) is not exceeded.
The S/RV setpoints are established to ensure the ASME Code limit on peak reactor pressure is satisfied. The ASME Code specifications require the lowest safety valve be set at or below vessel design pressure (1250 psig) and the highest safety valve be set so the total accumulated pressure does not exceed 110% of the design pressure for conditions. The transient evaluations in Reference 4 are based on these setpoints, but also include the additional uncertainties of
              +/- 3% of the nominal setpoint to account for potential setpoint drift to provide an added degree of conservatism.
Operation with fewer valves OPERABLE than specified, or with setpoints outside the ASME limits, could result in a more severe reactor response to a transient than predicted, possibly resulting in the ASME Code limit on reactor pressure being exceeded.
APPLICABILITY In MODES 1, 2, and 3, the specified number of S/RVs must be OPERABLE since there may be considerable energy in the reactor core and the limiting design basis transients are assumed to occur. The S/RVs may be required to provide pressure relief to discharge energy from the core until such time that the Residual Heat Removal (RHR) System is capable of dissipating the heat.
In MODE 4, decay heat is low enough for the RHR System to provide adequate cooling, and reactor pressure is low enough that the overpressure limit is unlikely to be approached by assumed operational transients or accidents. In MODE 5, the reactor vessel head is unbolted or removed and the reactor is at atmospheric pressure. The S/RV function is not needed during these conditions.
ACTIONS       A.1 and A.2 With less than the minimum number of required S/RVs OPERABLE, a transient may result in the violation of the ASME Code limit on reactor pressure. If one or more required S/RVs are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within (continued)
CLINTON                        B 3.4-19                     Revision No. 0

S/RVs B 3.4.4 BASES ACTIONS      A.1 and A.2  (continued) 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE SR  3.4.4.1 REQUIREMENTS This Surveillance demonstrates that the required S/RVs will open at the pressures assumed in the safety analysis of Reference 4. The demonstration of the S/RV safety function lift settings must be performed during shutdown, since this is a bench test, and in accordance with the INSERVICE TESTING PROGRAM. The lift setting pressure shall correspond to ambient conditions of the valves at nominal operating temperatures and pressures. The S/RV setpoint is +/- 3% for OPERABILITY; however, the valves are reset to +/- 1% during the Surveillance to allow for drift.
The Frequency was selected because this Surveillance must be performed during shutdown conditions and is based on the time between refuelings.
With regard to pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 5).
SR  3.4.4.2 The required relief function S/RVs are required to actuate automatically upon receipt of specific initiation signals.
A system functional test is performed to verify the mechanical portions (i.e., solenoids) of the automatic relief function operate as designed when initiated either by an actual or simulated initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.5.4 overlaps this SR to provide complete testing of the safety function.
(continued)
CLINTON                       B 3.4-20                  Revision No. 19-4

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.2  (continued)
REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that excludes valve actuation.
This prevents an RPV pressure blowdown.
SR  3.4.4.3 A manual actuation of each required S/RV (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by Method 1, plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements (Ref. 6), prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours after reactor steam pressure and flow are adequate to perform the test. The 12 hours allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR. If performed by Method 2, valve OPERABILITY has been demonstrated for all installed S/RVs based upon the successful operation of a test sample of S/RVs.
: 1. Manual actuation of the S/RV with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g.,
tailpipe temperature or acoustic monitoring).
Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the S/RVs divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.
(continued)
CLINTON                       B 3.4-21                  Revision No. 14-2

S/RVs B 3.4.4 BASES SURVEILLANCE SR  3.4.4.3  (continued)
REQUIREMENTS
: 2. The sample population of S/RVs tested to satisfy SR 3.4.4.1 will also be stroked in the relief mode during as-found testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs provides reasonable assurance that the remaining installed S/RVs will perform in a similar fashion. After the S/RVs are replaced, the relief-mode actuator of the newly-installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure that no damage has occurred to the S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the proper positioning of the stem nut is independently verified.
This verifies that each replaced S/RV will properly perform its intended function. If the valve fails to actuate due only to the failure of the solenoid but is capable of opening on overpressure, the safety function of the S/RV is considered OPERABLE.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES   1. ASME, Boiler and Pressure Vessel Code, Section III.
: 2. USAR, Section 5.2.2.
: 3. USAR, Section 15.
: 4. NEDC-32202P, "SRV Setpoint Tolerance and Out-of-Service Analysis for Clinton Power Station, "August 1993."
: 5. Calculation IP-0-0032.
: 6. ASME/ANSI OM-1987, Operation and Maintenance of Nuclear Power Plants, Part 1.
: 7. ASME Code for Operation and Maintenance of Nuclear Power Plants.
CLINTON                       B 3.4-22                  Revision No. 14-2

RCS Operational LEAKAGE B 3.4.5 B 3.4    REACTOR COOLANT SYSTEM (RCS)
B 3.4.5  RCS Operational LEAKAGE BASES BACKGROUND        The RCS includes systems and components that contain or transport the coolant to or from the reactor core. The pressure containing components of the RCS and the portions of connecting systems out to and including the isolation valves define the reactor coolant pressure boundary (RCPB).
The joints of the RCPB components are welded or bolted.
During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration.
Limits on RCS operational LEAKAGE are required to ensure appropriate action is taken before the integrity of the RCPB is impaired. This LCO specifies the types and limits of LEAKAGE.
This protects the RCS pressure boundary described in 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, and 3).
The safety significance of leaks from the RCPB varies widely depending on the source, rate, and duration. Therefore, detection of LEAKAGE in the drywell is necessary. Methods for quickly separating the identified LEAKAGE from the unidentified LEAKAGE are necessary to provide the operators quantitative information to permit them to take corrective action should a leak occur detrimental to the safety of the facility or the public.
A limited amount of leakage inside the drywell is expected from auxiliary systems that cannot be made 100% leaktight.
Leakage from these systems should be detected and isolated from the drywell atmosphere, if possible, so as not to mask RCS operational LEAKAGE detection.
This LCO deals with protection of the RCPB from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release (continued)
CLINTON                            B 3.4-23                     Revision No. 0

RCS Operational LEAKAGE B 3.4.5 BASES BACKGROUND        assumptions from being exceeded. The consequences of (continued)     violating this LCO include the possibility of a loss of coolant accident.
APPLICABLE        The allowable RCS operational LEAKAGE limits are based on SAFETY ANALYSES   the predicted and experimentally observed behavior of pipe cracks. The normally expected background LEAKAGE due to equipment design and the detection capability of the instrumentation for determining system LEAKAGE were also considered. The evidence from experiments suggests, for LEAKAGE even greater than the specified unidentified LEAKAGE limits, the probability is small that the imperfection or crack associated with such LEAKAGE would grow rapidly.
The unidentified LEAKAGE flow limit allows time for corrective action before the RCPB could be significantly compromised. The 5 gpm limit is a small fraction of the calculated flow from a critical crack in the primary system piping. Crack behavior from experimental programs (Refs. 4 and 5) shows leak rates of hundreds of gallons per minute will precede crack instability (Ref. 6).
The low limit on increase in unidentified LEAKAGE assumes a failure mechanism of intergranular stress corrosion cracking (IGSCC) that produces tight cracks. This flow increase limit is capable of providing an early warning of such deterioration.
No applicable safety analysis assumes the total LEAKAGE limit. The total LEAKAGE limit considers RCS inventory makeup capability and drywell floor sump capacity.
RCS operational LEAKAGE satisfies Criterion 2 of the NRC Policy Statement.
LCO               RCS operational LEAKAGE shall be limited to:
: a. Pressure Boundary LEAKAGE Pressure boundary LEAKAGE is prohibited as the leak itself could cause further RCPB deterioration, resulting in higher LEAKAGE.
(continued)
CLINTON                             B 3.4-24                Revision No. 21-11

RCS Operational LEAKAGE B 3.4.5 BASES LCO           b. Unidentified LEAKAGE (continued)
Five gpm of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the drywell atmospheric monitoring, drywell sump level monitoring, and drywell air cooler condensate flow rate monitoring equipment can detect within a reasonable time period.
Separating the sources of LEAKAGE (i.e., LEAKAGE from an identified source versus LEAKAGE from an unidentified source) is necessary for prompt identification of potentially adverse conditions, assessment of the safety significance, and corrective action.
: c. Total LEAKAGE The total LEAKAGE limit is based on a reasonable minimum detectable amount. The limit also accounts for LEAKAGE from known sources (identified LEAKAGE).
Violation of this LCO indicates an unexpected amount of LEAKAGE and, therefore, could indicate new or additional degradation in an RCPB component or system.
: d. Unidentified LEAKAGE Increase An unidentified LEAKAGE increase of > 2 gpm within the previous 24 hour period indicates a potential flaw in the RCPB and must be quickly evaluated to determine the source and extent of the LEAKAGE. The increase is measured relative to the steady state value; temporary changes in LEAKAGE rate as a result of transient conditions (e.g., startup) are not considered. As such, the 2 gpm increase limit is only applicable in MODE 1 when operating pressures and temperatures are established.
APPLICABILITY In MODES 1, 2, and 3, the RCS operational LEAKAGE LCO applies because the potential for RCPB LEAKAGE is greatest when the reactor is pressurized.
In MODES 4 and 5, RCS operational LEAKAGE limits are not required since the reactor is not pressurized and stresses in the RCPB materials and potential for LEAKAGE are reduced.
(continued)
CLINTON                        B 3.4-25                 Revision No. 21-11

RCS Operational LEAKAGE B 3.4.5 BASES (continued)
ACTIONS           A.1 If pressure boundary LEAKAGE exists, the affected component, pipe, or vessel must be isolated from the RCS by a closed manual valve, closed and de-activated automatic valve, blind flange, or check valve within 4 hours. While in this condition, structural integrity of the system should be considered because the structural integrity of the part of the system within the isolation boundary must be maintained under all licensing basis conditions, including consideration of the potential for further degradation of the isolated location. Normal LEAKAGE past the isolation device is acceptable as it will limit RCS LEAKAGE and is included in identified or unidentified LEAKAGE. This action is necessary to prevent further deterioration of the RCPB.
B.1 With RCS unidentified or total LEAKAGE greater than the limits, actions must be taken to reduce the leakage.
Because the LEAKAGE limits are conservatively below the LEAKAGE that would constitute a critical crack size, 4 hours is allowed to reduce the LEAKAGE rates before the reactor must be shut down. If an unidentified LEAKAGE has been identified and quantified, it may be reclassified and considered as identified LEAKAGE. However, the total LEAKAGE limit would remain unchanged.
C.1 An unidentified LEAKAGE increase of > 2 gpm within a 24 hour period is an indication of a potential flaw in the RCPB and must be quickly evaluated. Although the increase does not necessarily violate the absolute unidentified LEAKAGE limit, certain susceptible components must be determined not to be the source of the LEAKAGE increase within the required Completion Time. For an unidentified LEAKAGE increase greater than required limits, an alternative to reducing LEAKAGE increase to within limits (i.e., reducing the leakage rate such that the current rate is less than the 2 gpm increase in the previous 24 hours; either by isolating the source or other possible methods) is to evaluate RCS type 304 and type 316 austenitic stainless steel piping that is subject to high stress or that contains relatively stagnant or intermittent flow fluids and determine it is not the source of the increased LEAKAGE. This type of piping is very susceptible to IGSCC.
The 4 hour Completion Time is needed to properly reduce the LEAKAGE increase or verify the source before the reactor must be shut down.
(continued)
CLINTON                            B 3.4-26                  Revision No. 21-11

RCS Operational LEAKAGE B 3.4.5 BASES ACTIONS           D.1 and D.2 (continued)
If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE      SR  3.4.5.1 REQUIREMENTS The RCS LEAKAGE is monitored by a variety of instruments designed to quantify the various types of LEAKAGE. Leakage detection instrumentation is discussed in more detail in the Bases for LCO 3.4.7, "RCS Leakage Detection Instrumentation." Sump level and flow rate are typically monitored to determine actual LEAKAGE rates. However, any method may be used to quantify LEAKAGE within the guidelines of Reference 7. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to LEAKAGE values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).
REFERENCES        1. 10 CFR 50.2.
: 2. 10 CFR 50.55a(c).
: 3. 10 CFR 50, Appendix A, GDC 55.
: 4. GEAP-5620, "Failure Behavior in ASTM A106B Pipes Containing Axial Through  Wall Flaws," April 1968.
: 5. NUREG-75/067, "Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactor Plants," October 1975.
: 6. USAR, Section 5.2.5.5.3.
: 7. Regulatory Guide 1.45, May 1973.
: 8. Calculation IP-0-0033.
CLINTON                            B 3.4-27                  Revision No. 21-11

RCS PIV Leakage B 3.4.6 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.6   RCS Pressure Isolation Valve (PIV) Leakage BASES BACKGROUND         RCS PIVs are defined as any two normally closed valves in series within the reactor coolant pressure boundary (RCPB).
The function of RCS PIVs is to separate the high pressure RCS from an attached low pressure system. This protects the RCS pressure boundary described in 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, and 3). PIVs are designed to meet the requirements of Reference 4. During their lives, these valves can produce varying amounts of reactor coolant leakage through either normal operational wear or mechanical deterioration.
The RCS PIV LCO allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety. The PIV leakage limit applies to each individual valve. Leakage through these valves is not included in any allowable LEAKAGE specified in LCO 3.4.5, "RCS Operational LEAKAGE."
Although this Specification provides a limit on allowable PIV leakage rate, its main purpose is to prevent overpressure failure of the low pressure portions of connecting systems. The leakage limit is an indication that the PIVs between the RCS and the connecting systems are degraded or degrading. PIV leakage could lead to overpressure of the low pressure piping or components.
Failure consequences could be a loss of coolant accident (LOCA) outside of containment, an unanalyzed accident which could degrade the ability for low pressure injection.
A study (Ref. 5) evaluated various PIV configurations to determine the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce intersystem LOCA probability.
PIVs are provided to isolate the RCS from the following connected systems:
(continued)
CLINTON                              B 3.4-28                  Revision No. 1-1

RCS PIV Leakage B 3.4.6 BASES BACKGROUND      a. Residual Heat Removal (RHR) System; (continued)
: b. Low Pressure Core Spray System;
: c. High Pressure Core Spray System; and
: d. Reactor Core Isolation Cooling System.
The PIVs are listed in Reference 6.
APPLICABLE      Reference 5 evaluated various PIV configurations, leakage SAFETY ANALYSES testing of the valves, and operational changes to determine the effect on the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce the probability of an intersystem LOCA.
PIV leakage is not considered in any Design Basis Accident analyses. This Specification provides for monitoring the condition of the RCPB to detect PIV degradation that has the potential to cause a LOCA outside of containment. RCS PIV leakage satisfies Criterion 2 of the NRC Policy Statement.
LCO             RCS PIV leakage is leakage into closed systems connected to the RCS. Isolation valve leakage is usually on the order of drops per minute. Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken. Violation of this LCO could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.
The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with a maximum limit of 5 gpm.
Reference 7 permits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure of the connected system during RCS operation (the maximum pressure differential). The observed rate may be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one-half power.
(continued)
CLINTON                           B 3.4-29                    Revision No. 0

RCS PIV Leakage B 3.4.6 BASES   (continued)
APPLICABILITY       In MODES 1, 2, and 3, this LCO applies because the PIV leakage potential is greatest when the RCS is pressurized.
In MODE 3, valves in the RHR flowpath are not required to meet the requirements of this LCO when in, or during transition to or from, the RHR shutdown cooling mode of operation.
In MODES 4 and 5, leakage limits are not provided because the lower reactor coolant pressure results in a reduced potential for leakage and for a LOCA outside the containment. Accordingly, the potential for the consequences of reactor coolant leakage is far lower during these MODES.
ACTIONS             The ACTIONS are modified by two Notes. Note 1 has been provided to modify the ACTIONS related to RCS PIV flow paths. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition.
Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.
However, the Required Actions for the Condition of RCS PIV leakage limits exceeded provide appropriate compensatory measures for separate affected RCS PIV flow paths. As such, a Note has been provided that allows separate Condition entry for each affected RCS PIV flow path. Note 2 requires an evaluation of affected systems if a PIV is inoperable.
The leakage may have affected system OPERABILITY, or isolation of a leaking flow path with an alternate valve may have degraded the ability of the interconnected system to perform its safety function. As a result, the applicable Conditions and Required Actions for systems made inoperable by PIVs must be entered. This ensures appropriate remedial actions are taken, if necessary, for the affected systems.
A.1 and A.2 If leakage from one or more RCS PIVs is not within limit, the flow path must be isolated by at least one closed (continued)
CLINTON                              B 3.4-30                     Revision No. 0

RCS PIV Leakage B 3.4.6 BASES ACTIONS           A.1 and A.2  (continued) manual, deactivated automatic, or check valve within 4 hours. Required Action A.1 is modified by a Note stating that the valves used for isolation must meet the same leakage requirements as the PIVs and must be on the RCPB or the high pressure portion of the system.
Four hours provides time to reduce leakage in excess of the allowable limit and to isolate the flow path if leakage cannot be reduced while corrective actions to reseat the leaking PIVs are taken. The 4 hours allows time for these actions and restricts the time of operation with leaking valves.
Required Action A.2 specifies that the double isolation barrier of two valves be restored by closing another valve qualified for isolation or restoring one leaking PIV. The 72 hour Completion Time after exceeding the limit considers the time required to complete the Required Action, the low probability of a second valve failing during this time period, and the low probability of a pressure boundary rupture of the low pressure ECCS piping when overpressurized to reactor pressure (Ref. 8).
B.1 and B.2 If leakage cannot be reduced or the system isolated, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours and to MODE 4 within 36 hours. This action may reduce the leakage and also reduces the potential for a LOCA outside the containment. The Completion Times are reasonable, based on operating experience, to achieve the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                            B 3.4-31                     Revision No. 0

RCS PIV Leakage B 3.4.6 BASES (continued)
SURVEILLANCE      SR  3.4.6.1 REQUIREMENTS Performance of leakage testing on each RCS PIV is required to verify that leakage is below the specified limit and to identify each leaking valve. The leakage limit of 0.5 gpm per inch of nominal valve diameter up to 5 gpm maximum applies to each valve. Leakage testing requires a stable pressure condition. For the two PIVs in series, the leakage requirement applies to each valve individually and not to the combined leakage across both valves. If the PIVs are not individually leakage tested, one valve may have failed completely and not be detected if the other valve in series meets the leakage requirement. In this situation, the protection provided by redundant valves would be lost.
The Frequency required by the INSERVICE TESTING PROGRAM is within the ASME Code Frequency requirement and is based on the need to perform this surveillance under the conditions that apply during an outage and the potential for an unplanned transient if the surveillance were performed with the reactor at power.
Therefore, this SR is modified by a Note that states the leakage Surveillance is not required to be performed in MODE 3. Entry into MODE 3 is permitted for leakage testing at high differential pressures with stable conditions not possible in the lower MODES.
With regard to leakage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).
(continued)
CLINTON                            B 3.4-32                  Revision No. 19-4

RCS PIV Leakage B 3.4.6 BASES (continued)
REFERENCES        1. 10 CFR 50.2.
: 2. 10 CFR 50.55a(c).
: 3. 10 CFR 50, Appendix A, GDC 55.
: 4. ASME Code for Operation and Maintenance of Nuclear Power Plants.
: 5. NUREG-0677, "The Probability of Intersystem LOCA:
Impact Due to Leak Testing and Operational Changes,"
May 1980.
: 6. CPS ISI Program Manual.
: 7. ASME Operations and Maintenance Code, Part 10, Inservice Testing of Valves in Light-Water Reactor Power Plants, 4.2.2.3(b)(4).
: 8. NEDC-31339, "BWR Owners Group Assessment of ECCS Pressurization in BWRs," November 1986.
: 9. Calculation IP-0-0034.
CLINTON                            B 3.4-32a                 Revision No. 13-3

This page intentionally left blank.
CLINTON              B 3.4-32b              Revision No. 4-6

RCS Leakage Detection Instrumentation B 3.4.7 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.7   RCS Leakage Detection Instrumentation BASES BACKGROUND         GDC 30 of 10 CFR 50, Appendix A (Ref. 1), requires means for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.
Limits on LEAKAGE from the reactor coolant pressure boundary (RCPB) are required so that appropriate action can be taken before the integrity of the RCPB is impaired (Ref. 2).
Leakage detection systems for the RCS are provided to alert the operators when leakage rates above normal background levels are detected and also to supply quantitative measurement of rates. The Bases for LCO 3.4.5, "RCS Operational LEAKAGE," discuss the limits on RCS LEAKAGE rates.
Systems for separating the LEAKAGE of an identified source from an unidentified source are necessary to provide prompt and quantitative information to the operators to permit them to take immediate corrective action.
LEAKAGE from the RCPB inside the drywell is detected by at least one of three independently monitored variables, such as sump level changes and drywell gaseous and particulate radioactivity levels. The primary means of quantifying LEAKAGE in the drywell is the drywell floor drain sump monitoring system.
The drywell floor drain sump monitoring system monitors the LEAKAGE collected in the floor drain sump. This unidentified LEAKAGE consists of LEAKAGE from control rod drives, valve flanges or packings, floor drains, the Component Cooling Water System, and drywell air cooling unit condensate drains, and any LEAKAGE not collected in the drywell equipment drain sump.
(continued)
CLINTON                              B 3.4-33                   Revision No. 3-1

RCS Leakage Detection Instrumentation B 3.4.7 BASES BACKGROUND    The drywell floor drain sump has two flow monitoring (continued) systems: 1) a magnetic flow meter installed on the discharge piping of the drywell floor drain pumps and a flow totalizer converter installed in the vicinity of the flow element; and 2) a bubbler type level sensing system installed in the drywell floor drain sump pit.
The flow totalizer converter provides local indication of total pump discharge flow and discharge flow rate. It also provides a signal representing actual pump discharge flow rate to a programmable logic controller (PLC), in the main control room. The PLC calculates the average (total) and actual pump discharge flow by integrating the signal from the flow totalizer converter and dividing the result by the total time between pump cycles. When the sump in the drywell reaches a high level, one of the two pumps start (the pumps alternate each cycle) pumping water to the drain sump collector tank. This operation continues until the sump level reaches a low level setting. When the pump stops, the PLC senses a "no flow" signal and resets the timer, performs the average flow rate calculation, and transmits the resulting signal to a recorder, an analog computer point and a totalizer (counter). The PLC also generates main control room alarms to indicate high flow (3.6 gpm), and large flow increase (2 gpm/24 hours). This operation is repeated every time a sump pump completes its cycle. The sump pumps can also be operated with the control switch in "manual" which automatically controls starting and stopping of both pumps within a smaller range.
The bubbler type level sensor provides a pneumatic level signal to a differential pressure transmitter installed in the containment building. The level transmitter provides a level signal to the PLC in the main control room. The PLC calculates the total inleakage flow rate by measuring the level and calculating a rate of change once every minute and provides alternating pump operation. From this signal, the PLC generates three analog output signals representing total inleakage flow rate and sump pit level. These signals are transmitted to a recorder, analog computer point, and to a digital counter. The PLC also generates main control room annunciators to indicate high flow rate (3.6 gpm), sump Hi-Hi water level, and large flow increase (2 gpm/24 hours),
and produces a computer alarm for system inoperable (PLC diagnostic fault, or level signal out of range).
(continued)
CLINTON                        B 3.4-34                   Revision No. 3-5

RCS Leakage Detection Instrumentation B 3.4.7 BASES BACKGROUND    The drywell floor drain sump also has level switches that (continued) start and stop the sump pumps when required. A timer starts each time the sump is pumped down to the low level setpoint.
If the sump fills to the high level setpoint before the timer ends, an alarm sounds in the control room, indicating a LEAKAGE rate into the sump in excess of a preset limit. A second timer starts when the sump pumps start on high level.
Should this timer run out before the sump level reaches the low level setpoint, an alarm is sounded in the control room indicating a LEAKAGE rate into the sump in excess of a preset limit.
Because proper functioning of the drywell floor drain sump monitoring instrumentation is dependent upon the ability to collect the LEAKAGE in the drywell floor drain sump, the drywell floor drain sump inlet piping is periodically verified to be unblocked, as described in Ref. 7.
The drywell atmospheric monitoring systems continuously monitor the drywell atmosphere for airborne particulate and gaseous radioactivity. A sudden increase of radioactivity, which may be attributed to RCPB steam or reactor water LEAKAGE, is annunciated in the control room. The drywell atmosphere`ic particulate and gaseous radioactivity monitoring systems are not capable of quantifying leakage rates. (Ref. 3)
Two of the drywell cooling system coil cabinets are equipped with condensate flow monitoring equipment to provide a diverse means of detecting, but not quantifying RCS unidentified leakage. Condensate flow is detected by means of an inline rotameter (flow transmitter) that provides an alarm in the main control room. At least one of the two associated drywell cooling system coil cabinets (and its flow monitoring device) must be in service to meet the OPERABILITY requirements of the leakage detection system.
(continued)
CLINTON                        B 3.4-34a                  Revision No. 5-4

RCS Leakage Detection Instrumentation B 3.4.7 BASES (continued)
APPLICABLE        A threat of significant compromise to the RCPB exists if the SAFETY ANALYSES   barrier contains a crack that is large enough to propagate rapidly. LEAKAGE rate limits are set low enough to detect the LEAKAGE emitted from a single crack in the RCPB (Refs. 4 (continued)
CLINTON                            B 3.4-34b                 Revision No. 2-13

RCS Leakage Detection Instrumentation B 3.4.7 BASES APPLICABLE      and 5). Each of the leakage detection systems inside the SAFETY ANALYSES drywell is designed with the capability of detecting LEAKAGE (continued)   less than the established LEAKAGE rate limits.
Identification of the LEAKAGE allows the operators to evaluate the significance of the indicated LEAKAGE and, if necessary, shut down the reactor for further investigation and corrective action. The allowed LEAKAGE rates are well below the rates predicted for critical crack sizes (Ref. 6).
Therefore, these actions provide adequate response before a significant break in the RCPB can occur.
RCS leakage detection instrumentation satisfies Criterion 1 of the NRC Policy Statement.
LCO             The drywell floor drain sump flow monitoring system is required to quantify the unidentified LEAKAGE from the RCS.
Thus, for the system to be considered OPERABLE, either the sump level rate of change, or the sump pump discharge flow monitoring portion of the system must be OPERABLE. The other monitoring systems provide qualitative indication to the operators so closer examination of other detection systems will be made to determine the extent of any corrective action that may be required. With the leakage detection systems inoperable, monitoring for LEAKAGE in the RCPB is degraded.
APPLICABILITY   In MODES 1, 2, and 3, leakage detection systems are required to be OPERABLE to support LCO 3.4.5. This Applicability is consistent with that for LCO 3.4.5.
ACTIONS         A.1 With both drywell floor drain sump flow monitoring systems inoperable, no other form of sampling can provide the equivalent information to quantify leakage. However, the drywell atmospheric activity monitor and the drywell air cooler condensate flow rate monitor will provide indications of changes in leakage.
With both drywell floor drain sump monitoring systems inoperable, but with RCS unidentified and total LEAKAGE being determined (SR 3.4.5.1), operation may (continued)
CLINTON                           B 3.4-35                  Revision No. 14-2

RCS Leakage Detection Instrumentation B 3.4.7 BASES ACTIONS           A.1  (continued) continue for 30 days. The 30 day Completion Time of Required Action A.1 is acceptable, based on operating experience, considering the multiple forms of leakage detection that are still available.
B.1 With both gaseous and particulate drywell atmospheric monitoring channels inoperable, grab samples of the drywell atmosphere shall be taken and analyzed to provide periodic leakage information. Provided a sample is obtained and analyzed every 24 hours, the plant may continue operation since at least one other form of drywell leakage detection (i.e., air cooler condensate flow rate monitor) is available. The 24 hour interval provides periodic information that is adequate to detect LEAKAGE.
C.1 With the required drywell air cooler condensate flow rate monitoring system inoperable, SR 3.4.7.1 is performed every 8 hours to provide periodic information of activity in the drywell at a more frequent interval than the routine Frequency of SR 3.4.7.1. The 8 hour interval provides periodic information that is adequate to detect LEAKAGE and recognizes that other forms of leakage detection are available. However, this Required Action is modified by a Note that allows this action to be not applicable if the required drywell atmospheric monitoring system is inoperable. Consistent with SR 3.0.1, Surveillances are not required to be performed on inoperable equipment.
(continued)
CLINTON                            B 3.4-36                  Revision No. 10-3

RCS Leakage Detection Instrumentation B 3.4.7 BASES ACTIONS           D.1 and D.2 (continued)
With both the gaseous and particulate drywell atmospheric monitor channels and the drywell air cooler condensate flow rate monitor inoperable, the only means of detecting LEAKAGE is the drywell floor drain sump monitoring system. This Condition does not provide the required diverse means of leakage detection. The Required Action is to restore either of the inoperable monitoring systems to OPERABLE status within 30 days to regain the intended leakage detection diversity. The 30 day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period.
E.1 and E.2 If any Required Action of Condition A, B, C, or D cannot be met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions in an orderly manner and without challenging plant systems.
F.1 With all required monitors inoperable, no required automatic means of monitoring LEAKAGE are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.
SURVEILLANCE      SR  3.4.7.1 REQUIREMENTS This SR requires the performance of a CHANNEL CHECK of the required drywell atmospheric monitoring system. The check (continued)
CLINTON                            B 3.4-37                  Revision No. 10-3

RCS Leakage Detection Instrumentation B 3.4.7 BASES SURVEILLANCE      SR  3.4.7.1  (continued)
REQUIREMENTS gives reasonable confidence that the channel is operating properly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.4.7.2 This SR requires the performance of a CHANNEL FUNCTIONAL TEST of the required RCS leakage detection instrumentation. The test ensures that the monitors can perform their function in the desired manner. The test also verifies the relative accuracy of the instrumentation. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are periodically verified by other Technical Specifications and non-Technical Specifications tests. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.4.7.3 This SR requires the performance of a CHANNEL CALIBRATION of the required RCS leakage detection instrumentation channels.
The calibration verifies the accuracy of the instrumentation, including the instruments located inside the drywell. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. 10 CFR 50, Appendix A, GDC 30.
: 2. Regulatory Guide 1.45.
: 3. USAR, Section 5.2.5.2.2.
: 4. GEAP-5620, "Failure Behavior in ASTM A106B Pipes Containing Axial Through  Wall Flaws," April 1968.
: 5. NUREG-75/067, "Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactor Plants," October 1975.
: 6. USAR, Section 5.2.5.5.3.
: 7. USAR, Section 5.2.5.9.
CLINTON                            B 3.4-38                   Revision No. 21-4

RCS Specific Activity B 3.4.8 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.8   RCS Specific Activity BASES BACKGROUND         During circulation, the reactor coolant acquires radioactive materials due to release of fission products from fuel leaks into the coolant and activation of corrosion products in the reactor coolant. These radioactive materials in the coolant can plate out in the RCS, and, at times, an accumulation will break away to spike the normal level of radioactivity.
The release of coolant during a Design Basis Accident (DBA) could send radioactive materials into the environment.
Limits on the maximum allowable level of radioactivity in the reactor coolant are established to ensure, in the event of a release of any radioactive material to the environment during a DBA, radiation doses are maintained within the limits of 10 CFR 100 (Ref. 1).
This LCO contains iodine specific activity limits. The iodine isotopic activities per gram of reactor coolant are expressed in terms of a DOSE EQUIVALENT I-131. The allowable levels are intended to limit the 2 hour radiation dose to an individual at the site boundary to a small fraction of the 10 CFR 100 limit.
APPLICABLE         Analytical methods and assumptions involving radioactive SAFETY ANALYSES    material in the primary coolant are presented in the USAR (Ref. 2). The specific activity in the reactor coolant (the source term) is an initial condition for evaluation of the consequences of an accident due to a main steam line break (MSLB) outside containment. No fuel damage is postulated in the MSLB accident, and the release of radioactive material to the environment is assumed to end when the main steam isolation valves (MSIVs) close completely.
The limits on the specific activity of the primary coolant ensure that the 2 hour thyroid and whole body doses at the site boundary, resulting from an MSLB outside containment during steady state operation, will not exceed 10% of the dose guidelines of 10 CFR 100.
(continued)
CLINTON                              B 3.4-39                    Revision No. 0

RCS Specific Activity B 3.4.8 BASES APPLICABLE        The limits on specific activity are values from a parametric SAFETY ANALYSES   evaluation of typical site locations. These limits are (continued)     conservative because the evaluation considered more restrictive parameters than for a specific site, such as the location of the site boundary and the meteorological conditions of the site.
RCS specific activity satisfies Criterion 2 of the NRC Policy Statement.
LCO               The specific iodine activity is limited to d 0.2 PCi/gm DOSE EQUIVALENT I-131. This limit ensures the source term assumed in the safety analysis for the MSLB is not exceeded, so any release of radioactivity to the environment during an MSLB is less than a small fraction of the 10 CFR 100 limits.
APPLICABILITY     In MODE 1, and MODES 2 and 3 with any main steam line not isolated, limits on the primary coolant radioactivity are applicable since there is an escape path for release of radioactive material from the primary coolant to the environment in the event of an MSLB outside of primary containment.
In MODES 2 and 3 with the main steam lines isolated, such limits do not apply since an escape path does not exist. In MODES 4 and 5, no limits are required since the reactor is not pressurized and the potential for leakage is reduced.
ACTIONS           A.1 and A.2 When the reactor coolant specific activity exceeds the LCO DOSE EQUIVALENT I-131 limit, but is d 4.0 PCi/gm, samples must be analyzed for DOSE EQUIVALENT I-131 at least once every 4 hours. In addition, the specific activity must be restored to the LCO limit within 48 hours. The Completion Time of once every 4 hours is based on the time needed to take and analyze a sample. The 48 hour Completion Time to restore the activity level provides a reasonable time for temporary coolant activity increases (iodine spikes or crud bursts) to be cleaned up with the normal processing systems.
(continued)
CLINTON                             B 3.4-40                    Revision No. 0

RCS Specific Activity B 3.4.8 BASES ACTIONS           A.1 and A.2  (continued)
A Note permits the use of the provisions of LCO 3.0.4.c.
This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS. This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of a limiting event while exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to power operation.
B.1, B.2.1, B.2.2.1, and B.2.2.2 If the DOSE EQUIVALENT I-131 cannot be restored to d 0.2 PCi/gm within 48 hours, or if at any time it is > 4.0 PCi/gm, it must be determined at least every 4 hours and all the main steam lines must be isolated within 12 hours.
Isolating the main steam lines precludes the possibility of releasing radioactive material to the environment in an amount that is more than a small fraction of the requirements of 10 CFR 100 during a postulated MSLB accident.
Alternately, the plant can be brought to MODE 3 within 12 hours and to MODE 4 within 36 hours. This option is provided for those instances when isolation of main steam lines is not desired (e.g., due to the decay heat loads).
In MODE 4, the requirements of the LCO are no longer applicable.
The Completion Time of once every 4 hours is based on the time needed to take and analyze a sample. The 12 hour Completion Time is reasonable, based on operating experience, to isolate the main steam lines in an orderly manner and without challenging plant systems. Also, the allowed Completion Times for Required Actions B.2.2.1 and B.2.2.2 for bringing the plant to MODES 3 and 4 are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                            B 3.4-41                   Revision No. 10-3

RCS Specific Activity B 3.4.8 BASES   (continued)
SURVEILLANCE        SR  3.4.8.1 REQUIREMENTS This Surveillance is performed to ensure iodine remains within limit during normal operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that requires this Surveillance to be performed only in MODE 1 because the level of fission products generated in other MODES is much less.
With regard to specific activity values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).
REFERENCES          1. 10 CFR 100.11.
: 2. USAR, Section 15.6.4.
: 3. Calculation IP-0-0035.
CLINTON                               B 3.4-42                 Revision No. 14-2

RHR Shutdown Cooling System  Hot Shutdown B 3.4.9 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.9   Residual Heat Removal (RHR) Shutdown Cooling System  Hot Shutdown BASES BACKGROUND         Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to reduce the temperature of the reactor coolant to d 200qF. This decay heat removal is in preparation for performing refueling or maintenance operations, or for keeping the reactor in the Hot Shutdown condition.
The two redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal.
Each loop consists of a motor driven pump, one heat exchanger, and associated piping and valves. Both loops have a common suction from the same recirculation loop.
Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via separate feedwater lines or to the reactor via the LPCI injection path. The RHR heat exchangers transfer heat to the Shutdown Service Water System (LCO 3.7.1, Division 1 and 2 "[Shutdown Service Water (SX)] Subsystem and Ultimate Heat Sink (UHS)").
APPLICABLE         Decay heat removal by the RHR System in the shutdown cooling SAFETY ANALYSES    mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. The RHR shutdown cooling mode is not credited as safety related decay heat removal, since it is not single failure proof due to the common suction. The alternate shutdown cooling mode using LPCI and SRVs is credited for safety related decay heat removal and is single failure proof. However, the RHR System in the shutdown cooling mode is a significant contributor to risk reduction. Therefore, the RHR Shutdown Cooling System, with its common suction from Reactor Recirculation, is retained as a Technical Specification.
LCO                Two RHR shutdown cooling subsystems are required to be OPERABLE, and, when no recirculation pump is in operation, one shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, and the associated piping and valves. Each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote (continued)
CLINTON                              B 3.4-43                  Revision No. 14-1

RHR Shutdown Cooling System  Hot Shutdown B 3.4.9 BASES LCO           or local) in the shutdown cooling mode for removal of decay (continued) heat. In MODE 3, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain or reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. Management of gas voids is important to RHR Shutdown Cooling System OPERABILITY.
Note 1 permits both RHR shutdown cooling subsystems and recirculation pumps to be shut down for a period of 2 hours in an 8 hour period. Note 2 allows one RHR shutdown cooling subsystem to be inoperable for up to 2 hours for performance of surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.
APPLICABILITY In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR cut in permissive pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping. Decay heat removal at reactor pressures greater than or equal to the RHR cut in permissive pressure is typically accomplished by condensing the steam in the main condenser. Additionally, in MODE 2 below this pressure, the OPERABILITY requirements for the Emergency Core Cooling Systems (ECCS) (LCO 3.5.1, "ECCS 
Operating") do not allow placing the RHR shutdown cooling subsystem into operation.
In MODE 3 with reactor steam dome pressure below the RHR cut in permissive pressure (i.e., the actual pressure at which the interlock resets) the RHR System may be operated in the shutdown cooling mode to remove decay heat to reduce or maintain coolant temperature. Otherwise, a recirculation pump is required to be in operation.
(continued)
CLINTON                        B 3.4-44                  Revision No. 17-1

RHR Shutdown Cooling System  Hot Shutdown B 3.4.9 BASES APPLICABILITY The requirements for decay heat removal in MODES 4 and 5 are (continued) discussed in LCO 3.4.10, "Residual Heat Removal (RHR)
Shutdown Cooling System  Cold Shutdown"; LCO 3.9.8, "Residual Heat Removal (RHR)  High Water Level"; and LCO 3.9.9, "Residual Heat Removal (RHR)  Low Water Level."
ACTIONS       A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.
A.1 With one required RHR shutdown cooling subsystem inoperable for decay heat removal, except as permitted by LCO Note 2, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced RHR shutdown cooling capability. Therefore an alternate method of decay heat removal must be provided.
(continued)
CLINTON                        B 3.4-45                   Revision No. 21-5

RHR Shutdown Cooling System  Hot Shutdown B 3.4.9 BASES ACTIONS A.1  (continued)
With both RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of these alternate methods must be confirmed every 24 hours thereafter. This will provide assurance of continued heat removal capacity.
The required cooling capacity of the alternate method should be sufficient to maintain or reduce temperature at or below 200qF. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods that can be used include (but are not limited to) the Reactor Water Cleanup System, or an inoperable but functional RHR shutdown cooling subsystem.
B.1 If the required alternate method(s) of decay heat removal cannot be verified within one hour, immediate action must be taken to restore the inoperable RHR shutdown cooling subsystem(s) to operable status. The Required Action will restore redundant decay heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
C.1, C.2, and C.3 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as is permitted by LCO Note 1, reactor coolant circulation by the RHR shutdown cooling subsystem or one recirculation pump must be restored without delay.
Until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour Completion Time is based on the coolant circulation function and is modified such that the 1 hour is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours thereafter. This will provide assurance of continued temperature monitoring capability.
(continued)
CLINTON                   B 3.4-46                  Revision No. 21-5

RHR Shutdown Cooling System  Hot Shutdown B 3.4.9 BASES ACTIONS      C.1, C.2, and C.3   (continued)
During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.
SURVEILLANCE SR  3.4.9.1 REQUIREMENTS This Surveillance verifies that one RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This Surveillance is modified by a Note allowing sufficient time to align the RHR System for shutdown cooling operation after clearing the pressure interlock that isolates the system, or for placing a recirculation pump in operation.
The Note takes exception to the requirements of the Surveillance being met (i.e., forced coolant circulation is not required for this initial 2 hour period), which also allows entry into the Applicability of this Specification in accordance with SR 3.0.4 since the Surveillance will not be "not met" at the time of entry into the Applicability.
SR  3.4.9.2 RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases.
Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR shutdown cooling subsystems and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove (continued)
CLINTON                        B 3.4-47                  Revision No. 21-5

RHR Shutdown Cooling System  Hot Shutdown B 3.4.9 BASES SURVEILLANCE SR  3.4.9.2   (continued)
REQUIREMENTS during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
Accumulated gas should be eliminated or brought within the acceptance criteria limits.
RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
This SR is modified by a Note that states the SR is not required to be performed until 12 hours after reactor steam dome pressure is less than the RHR cut in permissive pressure. In a rapid shutdown, there may be insufficient time to verify all susceptible locations prior to entering the Applicability.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
(continued)
CLINTON                        B 3.4-47a                 Revision No. 17-1

RHR Shutdown Cooling System  Hot Shutdown B 3.4.9 BASES   (continued)
REFERENCES          1. USAR, Section 5.4.7.
CLINTON                           B 3.4-47b                  Revision No. 17-1

RHR Shutdown Cooling System  Cold Shutdown B 3.4.10 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.10   Residual Heat Removal (RHR) Shutdown Cooling System  Cold Shutdown BASES BACKGROUND         Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to maintain the temperature of the reactor coolant at d 200qF. This decay heat removal is in preparation for performing refueling or maintenance operations, or for keeping the reactor in the Cold Shutdown condition.
The two redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal.
Each loop consists of a motor driven pump, one heat exchanger, and associated piping and valves. Both loops have a common suction from the same recirculation loop.
Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via separate feedwater lines or to the reactor via the LPCI injection path.
APPLICABLE         Decay heat removal by the RHR System in the shutdown cooling SAFETY ANALYSES    mode is not required for mitigation of any event or accident evaluated in the safety analyses. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. The RHR shutdown cooling mode is not credited as safety related decay heat removal, since it is not single failure proof due to the common suction. The alternate shutdown cooling mode using LPCI and SRVs is credited for safety related decay heat removal and is single failure proof. However, the RHR System in the shutdown cooling mode is a significant contributor to risk reduction. Therefore, the RHR Shutdown Cooling System is retained as a Technical Specification.
LCO                Two RHR shutdown cooling subsystems are required to be OPERABLE, and, when no recirculation pump is in operation, one shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, one heat exchanger, and the associated piping and valves. Each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or (continued)
CLINTON                              B 3.4-48                  Revision No. 14-1

RHR Shutdown Cooling System  Cold Shutdown B 3.4.10 BASES LCO           local) in the shutdown cooling mode for removal of decay (continued) heat. In MODE 4, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain and reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. Management of gas voids is important to RHR Shutdown Cooling System OPERABILITY.
Note 1 permits both RHR shutdown cooling subsystems and recirculation pumps to be shut down for a period of 2 hours in an 8 hour period. Note 2 allows one RHR shutdown cooling subsystem to be inoperable for up to 2 hours for performance of surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy. Note 3 permits both RHR shutdown cooling subsystems and recirculation pumps to be shut down during performance of inservice leak testing and during hydrostatic testing. This is permitted because RCS pressures and temperatures are being closely monitored during this testing as required by LCO 3.4.11, "RCS Pressure and Temperature (P/T) Limits."
APPLICABILITY In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR cut in permissive pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping. Decay heat removal at reactor pressures greater than or equal to the RHR cut in permissive pressure is typically accomplished by condensing the steam in the main condenser. Additionally, in MODE 2 below this pressure, the OPERABILITY requirements for the Emergency Core Cooling Systems (ECCS) (LCO 3.5.1, "ECCS 
Operating") do not allow placing the RHR shutdown cooling subsystem into operation.
(continued)
CLINTON                        B 3.4-49                  Revision No. 17-1

RHR Shutdown Cooling System  Cold Shutdown B 3.4.10 BASES APPLICABILITY In MODE 4, the RHR System may be operated in the shutdown (continued) cooling mode to remove decay heat to maintain coolant temperature below 200qF. Otherwise, a recirculation pump is required to be in operation.
The requirements for decay heat removal in MODE 3 below the cut in permissive pressure and in MODE 5 are discussed in LCO 3.4.9, "Residual Heat Removal (RHR) Shutdown Cooling System  Hot Shutdown"; LCO 3.9.8, "Residual Heat Removal (RHR)  High Water Level"; and LCO 3.9.9, "Residual Heat Removal (RHR)  Low Water Level."
ACTIONS       A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.
A.1 With one of the two required RHR shutdown cooling subsystems inoperable except as permitted by LCO Note 2, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced.
Therefore, an alternate method of decay heat removal must be provided. With both RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of these alternate method(s) must be (continued)
CLINTON                         B 3.4-50                      Revision No. 0

RHR Shutdown Cooling System  Cold Shutdown B 3.4.10 BASES ACTIONS      A.1  (continued) reconfirmed every 24 hours thereafter. This will provide assurance of continued heat removal capability.
The required cooling capacity of the alternate method should be sufficient to maintain or reduce temperature at or below 200qF. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability. Alternate methods that can be used include (but are not limited to) the Reactor Water Cleanup System, or an inoperable but functional RHR shutdown cooling subsystem.
B.1 If the required alternate method(s) of decay heat removal cannot be verified within one hour, immediate action must be taken to restore the inoperable RHR shutdown cooling subsystem(s) to operable status. The Required Action will restore redundant decay heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
C.1 and C.2 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as is permitted by LCO Note 1, and until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour Completion Time is based on the coolant circulation function and is modified such that the 1 hour is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours thereafter. This will provide assurance of continued temperature monitoring capability.
During the period when the reactor coolant is being circu-lated by an alternate method (other than by the required RHR Shutdown Cooling System or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method.
The once per hour Completion Time is deemed appropriate.
SURVEILLANCE SR  3.4.10.1 REQUIREMENTS This Surveillance verifies that one RHR shutdown cooling subsystem or recirculation pump is in operation and (continued)
CLINTON                       B 3.4-51                   Revision No. 21-5

RHR Shutdown Cooling System  Cold Shutdown B 3.4.10 BASES SURVEILLANCE SR  3.4.10.1  (continued)
REQUIREMENTS circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.4.10.2 RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases.
Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR shutdown cooling subsystems and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
Accumulated gas should be eliminated or brought within the acceptance criteria limits.
RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for (continued)
CLINTON                       B 3.4-52                  Revision No. 21-5

RHR Shutdown Cooling System  Cold Shutdown B 3.4.10 BASES SURVEILLANCE SR  3.4.10.2  (continued)
REQUIREMENTS locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
REFERENCES   1. USAR, Section 5.4.7.
CLINTON                       B 3.4-52a                 Revision No. 21-5

This page intentionally left blank.
CLINTON              B 3.4-52b              Revision No. 17-1

RCS P/T Limits B 3.4.11 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.11   RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND         All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.
Figures 3.4.11-1, 3.4.11-2, and 3.4.11-3 contain composite P/T limit curves for heatup, cooldown, and inservice leak and hydrostatic testing. The P/T limit curves are valid for 32 Effective Full Power Years (EFPY) of operation. Upper vessel and beltline limits are based on a calculated 72qF shift from an initial RTNDT of -20qF and an adjusted reference temperatures (ART) of 52qF (Ref. 18). In addition, Figures 3.4.11-1 and 3.4.11-2 include a separate P/T limit curve for the reactor pressure vessel bottom head to account for the fact that during leak and hydrostatic pressure testing and during heatup and cooldown, the bottom head temperature may be cooler than the higher elevations of the vessel if the recirculation pumps are either stopped or operating at low speed, and if there is injection through the control rod drives.
Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.
The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure. Therefore, the LCO limits apply mainly to the vessel.
(continued)
CLINTON                              B 3.4-53                  Revision No. 5-11

RCS P/T Limits B 3.4.11 BASES   (continued)
BACKGROUND          10 CFR 50, Appendix G (Ref. 1), requires the establishment (continued)       of P/T limits for material fracture toughness requirements of the RCPB materials. Reference 1 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code, Section III, Appendix G (Ref. 2).
The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3) and 10 CFR 50, Appendix H (Ref. 4).
The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Reference 5.
(continued)
CLINTON                              B 3.4-53a                   Revision No. 8-5

This page intentionally left blank.
CLINTON              B 3.4-53b              Revision No. 2-10

RCS P/T Limits B 3.4.11 BASES BACKGROUND      The P/T limit curves are composite curves established by (continued)   superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.
The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.
The criticality limits include the Reference 1 requirement that they be at least 40qF above the heatup curve or the cooldown curve and not lower than the minimum permissible temperature for the inservice leak and hydrostatic testing.
The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components. The ASME Code, Section XI, Appendix E (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.
APPLICABLE      The P/T limits are not derived from Design Basis Accident SAFETY ANALYSES (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, a condition that is unanalyzed. Reference 7 establishes the (continued)
CLINTON                          B 3.4-54                   Revision No. 3-4

RCS P/T Limits B 3.4.11 BASES APPLICABLE      methodology for determining the P/T limits. Since the P/T SAFETY ANALYSES limits are not derived from any DBA, there are no acceptance (continued)   limits related to the P/T limits. Rather, the P/T limits are acceptance limits themselves since they preclude operation in an unanalyzed condition.
RCS P/T limits satisfy Criterion 2 of the NRC Policy Statement.
LCO             The elements of this LCO are:
: a. RCS pressure, temperature, and heatup or cooldown rate are within the limits during RCS heatup, cooldown, and inservice leak and hydrostatic testing.
: b. The temperature difference between the reactor vessel bottom head coolant and the reactor pressure vessel (RPV) coolant is within the limit during recirculation pump startup, and during increases in THERMAL POWER or loop flow while operating at low THERMAL POWER or loop flow.
: c. The temperature difference between the reactor coolant in the respective recirculation loop and in the reactor vessel meets the limit during recirculation pump startup, and during increases in THERMAL POWER or loop flow while operating at low THERMAL POWER or loop flow.
: d. RCS pressure and temperature are within the criticality limits prior to achieving criticality.
: e. The reactor vessel flange and the head flange temperatures are within the limits when tensioning the reactor vessel head bolting studs.
These limits define allowable operating regions and permit a large number of operating cycles while also providing a wide margin to nonductile failure.
The rate of change of temperature limits control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and inservice leak and (continued)
CLINTON                          B 3.4-55                   Revision No. 1-1

RCS P/T Limits B 3.4.11 BASES LCO           hydrostatic testing P/T limit curves. Thus, the LCO for the (continued) rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves. In addition, limits have been imposed to restrict the rate of temperature changes to d 20qF in any one hour period when operating between Figure 3.4.11-1 limits and Figures 3.4.11-2/3.4.11-3 limits, as applicable.
This additional limitation on temperature changes is imposed to ensure margin to the limits and the desire to maintain RCS temperature essentially constant during pressurization for hydrostatic testing.
Violation of the limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCS components. The consequences depend on several factors, as follows:
: a. The severity of the departure from the allowable operating pressure temperature regime or the severity of the rate of change of temperature;
: b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and
: c. The existences, sizes, and orientations of flaws in the vessel material.
APPLICABILITY The potential for violating a P/T limit exists at all times.
For example, P/T limit violations could result from ambient temperature conditions that result in the reactor vessel metal temperature being less than the minimum allowed temperature for boltup. Therefore, this LCO is applicable even when fuel is not loaded in the core.
ACTIONS       A.1 and A.2 Operation outside the P/T limits while in MODE 1, 2, or 3 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.
The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.
(continued)
CLINTON                        B 3.4-56                   Revision No. 7-8

RCS P/T Limits B 3.4.11 BASES ACTIONS A.1 and A.2  (continued)
Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed if continued operation is desired.
Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.
ASME Code, Section XI, Appendix E (Ref. 6), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.
The 72 hour Completion Time is reasonable to accomplish the evaluation of a mild violation. More severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed if continued operation is desired.
Condition A is modified by a Note requiring Required Action A.2 be completed whenever the Condition is entered.
The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits.
Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.
B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress, or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. With the reduced pressure and temperature conditions, the possibility of propagation of undetected flaws is decreased.
Pressure and temperature are reduced by bringing the plant to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                  B 3.4-57                   Revision No. 1-1

RCS P/T Limits B 3.4.11 BASES ACTIONS       C.1 and C.2 (continued)
Operation outside the P/T limits in other than MODES 1, 2, and 3 (including defueled conditions) must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses. The Required Action must be initiated without delay and continued until the limits are restored.
Besides restoring the P/T limit parameters to within limits, an evaluation is required to determine if RCS operation is allowed. This evaluation must verify that the RCPB integrity is acceptable and must be completed before approaching criticality or heating up to > 200qF. Several methods may be used, including comparison with pre-analyzed transients, new analyses, or inspection of the components.
ASME Section XI, Appendix E (Ref. 6), may be used to support the evaluation; however, its use is restricted to evaluation of the beltline.
SURVEILLANCE  SR  3.4.11.1 REQUIREMENTS Verification that operation is within limits is required periodically when RCS pressure and temperature conditions are undergoing planned changes. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Surveillance for heatup, cooldown, or inservice leakage and hydrostatic testing may be discontinued when the criteria given in the relevant plant procedure for ending the activity are satisfied.
This SR has been modified by a Note that requires this Surveillance to be performed only during system heatup and cooldown operations and inservice leakage and hydrostatic testing.
(continued)
CLINTON                        B 3.4-58                  Revision No. 14-2

RCS P/T Limits B 3.4.11 BASES SURVEILLANCE  SR  3.4.11.1  (continued)
REQUIREMENTS (continued) With regard to RCS pressure, temperature, and heatup and cooldown rates values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).
SR 3.4.11.2 A separate limit is used when the reactor is approaching criticality. Consequently, the RCS pressure and temperature must be verified within the appropriate limits before withdrawing control rods that will make the reactor critical.
Performing the Surveillance within 15 minutes before control rod withdrawal for the purpose of achieving criticality provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the control rod withdrawal.
This SR has been modified by a Note that requires this Surveillance to be met only during control rod withdrawal for the purpose of achieving criticality.
With regard to RCS pressure and temperature values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 12).
SR  3.4.11.3 and SR  3.4.11.4 Differential temperatures within the applicable limits ensure that thermal stresses resulting from the startup of an idle recirculation pump will not exceed design allowances. In addition, compliance with these limits ensures that the assumptions of the analysis for the startup of an idle recirculation loop (Ref. 8) are satisfied.
Performing the Surveillance within 15 minutes before start-ing the idle recirculation pump provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the idle pump start.
(continued)
CLINTON                        B 3.4-59                   Revision No. 4-6

RCS P/T Limits B 3.4.11 BASES SURVEILLANCE  SR  3.4.11.3 and SR   3.4.11.4  (continued)
REQUIREMENTS (continued) An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.11.4 is to compare the temperatures of the operating recirculation loop and the idle loop.
SR 3.4.11.3 and SR 3.4.11.4 have been modified by a Note that requires the Surveillance to be met only in MODES 1, 2, 3, and 4 during recirculation pump start. In MODE 5, the overall stress on limiting components is lower; therefore,
              'T limits are not required.
With regard to temperature difference values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Refs. 13, 14).
SR  3.4.11.5, SR   3.4.11.6, and SR  3.4.11.7 Limits on the reactor vessel flange and head flange temperatures are generally bounded by the other P/T limits during system heatup and cooldown. However, operations approaching MODE 4 from MODE 5 and in MODE 4 with RCS temperature less than or equal to certain specified values require assurance that these temperatures meet the LCO limits.
The flange temperatures must be verified to be above the limits before and while tensioning the vessel head bolting studs to ensure that once the head is tensioned the limits are satisfied. SR 3.4.11.5 allows up to 10% of the reactor vessel head bolting studs to be fully tensioned with flange temperatures < 70 qF. This allows the closure flange O-rings to be sealed to support raising reactor water level to assist in warming the flanges. When in MODE 4 with RCS temperature d 80qF, checks of the flange temperatures are required because of the reduced margin to the limits. When in MODE 4 with RCS temperature d 90qF, monitoring of the flange temperature is required to ensure the temperatures are within limits.
(continued)
CLINTON                        B 3.4-60                   Revision No. 14-2

RCS P/T Limits B 3.4.11 BASES SURVEILLANCE SR  3.4.11.5, SR   3.4.11.6, and SR 3.4.11.7  (continued)
REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to reactor vessel flange and head flange temperature values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 15).
SR  3.4.11.8 and SR   3.4.11.9 Differential temperatures within the applicable limits ensure that thermal stresses resulting from increases in THERMAL POWER or recirculation loop flow during single recirculation loop operation will not exceed design allowances. Performing the Surveillance within 15 minutes before beginning such an increase in power or flow rate provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the change in operation.
An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.11.9 is to compare the temperatures of the operating recirculation loop and the idle loop.
Plant specific test data has determined that the bottom head is not subject to temperature stratification with natural circulation at power levels as low as 25% of RTP and with any single loop flow rate greater than or equal to 30% of rated loop flow. Therefore, SR 3.4.11.8 and SR 3.4.11.9 have been modified by a Note that requires the Surveillance to be met only when THERMAL POWER or loop flow is being increased when the above conditions are not met. The Note for SR 3.4.11.9 further limits the requirement for this Surveillance to exclude comparison of the idle loop temperature if the idle loop is isolated from the RPV since the water in the loop cannot be introduced into the remainder of the Reactor Coolant System.
(continued)
CLINTON                       B 3.4-61                  Revision No. 14-2

RCS P/T Limits B 3.4.11 BASES SURVEILLANCE SR  3.4.11.8 and SR  3.4.11.9  (continued)
REQUIREMENTS With regard to temperature difference values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Refs. 16, 17).
REFERENCES   1. 10 CFR 50, Appendix G.
: 2. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.
: 3. ASTM E 185-82, "Standard Practice for Conducting Surveillance Tests For Light-Water Cooled Nuclear Power Reactor Vessels."
: 4. 10 CFR 50, Appendix H.
: 5. Regulatory Guide 1.99, Revision 2, May 1988.
: 6. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E.
: 7. NEDO-21778-A, "Transient Pressure Rises Affecting Fracture Toughness Requirements for BWRs," December 1978.
: 8. USAR, Section 15.4.4.
: 9. USAR, Section 5.3.
: 10. Deleted
: 11. Calculation IP-0-0036.
: 12. Calculation IP-0-0037.
: 13. Calculation IP-0-0038.
: 14. Calculation IP-0-0039.
: 15. Calculation IP-0-0040.
: 16. Calculation IP-0-0041.
: 17. Calculation IP-0-0042.
: 18. GE-NE-B13-02084-00-01, Rev. 0, Pressure-Temperature Curves for AmerGen, Clinton Power Station Using the KIc Methodology, August 2000.
CLINTON                       B 3.4-62                  Revision No. 14-2

Reactor Steam Dome Pressure B 3.4.12 B 3.4   REACTOR COOLANT SYSTEM (RCS)
B 3.4.12   Reactor Steam Dome Pressure BASES BACKGROUND         The reactor steam dome pressure is an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria and is also an assumed initial condition of Design Basis Accidents (DBAs) and transients.
APPLICABLE         The reactor steam dome pressure of d 1045 psig is an SAFETY ANALYSES    initial condition of the vessel overpressure protection analysis of Reference 1. This analysis assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system, primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance with the overpressure criteria is dependent on the initial reactor steam dome pressure; therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved. Reference 2 also assumes an initial reactor steam dome pressure for the analysis of DBAs and transients used to determine the limits for fuel cladding integrity MCPR (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1% cladding plastic strain (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)").
Reactor steam dome pressure satisfies the requirements of Criterion 2 of the NRC Policy Statement.
LCO                The specified reactor steam dome pressure limit of d 1045 psig ensures the plant is operated within the assumptions of the vessel overpressure protection analysis.
Operation above the limit may result in a transient response more severe than analyzed.
APPLICABILITY      In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam, and events which may challenge the overpressure limits are possible.
In MODES 3, 4, and 5, the limit is not applicable because the reactor is shut down. In these MODES, the reactor pressure is well below the required limit, and no anticipated events will challenge the overpressure limits.
(continued)
CLINTON                              B 3.4-63                 Revision No. 14-2

Reactor Steam Dome Pressure B 3.4.12 BASES   (continued)
ACTIONS             A.1 With the reactor steam dome pressure greater than the limit, prompt action should be taken to reduce pressure to below the limit and return the reactor to operation within the bounds of the analyses. The 15 minute Completion Time is reasonable considering the importance of maintaining the pressure within limits. This Completion Time also ensures that the probability of an accident while pressure is greater than the limit is minimal.
B.1 If the reactor steam dome pressure cannot be restored to within the limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE        SR  3.4.12.1 REQUIREMENTS Verification that reactor steam dome pressure is d 1045 psig ensures that the initial conditions of the vessel overpressure protection analysis are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to reactor steam dome pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).
REFERENCES          1. USAR, Section 5.2.2.
: 2. USAR, Section 15.
: 3. Calculation IP-0-0043.
CLINTON                              B 3.4-64                  Revision No. 14-2

ECCS Operating B 3.5.1 B 3.5   EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV)
WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC)
SYSTEM B 3.5.1  ECCS  Operating BASES BACKGROUND         The ECCS is designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS uses two independent methods (flooding and spraying) to cool the core during a LOCA. The ECCS network is composed of the High Pressure Core Spray (HPCS) System, the Low Pressure Core Spray (LPCS) System, and the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System. The ECCS also consists of the Automatic Depressurization System (ADS). The suppression pool provides the required source of water for the ECCS. Although no credit is taken in the safety analyses for the RCIC storage tank, it is capable of providing a source of water for the HPCS System.
On receipt of an initiation signal, each associated ECCS pump automatically starts; simultaneously the system aligns, and the pump injects water, taken either from the RCIC storage tank or suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pump. Although the system is initiated, ADS action is delayed by a timer, allowing the operator to interrupt the timed sequence if the system is not needed. The HPCS pump discharge pressure almost immediately exceeds that of the RCS, and the pump injects coolant into the spray sparger above the core. If the break is small, HPCS will maintain coolant inventory, as well as vessel level, while the RCS is still pressurized. If HPCS fails to maintain water level above Level 1, it is backed up by automatic initiation of ADS in combination with LPCI and LPCS. In this event, the ADS would time out and open the selected safety/relief valves (S/RVs), depressurizing the RCS and allowing the LPCI and LPCS to overcome RCS pressure and inject coolant into the vessel. Alternately, procedures may direct this automatic function be inhibited until subsequently required. If the break is large, RCS pressure initially drops rapidly, and the LPCI and LPCS systems cool the core.
Water from the break returns to the suppression pool where it is used again and again. Water in the suppression pool is circulated through a heat exchanger cooled by the Shutdown Service Water (SX) System. Depending on the location and size of the break, portions of the ECCS may be ineffective; however, the overall design is effective in cooling the core regardless of the size or location of the (continued)
CLINTON                              B 3.5-1                  Revision No. 20-2

ECCS Operating B 3.5.1 BASES BACKGROUND     piping break. Although no credit is taken in the safety (continued) analysis for the RCIC System, it performs a similar function as HPCS but has reduced makeup capability. Nevertheless, it will maintain inventory and cool the core, while the RCS is still pressurized, following a reactor pressure vessel (RPV) isolation.
All ECCS subsystems are designed to ensure that no single active component failure will prevent automatic initiation and successful operation of the minimum required ECCS subsystems.
The LPCS System (Ref. 1) consists of a motor driven pump, a spray sparger above the core, piping, and valves to transfer water from the suppression pool to the sparger. The LPCS System is designed to provide cooling to the reactor core when the reactor pressure is low. Upon receipt of an initiation signal, the LPCS pump is automatically started after AC power is available. When the RPV pressure drops sufficiently, LPCS flow to the RPV begins. A full flow test line is provided to route water from and to the suppression pool to allow testing of the LPCS System without spraying water into the RPV.
LPCI is an independent operating mode of the RHR System.
There are three LPCI subsystems. Each LPCI subsystem (Ref. 2) consists of a motor driven pump, piping, and valves to transfer water from the suppression pool to the core.
Each LPCI subsystem has its own suction and discharge piping and separate vessel nozzle that connects with the core shroud through internal piping. The LPCI subsystems are designed to provide core cooling at low RPV pressure. Upon receipt of an initiation signal, each LPCI pump is automatically started (C pump immediately after AC power is available, and A and B pumps approximately 5 seconds after AC power is restored). When the RPV pressure drops sufficiently, LPCI flow to the RPV begins. RHR System valves in the LPCI flow path are automatically positioned to ensure the proper flow path for water from the suppression pool to inject into the core. A discharge test line is provided to route water from and to the suppression pool to allow testing of each LPCI pump without injecting water into the RPV.
The HPCS System (Ref. 3) consists of a single motor driven pump, a spray sparger above the core, and piping and valves to transfer water from the suction source to the sparger.
Suction piping is provided from the RCIC storage tank and the suppression pool. Pump suction is normally aligned to the RCIC storage tank source to minimize injection of suppression pool water into the RPV. However, if the RCIC storage tank water supply is low or the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the HPCS System. The HPCS System is designed to provide (continued)
CLINTON                          B 3.5-2                  Revision No. 20-2

ECCS Operating B 3.5.1 BASES BACKGROUND      core cooling over a wide range of RPV pressures (0 psid to (continued)   1200 psid, vessel to suction source). Upon receipt of an initiation signal, the HPCS pump automatically starts after AC power is available and valves in the flow path begin to open. Since the HPCS System is designed to operate over the full range of expected RPV pressures, HPCS flow begins as soon as the necessary valves are open. Full flow test lines are provided to allow testing of the HPCS System during normal operation without spraying water into the RPV.
The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when other discharge line valves are closed or RPV pressure is greater than the LPCS or LPCI pump discharge pressures following system initiation. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the ECCS discharge line "keep fill" systems are designed to maintain all pump discharge lines filled with water.
The ADS (Ref. 4) consists of 7 of the 16 S/RVs. It is designed to provide depressurization of the primary system during a small break LOCA if HPCS fails or is unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (LPCS and LPCI),
so that these subsystems can provide core cooling. Each ADS valve is supplied with pneumatic power from an air storage system, which consists of air accumulators located in the drywell.
APPLICABLE      The ECCS performance is evaluated for the entire spectrum of SAFETY ANALYSES break sizes for a postulated LOCA. The accidents for which ECCS operation is required are presented in References 5, 6, and 7. The required analyses and assumptions are defined in 10 CFR 50 (Ref. 8), and the results of these analyses are described in Reference 9.
This LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46 (Ref. 10), will be met following a LOCA assuming the worst case single active component failure in the ECCS:
: a. Maximum fuel element cladding temperature is d 2200qF;
: b. Maximum cladding oxidation is d 0.17 times the total cladding thickness before oxidation;
: c. Maximum hydrogen generation from zirconium water reaction is < 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; (continued)
CLINTON                           B 3.5-3                  Revision No. 20-2

ECCS Operating B 3.5.1 BASES APPLICABLE      d. The core is maintained in a coolable geometry; and SAFETY ANALYSES (continued) e. Adequate long term cooling capability is maintained.
The limiting single failures are discussed in Reference 11.
For large and small break LOCAs the HPCS System failure is the most severe. One ADS valve failure is analyzed as a limiting single failure for events requiring ADS operation.
The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damage.
The ECCS satisfy Criterion 3 of the NRC Policy Statement.
LCO             Each ECCS injection/spray subsystem and seven ADS valves are required to be OPERABLE. The ECCS injection/spray subsystems are the three LPCI subsystems, the LPCS System, and the HPCS System. The ECCS injection/spray subsystems are further subdivided into the following groups:
a)   The low pressure ECCS injection/spray subsystems are the LPCS System and the three LPCI subsystems; b)   The ECCS injection subsystems are the three LPCI subsystems; and c)   The ECCS spray subsystems are the HPCS System and the LPCS System.
Management of gas voids is important to ECCS injection/spray subsystem OPERABILITY.
With less than the required number of ECCS subsystems OPERABLE during a limiting design basis LOCA concurrent with the worst case single failure, the limits specified in 10 CFR 50.46 (Ref. 10) could potentially be exceeded. All ECCS subsystems must therefore be OPERABLE to satisfy the single failure criterion required by 10 CFR 50.46 (Ref. 10).
The LCO is modified by a Note that allows a LPCI subsystem to be inoperable during alignment and operation for decay heat removal with reactor steam dome pressure less than the residual heat removal cut-in permissive pressure. This is necessary since the RHR system is required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor, and manual realignment from the shutdown cooling mode to the LPCI mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to damage the RHR system, including water hammer. One LPCI subsystem is allowed to be considered inoperable for this temporary period, because in shutdown cooling mode it is fulfilling a decay heat removal capacity function. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the (continued)
CLINTON                           B 3.5-4                  Revision No. 20-2

ECCS Operating B 3.5.1 BASES LCO             required core cooling, thereby allowing operation of RHR (continued) shutdown cooling when necessary.
APPLICABILITY   All ECCS subsystems are required to be OPERABLE during MODES 1, 2, and 3 when there is considerable energy in the reactor core and core cooling would be required to prevent fuel damage in the event of a break in the primary system piping. In MODES 2 and 3, the ADS function is not required when pressure is d 150 psig because the low pressure ECCS subsystems (LPCS and LPCI) are capable of providing flow into the RPV below this pressure. ECCS requirements for MODES 4 and 5 are specified in LCO 3.5.2, "RPV Water Inventory Control."
ACTIONS         A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCS subsystem. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable HPCS subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
A.1 If any one low pressure ECCS injection/spray subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a LOCA may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 12) that evaluated the impact on ECCS availability by assuming that various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).
B.1 and B.2 If the HPCS System is inoperable, and the RCIC System is verified to be OPERABLE (when RCIC is required to be OPERABLE), the HPCS System must be restored to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program. In this Condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with the ADS. Also, the RCIC (continued)
CLINTON                           B 3.5-5                  Revision No. 21-7

ECCS Operating B 3.5.1 BASES ACTIONS B.1 and B.2  (continued)
System will automatically provide makeup water at most reactor operating pressures. Verification of RCIC OPERABILITY within 1 hour is therefore required when HPCS is inoperable and RCIC is required to be OPERABLE. This may be performed by an administrative check, by examining logs or other information, to determine if RCIC is out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. However, if the OPERABILITY of the RCIC System cannot be verified and RCIC is required to be OPERABLE, Condition D must be immediately entered. If a single active component fails concurrent with a design basis LOCA, there is a potential, depending on the specific failure, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on the results of a reliability study (Ref. 12) and has been found to be acceptable through operating experience.
C.1 With two ECCS injection subsystems inoperable or one ECCS injection and one ECCS spray subsystem inoperable, at least one ECCS injection/spray subsystem must be restored to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program. In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced in this Condition because a single failure in one of the remaining OPERABLE subsystems concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function. Since the ECCS availability is reduced relative to Condition A, a more restrictive Completion Time is imposed. The 72 hour Completion Time is based on a reliability study, as provided in Reference 12.
D.1 If any Required Action and associated Completion Time of Condition A, B, or C are not met, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 13) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
Required Action D.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not (continued)
CLINTON                   B 3.5-6                  Revision No. 21-7

ECCS Operating B 3.5.1 BASES ACTIONS D.1  (continued) permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
E.1 The LCO requires seven ADS valves to be OPERABLE to provide the ADS function. Reference 14 contains the results of an analysis that evaluated the effect of one ADS valve being out of service. Per this analysis, operation of only six ADS valves will provide the required depressurization.
However, overall reliability of the ADS is reduced because a single failure in the OPERABLE ADS valves could result in a reduction in depressurization capability. Therefore, operation is only allowed for a limited time. The 14 day Completion Time is based on a reliability study (Ref. 12) and has been found to be acceptable through operating experience. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
F.1 and F.2 If any one low pressure ECCS injection/spray subsystem is inoperable in addition to one inoperable ADS valve, adequate core cooling is ensured by the OPERABILITY of HPCS and the remaining low pressure ECCS injection/spray subsystems.
However, the overall ECCS reliability is reduced because a single active component failure concurrent with a design basis LOCA could result in the minimum required ECCS equipment not being available. Since both a portion of a high pressure (ADS) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours is required to restore either the low pressure ECCS injection/spray subsystem or the ADS valve to OPERABLE status. This Completion Time is based on a reliability study (Ref. 12) and has been found to be acceptable through operating experience. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
(continued)
CLINTON                   B 3.5-7                  Revision No. 21-7

ECCS Operating B 3.5.1 BASES ACTIONS        G.1 (continued)
If any Required Action and associated Completion Time of Condition E or F are not met or if two or more ADS valves are inoperable, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 13) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
Required Action G.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
H.1 When multiple ECCS subsystems are inoperable, as stated in Condition H, the plant is in a degraded condition not specifically justified for continued operation, and may be in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.
SURVEILLANCE   SR 3.5.1.1 REQUIREMENTS The ECCS injection/spray subsystem flow path piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the ECCS injection/spray subsystems and may also prevent a water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
(continued)
CLINTON                          B 3.5-8                  Revision No. 20-2

ECCS Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.1  (continued)
REQUIREMENTS Selection of ECCS injection/spray subsystem locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The ECCS injection/spray subsystem is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the ECCS injection/spray subsystems are not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
Accumulated gas should be eliminated or brought within the acceptance criteria limits.
ECCS injection/spray subsystem locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
(continued)
CLINTON                        B 3.5-9                  Revision No. 20-2

ECCS Operating B 3.5.1 BASES SURVEILLANCE   SR 3.5.1.2 REQUIREMENTS (continued) Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves potentially capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
SR 3.5.1.3 Verification that ADS accumulator supply pressure is
               > 140 psig assures adequate air pressure for reliable ADS operation. The accumulator on each ADS valve provides pneumatic pressure for valve actuation. The designed pneumatic supply pressure requirements for the accumulator are such that, following a failure of the pneumatic supply to the accumulator, at least two valve actuations can occur with the drywell at 70% of design pressure (Ref. 15). The ECCS safety analysis assumes only one actuation to achieve the depressurization required for operation of the low pressure ECCS. This minimum required pressure of 140 psig is provided by the Instrument Air System. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.5-10                  Revision No. 20-2

ECCS Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.3  (continued)
REQUIREMENTS With regard to ADS accumulator supply pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties.
This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 17).
SR 3.5.1.4 The performance requirements of the ECCS pumps are determined through application of the 10 CFR 50, Appendix K, criteria (Ref. 8). This periodic Surveillance is performed (in accordance with the ASME Code requirements for the ECCS pumps) to verify that the ECCS pumps will develop the flow rates required by the respective analyses. The ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of 10 CFR 50.46 (Ref. 10).
The pump flow rates are verified with a pump differential pressure that is sufficient to overcome the RPV pressure expected during a LOCA. The pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during LOCAs. These values may be established during pre-operational testing. The Frequency for this Surveillance is in accordance with the INSERVICE TESTING PROGRAM requirements.
With regard to pump flow rates and differential pressures values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Refs. 18, 19, 20). Calculations 01HP15, 01LP16 and 01RH26 determine the margin between actual pump performance capability and the system design requirements and the Analyzed Design Limits as established by SAFER/GESTR. These margins are large enough to account for the instrument indication uncertainties and the lower EDG frequency limit per SR 3.8.1.2 and therefore the specified limit in this SR can be considered to be a nominal value (Refs. 18, 19, 20, 24).
(continued)
CLINTON                       B 3.5-11                  Revision No. 20-2

ECCS Operating B 3.5.1 BASES SURVEILLANCE   SR  3.5.1.5 REQUIREMENTS (continued) The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance test verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCS, LPCS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup, and actuation of all automatic valves to their required positions. This Surveillance also ensures that the HPCS System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the RCIC storage tank to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.
SR 3.5.1.6 The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals.
A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,
solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.7 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that excludes valve actuation.
This prevents an RPV pressure blowdown.
SR 3.5.1.7 A manual actuation of each required ADS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can (continued)
CLINTON                         B 3.5-12                  Revision No. 20-2

ECCS Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.7  (continued)
REQUIREMENTS be demonstrated by one of two methods. If performed by Method 1, plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements (Ref. 22), prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours after reactor steam pressure and flow are adequate to perform the test. The 12 hours allowed for manual actuation after the required pressure is reached is sufficient to achieve stable Conditions for testing and provides a reasonable time to complete the SR. If performed by Method 2, valve OPERABILITY has been demonstrated for all installed ADS valves based upon the successful operations of a test sample of S/RVs.
: 1. Manual actuation of the ADS valve, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g.,
tailpipe temperature or acoustic monitoring). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the ADS valves divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.
: 2. The sample population of S/RVs tested to satisfy SR 3.4.4.1 will also be stroked in the relief mode during as-found testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs provides reasonable assurance that all ADS valves will perform in a similar fashion. After the S/RVs are replaced, the relief-mode actuator of the newly-installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure that no damage has occurred to the S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the proper positioning of the stem nut is independently verified. This verifies that each replaced S/RV will properly perform its intended function.
SR 3.5.1.6 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                       B 3.5-13                   Revision No. 20-2

ECCS Operating B 3.5.1 BASES SURVEILLANCE      SR 3.5.1.8 REQUIREMENTS (continued)    This SR ensures that the ECCS RESPONSE TIMES are within limits for each of the ECCS injection and spray subsystems.
The response time limits (i.e., <42 seconds for the LPCI subsystems, <41 seconds for the LPCS subsystem, and <27 seconds for the HPCS system) are specified in applicable surveillance test procedures. This SR is modified by a Note which identifies that the associated ECCS actuation instrumentation is not required to be response time tested.
This is supported by Reference 16.
Response time testing of the remaining subsystem components is required. However, of the remaining subsystem components, the time for each ECCS pump to reach rated speed is not directly measured in the response time tests. The time(s) for the ECCS pumps to reach rated speed is bounded, in all cases, by the time(s) for the ECCS injection valve(s) to reach the full-open position. Plant-specific calculations show that all ECCS motor start times at rated voltage are less than two seconds. In addition, these calculations show that under degraded voltage conditions, the time to rated speed is less than five seconds.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to ECCS RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 21).
(continued)
CLINTON                            B 3.5-14                  Revision No. 20-2

ECCS Operating B 3.5.1 BASES   (continued)
REFERENCES          1. USAR, Section 6.3.2.2.3.
: 2. USAR, Section 6.3.2.2.4.
: 3. USAR, Section 6.3.2.2.1.
: 4. USAR, Section 6.3.2.2.2.
: 5. USAR, Section 15.2.8.
: 6. USAR, Section 15.6.4.
: 7. USAR, Section 15.6.5.
: 8. 10 CFR 50, Appendix K.
: 9. USAR, Section 6.3.3.
: 10. 10 CFR 50.46.
: 11. USAR, Section 6.3.3.3.
: 12. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.
(NRC), "Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.
: 13. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 14. USAR, Table 6.3-8.
: 15. USAR, Section 7.3.1.1.1.4.
: 16. NEDO-32291-A, "System Analyses for Elimination of Selected Response Time Testing Requirements," January 1994.
: 17. Calculation IP-0-0044.
: 18. Calculations 01HP09/10/11/15, IP-C-0042.
: 19. Calculations 01LP08/11/14/16, IP-C-0043.
: 20. Calculations 01RH19/20/22/26, IP-C-0041.
: 21. Calculation IP-0-0024.
: 22. ASME/ANSI OM-1987, Operation and Maintenance of Nuclear Power Plants, Part 1.
: 23. ASME Code for Operation and Maintenance of Nuclear Power Plants.
: 24. NEDC-32945P, Clinton Power Station SAFER/GESTR-LOCA Analysis, June 2000.
CLINTON                             B 3.5-15                  Revision No. 20-2

ECCS Operating B 3.5.1 This page intentionally left blank.
CLINTON               B 3.5-16              Revision No. 20-2

RPV Water Inventory Control B 3.5.2 B 3.5    EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV)
WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC)
SYSTEM B 3.5.2  RPV Water Inventory Control BASES BACKGROUND        The RPV contains penetrations below the top of the active fuel (TAF) that have the potential to drain the reactor coolant inventory to below the TAF. If the water level should drop below the TAF, the ability to remove decay heat is reduced, which could lead to elevated cladding temperatures and clad perforation. Safety Limit 2.1.1.3 requires the RPV water level to be above the top of the active irradiated fuel at all times to prevent such elevated cladding temperatures.
APPLICABLE        With the unit in MODE 4 or 5, RPV water inventory control is SAFETY ANALYSES   not required to mitigate any events or accidents evaluated in the safety analyses. RPV water inventory control is required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material to the environment should an unexpected draining event occur.
A double-ended guillotine break of the Reactor Coolant System (RCS) is not considered in MODES 4 and 5 due to the reduced RCS pressure, reduced piping stresses, and ductile piping systems. Instead, an event is considered in which an initiating event allows draining of the RPV water inventory through a single penetration flow path with the highest flow rate, or the sum of the drain rates through multiple penetration flow paths susceptible to a common mode failure (an event that creates a drain path through multiple vessel penetrations located below top of active fuel, such as loss of normal power, or single human error). It is assumed, based on engineering judgment, that while in MODES 4 and 5, one low pressure ECCS injection/spray subsystem can maintain adequate reactor vessel water level.
As discussed in References 1, 2, 3, 4, and 5, operating experience has shown RPV water inventory to be significant to public health and safety. Therefore, RPV Water Inventory Control satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
LCO               The RPV water level must be controlled in MODES 4 and 5 to ensure that if an unexpected draining event should occur, the reactor coolant water level remains above the top of the active irradiated fuel as required by Safety Limit 2.1.1.3.
The Limiting Condition for Operation (LCO) requires the DRAIN TIME of RPV water inventory to the TAF to be  36 hours. A DRAIN TIME of 36 hours is considered reasonable to (continued)
CLINTON                            B 3.5-17                  Revision No. 21-9

RPV Water Inventory Control B 3.5.2 BASES LCO             identify and initiate action to mitigate unexpected draining (continued) of reactor coolant. An event that could cause loss of RPV water inventory and result in the RPV water level reaching the TAF in greater than 36 hours does not represent a significant challenge to Safety Limit 2.1.1.3 and can be managed as part of normal plant operation.
One ECCS injection/spray subsystem is required to be OPERABLE and capable of being manually aligned and started from the control room to provide defense-in-depth should an unexpected draining event occur. OPERABILITY of the ECCS injection/spray subsystem includes any necessary valves, instrumentation, or controls needed to manually align and start the subsystem from the control room. An ECCS injection/spray subsystem is defined as either one of the three Low Pressure Coolant Injection (LPCI) subsystems, one Low Pressure Core Spray (LPCS) System, or one High Pressure Core Spray (HPCS) System. The LPCI subsystem and the LPCS System consist of one motor driven pump, piping, and valves to transfer water from the suppression pool to the reactor pressure vessel (RPV). The HPCS System consists of one motor driven pump, piping, and valves to transfer water from the suppression pool or RCIC storage tank to the RPV.
Management of gas voids is important to ECCS injection/spray subsystem OPERABILITY.
The LCO is modified by a Note that allows a LPCI subsystem to be inoperable during alignment and operation for decay heat removal with reactor steam dome pressure less than the residual heat removal cut-in permissive pressure. This is necessary since the RHR system is required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor, and manual realignment from the shutdown cooling mode to the LPCI mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to damage the RHR system, including water hammer. One LPCI subsystem is allowed to be considered inoperable for this temporary period, because in shutdown cooling mode it is fulfilling a decay heat removal capacity function. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary. Because of the restrictions on DRAIN TIME, sufficient time will be available following an unexpected draining event to manually align and operate the required LPCI subsystem to maintain RPV water inventory prior to the RPV water level reaching the TAF.
(continued)
CLINTON                           B 3.5-18                  Revision No. 21-9

RPV Water Inventory Control B 3.5.2 BASES   (continued)
APPLICABILITY       RPV water inventory control is required in MODES 4 and 5.
Requirements on water inventory control in other MODES are contained in LCOs in Section 3.3, "Instrumentation," and other LCOs in Section 3.5, "ECCS, RPV Water Inventory Control, and RCIC System." RPV water inventory control is required to protect Safety Limit 2.1.1.3 which is applicable whenever irradiated fuel is in the reactor vessel.
ACTIONS             A.1 and B.1 If the required ECCS injection/spray subsystem is inoperable, it must be restored to OPERABLE status within 4 hours. In this Condition, the LCO controls on DRAIN TIME minimize the possibility that an unexpected draining event could necessitate the use of the ECCS injection/spray subsystem, however the defense-in-depth provided by the ECCS injection/spray subsystem is lost. The 4 hour Completion Time for restoring the required ECCS injection/spray subsystem to OPERABLE status is based on engineering judgment that considers the LCO controls on DRAIN TIME and the low probability of a an unexpected draining event that would result in a loss of RPV water inventory.
If the inoperable ECCS injection/spray subsystem is not restored to OPERABLE status within the required Completion Time, action must be initiated immediately to establish a method of water injection capable of operating without offsite electrical power. The method of water injection includes the necessary instrumentation and controls, water sources, and pumps and valves needed to add water to the RPV or refueling cavity should an unexpected draining event occur. The method of water injection may be manually operated and may consist of one or more systems or subsystems, and must be able to access water inventory capable of maintaining the RPV water level above the TAF for 36 hours. If recirculation of injected water would occur, it may be credited in determining the necessary water volume.
(continued)
CLINTON                              B 3.5-19                  Revision No. 21-9

RPV Water Inventory Control B 3.5.2 BASES ACTIONS        C.1, C.2, and C.3 (continued)
With the DRAIN TIME less than 36 hours but greater than or equal to 8 hours, compensatory measures should be taken to ensure the ability to implement mitigating actions should an unexpected draining event occur. Should a draining event lower the reactor coolant level to below the TAF, there is potential for damage to the reactor fuel cladding and release of radioactive material. Additional actions are taken to ensure that radioactive material will be contained, diluted, and processed prior to being released to the environment.
The secondary containment provides a controlled volume in which fission products can be contained, diluted, and processed prior to release to the environment. Required Action C.1 requires verification of the capability to establish the secondary containment boundary in less than the DRAIN TIME. The required verification confirms actions to establish the secondary containment boundary are preplanned and necessary materials are available. The secondary containment boundary is considered established when one Standby Gas Treatment (SGT) subsystem is capable of maintaining a negative pressure in the secondary containment with respect to the environment.
Verification that the secondary containment boundary can be established must be performed within 4 hours. The required verification is an administrative activity and does not require manipulation or testing of equipment. Secondary containment penetration flow paths form a part of the secondary containment boundary. A secondary containment penetration flow path can be considered isolated when one barrier in the flow path is in place. Examples of suitable barriers include, but are not limited to, a closed secondary containment isolation damper (SCID), a closed manual valve, a blind flange, or another sealing device that sufficiently seals the penetration flow path. Required Action C.2 requires verification of the capability to isolate each secondary containment penetration flow path in less than the DRAIN TIME. The required verification confirms actions to isolate the secondary containment penetration flow paths are preplanned and necessary materials are available. Power operated dampers are not required to receive automatic isolation signals if they can be closed manually within the required time. Verification that the secondary containment penetration flow paths can be isolated must be performed within 4 hours. The required verification is an administrative activity and does not require manipulation or testing of equipment. The primary containment upper personnel airlock is considered part of the secondary containment boundary; therefore, it must be considered when completing this action.
(continued)
CLINTON                          B 3.5-20                 Revision No. 21-9

RPV Water Inventory Control B 3.5.2 BASES ACTIONS C.1, C.2, and C.3   (continued)
One SGT subsystem is capable of maintaining the secondary containment at a negative pressure with respect to the environment and filter gaseous releases. Required Action C.3 requires verification of the capability to place one SGT subsystem in operation in less than the DRAIN TIME. The required verification confirms actions to place a SGT subsystem in operation are preplanned and necessary materials are available. Verification that a SGT subsystem can be placed in operation must be performed within 4 hours.
The required verification is an administrative activity and does not require manipulation or testing of equipment.
D.1, D.2, D.3, and D.4 With the DRAIN TIME less than 8 hours, mitigating actions are implemented in case an unexpected draining event should occur. Note that if the DRAIN TIME is less than 1 hour, Required Action E.1 is also applicable.
Required Action D.1 requires immediate action to establish an additional method of water injection augmenting the ECCS injection/spray subsystem required by the LCO. The systems or injection and the ECCS subsystems. The additional method of water injection includes the necessary instrumentation and controls, water sources, and pumps and valves needed to add water to the RPV or refueling cavity should an unexpected draining event occur. The Note to Required Action D.1 states that either the ECCS injection/spray subsystem or the additional method of water injection must be capable of operating without offsite electrical power.
The additional method of water injection may be manually operated and may consist of one or more additional method of water injection must be able to access water inventory capable of being injected to maintain the RPV water level above the TAF for  36 hours. The additional method of water injection and the ECCS injection/spray subsystem may share all or part of the same water sources. If recirculation of injected water would occur, it may be credited in determining the required water volume.
Should a draining event lower the reactor coolant level to below the TAF, there is potential for damage to the reactor fuel cladding and release of radioactive material.
Additional actions are taken to ensure that radioactive material will be contained, diluted, and processed prior to being released to the environment.
The secondary containment provides a control volume into which fission products can be contained, diluted, and (continued)
CLINTON                   B 3.5-21                  Revision No. 21-9

RPV Water Inventory Control B 3.5.2 BASES ACTIONS D.1, D.2, D.3, and D.4  (continued) processed prior to release to the environment. Required Action D.2 requires that actions be immediately initiated to establish the secondary containment boundary. With the secondary containment boundary established, one SGT subsystem is capable of maintaining a negative pressure in the secondary containment with respect to the environment.
The secondary containment penetrations form a part of the secondary containment boundary. Required Action D.3 requires that actions be immediately initiated to verify that each secondary containment penetration flow path is isolated or to verify that it can be automatically or manually isolated from the control room. Examples of manual isolation from the control room could include the use of manual isolation pushbuttons, control switches, or placing a sufficient number of radiation monitor channels in trip. A secondary containment penetration flow path can be considered isolated when one barrier in the flow path is in place. Examples of suitable barriers include, but are not limited to, a closed secondary containment isolation damper (SCID), a closed manual valve, a blind flange, or another sealing device that sufficiently seals the penetration flow path. The primary containment upper personnel airlock and other primary containment penetrations that bypass secondary containment are considered part of the secondary containment boundary; therefore, they must be considered when completing this action.
One SGT subsystem is capable of maintaining the secondary containment at a negative pressure with respect to the environment and filter gaseous releases. Required Action D.4 requires that actions be immediately initiated to verify that at least one SGT subsystem is capable of being placed in operation. The required verification is an administrative activity and does not require manipulation or testing of equipment.
Required Actions D.2, D.3, and D.4 are considered to be met when secondary containment, secondary containment penetrations, and the Standby Gas Treatment System are OPERABLE in accordance with LCO 3.6.4.1, LCO 3.6.4.2, and LCO 3.6.4.3.
E.1 If the Required Actions and associated Completion times of Conditions C or D are not met or if the DRAIN TIME is less than 1 hour, actions must be initiated immediately to restore the DRAIN TIME to  36 hours. In this condition, (continued)
CLINTON                  B 3.5-22                  Revision No. 21-9

RPV Water Inventory Control B 3.5.2 BASES ACTIONS      E.1   (continued) there may be insufficient time to respond to an unexpected draining event to prevent the RPV water inventory from reaching the TAF. Note that Required Actions D.1, D.2, D.3, and D.4 are also applicable when DRAIN TIME is less than 1 hour.
SURVEILLANCE SR  3.5.2.1 REQUIREMENTS This Surveillance verifies that the DRAIN TIME of RPV water inventory to the TAF is  36 hours. The period of 36 hours is considered reasonable to identify and initiate action to mitigate draining of reactor coolant. Loss of RPV water inventory that would result in the RPV water level reaching the TAF in greater than 36 hours does not represent a significant challenge to Safety Limit 2.1.1.3 and can be managed as part of normal plant operation.
The definition of DRAIN TIME states that realistic cross-sectional areas and drain rates are used in the calculation.
A realistic drain rate may be determined using a single, step-wise, or integrated calculation considering the changing RPV water level during a draining event. For a Control Rod RPV penetration flow path with the Control Rod Drive Mechanism removed and not replaced with a blank flange, the realistic cross-sectional area is based on the control rod blade seated in the control rod guide tube. If the control rod blade will be raised from the penetration to adjust or verify seating of the blade, the exposed cross-sectional area of the RPV penetration flow path is used.
The definition of DRAIN TIME excludes from the calculation those penetration flow paths connected to an intact closed system, or isolated by manual or automatic valves that are closed and administratively controlled, blank flanges, or other devices that prevent flow of reactor coolant through the penetration flow paths. A blank flange or other bolted device must be connected with a sufficient number of bolts to prevent draining. Normal or expected leakage from closed systems or past isolation devices is permitted.
Determination that a system is intact and closed or isolated must consider the status of branch lines.
The Residual Heat Removal (RHR) Shutdown Cooling System is only considered an intact closed system when misalignment issues (Reference 6) have been precluded by functional valve interlocks or by isolation devices, such that redirection of RPV water out of an RHR subsystem is precluded. Further, RHR Shutdown Cooling System is only considered an intact closed system if its controls have not been transferred to (continued)
CLINTON                        B 3.5-23                 Revision No. 21-9

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR  3.5.2.1  (continued)
REQUIREMENTS Remote Shutdown, which disables the interlocks and isolation signals.
The exclusion of a single penetration flow path, or multiple penetration flow paths susceptible to a common mode failure, from the determination of DRAIN TIME should consider the effects of temporary alterations in support of maintenance (rigging, scaffolding, temporary shielding, piping plugs, freeze seals, etc.). If reasonable controls are implemented to prevent such temporary alterations from causing a draining event from a closed system or between the RPV and the isolation device, the effect of the temporary alterations on DRAIN TIME need not be considered.
Reasonable controls include, but are not limited to controls consistent with the guidance in NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," Revision 4, NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," or commitments to NUREG-0612, "Control of Heavy Loads at Nuclear Power Plants."
Surveillance Requirement 3.0.1 requires SRs to be met between performances. Therefore, any changes in plant conditions that would change the DRAIN TIME requires that a new DRAIN TIME be determined.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.5.2.2 and SR 3.5.2.3 The minimum water level of 12 ft 8 inches required for the suppression pool is periodically verified to ensure that the suppression pool will provide adequate net positive suction head (NPSH) for the ECCS pump, recirculation volume, and vortex prevention. With the suppression pool water level less than the required limit, the required ECCS injection/spray subsystem is inoperable unless it is aligned to an OPERABLE RCIC storage tank.
With regard to suppression pool water level values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties.
This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 2).
When the suppression pool level is < 12 ft 8 inches, the HPCS System is considered OPERABLE only if it can take suction from the RCIC storage tank and the RCIC storage tank (continued)
CLINTON                       B 3.5-24                   Revision No. 21-9

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.2 and SR 3.5.2.3  (continued)
REQUIREMENTS water level is sufficient to provide the required NPSH for the HPCS pump. Therefore, a verification that either the suppression pool water level is t 12 ft 8 inches or the HPCS System is aligned to take suction from the RCIC storage tank and the RCIC storage tank contains t 125,000 available gallons of water ensures that the HPCS System can supply makeup water to the RPV. Verification that the RCIC storage tank contains t 125,000 available gallons of water may be performed by verifying that the trip light for 1E51-N801 is on.
With regard to RCIC storage tank water level values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 2).
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.5.2.4 The Bases provided for SR 3.5.1.1 are applicable to SR 3.5.2.4.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                       B 3.5-25                  Revision No. 21-2

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE   SR  3.5.2.5 REQUIREMENTS (continued)
Verifying that the required ECCS injection/spray subsystem can be manually started and operate for at least 10 minutes demonstrates that the subsystem is available to mitigate a draining event. This SR is modified by two Notes. Note 1 acknowledges that testing of the ECCS injection/spray subsystem through the full flow test return line is adequate to confirm the operational readiness of the required ECCS injection/spray subsystem. Note 2 states that credit for meeting this SR may be taken for normal system operation to satisfy this SR. The minimum operating time of 10 minutes was based on engineering judgement.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.5.2.6 Verifying that each valve credited for automatically isolating a penetration flow path actuates to the isolation position on an actual or simulated RPV water level isolation signal is required to prevent RPV water inventory from dropping below the TAF should an unexpected draining event occur.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                         B 3.5-26                  Revision No. 21-2

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE   SR  3.5.2.7 REQUIREMENTS (continued) The required ECCS subsystem shall be capable of being manually operated from the main control room. This Surveillance verifies that the required LCPI subsystem, LPCS System, or HPCS System (including the associated pump and valve(s)) can be manually operated, including throttling injection valves, as necessary, to provide additional RPV Water Inventory, if needed, without delay.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the full flow test line, coolant injection into the RPV is not required during the Surveillance.
REFERENCES     1. Information Notice 84-81 "Inadvertent Reduction in Primary Coolant Inventory in Boiling Water Reactors During Shutdown and Startup," November 1984.
: 2. Information Notice 86-74, "Reduction of Reactor Coolant Inventory Because of Misalignment of RHR Valves," August 1986.
: 3. Generic Letter 92-04, "Resolution of the Issues Related to Reactor Vessel Water Level Instrumentation in BWRs Pursuant to 10 CFR 50.54(f)," August 1992.
: 4. NRC Bulletin 93-03, "Resolution of Issues Related to Reactor Vessel Water Level Instrumentation in BWRs,"
May 1993.
: 5. Information Notice 94-52, "Inadvertent Containment Spray and Reactor Vessel Draindown at Millstone 1,"
July 1994.
: 6. General Electric Service Information Letter No. 388, "RHR Valve Misalignment During Shutdown Cooling Operation for BWR 3/4/5/6," February 1983.
CLINTON                         B 3.5-27                  Revision No. 21-2

RPV Water Inventory Control B 3.5.2 This page intentionally left blank.
CLINTON               B 3.5-28                  Revision No. 20-2

RCIC System B 3.5.3 B 3.5    EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV)
WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC)
SYSTEM B 3.5.3  RCIC System BASES BACKGROUND        The RCIC System is not part of the ECCS; however, the RCIC System is included with the ECCS section because of their similar functions.
The RCIC System is designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of coolant flow from the feedwater system to provide adequate core cooling and control of RPV water level. Under these conditions, the High Pressure Core Spray (HPCS) and RCIC systems perform similar functions. The RCIC System design requirements ensure that the criteria of Reference 1 are satisfied.
The RCIC System (Ref. 2) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the reactor head cooling spray nozzle. Suction piping is provided from the RCIC storage tank and the suppression pool. Pump suction is normally aligned to the RCIC storage tank to minimize injection of suppression pool water into the RPV. However, if the RCIC storage tank water supply is low, or the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the RCIC System. The steam supply to the turbine is piped from main steam line A, upstream of the inboard main steam line isolation valve.
The RCIC System is designed to provide core cooling for a wide range of reactor pressures, 165 psia to 1215 psia.
Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed. As the RCIC flow increases, the turbine control valve is automatically adjusted to maintain design flow. Exhaust steam from the RCIC turbine is discharged to the suppression pool. A full flow test line is provided to route water from and to the RCIC storage tank to allow testing of the RCIC System during normal operation without injecting water into the RPV.
(continued)
CLINTON                            B 3.5-29                  Revision No. 20-2

RCIC System B 3.5.3 BASES BACKGROUND      The RCIC pump is provided with a minimum flow bypass line, (continued) which discharges to the suppression pool. The valve in this line automatically opens to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the RCIC System discharge line "keep fill" system is designed to maintain the pump discharge line filled with water.
APPLICABLE      The function of the RCIC System is to respond to transient SAFETY ANALYSES events by providing makeup coolant to the reactor. The RCIC System is not an Engineered Safety Feature and no credit is taken in the safety analysis for RCIC System operation. The RCIC System satisfies Criterion 4 of the NRC Policy Statement.
LCO             The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity to maintain RPV inventory during an isolation event. Management of gas voids is important to RCIC System OPERABILITY.
APPLICABILITY   The RCIC System is required to be OPERABLE in MODE 1, and MODES 2 and 3 with reactor steam dome pressure > 150 psig since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure d 150 psig, and in MODES 4 and 5, RCIC is not required to be OPERABLE since the ECCS injection/spray subsystems can provide sufficient flow to the vessel.
ACTIONS         A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC system. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable RCIC system and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
(continued)
CLINTON                          B 3.5-30                  Revision No. 20-2

RCIC System B 3.5.3 BASES ACTIONS        A.1 and A.2 (continued)
If the RCIC System is inoperable during MODE 1, or MODES 2 or 3 with reactor steam dome pressure > 150 psig, and the HPCS System is verified to be OPERABLE, the RCIC System must be restored to OPERABLE status within 14 days or in accordance with the Risk Informed Completion Time Program.
In this Condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high RPV pressure since the HPCS System is the only high pressure system assumed to function during a loss of coolant accident (LOCA). OPERABILITY of the HPCS is therefore verified within 1 hour when the RCIC System is inoperable.
This may be performed as an administrative check, by examining logs or other information, to determine if the HPCS is out of service for maintenance or other reasons.
Verification does not require performing the Surveillances needed to demonstrate the OPERABILITY of the HPCS System.
If the OPERABILITY of the HPCS System cannot be verified, however, Condition B must be immediately entered. For transients and certain abnormal events with no LOCA, RCIC (as opposed to HPCS) is the preferred source of makeup coolant because of its relatively small capacity, which allows easier control of RPV water level. Therefore, a limited time is allowed to restore the inoperable RCIC to OPERABLE status.
The 14 day Completion Time is based on a reliability study (Ref. 3) that evaluated the impact on ECCS availability, assuming that various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (AOTs). Because of the similar functions of the HPCS and RCIC, the AOTs (i.e., Completion Times) determined for the HPCS are also applied to RCIC.
B.1 and B.2 If the RCIC System cannot be restored to OPERABLE status within the associated Completion Time, or if the HPCS System is simultaneously inoperable, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and reactor steam dome pressure reduced to d 150 psig within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                         B 3.5-31                  Revision No. 21-7

RCIC System B 3.5.3 BASES   (continued)
SURVEILLANCE        SR  3.5.3.1 REQUIREMENTS The RCIC System flow path piping and components have the potential to develop voids and pockets of entrained gases.
Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RCIC System and may also prevent a water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.
Selection of RCIC System locations susceptible to gas accumulation is based on a self-assessment of the piping configuration to identify where gases may accumulate and remain even after the system is filled and vented, and to identify vulnerable potential degassing flow paths. The review is supplemented by verification that installed high-point vents are actually at the system high points, including field verification to ensure pipe shapes and construction tolerances have not inadvertently created additional high points. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The RCIC System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RCIC Systems are not rendered inoperable by the accumulated gas (i.e.,
the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
RCIC System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety.
For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
(continued)
CLINTON                              B 3.5-32                   Revision No. 20-2

RCIC System B 3.5.3 BASES SURVEILLANCE SR  3.5.3.1   (continued)
REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
SR  3.5.3.2 Verifying the correct alignment for manual, power operated, and automatic valves in the RCIC flow path provides assurance that the proper flow path will exist for RCIC operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the RCIC System, this SR also includes the steam flow path for the turbine and the flow controller position.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
(continued)
CLINTON                        B 3.5-33                 Revision No. 20-2

RCIC System B 3.5.3 BASES SURVEILLANCE   SR  3.5.3.3 and SR  3.5.3.4 REQUIREMENTS (continued) The RCIC pump flow rates ensure that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated. The flow tests for the RCIC System are performed at two different pressure ranges such that system capability to provide rated flow is tested both at the higher and lower operating ranges of the system.
Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the RCIC System diverts steam flow. Since the required reactor steam pressure must be available to perform SR 3.5.3.3 and SR 3.5.3.4, sufficient time is allowed after adequate pressure and flow are achieved to perform these SRs. Reactor startup is allowed prior to performing the low pressure Surveillance because the reactor pressure is low and the time to satisfactorily perform the Surveillance is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that RCIC is inoperable. Therefore, these SRs are modified by Notes that state the Surveillances are not required to be performed until 12 hours after the reactor steam pressure and flow are adequate to perform the test.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to RCIC steam supply pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 5).
With regard to the measured reactor pressure and flow rate values obtained pursuant to SR 3.5.3.3, as read from plant instrumentation assumed in Reference 5, are considered to be nominal values and therefore do not require compensation for instrument indication uncertainties.
With regard to the measured reactor pressure and flow rate values obtained pursuant to SR 3.5.3.4, the values as read from plant indication instrumentation are not considered to be nominal values with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 5).
(continued)
CLINTON                         B 3.5-34                  Revision No. 20-2

RCIC System B 3.5.3 BASES SURVEILLANCE   SR  3.5.3.5 REQUIREMENTS (continued) The RCIC System is required to actuate automatically to perform its design function. This Surveillance verifies that with a required system initiation signal (actual or simulated) the automatic initiation logic of RCIC will cause the system to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup and actuation of all automatic valves to their required positions. This Surveillance test also ensures that the RCIC System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the RCIC storage tank to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.3, "Reactor Core Isolation Cooling (RCIC) System Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that excludes vessel injection during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.
REFERENCES     1. 10 CFR 50, Appendix A, GDC 33.
: 2. USAR, Section 5.4.6.
: 3. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.
(NRC), "Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.
: 4. Deleted.
: 5. Calculation 01RI15.
CLINTON                         B 3.5-35                  Revision No. 20-2

RCIC System B 3.5.3 This page intentionally left blank.
CLINTON               B 3.5-36              Revision No. 20-2

Primary Containment B 3.6.1.1 B 3.6   CONTAINMENT SYSTEMS B 3.6.1.1   Primary Containment BASES BACKGROUND         The function of the primary containment is to isolate and contain fission products released from the Reactor Primary System following a Design Basis Accident (DBA) and to confine the postulated release of radioactive material to within limits. The primary containment consists of a steel lined, reinforced concrete vessel, which surrounds the Reactor Primary System and provides an essentially leak tight barrier against an uncontrolled release of radioactive material to the environment. Additionally, this structure provides shielding from the fission products that may be present in the primary containment atmosphere following accident conditions.
The isolation devices for the penetrations in the primary containment boundary are a part of the primary containment leak tight barrier. To maintain this leak tight barrier:
: a. All penetrations required to be closed during accident conditions are either:
: 1. capable of being closed by an OPERABLE automatic containment isolation system, or
: 2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)";
: b. Primary containment air locks are OPERABLE, except as provided in LCO 3.6.1.2, "Primary Containment Air Locks";
: c. All equipment hatches are closed;
: d. The suppression pool is OPERABLE, except as provided in LCO 3.6.2.2, "Suppression Pool Water Level"; and (continued)
CLINTON                                  B 3.6-1               Revision No. 11-4

Primary Containment B 3.6.1.1 BASES BACKGROUND      e. The primary containment leakage rates are within the (continued)       limits of this LCO.
This Specification ensures that the performance of the primary containment, in the event of a DBA, meets the assumptions used in the safety analyses of References 1 and 2. SR 3.6.1.1.1 leakage rate requirements are in conformance with 10 CFR 50, Appendix J, Option B (Ref. 3),
as modified by approved exemptions.
APPLICABLE      The safety design basis for the primary containment is that SAFETY ANALYSES it must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate.
The DBA that postulates the maximum release of radioactive material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE such that release of fission products to the environment is controlled by the rate of primary containment leakage.
Analytical methods and assumptions involving the primary containment are presented in References 1 and 2. The safety analyses assume a nonmechanistic fission product release following a DBA, which forms the basis for determination of offsite doses. The fission product release is, in turn, based on an assumed leakage rate from the primary containment. OPERABILITY of the primary containment ensures that the leakage rate assumed in the safety analyses is not exceeded.
The maximum allowable leakage rate for the primary containment (La) is 0.65% by weight of the containment and drywell air per 24 hours at the design basis LOCA maximum peak containment pressure (Pa) of 9.0 psig (Ref. 4).
Primary containment satisfies Criterion 3 of the NRC Policy Statement.
LCO             Primary containment OPERABILITY is maintained by limiting leakage to d 1.0 La, except prior to the first startup after performing a required Primary Containment Leakage Rate Testing Program leakage test. At this time, applicable leakage limits must be met. Compliance with this LCO will (continued)
CLINTON                              B 3.6-2               Revision No. 11-4

Primary Containment B 3.6.1.1 BASES LCO             ensure a primary containment configuration, including (continued) equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis. Individual leakage rates specified for the primary containment air locks are addressed in LCO 3.6.1.2.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In other operational conditions, events which could cause a release of radioactive material to primary containment are mitigated by secondary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.
Therefore, primary containment is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.
ACTIONS         A Note has been provided to indicate that when the Inclined Fuel Transfer System (IFTS) blind flange is unbolted for removal or reinstallation, entry into the associated Conditions and Required Actions may be delayed for up to 12 hours per operating cycle. This Note applies to the IFTS penetration and not to any other Primary Containment penetration. During removal and reinstallation of the blind flange, a temporary condition will exist where the bolting will be loosened, hydraulic jacks will spread the flange faces, and normally about one half of the bolts will be removed while the blind is rotated. This configuration is expected to exist for no more than a cumulative of 12 hours during MODES 1, 2, and 3. Upon expiration of the 12-hour allowance for this maintenance activity, if the IFTS blind flange has not yet been re-bolted, the applicable Condition must be entered and the required Actions taken. With the bolts removed, the seismic restraint for the IFTS penetration is potentially challenged. The risk is to the bellows assembly, as exact displacements are not quantified.
Failure of the ASME Class 2 bellows could result in a potential bypass of containment. Therefore, the total number of hours that the blind flange is unbolted per operating cycle shall be tracked to ensure that the 12-hour limitation is maintained. The cumulative 12-hour duration conservatively limits the seismic risk associated with the unbolted IFTS flange, yet provides adequate time to complete flange rotation.
A.1 In the event that primary containment is inoperable, primary containment must be restored to OPERABLE status within 1 hour. The 1 hour Completion Time provides a period of (continued)
CLINTON                              B 3.6-3                Revision No. 8-6

Primary Containment B 3.6.1.1 BASES ACTIONS           A.1  (continued) time to correct the problem that is commensurate with the importance of maintaining primary containment OPERABILITY during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring primary containment OPERABILITY) occurring during periods where primary containment is inoperable is minimal.
B.1 and B.2 If primary containment cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE      SR  3.6.1.1.1 REQUIREMENTS Maintaining the primary containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Primary Containment Leakage Rate Testing Program. Failure to meet air lock leakage testing (SR 3.6.1.2.1), secondary containment bypass leakage (SR 3.6.1.3.8), resilient seal primary containment purge valve leakage testing (SR 3.6.1.3.5), main steam isolation valve leakage (SR 3.6.1.3.9), or hydrostatically tested valve leakage (SR 3.6.1.3.10) does not necessarily result in a failure of this SR. The impact of the failure to meet these SRs must be evaluated against the Type A, B, and C acceptance criteria of the Primary Containment Leakage Rate Testing Program. As left leakage prior to the first startup after performing a required leakage test is required to be d 0.6 La for combined Type B and C leakage, and d 0.75 La for overall Type A leakage. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of d 1.0 La. At d 1.0 La the offsite dose consequences are bounded by the assumptions of the safety analysis. The Frequency is required by the Primary Containment Leakage Rate Testing Program.
This Surveillance is modified by a Note that requires the leakage rate results of SR 3.6.1.1.2 for the Primary Containment Hydrogen Recombiner System (each loop) to be included in determining compliance with required limits.
This can be accomplished either by having the loops in service during the ILRT, or if the loop is not in service during the ILRT, by separately measuring the leakage and including it in the measured ILRT results.
(continued)
CLINTON                                B 3.6-4                Revision No. 8-6

Primary Containment B 3.6.1.1 BASES SURVEILLANCE   SR 3.6.1.1.1 (continued)
REQUIREMENTS (continued) With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 7).
SR 3.6.1.1.2 With respect to primary containment integrated leakage rate testing, the primary containment hydrogen recombiners (located outside the primary containment) are considered extensions of the primary containment boundary. This requires the smaller of the leakage from the PCIVs that isolate the primary containment hydrogen recombiner, or from the piping boundary outside containment, to be included in the ILRT results. The Frequency is required by the Primary Containment Leakage Rate Testing Program.
With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 7).
REFERENCES     1. USAR, Section 6.2.
: 2. USAR, Section 15.6.5.
: 3. 10 CFR 50, Appendix J, Option B.
: 4. USAR, Section 6.2.1.
: 5. NEI 94-01, Revision 3-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J."
: 6. ANSI/ANS-56.8-2002, "American National Standard for Containment System Leakage Testing Requirement."
: 7. Calculation IP-0-0056.
: 8. NEI 94-01, Revision 2-A, "Industry Guideline for Implementing Performance-Based Option of 10 CFR Part 50, Appendix J."
CLINTON                             B 3.6-5                Revision No. 19-5

Primary Containment Air Locks B 3.6.1.2 B 3.6   CONTAINMENT SYSTEMS B 3.6.1.2   Primary Containment Air Locks BASES BACKGROUND         Two double door primary containment air locks have been built into the primary containment to provide personnel access to the primary containment and to provide primary containment isolation during the process of personnel entry and exit. The air locks are designed to withstand the same loads, temperatures, and peak design internal and external pressures as the primary containment (Ref. 1). As part of the primary containment, the air lock limits the release of radioactive material to the environment during normal unit operation and through a range of transients and accidents up to and including postulated Design Basis Accidents (DBAs).
Each air lock door has been designed and tested to certify its ability to withstand pressure in excess of the maximum expected pressure following a DBA in primary containment.
Each of the doors has compression seals. Each door has two seals to ensure they are single failure proof in maintaining the leak tight boundary of primary containment.
Each air lock is nominally a right circular cylinder, 9 ft 10 inches in diameter, with doors at each end that are interlocked to prevent simultaneous opening. During periods when the air lock is not required to be OPERABLE, the air lock interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent primary containment entry is necessary. Under some conditions, as allowed by this LCO, the primary containment may be accessed through the air lock when the door interlock mechanism has failed, by manually performing the interlock function.
The primary containment air locks form part of the primary containment pressure boundary. As such, air lock integrity and leak tightness are essential for maintaining primary containment leakage rate to within limits in the event of a (continued)
CLINTON                                 B 3.6-6                  Revision No. 0

Primary Containment Air Locks B 3.6.1.2 BASES BACKGROUND      DBA. Not maintaining air lock integrity or leak tightness (continued) may result in a leakage rate in excess of that assumed in the unit safety analysis.
APPLICABLE      The DBA that postulates the maximum release of radioactive SAFETY ANALYSES material within primary containment is a LOCA. In the analysis of this accident, it is assumed that primary containment is OPERABLE, such that release of fission products to the environment is controlled by the rate of primary containment leakage. The primary containment is designed with a maximum allowable leakage rate (La) of 0.65%
by weight of the containment and drywell air per 24 hours at the calculated maximum peak containment pressure (Pa) of 9.0 psig. This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air locks.
Primary containment air lock OPERABILITY is also required to minimize the amount of fission product gases that may escape primary containment through the air lock and contaminate and pressurize the secondary containment.
In addition, credit is taken for OPERABILITY of the upper containment personnel air lock during a Fuel Handling Accident (FHA) (Ref. 3). The upper containment personnel air lock performs no active function in response to the postulated FHA; however, its leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage paths assumed in the accident analysis, and that fission products released by the FHA will be treated by the Standby Gas Treatment System. Therefore, OPERABILITY of the upper containment personnel air lock is required during those conditions which require secondary containment OPERABILITY.
Primary containment air locks satisfy Criterion 3 of the NRC Policy Statement.
LCO             As part of the primary containment, the air lock's safety function is related to control of containment leakage rates following a DBA. Thus, the air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.
(continued)
CLINTON                              B 3.6-7                  Revision No. 0

Primary Containment Air Locks B 3.6.1.2 BASES LCO             The primary containment air locks are required to be (continued) OPERABLE. For each air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door to be open at a time. This provision ensures that a gross breach of primary containment does not exist when primary containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into and exit from primary containment.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining OPERABLE primary containment air locks in MODE 4 or 5 to ensure a control volume is only required during situations for which significant releases of radioactive material can be postulated; such as during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) in the primary containment.
ACTIONS         The ACTIONS are modified by Note 1, which allows entry and exit to perform repairs of the affected air lock component.
If the outer door is inoperable, then it may be easily accessed for most repairs. It is preferred that the air lock be accessed from inside primary containment by entering through the other OPERABLE air lock. However, if this is not practicable, or if repairs on either door must be performed from the barrel side of the door, then it is permissible to enter the air lock through the OPERABLE door, which means there is a short time during which the primary containment boundary is not intact (during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the primary containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the primary containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed.
(continued)
CLINTON                              B 3.6-8               Revision No. 20-2

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS        Note 2 has been included to provide clarification that, for (continued) this LCO, separate Condition entry is allowed for each air lock.
This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable air lock. Complying with the Required Actions may allow for continued operation, and a subsequent inoperable air lock is governed by subsequent Condition entry and application of associated Required Actions.
The ACTIONS are modified by a third Note, which ensures appropriate remedial actions are taken when necessary.
Pursuant to LCO 3.0.6, ACTIONS are not required even if primary containment is exceeding its leakage limit.
Therefore, the Note is added to require ACTIONS for LCO 3.6.1.1, "Primary Containment," to be taken in this event.
A.1, A.2, and A.3 With one primary containment air lock door inoperable in one or more required primary containment air locks, the OPERABLE door must be verified closed (Required Action A.1) in each affected air lock. This ensures that a leak tight primary containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour.
The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, which requires that primary containment be restored to OPERABLE status within 1 hour.
In addition, the affected air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour Completion Time. The 24 hour Completion Time is considered reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed.
Required Action A.3 ensures that the affected air lock with an inoperable door has been isolated by the use of a locked closed OPERABLE air lock door. This ensures that an acceptable primary containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls.
(continued)
CLINTON                             B 3.6-9                  Revision No. 0

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS A.1, A.2, and A.3  (continued)
Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
The Required Actions have been modified by two Notes.
Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception provided by Note 1 does not affect tracking the Completion Times from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls if both air locks have an inoperable door. This 7 day restriction begins when the second air lock is discovered inoperable.
Primary containment entry may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities inside primary containment that are required by TS or activities that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS-related activities) if the primary containment was entered, using the inoperable air lock, to perform an allowed activity listed above. The administrative controls required consist of the stationing of a dedicated individual to assure closure of the OPERABLE door except during the entry and exit, and assuring the OPERABLE door is relocked after completion of the containment entry and exit. In addition, Note 2 allows an OPERABLE air lock door to remain unlocked, but closed, when the door is under the control of a dedicated individual stationed at the air lock. This allowance is acceptable due to the low probability of an event that could pressurize the primary containment during the short time that the OPERABLE door is expected to be open.
(continued)
CLINTON                     B 3.6-10                Revision No. 1-1

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS B.1, B.2, and B.3 With an air lock interlock mechanism inoperable in one or both required primary containment air locks, the Required Actions and associated Completion Times are consistent with those specified in Condition A.
The Required Actions have been modified by two Notes.
Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in one air lock are inoperable. With both doors in the air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from the primary containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock). In addition, Note 2 allows an OPERABLE air lock door to remain unlocked, but closed, when the door is under the control of a dedicated individual stationed at the air lock.
Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
C.1, C.2, and C.3 With one or more required air locks inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be immediately initiated to evaluate containment overall leakage rates using current air lock leakage test results. An evaluation is acceptable since it is overly conservative to immediately declare the primary containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed) primary containment remains OPERABLE, yet only 1 hour (according to LCO 3.6.1.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.
(continued)
CLINTON                     B 3.6-11                Revision No. 21-7

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS C.1, C.2, and C.3  (continued)
Required Action C.2 requires that one door in the affected primary containment air locks must be verified closed. This Required Action must be completed within the 1 hour Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 1 hour.
Additionally, the air lock must be restored to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable if leakage exceeds limits or if there is a loss of function. The 24 hour Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status considering that at least one door is maintained closed in each affected air lock.
D.1 and D.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time while operating in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
E.1 and E.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) in the primary or secondary containment, action is required to immediately suspend activities that represent a potential for releasing radioactive material, thus placing the unit in a Condition that minimizes risk. If applicable, movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
The Required Actions of Condition E are modified by a Note indicating that LCO 3.0.3 does not apply. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.
Therefore, inability to suspend movement of recently irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.
(continued)
CLINTON                     B 3.6-12               Revision No. 21-7

Primary Containment Air Locks B 3.6.1.2 BASES   (continued)
SURVEILLANCE        SR  3.6.1.2.1 REQUIREMENTS Maintaining primary containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Primary Containment Leakage Rate Testing Program when in MODES 1, 2, and 3. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and primary containment OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall primary containment leakage rate. The Frequency is required by the Primary Containment Leakage Rate Testing Program.
The SR has been modified by three Notes. Note 1 provides an exception to the specific leakage requirements for the primary containment air locks in other than MODES 1, 2, and 3. When not operating in MODES 1, 2, or 3, primary containment pressure is not expected to significantly increase above normal, and therefore specific testing at elevated pressure is not required. Note 2 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.
This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 3 has been added to this SR, requiring the results to be evaluated against the acceptance criteria applicable to SR 3.6.1.1.1, i.e., the acceptance criteria specified in the Primary Containment Leakage Rate Testing Program. Conformance to the Primary Containment Leakage Rate Testing Program requires air lock leakage to be included in determining the overall primary containment leakage rate.
With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 5).
(continued)
CLINTON                                 B 3.6-13               Revision No. 20-2

Primary Containment Air Locks B 3.6.1.2 BASES SURVEILLANCE   SR  3.6.1.2.2 REQUIREMENTS (continued) The air lock interlock mechanism is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident primary containment pressure (Ref. 4), closure of either door will support primary containment OPERABILITY. Thus, the interlock feature supports primary containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES     1. USAR, Section 3.8.
: 2. 10 CFR 50, Appendix J, Option B.
: 3. USAR, Section 6.2.1.
: 4. USAR, Section 15.7.4.
5     Calculation IP-0-0056.
CLINTON                            B 3.6-14               Revision No. 20-2

PCIVs B 3.6.1.3 B 3.6   CONTAINMENT SYSTEMS B 3.6.1.3   Primary Containment Isolation Valves (PCIVs)
BASES BACKGROUND         The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) to within limits. Primary containment isolation within the time limits specified for those PCIVs designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.
The OPERABILITY requirements for PCIVs help ensure that an adequate primary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. Therefore, the OPERABILITY requirements provide assurance that the primary containment function assumed in the safety analysis will be maintained.
Typically two isolation barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or in leakage that exceeds limits assumed in the safety analysis. One of these barriers may be other than a PCIV, such as a closed system, while other penetrations may be designed with only one barrier such as a welded closed spare penetration. The isolation devices addressed by this LCO consist of either passive devices or active (automatic) devices. Manual valves, de-activated automatic valves, secured in their closed position, check valves with flow through the valve secured, and blind flanges are considered passive devices. Check valves and automatic valves, designed to close without operator action following an accident, are considered active devices.
The 12-inch supply (1VR006A and 1VR006B), 12-inch exhaust (1VR007A and 1VR007B), 36-inch supply (1VR001A and 1VR001B),
and 36-inch exhaust (1VQ004A and 1VQ004B) primary containment purge valves are PCIVs that are qualified for use during all operational conditions. The 36-inch primary containment purge valves are normally maintained closed in MODES 1, 2, and 3 to ensure leak tightness. The 36-inch purge valves must be closed when not being used for pressure control, ALARA, air quality considerations for personnel entry, or Surveillances or special testing on the purge system that require valves to be open to ensure that primary (continued)
CLINTON                                B 3.6-15                Revision No. 1-1

PCIVs B 3.6.1.3 BASES BACKGROUND      containment boundary assumed in the safety analysis will be (continued) maintained.
APPLICABLE      The PCIVs LCO was derived from the assumptions related SAFETY ANALYSES to minimizing the loss of reactor coolant inventory, and establishing the primary containment boundary during major accidents. As part of the primary containment boundary, PCIV OPERABILITY supports leak tightness of primary containment. Therefore, the safety analysis of any event requiring isolation of primary containment is applicable to this LCO.
The DBAs that result in a release of radioactive material for which the consequences are mitigated by PCIVs, are a loss of coolant accident (LOCA), a main steam line break (MSLB), and a fuel handling accident (Refs. 1, 2, 3, and 4).
In the analysis for each of these accidents, it is assumed that PCIVs are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through PCIVs are minimized. Of the events analyzed, the LOCA is the most limiting event due to radiological consequences.
It is assumed that the primary containment is isolated such that release of fission products to the environment is controlled.
PCIVs satisfy Criterion 3 of the NRC Policy Statement.
LCO             PCIVs form a part of the primary containment boundary and some also form a part of the RCPB. The PCIV safety function is related to minimizing the loss of reactor coolant inventory, and establishing the primary containment boundary during a DBA.
The power operated isolation valves are required to have isolation times within limits. Additionally, power operated automatic valves are required to actuate on an automatic isolation signal.
The normally closed PCIVs are considered OPERABLE when, as applicable, manual valves are closed or open in accordance with appropriate administrative controls, automatic valves are de-activated and secured in their closed position, or blind flanges are in place. The valves covered by this LCO are listed with their associated stroke times, if (continued)
CLINTON                             B 3.6-16                Revision No. 1-1

PCIVs B 3.6.1.3 BASES LCO             applicable, in the USAR (Ref. 5). Purge valves with (continued) resilient seals, secondary containment bypass isolation valves, MSIVs, and hydrostatically tested valves must meet other leakage rate requirements. Other PCIV leakage rates are addressed by LCO 3.6.1.1, "Primary Containment," as Type B or C testing.
This LCO provides assurance that the PCIVs will perform their designed safety functions to minimize the loss of reactor coolant inventory, and establish the primary containment boundary during accidents.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, most PCIVs are not required to be OPERABLE in MODES 4 and 5. Certain valves are required to be OPERABLE, however, to prevent release of radioactive material during a postulated fuel handling accident. These valves are those PCIVs in lines which bypass secondary containment.
ACTIONS         The ACTIONS are modified by a Note allowing penetration flow path(s) to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated individual at the controls of the valve, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.
A second Note has been added to provide clarification that, for the purpose of this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable PCIV.
Complying with the Required Actions may allow for continued operation, and subsequent inoperable PCIVs are governed by subsequent Condition entry and application of associated Required Actions.
The ACTIONS are modified by Notes 3 and 4. These Notes ensure appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable PCIV (e.g., an Emergency Core Cooling System subsystem is inoperable due to a failed open test return valve, or when the primary containment leakage limits are exceeded). Pursuant to LCO 3.0.6, these ACTIONS are not required even when the associated LCO is not met.
Therefore, Notes 3 and 4 are added to require the proper actions to be taken.
A fifth note has been added to allow removal of the Inclined Fuel Transfer System (IFTS) blind flange when primary containment operability is required. This provides the (continued)
CLINTON                              B 3.6-17               Revision No. 20-2

PCIVs B 3.6.1.3 BASES ACTIONS        option of operating the IFTS for testing, maintenance, or (continued) movement of new (non-irradiated) fuel to the upper containment pool when primary containment operability is required. Requiring the fuel building fuel transfer pool water to be t el. 753 ft. ensures a sufficient depth of water over the highest point on the transfer tube outlet valve in the fuel building fuel transfer pool to prevent direct communication between the containment building atmosphere and the fuel building atmosphere via the inclined fuel transfer tube. Because excessive leakage of water from the upper containment pool through the open IFTS penetration would result in the inability to provide the required volume of water to the suppression pool in an upper pool dump, an administrative control was required to ensure the upper pool volume meets the design requirements. In addition to the dedicated individual stationed at the IFTS controls, the required administrative controls involved the installation of the Steam Dryer Pool to Reactor Cavity Pool gate with the seal inflated and a backup air supply provided. Since the IFTS transfer tube drain line does not have the same water level as the transfer tube, and the motor-operated drain valve remains open when the carriage is in the lower pool, administrative controls are required to ensure the drain line flow path is quickly isolated in the event of a LOCA.
In this instance, administrative controls of the IFTS transfer tube drain line isolation valve(s) include stationing a dedicated individual, who is in continuous communication with the control room, at the IFTS control panel in the fuel building. This individual will initiate closure of the IFTS transfer tube drain line motor-operated isolation valve (1F42-F003), the IFTS transfer tube drain line manual isolation valve (1F42-F301), and the IFTS drain line test connection isolation valve (1F42-F305) if a need for primary containment isolation is indicated. The pressure integrity of the IFTS transfer tube, the seal created by water depth of the fuel building transfer pool, and the administrative control of the drain line flow path create an acceptable barrier to prevent the post-accident containment building atmosphere from leaking into the fuel building.
The total time per operating cycle that the blind flange may be open in Modes 1, 2, and 3 without affecting plant risk levels is 40 days.
A.1 and A.2 With one or more penetration flow paths with one PCIV inoperable except for inoperability due to leakage not within a limit specified in an SR to this LCO, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through (continued)
CLINTON                            B 3.6-18               Revision No. 20-2

PCIVs B 3.6.1.3 BASES ACTIONS A.1 and A.2  (continued) the valve secured. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest one available to the primary containment. The Required Action must be completed within the 4 hour Completion Time (8 hours for main steam lines and 12 hours for instrument line excess flow check valves (EFCVs)) or in accordance with the Risk Informed Completion Time Program. The specified time period of 4 hours is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3.
For main steam lines, an 8 hour Completion Time is allowed.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
The Completion Time of 8 hours for the main steam lines allows a period of time to restore the MSIVs to OPERABLE status given the fact that MSIV closure will result in isolation of the main steam line(s) and a potential for plant shutdown. For EFCVs, a 12 hour Completion Time is allowed. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. The Completion Time of 12 hours for EFCVs allows a period of time to restore the EFCVs to OPERABLE status given the fact that these valves are associated with instrument lines which are of small diameter and thus represent less significant leakage paths.
For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be isolated should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those devices outside primary containment, drywell, and steam tunnel and capable of being mispositioned are in the correct position. The Completion Time for this verification of "once per 31 days following isolation for isolation devices outside primary containment, drywell, and steam tunnel," is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. For devices inside primary containment, drywell, or steam tunnel, the specified time period of "prior to entering MODE 2 or 3 from MODE 4, if not performed within the previous 92 days," is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and the existence of other administrative controls ensuring that device misalignment is an unlikely possibility.
Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative means.
Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment; once they have been verified to be in the proper position, is low.
(continued)
CLINTON                     B 3.6-19               Revision No. 21-7

PCIVs B 3.6.1.3 BASES ACTIONS        B.1 (continued)
With one or more penetration flow paths with two PCIVs inoperable, except due to leakage not within limits, either the inoperable PCIVs must be restored to OPERABLE status or the affected penetration flow path must be isolated within 1 hour. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange.
The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1.1.
C.1 With the secondary containment bypass leakage rate, hydrostatic leakage rate, or MSIV leakage rate not within limit, the assumptions of the safety analysis may not be met. Therefore, the leakage must be restored to within limit within 4 hours. Restoration can be accomplished by isolating the penetration that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated, the leakage rate for the isolation penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices.
The 4 hour Completion Time is reasonable considering the time required to restore the leakage by isolating the penetration and the relative importance to the overall containment function.
D.1, D.2, and D.3 In the event one or more primary containment purge valves are not within the purge valve leakage limits, purge valve leakage must be restored to within limits or the affected penetration must be isolated. The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, closed manual valve, and blind flange. If a purge valve with resilient seals is utilized to satisfy Required Action D.1, it must have been demonstrated to meet the leakage requirements of SR 3.6.1.3.5. The specified Completion Time is reasonable, considering that one primary containment purge valve remains closed (refer to the requirements of SR 3.6.1.3.1; if this requirement is not met, entry into Condition A and B, as appropriate, would also be required), so that a gross breach of primary containment does not exist. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
(continued)
CLINTON                            B 3.6-20               Revision No. 21-7

PCIVs B 3.6.1.3 BASES ACTIONS D.1, D.2, and D.3  (continued)
In accordance with Required Action D.2, this penetration flow path following isolation must be verified to be isolated on a periodic basis. The periodic verification is necessary to ensure that primary containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be isolated should an event occur. This Required Action does not require any testing or valve manipulation. Rather, it involves verification that those isolation devices outside primary containment and potentially capable of being mispositioned are in the correct position. For the isolation devices inside primary containment, the time period specified as "prior to entering MODE 2 or 3, from MODE 4 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of administrative controls that will ensure that isolation device misalignment is an unlikely possibility.
For a primary containment purge valve with a resilient seal that is isolated in accordance with Required Action D.1, SR 3.6.1.3.5 must be performed at least once every 92 days following isolation. This provides assurance that degradation of the resilient seal is detected and confirms that the leakage rate of the primary containment purge valve does not increase during the time the penetration is isolated. The normal Frequency for SR 3.6.1.3.5 is as required by the Primary Containment Leakage Rate Testing Program. Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more often. Therefore, a Frequency of once per 92 days was chosen and has been shown acceptable based on operating experience.
E.1 and E.2 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
F.1 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies (i.e., fuel that has occupied (continued)
CLINTON                     B 3.6-21               Revision No. 21-7

PCIVs B 3.6.1.3 BASES ACTIONS      F.1  (continued) part of a critical reactor core within the previous 24 hours) in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe condition.
The Required Actions of Condition F are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.
Therefore, inability to suspend movement of recently irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.
SURVEILLANCE SR  3.6.1.3.1 REQUIREMENTS This SR verifies that the 36-inch primary containment purge valves are closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of the limits. If the open valve is known to have excessive leakage, Condition D applies.
The SR is also modified by a Note (Note 1) stating that primary containment purge valves are only required to be closed in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, the primary containment purge valves are capable of closing before the pressure pulse affects systems downstream of the purge valves and the release of radioactive material will not exceed limits prior to the purge valves closing. At times other than MODE 1, 2, or 3 when the purge valves are required to be capable of closing (e.g., during movement of recently irradiated fuel assemblies) pressurization concerns are not present and the purge valves are allowed to be open (automatic isolation capability would be required by SR 3.6.1.3.4 and SR 3.6.1.3.7).
The SR is modified by a Note (Note 2) stating that the SR is not required to be met when the purge valves are open for the stated reasons. The Note states that the 36-inch valves may be opened for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances or special testing on the purge system that require the valves to be open (e.g., testing of containment and drywell ventilation radiation monitors), provided the 12-inch containment purge and the drywell vent and purge lines are isolated. These primary containment purge valves are capable of closing in the environment following a LOCA.
Therefore, these valves are allowed to be open for limited periods of time. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                          B 3.6-22               Revision No. 21-7

PCIVs B 3.6.1.3 BASES SURVEILLANCE   SR  3.6.1.3.2 REQUIREMENTS (continued) This SR verifies that each primary containment isolation manual valve and blind flange that is located outside primary containment, drywell, and steam tunnel, and is required to be closed during accident conditions, is closed.
The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the primary containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those devices outside primary containment, drywell, and steam tunnel, and capable of being mispositioned, are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Two Notes are added to this SR. The first Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is low. A second Note is included to clarify that PCIVs open under administrative controls are not required to meet the SR during the time the PCIVs are open.
SR  3.6.1.3.3 This SR verifies that each primary containment manual isolation valve and blind flange located inside primary containment, drywell, or steam tunnel, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. For devices inside primary containment, drywell, and steam tunnel, the Frequency of "prior to entering MODE 2 or 3 from MODE 4, if not performed within the previous 92 days", is appropriate since these devices are operated under administrative controls and the probability of their misalignment is low.
Two Notes are added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since access to these areas is typically restricted during MODES 1, 2, and 3. Therefore, the probability of misalignment of these devices, once they have been verified to be in their proper position, is low. A second Note is included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open.
(continued)
CLINTON                            B 3.6-23                Revision No. 20-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE   SR  3.6.1.3.4 REQUIREMENTS (continued) Verifying the isolation time of each power operated and each automatic PCIV is within limits is required to demonstrate OPERABILITY. MSIVs may be excluded from this SR since MSIV full closure isolation time is demonstrated by SR 3.6.1.3.6.
The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the INSERVICE TESTING PROGRAM.
With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).
SR  3.6.1.3.5 For primary containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of the Primary Containment Leakage Rate Testing Program is required to ensure OPERABILITY. The acceptance criterion for this test is d 0.02 La for each penetration when pressurized to Pa, 9.0 psig. Since cycling these valves may introduce additional seal degradation (beyond that which occurs to a valve that has not been opened), this SR must be performed within 92 days after opening the valve. However, operating experience has demonstrated that if a valve with a resilient seal is not stroked during an operating cycle, significant increased leakage through the valve is not observed. Based on this observation, a normal Frequency in accordance with the Primary Containment Leakage Rate Testing Program was established.
The SR is modified by a Note stating that the primary containment purge valves are only required to meet leakage rate testing requirements in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, purge valve leakage must be minimized to ensure offsite radiological release is within limits. At other times when the purge valves are required to be capable of closing (e.g., during handling of recently irradiated fuel),
pressurization concerns are not present and the purge valves are not required to meet any specific leakage criteria.
With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).
Dose associated with leakage through the primary containment purge lines is considered to be in addition to that controlled as part of the primary containment leakage rate limit, La, and the 0.08 La limit for the other secondary containment bypass leakage paths.
(continued)
CLINTON                            B 3.6-24                Revision No. 20-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE   SR  3.6.1.3.6 REQUIREMENTS (continued) Verifying that the full closure isolation time of each MSIV is within the specified limits is required to demonstrate OPERABILITY. The full closure isolation time test ensures that the MSIV will isolate in a time period that does not exceed the times assumed in the DBA analyses. The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 10).
SR  3.6.1.3.7 Automatic PCIVs close on a primary containment isolation signal to prevent leakage of radioactive material from primary containment following a DBA. This SR ensures that each automatic PCIV will actuate to its isolation position on a primary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.6 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.6.1.3.8 This SR ensures that the leakage rate of secondary containment bypass leakage paths is less than the specified leakage rate. This provides assurance that the assumptions in the radiological evaluations of References 1, 2, and 3 are met. The leakage rate of each bypass leakage path is assumed to be the maximum pathway leakage (leakage through the worse of the two isolation valves) unless the penetration is isolated by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. In this case, the leakage rate of the isolated bypass leakage path is assumed to be the actual pathway leakage through the isolation device. If both isolation valves in the penetration are closed, the actual leakage rate is the lesser leakage rate of the two valves. This method of quantifying maximum pathway leakage is only to be used for this SR.
The Frequency is consistent with the Primary Containment Leakage Rate Testing Program. This SR simply imposes additional acceptance criteria. Secondary containment bypass leakage is considered part of La.
Note 1 states that primary containment purge penetrations 1MC-101 and 1MC-102 are excluded from this SR verifying the secondary containment bypass leakage. The leakage through (continued)
CLINTON                            B 3.6-25               Revision No. 20-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR  3.6.1.3.8  (continued)
REQUIREMENTS these penetrations is measured by SR 3.6.1.3.5 and the consequences associated with this leakage are evaluated separately as part of the LOCA analysis. Therefore, the leakage through the primary containment purge penetrations is excluded from the total secondary containment bypass leakage as verified in this SR. A second Note is provided to this SR which states that these valves are only required to meet this leakage limit in MODES 1, 2 and 3. In the other conditions, the Reactor Coolant System is not pressurized and specific primary containment leakage limits are not required.
With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).
SR  3.6.1.3.9 The analyses in References 1, 2, and 3 are based on leakage that is less than the specified leakage rate. Combined leakage through all four main steamlines must be d 200 scfh when tested at Pa (9.0 psig). In addition, the leakage rate through any single main steam line must be < 100 scfh when tested at Pa. The MSIV leakage rate must be verified to be in accordance with the assumptions of References 1, 2, and 3. A Note is added to this SR which states that these valves are only required to meet this leakage limit in MODES 1, 2, and 3. In the other conditions, the Reactor Coolant System is not pressurized and primary containment leakage limits are not required. The Frequency is required by the Primary Containment Leakage Rate Testing Program.
With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).
SR  3.6.1.3.10 Surveillance of hydrostatically tested lines provides assurance that the calculation assumptions of Reference 4 are met. The combined leakage rates (of 1 gpm times the total number of PCIVs when tested at t 1.1 Pa) must be demonstrated at the frequency of the leakage test requirements of the Primary Containment Leakage Rate Testing Program.
This SR is modified by a Note that states that these valves are only required to meet the combined leakage rate in MODES 1, 2, and 3 since this is when the Reactor Coolant System is pressurized and primary containment is required.
(continued)
CLINTON                          B 3.6-26               Revision No. 20-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR  3.6.1.3.10  (continued)
REQUIREMENTS In some instances, the valves are required to be capable of automatically closing during MODES other than MODES 1, 2, and 3. However, specific leakage limits are not applicable in these other MODES or conditions.
With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 12).
SR  3.6.1.3.11 This SR ensures that the combined leakage rate of the primary containment feedwater penetrations is less than the specified leakage rate. The leakage rate is based on water as the test medium since these penetrations are designed to be sealed by the FWLCS. The 1.5 gpm leakage limit has been shown by testing and analysis to bound the condition following a DBA LOCA where, for a limited time, both air and water are postulated to leak through this pathway. The leakage rate of each primary containment feedwater penetration is assumed to be the maximum pathway leakage, i.e., the leakage through the worst of the two isolation valves (either 1B21-F032A(B) or 1B21-F065A(B)) in each penetration. This provides assurance that the assumptions in the radiological evaluations of References 1 and 2 are met (Ref. 15).
Dose associated with leakage (both air and water) through the primary containment feedwater penetrations is considered to be in addition to the dose associated with all other secondary containment bypass leakage paths.
The Frequency is in accordance with the Primary Containment Leakage Rate Testing Program.
A Note is added to this SR which states that the primary containment feedwater penetrations are only required to meet this leakage limit in Modes 1, 2, and 3. In other conditions, the Reactor Coolant System is not pressurized and specific primary containment leakage limits are not required.
SR  3.6.1.3.12 This SR requires a demonstration that each instrumentation line excess flow check valve (EFCV) which communicates to the reactor coolant pressure boundary (Ref. 16) is OPERABLE by verifying that the valve activates within the required flow range. For instrument lines connected to reactor coolant pressure boundary, the EFCVs serve as an additional flow restrictor to the orifices that are installed inside (continued)
CLINTON                          B 3.6-27                Revision No. 20-5

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR  3.6.1.3.12  (continued)
REQUIREMENTS the drywell (Ref. 14). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
The operating limit or process parameter value associated with this SR, as read from plant indication instrumentation, is considered nominal. Instrument indications that are considered nominal do not require compensation for instrument indication uncertainties (Ref. 13).
Instrument lines that connect to the containment atmosphere, such as those which measure drywell pressure, or monitor the containment atmosphere or suppression pool water level, are considered extensions of primary containment. A failure of one of these instrument lines during normal operation would not result in the closure of the associated EFCV, since normal operating containment pressure is not sufficient to operate the valve. Such EFCVs will only close with a downstream line break concurrent with a LOCA. Since these conditions are beyond the plant design basis, EFCV closure is not needed and containment atmospheric instrument line EFCVs need not be tested (Ref. 16).
REFERENCES   1. USAR, Chapter 15.6.5.
: 2. USAR, Section 15.6.4.
: 3. USAR, Section 15.7.4.
: 4. USAR, Section 6.2.
: 5. USAR, Table 6.2-47.
: 6. 10 CFR 50, Appendix J, Option B.
: 7. Regulatory Guide 1.11.
: 8. Calculation IP-0-0059.
: 9. Calculation IP-0-0056.
: 10. Calculation IP-0-0028.
: 11. Calculation IP-0-0063.
: 12. Calculation IP-0-0064.
: 13. Calculation IP-0-0065.
: 14. Calculation IP-M-0506
: 15. License Amendment 127
: 16. NEDO 32977-A, Excess Flow Check Valve Testing Relaxation CLINTON                          B 3.6-28               Revision No. 20-2

Primary Containment Pressure B 3.6.1.4 B 3.6   CONTAINMENT SYSTEMS B 3.6.1.4   Primary Containment Pressure BASES BACKGROUND         The primary containment pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a Design Basis Accident (DBA) or loss of coolant accident (LOCA).
The limits on primary containment to secondary containment differential pressure have been developed based on operating experience. The secondary containment pressure is kept slightly negative relative to the atmospheric pressure to prevent leakage to the atmosphere.
Transient events, which include inadvertent containment spray initiation, can reduce the primary containment pressure (Ref. 1). Without an appropriate limit on the negative containment pressure, the design limit for negative internal pressure of 3.0 psid could be exceeded (Ref. 2).
Therefore, the Specification pressure limits of t -0.25 and d 0.25 psid were established.
The limitation on the primary to secondary containment differential pressure provides added assurance that the peak LOCA primary containment pressure does not exceed the design value of 15 psig (Ref. 2).
APPLICABLE         Primary containment performance for the DBA is evaluated for SAFETY ANALYSES    the entire spectrum of break sizes for postulated LOCAs inside containment (Ref. 3). Among the inputs to the design basis analysis is the initial primary containment internal pressure. The primary containment to secondary containment differential pressure can affect the initial containment internal pressure. The initial pressure limitation requirements ensure that peak primary containment pressure for a DBA LOCA does not exceed the design value of 15 psig and that peak negative pressure for an inadvertent containment spray event does not exceed the design value of 3.0 psid.
(continued)
CLINTON                                B 3.6-29                  Revision No. 0

Primary Containment Pressure B 3.6.1.4 BASES APPLICABLE      Primary containment pressure satisfies Criterion 2 of the SAFETY ANALYSES NRC Policy Statement.
(continued)
LCO             A limitation on the primary to secondary containment differential pressure of t -0.25 and d 0.25 psid is required to ensure that primary containment initial conditions are consistent with the initial safety analyses assumptions so that containment pressures remain within design values during a LOCA and the design value of containment negative pressure is not exceeded during an inadvertent operation of containment sprays.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could result in a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining primary containment pressure within limits is not required in MODE 4 or 5.
ACTIONS         A.1 When primary to secondary containment differential pressure is not within the limits of the LCO, differential pressure must be restored to within limits within 1 hour. The Required Action is necessary to return operation to within the bounds of the primary containment analysis. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, "Primary Containment," which requires that primary containment be restored to OPERABLE status within 1 hour.
B.1 and B.2 If primary to secondary containment differential pressure cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                             B 3.6-30                  Revision No. 0

Primary Containment Pressure B 3.6.1.4 BASES   (continued)
SURVEILLANCE        SR  3.6.1.4.1 REQUIREMENTS Verifying that primary containment to secondary containment differential pressure is within limits ensures that operation remains within the limits assumed in the primary containment analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to differential pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).
REFERENCES          1. USAR, Section 6.2.1.1.4.
: 2. USAR, Table 6.2-1.
: 3. USAR, Section 6.2.
: 4. Calculation IP-0-0066.
CLINTON                                 B 3.6-31               Revision No. 14-2

Primary Containment Air Temperature B 3.6.1.5 B 3.6   CONTAINMENT SYSTEMS B 3.6.1.5   Primary Containment Air Temperature BASES BACKGROUND         Heat loads from the drywell, as well as piping and equipment in the primary containment, add energy to the primary containment airspace and raise airspace temperature.
Coolers included in the unit design remove this energy and maintain an appropriate average temperature inside primary containment. The average airspace temperature affects the calculated response to postulated Design Basis Accidents (DBAs). This primary containment air temperature limit is an initial condition input for the Reference 1 safety analyses.
APPLICABLE         Primary containment performance for the DBA is evaluated for SAFETY ANALYSES    a entire spectrum of break sizes for postulated loss of coolant accidents (LOCAs) inside containment (Ref. 1).
Among the inputs to the design basis analysis is the initial primary containment average air temperature. Analyses assume an initial average primary containment air temperature of 122&deg;F (Ref. 2). Maintaining the expected initial conditions ensures that safety analyses remain valid and ensures that the peak LOCA primary containment temperature does not exceed the maximum allowable temperature of 185&deg;F (Ref. 1). Exceeding this design temperature may result in the degradation of the primary containment structure under accident loads. Equipment inside primary containment, and needed to mitigate the effects of a DBA, is designed to operate and be capable of operating under environmental conditions expected for the accident.
Primary containment air temperature satisfies Criterion 2 of the NRC Policy Statement.
LCO                With an initial primary containment average air temperature less than or equal to the LCO temperature limit, the peak accident temperature is maintained below the primary containment design temperature. As a result, the ability of (continued)
CLINTON                                B 3.6-32                   Revision No. 0

Primary Containment Air Temperature B 3.6.1.5 BASES LCO             primary containment to perform its design function is (continued) ensured.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining primary containment average air temperature within the limit is not required in MODE 4 or 5.
ACTIONS         A.1 When primary containment average air temperature is not within the limit of the LCO, it must be restored within 8 hours. This Required Action is necessary to return operation to within the bounds of the primary containment analysis. The 8 hour Completion Time is acceptable, considering the sensitivity of the analysis to variations in this parameter, and provides sufficient time to correct minor problems.
B.1 and B.2 If the primary containment average air temperature cannot be restored to within limit within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE    SR  3.6.1.5.1 REQUIREMENTS Verifying that the primary containment average air temperature is within the LCO limit ensures that operation remains within the limits assumed for the primary (continued)
CLINTON                             B 3.6-33                  Revision No. 0

Primary Containment Air Temperature B 3.6.1.5 BASES SURVEILLANCE SR  3.6.1.5.1  (continued)
REQUIREMENTS containment analyses. In order to determine the primary containment average air temperature, an arithmetic average is calculated, using measurements taken at locations within the primary containment selected to provide a representative sample of the overall primary containment atmosphere. The arithmetical average must consist of at least one reading from one location per quadrant as described in Ref. 3.
However, all available instruments should be used in determining the arithmetical average.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to containment air temperature values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties.
This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 4).
REFERENCES   1. USAR, Section 6.2.
: 2. USAR, Table 6.2-4.
: 3. USAR, Section 7.5.1.4.2.4.
: 4. Calculation IP-0-0067.
CLINTON                          B 3.6-34               Revision No. 14-2

LLS Valves B 3.6.1.6 B 3.6   CONTAINMENT SYSTEMS B 3.6.1.6   Low-Low Set (LLS) Valves BASES BACKGROUND         The safety/relief valves (S/RVs) can actuate either in the relief mode, the safety mode, the Automatic Depressurization System mode, or the LLS mode. In the LLS mode (one of the power actuated modes of operation), a pneumatic operator and mechanical linkage overcome the spring force and open the valve. The valve can be maintained open with valve inlet steam pressure as low as 0 psig. The pneumatic operator is arranged so that its malfunction will not prevent the valve disk from lifting if steam inlet pressure exceeds the safety mode pressure setpoints.
Five of the S/RVs are equipped to provide the LLS function.
The LLS logic causes two LLS valves to be opened at a lower pressure than the relief or safety mode pressure setpoints and causes all the LLS valves to stay open longer, such that reopening of more than one S/RV is prevented on subsequent actuations. Therefore, the LLS function prevents excessive short duration S/RV cycles with valve actuation at the relief setpoint.
Each S/RV discharges steam through a discharge line and quencher to a location near the bottom of the suppression pool, which causes a load on the suppression pool wall.
Actuation at lower reactor pressure results in a lower load.
APPLICABLE         The LLS relief mode functions to ensure that the SAFETY ANALYSES    containment design basis of one S/RV operating on "subsequent actuations" is met (Ref. 1). In other words, multiple simultaneous openings of S/RVs (following the initial opening) and the corresponding higher loads, are avoided. The safety analysis demonstrates that the LLS functions to avoid the induced thrust loads on the S/RV discharge line resulting from "subsequent actuations" of the S/RV during Design Basis Accidents (DBAs). Furthermore, the LLS function justifies the primary containment analysis assumption that multiple simultaneous S/RV openings occur only on the initial actuation for DBAs. Even though five (continued)
CLINTON                                B 3.6-35                  Revision No. 0

LLS Valves B 3.6.1.6 BASES APPLICABLE      LLS S/RVs are specified, all five LLS S/RVs do not operate SAFETY ANALYSES in any DBA analysis.LLS valves satisfy Criterion 3 of the (continued) NRC Policy Statement LCO             Five LLS valves are required to be OPERABLE to satisfy the assumptions of the safety analysis (Ref. 1). The requirements of this LCO are applicable to the mechanical and electrical/pneumatic capability of the LLS valves to function for controlling the opening and closing of the S/RVs.
APPLICABILITY   In MODES 1, 2, and 3, an event could cause pressurization of the reactor and opening of S/RVs. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES.
Therefore, maintaining the LLS valves OPERABLE is not required in MODE 4 or 5.
ACTIONS         A.1 With one LLS valve inoperable, the remaining OPERABLE LLS valves are adequate to perform the designed function.
However, the overall reliability is reduced. The 14 day Completion Time takes into account the redundant capability afforded by the remaining LLS S/RVs and the low probability of an event in which the remaining LLS S/RV capability would be inadequate. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
B.1 If the inoperable LLS valve cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
Required Action B.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
(continued)
CLINTON                              B 3.6-36              Revision No. 21-7

LLS Valves B 3.6.1.6 BASES ACTIONS      B.1  (continued)
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
C.1 and C.2 If two or more LLS valves are inoperable, there could be excessive short duration S/RV cycling during an overpressure event. The plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 and MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE SR  3.6.1.6.1 REQUIREMENTS A manual actuation of each required LLS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by Method 1, plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements (Ref. 3), prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours after reactor steam pressure and flow are adequate to perform the test. The 12 hours allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR. If performed by Method 2, valve OPERABILITY has been demonstrated for all installed LLS valves based upon the successful operation of a test sample of S/RVs.
: 1. Manual actuation of the LLS valve, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g.,
tailpipe temperature or acoustic monitoring). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the LLS valves divert steam flow upon opening.
Sufficient time is therefore allowed after the required (continued)
CLINTON                          B 3.6-37               Revision No. 13-2

LLS Valves B 3.6.1.6 BASES SURVEILLANCE SR  3.6.1.6.1 (continued)
REQUIREMENTS pressure and flow are achieved to perform this test.
Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.
: 2. The sample population of S/RVs tested to satisfy SR 3.4.4.1 will also be stroked in the relief mode during as-found testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs provides reasonable assurance that all LLS valves will perform in similar fashion. After the S/RVs are replaced, the relief-mode actuator of the newly-installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure that no damage has occurred to the S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the proper positioning of the stem nut is independently verified. This verifies that each replaced S/RV will properly perform its intended function.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.6.1.6.2 The LLS designed S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to verify that the mechanical portions (i.e., solenoids) of the automatic LLS function operate as designed when initiated either by an actual or simulated automatic initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.5.4 overlaps this SR to provide complete testing of the safety function.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that excludes valve actuation.
This prevents a reactor pressure vessel pressure blowdown.
REFERENCES   1. USAR, Section 5.2.2.2.3.
: 2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 3. ASME/ANSI OM-1987, Operation and Maintenance of Nuclear Power Plants, Part 1.
CLINTON                          B 3.6-38                Revision No. 14-2

RHR Containment Spray System B 3.6.1.7 B 3.6   CONTAINMENT SYSTEMS B 3.6.1.7   Residual Heat Removal (RHR) Containment Spray System BASES BACKGROUND         The primary containment is designed with a suppression pool so that, in the event of a loss of coolant accident (LOCA),
steam released from the primary system is channeled through the suppression pool water and condensed without producing significant pressurization of the primary containment. The primary containment is designed so that with the pool initially at the minimum water volume and the worst single failure of the primary containment heat removal systems, suppression pool energy absorption combined with subsequent operator controlled pool cooling will prevent the primary containment pressure from exceeding its design value.
However, the primary containment must also withstand a postulated drywell bypass leakage pathway that allows the passage of steam from the drywell directly into the primary containment airspace, bypassing the suppression pool. The primary containment also must withstand a low energy steam release into the primary containment airspace. The RHR Containment Spray System is designed to mitigate the effects of bypass leakage and low energy line breaks.
There are two redundant, 100% capacity RHR containment spray subsystems. Each subsystem consists of a suction line from the suppression pool, an RHR pump, a heat exchanger, and two spray headers inside the primary containment (outside of the drywell) above the refueling floor. Dispersion of the spray water is accomplished by 249 nozzles in the Division 1 subsystem and 251 nozzles in the Division 2 subsystem.
The RHR containment spray mode will be automatically initiated, if required, following a LOCA.
APPLICABLE         Reference 1 contains the results of analyses that predict SAFETY ANALYSES    the primary containment pressure response for a LOCA with the maximum allowable bypass leakage area.
The equivalent flow path area for drywell bypass leakage has been specified to be 1.0 ft2.
The analysis demonstrates that with containment spray operation the containment pressure remains within design limits.
The RHR Containment Spray System satisfies Criterion 3 of the NRC Policy Statement.
(continued)
CLINTON                                B 3.6-39               Revision No. 21-7

RHR Containment Spray System B 3.6.1.7 BASES   (continued)
LCO                 In the event of a Design Basis Accident (DBA), a minimum of one RHR containment spray subsystem is required to mitigate potential bypass leakage paths and maintain the primary containment peak pressure below design limits. To ensure that these requirements are met, two RHR containment spray subsystems must be OPERABLE. Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR containment spray subsystem is OPERABLE when the pump, the heat exchanger, and associated piping, valves, instrumentation, and controls are OPERABLE. Management of gas voids is important to RHR Containment Spray System OPERABILITY.
The LCO is modified by a Note that allows an RHR containment spray subsystem to be inoperable during alignment and operation for decay heat removal with reactor steam dome pressure less than the residual heat removal cut-in permissive pressure. This is necessary since the RHR system is required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor, and manual realignment from the shutdown cooling mode to the RHR containment spray mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to damage the RHR system, including water hammer. One RHR Containment Spray subsystem is allowed to be considered inoperable for this temporary period, because in shutdown cooling mode it is fulfilling a decay heat removal capacity function. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary.
APPLICABILITY       In MODES 1, 2, and 3, a DBA could cause pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining RHR containment spray subsystems OPERABLE is not required in MODE 4 or 5.
ACTIONS             A.1 With one RHR containment spray subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. In this Condition, the remaining OPERABLE RHR containment spray subsystem is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the (continued)
CLINTON                                 B 3.6-40                Revision No. 21-7

RHR Containment Spray System B 3.6.1.7 BASES ACTIONS A.1  (continued)
OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time was chosen in light of the redundant RHR containment capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.
B.1 With two RHR containment spray subsystems inoperable, one subsystem must be restored to OPERABLE status within 8 hours. In this Condition, there is a substantial loss of the drywell bypass leakage mitigation function. The 8 hour Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and because alternative methods to remove heat from primary containment are available.
C.1 If the inoperable RHR containment spray subsystem cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
Required Action C.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.
The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                     B 3.6-41               Revision No. 20-1

RHR Containment Spray System B 3.6.1.7 BASES   (continued)
SURVEILLANCE        SR  3.6.1.7.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the RHR containment spray mode flow path provides assurance that the proper flow paths will exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.
SR  3.6.1.7.2 Verifying each RHR pump develops a flow rate t 3800 gpm while operating in the suppression pool cooling mode with flow through the associated heat exchanger ensures that pump performance has not degraded below the required flow rate during the cycle. It is tested in the pool cooling mode to demonstrate pump OPERABILITY without spraying down equipment in primary containment. Although this SR is satisfied by running the pump in the suppression pool cooling mode, the test procedures that satisfy this SR include appropriate acceptance criteria to account for the higher pressure requirements resulting from aligning the RHR System in the containment spray mode. The Frequency of this SR is in accordance with the Inservice Testing Program.
(continued)
CLINTON                                 B 3.6-42               Revision No. 20-1

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE   SR  3.6.1.7.3 REQUIREMENTS (continued) This SR verifies that each RHR containment spray subsystem automatic valve actuates to its correct position upon receipt of an actual or simulated automatic actuation signal. Actual spray initiation is not required to meet this SR. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.3.5 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.6.1.7.4 This Surveillance is performed following activities that could result in nozzle blockage to verify that the spray nozzles are not obstructed and that flow will be provided when required. Such activities may include a loss of foreign material control (of if it cannot be assured),
following a major configuration change, or following an inadvertent actuation of containment spray. This Surveillance is normally performed by an air or smoke flow test. The Frequency is adequate due to the passive nozzle design and its normally dry state and has been shown to be acceptable through operating experience.
SR  3.6.1.7.5 RHR Containment Spray System piping and components have the potential to develop voids and pockets of entrained gases.
Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR containment spray subsystems and may also prevent water hammer and pump cavitation.
Selection of RHR Containment Spray System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The RHR Containment Spray System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume (continued)
CLINTON                            B 3.6-43                Revision No. 20-9

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE SR  3.6.1.7.5  (continued)
REQUIREMENTS at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Containment Spray System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.
Accumulated gas should be eliminated or brought within the acceptance criteria limits.
RHR Containment Spray System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
REFERENCES   1. USAR, Section 6.2.1.1.5.
: 2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 3. ASME Code for Operation and Maintenance of Nuclear Power Plants.
: 4. USAR, Section 5.4.7 CLINTON                          B 3.6-43a              Revision No. 17-1

This page intentionally left blank.
CLINTON                 B 3.6-43b           Revision No. 17-1

B 3.6   CONTAINMENT SYSTEMS B 3.6.1.8   Deleted CLINTON                     B 3.6-44 Revision No. 10-5

FWLCS B 3.6.1.9 B 3.6   CONTAINMENT SYSTEMS B 3.6.1.9   Feedwater Leakage Control System (FWLCS)
BASES BACKGROUND         Following a DBA LOCA, the FWLCS supplements the isolation function of primary containment isolation valves (PCIVs) in the feedwater lines which also penetrate the secondary containment. These penetrations are sealed by water form the FWLCS to prevent fission products (post-LOCA containment atmosphere) from leaking past the isolation valves and bypassing the secondary containment after a Design Basis Accident (DBA) loss of coolant accident (LOCA).
The FWLCS consists of two independent, manually initiated subsystems. Each subsystem uses its connected train of the residual heat removal (RHR) system and a header to provide sealing water for pressurizing the feedwater piping either between the inboard and outboard containment isolation check valves or between the outboard containment isolation check valve and the outboard motor-operated gate valve.
APPLICABLE         The analyses described in Reference 1 provide the evaluation SAFETY ANALYSES    of offsite dose consequences during accident conditions.
The analyses take credit for manually initiating FWLCS within 20 minutes following the initiation of a DBA LOCA (assuming termination of feedwater flow through the feedwater lines), after which secondary containment bypass leakage through the feedwater lines is assumed to continue until the associated piping is filled, which occurs within one hour after initiation of the accident.
The FWLCS satisfies Criterion 3 of the NRC Policy Statement.
LCO                Two FWLCS subsystems must be OPERABLE so that in the event of an accident, at least one subsystem is OPERABLE assuming a worst-case single active failure. A FWLCS subsystem is OPERABLE when all necessary components are available to pressurize each feedwater piping section with sufficient water pressure to preclude containment atmosphere leakage (following the time period required to fill and pressurize the feedwater piping sections) when the containment atmosphere is at the maximum peak containment pressure, P.
The LCO is modified by a Note that allows one FWLCS subsystem to be inoperable during alignment and operation for decay heat removal with reactor steam dome pressure less than the residual heat removal cut-in permissive pressure.
This is necessary since the RHR system is required to (continued)
CLINTON                                B 3.6-45               Revision No. 20-1

FWLCS B 3.6.1.9 BASES LCO           operate in the shutdown cooling mode to remove decay heat (continued) and sensible heat from the reactor, and manual realignment from the shutdown cooling mode to the FWLCS mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to damage the RHR system, including water hammer.
APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the FWLCS is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.
ACTIONS       A.1 With one FWLCS subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 30 days. In this Condition, the remaining OPERABLE FWLCS subsystem is adequate to perform the required leakage control function. The 30-day Completion Time is based on low probability of the occurrence of a DBA LOCA, the amount of time available after the event for operator action to prevent exceeding this limit, the low probability of failure of the OPERABLE FWLCS subsystem, and the availability of the PCIVs.
B.1 With two FWLCS subsystems inoperable, at least one subsystem must be restored to OPERABLE status within 7 days. The 7 day Completion Time is based on the low probability of the occurrence of a DBA LOCA, the availability of operator action, and the availability of the PCIVs.
C.1 If the inoperable FWLCS subsystem cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
(continued)
CLINTON                           B 3.6-46               Revision No. 20-2

FWLCS B 3.6.1.9 BASES ACTIONS      C.1 (continued)
Required Action C.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE SR  3.6.1.9.1 REQUIREMENTS A system functional test of each FWLCS subsystem is performed to ensure that each FWLCS subsystem will operate through its operating sequence. This includes verifying automatic positioning of valves and operation of each interlock, and that the necessary check valves open.
Adequacy of the associated RHR pumps to deliver FWLCS flow rates required to meet the assumptions made in the supporting analyses concurrent with other modes was demonstrated during acceptance testing of the system after installation. Periodic verification of the capabilities of the RHR pumps is performed under SR 3.5.1.4.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES   1. USAR, Section 15.6.5.
: 2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
CLINTON                          B 3.6-47               Revision No. 14-2

Suppression Pool Average Temperature B 3.6.2.1 B 3.6   CONTAINMENT SYSTEMS B 3.6.2.1   Suppression Pool Average Temperature BASES BACKGROUND         The suppression pool is a concentric open container of water with a stainless steel liner that is located at the bottom of the primary containment. The suppression pool is designed to absorb the decay heat and sensible heat released during a reactor blowdown from safety/relief valve discharges or from a loss of coolant accident (LOCA). The suppression pool must also condense steam from the Reactor Core Isolation Cooling System turbine exhaust and provides the main emergency water supply source for the reactor vessel. The amount of energy that the pool can absorb as it condenses steam is dependent upon the initial average suppression pool temperature. The lower the initial pool temperature, the more heat it can absorb without heating up excessively. Since it is an open pool, its temperature will affect both primary containment pressure and average air temperature. Using conservative inputs and methods, the maximum calculated primary containment pressure during and following a Design Basis Accident (DBA) must remain below the primary containment design pressure of 15 psig. In addition, the maximum primary containment average air temperature must remain < 185qF.
The technical concerns that lead to the development of suppression pool average temperature limits are as follows:
: a. Complete steam condensation;
: b. Primary containment peak pressure and temperature;
: c. Condensation oscillation (CO) loads; and
: d. Chugging loads.
(continued)
CLINTON                                B 3.6-48                   Revision No. 0

Suppression Pool Average Temperature B 3.6.2.1 BASES   (continued)
APPLICABLE          The postulated DBA against which the primary containment SAFETY ANALYSES     performance is evaluated is the entire spectrum of postulated pipe breaks within the primary containment.
Inputs to the safety analyses include initial suppression pool water volume and suppression pool temperature (References 1 and 2). An initial pool temperature of 95qF is assumed for the Reference 1 and 2 analyses. Reactor shutdown at a pool temperature of 110qF and vessel depressurization at a pool temperature of 120qF are assumed for the Reference 2 analyses. The limit of 105qF, at which testing is terminated, is not used in the safety analyses because DBAs are assumed to not initiate during plant testing.
Suppression pool average temperature satisfies Criteria 2 and 3 of the NRC Policy Statement.
LCO                 A limitation on the suppression pool average temperature is required to assure that the primary containment conditions assumed for the safety analyses are met. This limitation subsequently ensures that peak primary containment pressures and temperatures do not exceed maximum allowable values during a postulated DBA or any transient resulting in heatup of the suppression pool. The LCO requirements are as follows:
: a. Average temperature d 95qF when THERMAL POWER is > 1%
RTP and no testing that adds heat to the suppression pool is being performed. This requirement ensures that licensing bases initial conditions are met.
: b. Average temperature d 105qF when THERMAL POWER is > 1%
RTP and testing that adds heat to the suppression pool is being performed. This requirement ensures that the plant has testing flexibility, and was selected to provide margin below the 110qF limit at which reactor shutdown is required. When testing ends, temperature must be restored to d 95qF within 24 hours according to Required Action A.2. Therefore, the time period that the temperature is > 95qF is short enough not to cause a significant increase in plant risk.
: c. Average temperature d 110qF when THERMAL POWER is d 1%
RTP. This requirement ensures that the plant will be shut down at > 110qF. The pool is designed to absorb decay heat and sensible heat but could be heated beyond design limits by the steam generated if the reactor is not shut down.
Note that when the reactor is producing power essentially equivalent to 1% RTP, heat input is approximately equal to normal system heat losses.
(continued)
CLINTON                                 B 3.6-49               Revision No. 20-2

Suppression Pool Average Temperature B 3.6.2.1 BASES   (continued)
APPLICABILITY       In MODES 1, 2, and 3, a DBA could cause significant heatup of the suppression pool. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES.
Therefore, maintaining suppression pool average temperature within limits is not required in MODE 4 or 5.
ACTIONS             A.1 and A.2 With the suppression pool average temperature above the specified limit when not performing testing that adds heat to the suppression pool and when above the specified power indication, the initial conditions exceed the conditions assumed for the Reference 1 and 2 analyses. However, primary containment cooling capability still exists, and the primary containment pressure suppression function will occur at temperatures well above that assumed for safety analyses.
Therefore, continued operation is allowed for a limited time. The 24 hour Completion Time is adequate to allow the suppression pool temperature to be restored to below the limit. Additionally, when pool temperature is > 95qF, increased monitoring of the pool temperature is required to ensure it remains d 110qF. The once per hour Completion Time is adequate based on past experience, which has shown that suppression pool temperature increases relatively slowly except when testing that adds heat to the pool is being performed. Testing that adds heat to the suppression pool excludes RHR pump testing. Furthermore, the once per hour Completion Time is considered adequate in view of other indications in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.
B.1 If the suppression pool average temperature cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 1% RTP within 12 hours. The 12 hour Completion Time is reasonable, based on operating experience, to reduce reactor power from full power in an orderly manner and without challenging plant systems.
(continued)
CLINTON                                 B 3.6-50               Revision No. 20-2

Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS        C.1 (continued)
Suppression pool average temperature is allowed to be > 95qF with THERMAL POWER > 1% RTP when testing that adds heat to the suppression pool is being performed. However, if temperature is > 105qF, the testing must be immediately suspended to preserve the pool's heat absorption capability.
With the testing suspended, Condition A is entered and the Required Actions and associated Completion Times are applicable.
D.1, D.2, and D.3 Suppression pool average temperature > 110qF requires that the reactor be shut down immediately. This is accomplished by placing the reactor mode switch in the shutdown position.
Further cooldown to MODE 4 is required at normal cooldown rates (provided pool temperature remains d 120qF.)
Additionally, when pool temperature is > 110qF, increased monitoring of pool temperature is required to ensure that it remains d 120qF. The once per 30 minute Completion Time is adequate, based on operating experience. Given the high pool temperature in this Condition, the monitoring Frequency is increased to twice that of Condition A. Furthermore, the 30 minute Completion Time is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.
E.1 and E.2 If suppression pool average temperature cannot be maintained d 120&deg;F, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the reactor pressure must be reduced to < 200 psig within 12 hours and the plant must be brought to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.
Continued addition of heat to the suppression pool with pool temperature > 120qF could result in exceeding the design basis maximum allowable values for primary containment temperature or pressure.
(continued)
CLINTON                            B 3.6-51                Revision No. 20-2

Suppression Pool Average Temperature B 3.6.2.1 BASES   (continued)
SURVEILLANCE        SR  3.6.2.1.1 REQUIREMENTS The suppression pool average temperature is regularly monitored to ensure that the required limits are satisfied.
Average temperature is determined by taking an arithmetic average of the functional suppression pool water temperature channels. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. When heat is being added to the suppression pool by testing, however, it is necessary to monitor suppression pool temperature more frequently. Testing that adds heat to the suppression pool excludes RHR pump testing. The 5 minute Frequency during testing is justified by the rates at which testing will heat up the suppression pool, has been shown to be acceptable based on operating experience, and provides assurance that allowable pool temperatures are not exceeded. The Frequency is further justified in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.
With regard to the 95qF suppression pool average temperature pursuant to this SR, as read from plant indication instrumentation, this limit is considered a nominal value and therefore does not require compensation for instrument indication uncertainties.
With regard to suppression pool average temperature values obtained for compliance with the 105qF, 110qF, and 120qF limits, as read from plant indication instrumentation, the specified limits are not considered to be nominal values with respect to instrument uncertainties. This requires additional margin to be added to the limits to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 3).
REFERENCES          1. USAR, Section 6.2.
: 2. USAR, Section 15.2.
: 3. Calculation IP-0-0071.
CLINTON                                 B 3.6-52                Revision No. 20-2

Suppression Pool Water Level B 3.6.2.2 B 3.6   CONTAINMENT SYSTEMS B 3.6.2.2   Suppression Pool Water Level BASES BACKGROUND         The suppression pool is a concentric open container of water with a stainless steel liner, which is located at the bottom of the primary containment. The suppression pool is designed to absorb the decay heat and sensible heat released during a reactor blowdown from safety/relief valve (S/RV) discharges or from a loss of coolant accident (LOCA). The suppression pool must also condense steam from the Reactor Core Isolation Cooling (RCIC) System turbine exhaust and provides the main emergency water supply source for the reactor vessel. The suppression pool volume ranges between 146,400 ft3 at the low water level limit of 18 ft 11 inches and 150,230 ft3 at the high water level limit of 19 ft 5 inches, in MODES 1, 2, and 3. (These volume values do not explicitly exclude a volume of approximately 500 ft3 rendered unavailable due to the additional displacement of suppression pool water caused by the ECCS/RCIC suction strainers that were introduced by plant modification M-083.
Analysis has shown that this volume impact is negligible.)
In MODE 3, with reactor pressure less than 235 psig and the upper containment pool level less than the limit, the lower and upper limits are 19 ft 9 inches and 20 ft 1 inches. The lower limit is controlled by Technical Specification 3.6.2.4 when the upper containment pool is drained.
If the suppression pool water level is too low, an insufficient amount of water would be available to adequately condense the steam from the S/RV quenchers, main vents, or RCIC turbine exhaust lines. Low suppression pool water level could also result in an inadequate emergency makeup water source to the Emergency Core Cooling System.
The lower volume would also absorb less steam energy before heating up excessively. Therefore, a minimum suppression pool water level is specified.
If the suppression pool water level is too high, it could result in excessive clearing loads from S/RV discharges and excessive pool swell loads resulting from a Design Basis Accident (DBA) LOCA. An inadvertent upper pool dump could also overflow the weir wall into the drywell. Therefore, a maximum pool water level is specified. This LCO specifies an acceptable range to prevent the suppression pool water level from being either too high or too low.
APPLICABLE         Initial suppression pool water level affects suppression SAFETY ANALYSES    pool temperature response calculations, calculated drywell pressure during vent clearing for a DBA, calculated pool swell loads for a DBA LOCA, and calculated loads due to S/RV discharges. Suppression pool water level must be maintained (continued)
CLINTON                                B 3.6-53                 Revision No. 8-3

Suppression Pool Water Level B 3.6.2.2 BASES APPLICABLE      within the limits specified so that the safety analysis of SAFETY ANALYSES Reference 1 remains valid.
(continued)
Suppression pool water level satisfies Criteria 2 and 3 of the NRC Policy Statement.
LCO             A limit that suppression pool water level be t 18 ft 11 inches and d 19 ft 5 inches (or t 18 feet 11 inches and d 20 ft 1 inches in MODE 3 with reactor pressure less than 235 psig) is required to ensure that the primary containment conditions assumed for the safety analysis are met. Either the high or low water level limits were used in the safety analysis, depending upon which is conservative for a particular calculation.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could cause significant loads on the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced because of the pressure and temperature limitations in these MODES.
Requirements for suppression pool level in MODE 4 or 5 are addressed in LCO 3.5.2, "RPV Water Inventory Control."
ACTIONS         A.1 With suppression pool water level outside the limits, the conditions assumed for the safety analysis are not met. If water level is below the minimum level, the pressure suppression function still exists as long as horizontal vents are covered, RCIC turbine exhaust is covered, and S/RV quenchers are covered. If suppression pool water level is above the maximum level, protection against overpressurization still exists due to the margin in the peak containment pressure analysis and due to OPERABLE containment sprays. Prompt action to restore the suppression pool water level to within the normal range is prudent, however, to retain the margin to weir wall overflow from an inadvertent upper pool dump and reduce the risks of increased pool swell and dynamic loading. Therefore, continued operation for a limited time is allowed. The 2 hour Completion Time is sufficient to restore suppression pool water level to within specified limits. Also, it takes into account the low probability of an event impacting the suppression pool water level occurring during this interval.
(continued)
CLINTON                             B 3.6-54                Revision No. 20-2

Suppression Pool Water Level B 3.6.2.2 BASES ACTIONS        B.1 and B.2 (continued)
If suppression pool water level cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE   SR  3.6.2.2.1 REQUIREMENTS Verification of the suppression pool water level is to ensure that the required limits are satisfied. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to the suppression pool water minimum level values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures. The suppression pool maximum water level values are considered to be nominal values and do not require compensation for instrument uncertainties (Ref. 2).
REFERENCES     1. USAR, Section 6.2.
: 2. Calculation IP-0-0049.
CLINTON                            B 3.6-55               Revision No. 14-2

RHR Suppression Pool Cooling B 3.6.2.3 B 3.6   CONTAINMENT SYSTEMS B 3.6.2.3   Residual Heat Removal (RHR) Suppression Pool Cooling BASES BACKGROUND         Following a Design Basis Accident (DBA), the RHR Suppression Pool Cooling System removes heat from the suppression pool.
The suppression pool is designed to absorb the sudden input of heat from the primary system. In the long term, the pool continues to absorb residual heat generated by fuel in the reactor core. Some means must be provided to remove heat from the suppression pool so that the temperature inside the primary containment remains within design limits. This function is provided by two redundant RHR suppression pool cooling subsystems. The purpose of this LCO is to ensure that both subsystems are OPERABLE in applicable MODES.
Each RHR subsystem contains a pump and one heat exchanger and is manually initiated and independently controlled. The two RHR subsystems perform the suppression pool cooling function by circulating water from the suppression pool through the RHR heat exchangers and returning it to the suppression pool. Shutdown service water, circulating through the tube side of the heat exchangers, exchanges heat with the suppression pool water and discharges this heat to the external heat sink.
The heat removal capability of one RHR subsystem is sufficient to meet the overall DBA pool cooling requirement to limit peak temperature to 185&deg;F for loss of coolant accidents (LOCAs) and transient events such as a turbine trip without bypass or a stuck open safety/relief valve (S/RV). S/RV leakage and Reactor Core Isolation Cooling System testing increase suppression pool temperature more slowly. The RHR Suppression Pool Cooling System is also used to lower the suppression pool water bulk temperature following such events.
APPLICABLE         Reference 1 contains the results of analyses used to predict SAFETY ANALYSES    primary containment pressure and temperature following large and small break LOCAs. The analyses demonstrate that the heat removal capacity of the RHR Suppression Pool Cooling System is adequate to maintain the primary containment conditions within design limits. The suppression pool temperature is calculated to remain below the design limit.
The RHR Suppression Pool Cooling System satisfies Criterion 3 of the NRC Policy Statement.
(continued)
CLINTON                                B 3.6-56               Revision No. 21-7

RHR Suppression Pool Cooling B 3.6.2.3 BASES   (continued)
LCO                 During a DBA, a minimum of one RHR suppression pool cooling subsystem is required to maintain the primary containment peak pressure and temperature below the design limits (Ref. 1). To ensure that these requirements are met, two RHR suppression pool cooling subsystems must be OPERABLE.
Therefore, in the event of an accident, at least one subsystem is OPERABLE, assuming the worst case single active failure. An RHR suppression pool cooling subsystem is OPERABLE when the pump, heat exchanger, and associated piping, valves, instrumentation, and controls are OPERABLE.
Management of gas voids is important to RHR Suppression Pool Cooling System OPERABILITY.
The LCO is modified by a Note that allows one RHR suppression pool cooling subsystem to be inoperable during alignment and operation for decay heat removal with reactor steam dome pressure less than the residual heat removal cut-in permissive pressure. This is necessary since the RHR system is required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor, and manual realignment from the shutdown cooling mode to the RHR suppression pool cooling mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to damage the RHR system, including water hammer. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling for decay heat removal.
APPLICABILITY       In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment and cause a heatup and pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the RHR Suppression Pool Cooling System is not required to be OPERABLE in MODE 4 or 5.
ACTIONS             A.1 With one RHR suppression pool cooling subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. In this Condition, the remaining RHR suppression pool cooling subsystem is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time is acceptable in light of the redundant RHR suppression pool cooling capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.
(continued)
CLINTON                                 B 3.6-57               Revision No. 21-7

RHR Suppression Pool Cooling B 3.6.2.3 BASES ACTIONS        B.1 (continued)
If the Required Action and required Completion Time of Condition A cannot be met, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
Required Action B.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.
The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
C.1 and C.2 If two RHR suppression pool cooling subsystems are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                            B 3.6-58               Revision No. 13-2

RHR Suppression Pool Cooling B 3.6.2.3 BASES SURVEILLANCE SR  3.6.2.3.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves, in the RHR suppression pool cooling mode flow path provides assurance that the proper flow path exists for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to being locked, sealed, or secured.
A valve is also allowed to be in the nonaccident position, provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable, since the RHR suppression pool cooling mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                          B 3.6-58a              Revision No. 14-2

RHR Suppression Pool Cooling B 3.6.2.3 BASES SURVEILLANCE   SR  3.6.2.3.2 REQUIREMENTS (continued) Verifying each RHR pump develops a flow rate t 4550 gpm, with flow through the associated heat exchanger to the suppression pool, ensures that pump performance has not degraded during the cycle. Flow is a normal test of centrifugal pump performance required by ASME (Ref. 3).
This test confirms one point on the pump design curve, and the results are indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.
With regard to RHR pump flow rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties for implementation in the associated plant procedures. (Ref. 5).
SR  3.6.2.3.3 RHR Suppression Pool Cooling System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR suppression pool cooling subsystems and may also prevent water hammer and pump cavitation.
Selection of RHR Suppression Pool Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.
The RHR Suppression Pool Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Suppression Pool Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be (continued)
CLINTON                            B 3.6-58b              Revision No. 19-4

RHR Suppression Pool Cooling B 3.6.2.3 BASES SURVEILLANCE SR  3.6.2.3.3  (continued)
REQUIREMENTS declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.
RHR Suppression Pool Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.
REFERENCES   1. USAR, Section 6.2.
: 2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 3. ASME Code for Operation and Maintenance of Nuclear Power Plants.
: 4. USAR, Section 5.4.7.
: 5. Calculations 01RH20/22/25 and IP-C-0041.
CLINTON                          B 3.6-59               Revision No. 17-1

SPMU System B 3.6.2.4 B 3.6   CONTAINMENT SYSTEMS B 3.6.2.4   Suppression Pool Makeup (SPMU) System BASES BACKGROUND         The function of the SPMU System is to transfer water from the upper containment pool to the suppression pool after a loss of coolant accident (LOCA). For a LOCA, with Emergency Core Cooling System injection from the suppression pool, a large volume of water can be held up in the drywell behind the weir wall. This holdup can significantly lower suppression pool water level. The water transfer from the SPMU System ensures a post LOCA suppression pool vent coverage of t 2 ft above the top of the top row vents so that long term steam condensation is maintained. The additional makeup water is used as part of the long term suppression pool heat sink. The post LOCA delayed transfer of this water to the suppression pool provides an initially low vent submergence, which results in lower drywell pressure loading and lower pool dynamic loading during a Design Basis Accident (DBA) LOCA as compared to higher vent submergence. The sizing of the residual heat removal heat exchanger takes credit for the additional SPMU System water mass in the calculation of the post LOCA peak containment pressure and suppression pool temperature.
The required water dump volume from the upper containment pool is equal to the difference between the total post LOCA drawdown volume and the assumed volume loss from the suppression pool. The total drawdown volume is the volume of suppression pool water that can be entrapped outside of the suppression pool following a LOCA. The post LOCA entrapment volumes causing suppression pool level drawdown include:
: a. The free volume inside and below the top of the drywell weir wall;
: b. The added volume required to fill the reactor pressure vessel from a condition of normal power operation to a post accident complete fill of the vessel, including the top dome;
: c. The volume in the steam lines out to the inboard main steam isolation valve (MSIV) on three lines and out to the outboard MSIV on one line; and (continued)
CLINTON                                B 3.6-60                  Revision No. 0

SPMU System B 3.6.2.4 BASES BACKGROUND      d. Allowances for primary containment spray holdup on (continued)        equipment and structural surfaces.
The SPMU System consists of two redundant subsystems, each capable of dumping the makeup volume from the upper containment pool to the suppression pool by gravity flow.
Each dump line includes two normally closed valves in series. The upper pool is dumped automatically on a suppression pool water level-Low Low signal (with a LOCA signal permissive) or on the basis of a timer following a LOCA signal alone to ensure that the makeup volume is available as part of the long term energy sink for small breaks that might not cause dump on a suppression pool water level-Low Low signal. A 30 minute timer was chosen, since the initial suppression pool mass is adequate for any sequence of vessel blowdown energy and decay heat up to at least 30 minutes.
Although the minimum freeboard distance above the suppression pool high water level limit of LCO 3.6.2.2, "Suppression Pool Water Level," to the top of the weir wall is adequate to preclude flooding of the drywell, a LOCA permissive signal is used to prevent an erroneous suppression pool level signal from causing pool dump. In addition, the SPMU System mode switch may be keylocked in the "OFF" position to ensure that inadvertent dump will not occur. Inadvertent actuation of the SPMU System during MODE 4 or 5 could create a radiation hazard to plant personnel due to a loss of shield water from the upper pool if irradiated fuel were in an elevated position.
APPLICABLE      Analyses used to predict suppression pool temperature SAFETY ANALYSES following large and small break LOCAs, which are the applicable DBAs for the SPMU System, are contained in References 1 and 2. During these events, the SPMU System is relied upon to dump upper containment pool water to maintain drywell horizontal vent coverage and an adequate suppression pool heat sink volume to ensure that the primary containment internal pressure and temperature stay within design limits.
The analysis assumes an SPMU System dump volume of 14,736 ft3 at a temperature of 120qF. Reference 6 contains an analysis for LOCAs in MODE 3 with reactor pressure less than 235 psig.
The SPMU System satisfies Criterion 3 of the NRC Policy Statement.
(continued)
CLINTON                             B 3.6-61              Revision No. 20-11

SPMU System B 3.6.2.4 BASES   (continued)
LCO                 During a DBA, a minimum of one SPMU subsystem is required to maintain peak suppression pool water temperature below the design limits (Ref. 1). To ensure that these requirements are met, two SPMU subsystems must be OPERABLE. Therefore, in the event of an accident, at least one subsystem is OPERABLE, assuming the worst case single active failure.
The SPMU System is OPERABLE when the upper containment pool water temperature is d 120qF, the water level is t el.
827 ft 1 inch, t el. 825 ft 10 inches with the reactor cavity to steam dryer storage pool gate open, or t el. 825 ft 6 inches with both the reactor cavity to steam dryer storage pool gate and the steam dryer storage pool to the inclined fuel transfer pool gate open, the piping is intact, and the system valves are OPERABLE. Two alternatives to the above SPMU operability requirements exist when the plant is in MODE 3 with reactor pressure level less than 235 psig.
In this condition, the combined upper containment pool and suppression pool water volumes may be used. The reactor cavity pool portion of the upper containment pool water level must be greater than el. 824 ft 7 inches, or the suppression pool water level needs to be greater than 19 ft 9 inches, to assure that there is sufficient water between the two sources. The level limits in MODE 3 account for all gate positions. The above temperature and water level conditions correspond to an SPMU System available dump volume of t 14,736 ft3, except for the alternative SPMU operability requirements in MODE 3, which assumes the available upper pool dump volume is t 3694 ft3.
APPLICABILITY       In MODES 1, 2, and 3, a DBA could cause heatup and pressurization of the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the SPMU System OPERABLE is not required in MODE 4 or 5.
ACTIONS             A.1 When the combined upper containment pool and suppression pool water levels are less than required, the volume is inadequate to ensure that the suppression pool heat sink capability matches the safety analysis assumptions. A sufficient quantity of water is necessary to ensure long term energy sink capabilities of the suppression pool and maintain water coverage over the uppermost horizontal vents.
Loss of water volume has a relatively large impact on heat sink capability. Therefore, the combined upper containment pool and suppression pool water levels must be restored to within limit within 4 hours. The 4 hour Completion Time is sufficient to provide makeup water to the upper containment pool to restore level within specified limit. Also, it takes into account the low probability of an event occurring that would require the SPMU System.
(continued)
CLINTON                                 B 3.6-62              Revision No. 20-11

SPMU System B 3.6.2.4 BASES ACTIONS        B.1 (continued)
When upper containment pool water temperature is > 120qF, the heat absorption capacity is inadequate to ensure that the suppression pool heat sink capability matches the safety analysis assumptions. Increased temperature has a relatively smaller impact on heat sink capability.
Therefore, the upper containment pool water temperature must be restored to within limit within 24 hours. The 24 hour Completion Time is sufficient to restore the upper containment pool to within the specified temperature limit.
It also takes into account the low probability of an event occurring that would require the SPMU System.
C.1 With one SPMU subsystem inoperable for reasons other than Condition A or B, the inoperable subsystem must be restored to OPERABLE status within 7 days or in accordance with the Risk Informed Completion Time Program. The 7 day Completion Time is acceptable in light of the redundant SPMU System capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.
D.1 and D.2 If any Required Action and required Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE   SR  3.6.2.4.1 REQUIREMENTS The upper containment pool water level is regularly monitored to ensure that the required limits are satisfied.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                            B 3.6-63               Revision No. 21-7

SPMU System B 3.6.2.4 BASES SURVEILLANCE SR  3.6.2.4.1  (continued)
REQUIREMENTS A fourth and fifth method (Items d. and e.) may be used to determine that there is sufficient water level combined between the upper containment pool and suppression pool when reactor pressure is less than 235 psig in MODE 3. The water level of the reactor cavity pool portion of the upper containment pool must be greater than el. 824 ft 7 inches, or the suppression pool water level must be greater than 19 ft 9 inches to satisfy this requirement.
With regard to upper containment pool water level values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).
SR  3.6.2.4.2 The upper containment pool water temperature is regularly monitored to ensure that the required limit is satisfied.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to the water level values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 5).
SR  3.6.2.4.3 Verifying the correct alignment for manual, power operated, and automatic valves in the SPMU System flow path provides assurance that the proper flow paths will exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to being locked, sealed, or secured. This SR does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.
This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                          B 3.6-64                Revision No. 14-2

SPMU System B 3.6.2.4 BASES SURVEILLANCE   SR  3.6.2.4.4 REQUIREMENTS (continued) This SR requires a verification that each SPMU subsystem automatic valve actuates to its correct position on receipt of an actual or simulated automatic initiation signal. This includes verification of the correct automatic positioning of the valves and of the operation of each interlock and timer. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.4.7 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that excludes make up to the suppression pool. Since all active components are testable, makeup to the suppression pool is not required.
REFERENCES     1. USAR, Section 6.2.
: 2. USAR, Chapter 15.
: 3. USAR, Section 6.2.7.
: 4. Calculation IP-0-0074.
: 5. Calculation IP-0-0075.
: 6. Calculation IP-M-0662.
CLINTON                            B 3.6-65                Revision No. 14-2

B 3.6.3.1 B 3.6   CONTAINMENT SYSTEMS B 3.6.3.1   Deleted CLINTON                     B 3.6-66 Revision No. 10-2

B 3.6.3.1 This page intentionally left blank CLINTON                 B 3.6-67           Revision No. 10-2

B 3.6.3.1 This page intentionally left blank CLINTON                 B 3.6-68           Revision No. 10-2

B 3.6.3.1 This page intentionally left blank CLINTON                 B 3.6-69           Revision No. 10-2

B 3.6.3.1 This page intentionally left blank CLINTON                 B 3.6-70           Revision No. 10-2

B 3.6.3.1 This page intentionally left blank CLINTON                 B 3.6-71           Revision No. 10-2

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 B 3.6   CONTAINMENT SYSTEMS B 3.6.3.2   Primary Containment and Drywell Hydrogen Igniters BASES BACKGROUND         The primary containment and drywell hydrogen igniters are a part of the combustible gas control required by 10 CFR 50.44 (Ref. 1) and GDC 41, "Containment Atmosphere Cleanup" (Ref. 2), to reduce the hydrogen concentration in the primary containment following a degraded core accident. The hydrogen igniters ensure the combustion of hydrogen in a manner such that containment overpressure failure is prevented as a result of a postulated degraded core accident.
10 CFR 50.44 (Ref. 1) requires boiling water reactor units with Mark III containments to install suitable hydrogen control systems. The hydrogen igniters are installed to accommodate an amount of hydrogen equivalent to that generated from the reaction of 75% of the fuel cladding with water. This requirement was placed on reactor units with Mark III containments because they were not designed for inerting and because of their low design pressure.
Calculations indicate that if hydrogen equivalent to that generated from the reaction of 75% of the fuel cladding with water were to collect in primary containment, the resulting hydrogen concentration would be far above the lower flammability limit such that, without the hydrogen igniters, if the hydrogen were ignited from a random ignition source, the resulting hydrogen burn would seriously challenge the primary containment.
The hydrogen igniters are based on the concept of controlled ignition using thermal igniters designed to be capable of functioning in a post accident environment, seismically supported and capable of actuation from the control room.
Igniters are distributed throughout the drywell and primary containment in which hydrogen could be released or to which it could flow in significant quantities. The hydrogen igniters are arranged in two independent divisions such that each containment region has two igniters, one from each division, controlled and powered redundantly so that ignition would occur in each region even if one division failed to energize.
(continued)
CLINTON                                 B 3.6-72                 Revision No. 0

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES BACKGROUND      When the hydrogen igniters are energized they heat up to a (continued) surface temperature t 1700qF. At this temperature, they ignite the hydrogen gas that is present in the airspace in the vicinity of the igniter. The hydrogen igniters depend on the dispersed location of the igniters so that local pockets of hydrogen at increased concentrations would burn before reaching a hydrogen concentration significantly higher than the lower flammability limit.
APPLICABLE      The hydrogen igniters cause hydrogen in containment to burn SAFETY ANALYSES in a controlled manner as it accumulates following a degraded core accident (Ref. 3). Burning occurs at the lower flammability concentration, where the resulting temperatures and pressures are relatively benign. Without the system, hydrogen could build up to higher concentrations that could result in a violent reaction if ignited by a random ignition source after such a buildup.
The hydrogen igniters are not included for mitigation of a Design Basis Accident (DBA) because an amount of hydrogen equivalent to that generated from the reaction of 75% of the fuel cladding with water is far in excess of the hydrogen calculated for the limiting DBA loss of coolant accident (LOCA). The hydrogen concentration resulting from a DBA can be maintained less than the flammability limit using the hydrogen recombiners in conjunction with the Containment/Drywell Hydrogen Mixing and Drywell Post-LOCA Vacuum Relief Systems. However, the hydrogen igniters have been shown by probabilistic risk analysis to be a significant contributor to limiting the severity of accident sequences that are commonly found to dominate risk for units with Mark III containment.
The hydrogen igniters are considered to be risk significant in accordance with the NRC Policy Statement.
LCO             Two divisions of primary containment and drywell hydrogen igniters must be OPERABLE, each with more than 90% of the igniters OPERABLE (i.e., no more than five inoperable igniters). This ensures operation of at least one igniter division, with adequate coverage of the primary containment and drywell, in the event of a worst case single active failure. This will ensure that the hydrogen concentration remains < 4.0 v/o.
(continued)
CLINTON                             B 3.6-73                 Revision No. 1-1

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES   (continued)
APPLICABILITY       In MODES 1 and 2, the hydrogen igniter is required to control hydrogen concentration to near the flammability limit of 4.0 v/o following a degraded core event that would generate hydrogen in amounts equivalent to a metal water reaction of 75% of the core cladding. The control of hydrogen concentration prevents overpressurization of the primary containment. The event that could generate hydrogen in quantities sufficiently high enough to exceed the flammability limit is limited to MODES 1 and 2.
In MODE 3, both the hydrogen production rate and the total hydrogen produced after a degraded core accident would be less than that calculated for the DBA LOCA. Also, because of the limited time in this MODE, the probability of an accident requiring the hydrogen igniter is low. Therefore, the hydrogen igniter is not required in MODE 3.
In MODES 4 and 5, the probability and consequences of a degraded core accident are reduced due to the pressure and temperature limitations. Therefore, the hydrogen igniters are not required to be OPERABLE in MODES 4 and 5 to control hydrogen.
ACTIONS             A.1 With one hydrogen igniter division inoperable, the inoperable division must be restored to OPERABLE status within 30 days. In this Condition, the remaining OPERABLE hydrogen igniter division is adequate to perform the hydrogen burn function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced hydrogen control capability. The 30 day Completion Time is based on the low probability of the occurrence of a degraded core event that would generate hydrogen in amounts equivalent to a metal water reaction of 75% of the core cladding, the amount of time available after the event for operator action to prevent hydrogen accumulation from exceeding the flammability limit, and the low probability of failure of the OPERABLE hydrogen igniter division.
(continued)
CLINTON                                 B 3.6-74               Revision No. 10-3

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES ACTIONS        B.1 and B.2 (continued)
With two primary containment and drywell igniter hydrogen divisions inoperable, the ability to perform the hydrogen control function via alternate capabilities must be verified by administrative means within 1 hour. The alternate hydrogen control capabilities are provided by at least one hydrogen recombiner in conjunction with one Containment/
Drywell Hydrogen Mixing System and two drywell post-LOCA vacuum relief subsystems. The 1 hour Completion Time allows a reasonable period of time to verify that a loss of hydrogen control function does not exist. The verification may be performed as an administrative check by examining logs or other information to determine the availability of the alternate hydrogen control capabilities. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of the alternate hydrogen control capabilities.
If the ability to perform the hydrogen control function is maintained, continued operation is permitted with two igniter divisions inoperable for up to 7 days. Seven days is a reasonable time to allow two igniter divisions to be inoperable because the hydrogen control function is maintained and because of the low probability of the occurrence of a LOCA that would generate hydrogen in the amounts capable of exceeding the flammability limit.
C.1 If any Required Action and required Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                             B 3.6-75               Revision No. 10-3

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES   (continued)
SURVEILLANCE        SR  3.6.3.2.1 and SR   3.6.3.2.2 REQUIREMENTS These SRs verify that there are no physical problems that could affect the igniter operation. Since the igniters are mechanically passive, they are not subject to mechanical failure. The only credible failures are loss of power or burnout. The verification that each required igniter is energized is performed by circuit current versus voltage measurement.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. SR 3.6.3.2.2 is modified by a Note that indicates that the Surveillance is not required to be performed until 92 days after four or more igniters in the division are discovered to be inoperable.
With regard to circuit current and voltage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).
(continued)
CLINTON                                  B 3.6-76               Revision No. 14-2

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES SURVEILLANCE      SR  3.6.3.2.3 and SR   3.6.3.2.4 REQUIREMENTS (continued)    These functional tests are performed to verify system OPERABILITY. The current draw to develop a surface temperature of t 1700qF is verified for igniters in inaccessible areas, e.g., in a high radiation area.
Additionally, the surface temperature of each accessible igniter is measured to be t 1700qF to demonstrate that a temperature sufficient for ignition is achieved. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to current draw and surface temperature values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).
REFERENCES        1. 10 CFR 50.44.
: 2. 10 CFR 50, Appendix A, GDC 41.
: 3. USAR, Section 6.2.5.
: 4. Calculation IP-0-0076.
CLINTON                                B 3.6-77              Revision No. 14-2

Containment/Drywell Hydrogen Mixing System B 3.6.3.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3.3 Containment/Drywell Hydrogen Mixing System BASES BACKGROUND        The Containment/Drywell Hydrogen Mixing System ensures a uniformly mixed post accident containment atmosphere, thereby minimizing the potential for local hydrogen burns due to a pocket of hydrogen above the flammable concentration.
The Containment/Drywell Hydrogen Mixing System is an Engineered Safety Feature and is designed to operate following a loss of coolant accident (LOCA) in post accident environments without loss of function. Each system consists of a compressor (located inside primary containment with a suction line connected to the drywell) and associated valves, controls, and piping. Each system is sized to pump 800 scfm. Each system is powered from a separate emergency power supply. Since each system can provide 100%
of the mixing requirements, the system will provide its design function with a worst case single active failure.
Following a LOCA, the drywell is immediately pressurized due to the release of steam into the drywell environment. This pressure is relieved by the lowering of the water level within the weir wall, clearing the drywell vents and allowing the mixture of steam and noncondensibles to flow into the primary containment through the suppression pool, removing much of the heat from the steam. The remaining steam in the drywell begins to condense. As steam flow from the reactor pressure vessel ceases, the drywell pressure falls rapidly. The compressors are manually started after a LOCA. The compressors draw in air from the drywell and force it through the suppression pool and into the primary containment. As a result of the negative pressure created in the drywell due to the operation of the compressors, primary containment atmosphere flows back into the drywell through the drywell post-LOCA vacuum relief valves, mixing the containment atmosphere with the drywell atmosphere to dilute the hydrogen. While containment and drywell atmosphere mixing continues following the LOCA, hydrogen continues to be produced. Eventually, the hydrogen recombiners are manually placed in operation.
(continued)
CLINTON                               B 3.6-78                Revision No. 1-1

Containment/Drywell Hydrogen Mixing System B 3.6.3.3 BASES   (continued)
APPLICABLE          The Containment/Drywell Hydrogen Mixing System provides the SAFETY ANALYSES     capability for reducing the drywell hydrogen concentration to approximately the bulk average primary containment concentration following a Design Basis Accident (DBA). The limiting DBA relative to hydrogen generation is a LOCA.
Hydrogen may accumulate in primary containment following a LOCA as a result of:
: a. A metal steam reaction between the zirconium fuel rod cladding and the reactor coolant; and
: b. Radiolytic decomposition of water in the Reactor Coolant System.
To evaluate the potential for hydrogen accumulation in primary containment following a LOCA, the hydrogen generation as a function of time following the initiation of the accident is calculated. Conservative assumptions recommended by Reference 1 are used to maximize the amount of hydrogen calculated.
The calculation confirms that when the mitigating systems are actuated in accordance with plant procedures, the peak hydrogen concentration in the primary containment remains
                    < 4 v/o.
The Containment/Drywell Hydrogen Mixing System satisfies Criterion 3 of the NRC Policy Statement.
LCO                 Two systems must be OPERABLE to ensure operation of at least one Containment/Drywell Hydrogen Mixing System in the event of a worst case single active failure. Operation with at least one OPERABLE Containment/Drywell Hydrogen Mixing System provides the capability of controlling the hydrogen concentration in the drywell without exceeding the flammability limit.
APPLICABILITY       In MODES 1 and 2, the two Containment/Drywell Hydrogen Mixing Systems ensure the capability to prevent localized hydrogen concentrations above the flammability limit of 4.0 v/o in the drywell, assuming a worst case single active failure.
In MODE 3, both the hydrogen production rate and the total hydrogen produced after a LOCA would be less than that (continued)
CLINTON                                  B 3.6-79               Revision No. 1-1

Containment/Drywell Hydrogen Mixing System B 3.6.3.3 BASES APPLICABILITY  calculated for the DBA LOCA. Also, because of the limited (continued) time in this MODE, the probability of an accident requiring the Containment/Drywell Hydrogen Mixing System is low.
Therefore, the Containment/Drywell Hydrogen Mixing System is not required in MODE 3.
In MODES 4 and 5, the probability and consequences of a LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, the Containment/Drywell Hydrogen Mixing System is not required in these MODES.
ACTIONS        A.1 With one Containment/Drywell Hydrogen Mixing System inoperable, the inoperable system must be restored to OPERABLE status within 30 days. In this condition, the remaining OPERABLE system is adequate to perform the hydrogen mixing function. However, the overall reliability is reduced because a single failure in the OPERABLE system could result in reduced hydrogen mixing capability. The 30 day Completion Time is based on the low probability of failure of the OPERABLE Containment/Drywell Hydrogen Mixing system, the low probability of a LOCA that would generate hydrogen in amounts capable of exceeding the flammability limit, and the amount of time available after the event for operator action to prevent hydrogen accumulation from exceeding this limit.
B.1 and B.2 With two Containment/Drywell Hydrogen Mixing Systems inoperable, the ability to perform the hydrogen control function via alternate capabilities must be verified by administrative means within 1 hour. The alternate hydrogen control capabilities are provided by one division of the hydrogen igniters. The 1 hour Completion Time allows a (continued)
CLINTON                            B 3.6-80               Revision No. 10-3

Containment/Drywell Hydrogen Mixing System B 3.6.3.3 BASES ACTIONS      B.1 and B.2 (continued) reasonable period of time to verify that a loss of hydrogen control function does not exist. The verification may be performed as an administrative check by examining logs or other information to determine the availability of the alternate hydrogen control system. It does not mean to perform the surveillances needed to demonstrate OPERABILITY of the alternate hydrogen control system. If the ability to perform the hydrogen control function is maintained, continued operation is permitted with two Containment/
Drywell Hydrogen Mixing Systems inoperable for up to 7 days.
Seven days is a reasonable time to allow two Containment/
Drywell Hydrogen Mixing Systems to be inoperable because the hydrogen control function is maintained and because of the low probability of the occurrence of a LOCA that would generate hydrogen in amounts capable of exceeding the flammability limit.
C.1 If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE SR  3.6.3.3.1 REQUIREMENTS Operating each Containment/Drywell Hydrogen Mixing System ensures that each system is OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, compressor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                          B 3.6-81               Revision No. 14-2

Containment/Drywell Hydrogen Mixing System B 3.6.3.3 BASES SURVEILLANCE   SR  3.6.3.3.2 REQUIREMENTS (continued) Verifying that each Containment/Drywell Hydrogen Mixing System flow rate is t 800 scfm ensures that each system is capable of maintaining drywell hydrogen concentrations below the flammability limit. In practice, verifying that the system differential pressure is less than 4.4 psid with the compressor running ensures that the system flow rate is greater than 800 scfm. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to system differential pressure values used to verify the required system flow rate as read from plant indication instrumentation, the procedural limit is considered to be not nominal and therefore requires compensation for instrument indication uncertainties (Ref.
3).
REFERENCES     1. Regulatory Guide 1.7.
: 2. USAR, Section 6.2.5.
: 3. Calculation IP-0-0076.
CLINTON                            B 3.6-82               Revision No. 14-2

Secondary Containment B 3.6.4.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.1  Secondary Containment BASES BACKGROUND        The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA).
In conjunction with operation of the Standby Gas Treatment (SGT) System and closure of certain valves whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment and to isolate and contain fission products that are released during certain operations that take place inside primary containment (e.g., during CORE ALTERATIONS or during movement of irradiated fuel assemblies in the primary or secondary containment), when primary containment is not required to be OPERABLE, or that take place outside primary containment.
The secondary containment is a structure that completely encloses the primary containment (except for the upper containment personnel air lock penetration) and those components that may be postulated to contain primary system fluid. This structure forms a control volume that serves to hold up and dilute the fission products. It is possible for the pressure in the control volume to rise relative to the environmental pressure (e.g., due to pump/motor heat load additions). To prevent ground level exfiltration while allowing the secondary containment to be designed as a conventional structure, the secondary containment requires support systems to maintain the control volume pressure at less than the external pressure. Requirements for these systems are specified separately in LCO 3.6.4.2, Secondary Containment Isolation Dampers (SCIDs), and LCO 3.6.4.3, Standby Gas Treatment (SGT) System.
The isolation devices for the penetrations in the secondary containment boundary are a part of the secondary containment barrier. To maintain this barrier:
: a. All secondary containment penetrations required to be closed during accident conditions are either:
: 1. capable of being closed by an OPERABLE automatic secondary containment isolation system, or
: 2. closed by at least one manual valve or damper, blind flange, or de-activated automatic damper secured in the closed position, except as provided in LCO 3.6.4.2, Secondary Containment Isolation Dampers (SCIDS);
(continued)
CLINTON                                B 3.6-83               Revision No. 20-2

Secondary Containment B 3.6.4.1 BASES BACKGROUND      b. The upper containment personnel air lock is (continued)      OPERABLE, except as provided in LCO 3.6.1.2, Primary Containment Air Locks;
: c. All secondary containment equipment hatches are closed and sealed;
: d. The Standby Gas Treatment System is OPERABLE, except as provided in LCO 3.6.4.3, Standby Gas Treatment (SGT)
System;
: e. At least one door in each access to the secondary containment is closed, except when the access penetration is being used for entry or exit;
: f. The pressure within the secondary containment is in compliance with SR 3.6.4.1.1, except as provided in this LCO; and
: g. At least one SGT subsystem is capable of drawing the secondary containment pressure down to the required pressure within the required time in compliance with SR 3.6.4.1.4, except as provided in this LCO.
APPLICABLE      There are two principal accidents for which credit is SAFETY ANALYSES taken for secondary containment OPERABILITY. These are a LOCA (Ref. 1), and a fuel handling accident (Ref. 2). The secondary containment performs no active function in response to each of these limiting events; however, its leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage paths and associated leakage rates assumed in the accident analysis, and that fission products entrapped within the secondary containment structure will be treated by the SGT System prior to discharge to the environment.
Secondary containment satisfies Criterion 3 of the NRC SAFETY ANALYSES Policy Statement.
LCO             An OPERABLE secondary containment provides a control volume into which fission products that bypass or leak from primary containment, or are released from the reactor coolant pressure boundary components located in secondary containment, can be diluted and processed prior to release to the environment. For the secondary containment to be considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained.
(continued)
CLINTON                              B 3.6-84               Revision No. 20-2

Secondary Containment B 3.6.4.1 BASES   (continued)
APPLICABILITY       In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, secondary containment OPERABILITY is required during the same operating conditions that require primary containment OPERABILITY.
In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5 to ensure a control volume, except for other situations for which significant releases of radioactive material can be postulated, such as during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) in the primary or secondary containment.
ACTIONS             A.1 If secondary containment is inoperable, it must be restored to OPERABLE status within 4 hours. The 4 hour Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal.
B.1 If the secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3), because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
Required Action B.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant (continued)
CLINTON                                 B 3.6-85               Revision No. 20-3

Secondary Containment B 3.6.4.1 BASES ACTIONS      B.1 (continued) conditions from full power conditions in an orderly manner and without challenging plant systems.
C.1 Movement of recently irradiated fuel assemblies in the primary or secondary containment can be postulated to cause fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. Movement of recently irradiated fuel assemblies must be immediately suspended if the secondary containment is inoperable.
Suspension of these activities shall not preclude completing an action that involves moving a component to a safe position.
Required Action C.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.
SURVEILLANCE SR  3.6.4.1.1 REQUIREMENTS This SR ensures that the secondary containment boundary is sufficiently leak tight to preclude exfiltration under expected wind conditions. The SR is modified by a Note which states the SR is not required to be met for up to 4 hours if an analysis demonstrates that one SGT subsystem remains capable of establishing the required secondary containment vacuum. Use of the Note is expected to be infrequent but may be necessitated by situations in which secondary containment vacuum may be less than the required containment vacuum, such as, but not limited to, wind gusts or failure or change of operating normal ventilation subsystems. These conditions do not indicate any change in the leak tightness of the secondary containment boundary.
The analysis should consider the actual conditions (equipment configuration, temperature, atmospheric pressure, wind conditions, measured secondary containment vacuum, etc.) to determine whether, if an accident requiring secondary containment to be OPERABLE were to occur, one train of SGT could establish the assumed secondary containment vacuum within the time assumed in the accident analysis. If so, the SR may be considered met for a period up to 4 hours. The 4 hour limit is based on the expected short duration of the situations when the Note would be applied. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                          B 3.6-86                Revision No. 20-3

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR  3.6.4.1.1  (continued)
REQUIREMENTS With regard to secondary containment vacuum values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).
SR  3.6.4.1.2 and SR   3.6.4.1.3 Verifying that secondary containment equipment hatches and access doors are closed ensures that the infiltration of outside air of such a magnitude as to prevent maintaining the desired negative pressure does not occur. Verifying that all such openings are closed provides adequate assurance that exfiltration from the secondary containment will not occur. In this application the term sealed has no connotation of leak tightness. Maintaining secondary containment OPERABILITY requires verifying one door in the access opening is closed, except when the access opening is being used for entry and exit. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.6.4.1.4 and SR   3.6.4.1.5 The SGT System exhausts the secondary containment atmosphere to the environment through appropriate treatment equipment.
Each SGT subsystem is designed to draw down pressure in the secondary containment to > 0.25 inches vacuum water gauge within the time required and maintain pressure in the secondary containment at > 0.25 inches of vacuum water gauge for 1 hour at a flow rate of < 4400 cfm. To ensure that all fission products released to the secondary containment are treated, SR 3.6.4.1.4 and SR 3.6.4.1.5 verify that a pressure in the secondary containment that is less than the lowest postulated pressure external to the secondary containment boundary can rapidly be established and maintained. When the SGT System is operating as designed, the establishment and maintenance of secondary containment pressure cannot be accomplished if the secondary containment boundary is not intact. Establishment of this pressure is confirmed by SR 3.6.4.1.4, which demonstrates that secondary containment can be drawn down to > 0.25 inches of vacuum water gauge in the required time using one SGT subsystem.
Specifically, the required drawdown time limit is based on ensuring that the SGT system will draw down the secondary containment pressure to t 0.25 inches of vacuum water gauge within 19 minutes (i.e., 17 minutes from start of gap release which occurs 2 minutes after LOCA initiation) under LOCA conditions. Typically, however, the conditions under which drawdown testing is performed pursuant to SR 3.6.4.1.4 are different than those assumed for LOCA conditions. For this reason, and because test results are dependent on or influenced by certain plant and/or atmospheric conditions that may be in effect at the time testing is performed, it is necessary to adjust the test acceptance criteria (i.e.,
(continued)
CLINTON                           B 3.6-87              Revision No. 20-3

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR  3.6.4.1.4 and SR   3.6.4.1.5 (continued)
REQUIREMENTS the required drawdown time) to account for such test conditions. Conditions or factors that may impact the test results include wind speed, whether the turbine building ventilation system is running, and whether the containment equipment hatch is open (when the test is performed during plant shutdown/outage conditions). The acceptance criteria for the drawdown test are thus based on a computer model (Ref. 7), verified by actual performance of drawdown tests,in which the drawdown time determined for accident conditions is adjusted to account for performance of the test during normal but certain plant conditions. The test acceptance criteria are specified in the applicable plant test procedure(s). Since the drawdown time is dependent upon secondary containment integrity, the drawdown requirement cannot be met if the secondary containment boundary is not intact.
SR 3.6.4.1.5 demonstrates that the pressure in the secondary containment can be maintained > 0.25 inches of vacuum water gauge for 1 hour using one SGT subsystem at a flow rate of
             < 4400 cfm. The 1 hour test period allows secondary containment to be in thermal equilibrium at steady state conditions. The primary purpose of these SRs is to ensure secondary containment boundary integrity. The secondary purpose of these SRs is to ensure that the SGT subsystem being tested functions as designed. There is a separate LCO with Surveillance Requirements which serves the primary purpose for ensuring OPERABILITY of the SGT System. These SRs need not be performed with each SGT subsystem. The inoperability of the SGT System does not necessarily constitute a failure of these Surveillances relative to the secondary containment OPERABILITY. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to drawdown time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Refs. 5, 6).
REFERENCES   1. USAR, Section 15.6.5.
: 2. USAR, Section 15.7.4.
: 3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 4. Calculation IP-0-0082.
: 5. Calculation IP-0-0083.
: 6. Calculation IP-0-0084.
: 7. Calculation 3C10-1079-001.
CLINTON                           B 3.6-88               Revision No. 20-3

SCIDs B 3.6.4.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.2 Secondary Containment Isolation Dampers (SCIDs)
BASES BACKGROUND        The function of the SCIDs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Refs. 1 and 3). Secondary containment isolation within the time limits specified for those isolation valves and dampers designed to close automatically ensures that fission products that leak from primary containment following a DBA, that are released during certain operations when primary containment is not required to be OPERABLE, or that take place outside primary containment, are maintained within the secondary containment boundary.
The OPERABILITY requirements for SCIDs help ensure that an adequate secondary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. The Isolation devices addressed by this LCO are either passive or active (automatic). Manual dampers and valves de-activated automatic dampers and valves secured in their closed position, check valves with flow through the valve secured, and blind flanges are considered passive devices. Check valves and automatic dampers and valves designed to close without operator action following an accident are considered active devices.
Automatic SCIDs close on a secondary containment isolation signal to establish a boundary for untreated radioactive material within secondary containment following a DBA or other accidents.
Other penetrations are isolated by the use of dampers or valves in the closed position or blind flanges.
APPLICABLE        The SCIDs must be OPERABLE to ensure the secondary SAFETY ANALYSES   containment barrier to fission product releases is established. The principal accidents for which the secondary containment boundary is required are a loss of coolant accident (Ref. 1), and a fuel handling accident (Ref. 3). The secondary containment performs no active function in response to each of these limiting events, but the boundary established by SCIDs is required to ensure that leakage from the primary containment is processed by the Standby Gas Treatment (SGT) System before being released to the environment.
Maintaining SCIDs OPERABLE with isolation times within limits ensures that fission products will remain trapped inside secondary containment so that they can be treated by the SGT System prior to discharge to the environment.
SCIDs satisfy Criterion 3 of the NRC Policy Statement.
(continued)
CLINTON                               B 3.6-89               Revision No. 20-2

SCIDs B 3.6.4.2 BASES   (continued)
LCO                 SCIDs form a part of the secondary containment boundary.
The SCID safety function is related to control of offsite radiation releases resulting from DBAs.
The power operated isolation dampers and valves are considered OPERABLE when their isolation times are within limits. Additionally, power operated automatic dampers and valves are required to actuate on an automatic isolation signal.
The normally closed isolation dampers, valves, or blind flanges are considered OPERABLE when manual dampers or valves are closed or open in accordance with appropriate administrative controls, automatic dampers are de-activated and secured in their closed position, or blind flanges are in place. The SCIDs covered by this LCO, along with their associated stroke times, if applicable, are listed in applicable plant procedures.
APPLICABILITY       In MODES 1, 2, and 3, a DBA could lead to a fission product release to the primary containment that leaks to the secondary containment. Therefore, OPERABILITY of SCIDs is required.
In MODES 4 and 5, the probability and consequences of these events are reduced due to pressure and temperature limitations in these MODES. Therefore, maintaining SCIDs OPERABLE is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during movement of recently irradiated fuel assemblies. (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours). Moving recently irradiated fuel assemblies in the secondary containment may also occur in MODES 1, 2, and 3.
ACTIONS             The ACTIONS are modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated individual, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when the need for secondary containment isolation is indicated.
The second Note provides clarification that for the purpose of this LCO separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SCID. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SCIDs are governed by subsequent Condition entry and application of associated Required Actions.
(continued)
CLINTON                                 B 3.6-90               Revision No. 20-2

SCIDs B 3.6.4.2 BASES ACTIONS        The third Note ensures appropriate remedial actions are (continued) taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable SCID.
A.1 and A.2 In the event that there are one or more penetration flow paths with one SCID inoperable, the affected penetration flow path(s) must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.
Isolation barriers that meet this criteria are a closed and de-activated automatic damper, a closed manual damper or valve, or a blind flange. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available device to secondary containment. This Required Action must be completed within the 8 hour Completion Time. The specified time period is reasonable considering the time required to isolate the penetration and the low probability of a DBA, which requires the SCIDs to close, occurring during this short time.
For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that secondary containment penetrations required to be isolated following an accident, but no longer capable of being automatically isolated, will be isolated should an event occur. This Required Action does not require any testing or isolation device manipulation. Rather, it involves verification that the affected penetration remains isolated.
Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative controls.
Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.
(continued)
CLINTON                            B 3.6-91               Revision No. 20-2

SCIDs B 3.6.4.2 BASES ACTIONS        B.1 (continued)
With two SCIDs in one or more penetration flow paths inoperable (Condition A is entered if one SCID is inoperable in each of two penetrations), the affected penetration flow path must be isolated within 4 hours. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic damper, a closed manual valve or damper, and a blind flange. The 4 hour Completion Time is reasonable, considering the time required to isolate the penetration and the low probability of a DBA, whichrequires the SCIDs to close, occurring during this short time.
C.1 and C.2 If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
Required Action D.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.
(continued)
CLINTON                            B 3.6-92               Revision No. 20-2

SCIDs B 3.6.4.2 BASES   (continued)
SURVEILLANCE        SR  3.6.4.2.1 REQUIREMENTS This SR verifies each secondary containment isolation manual valve, damper, and blind flange that is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the secondary containment boundary is within design limits. This SR does not require any testing or valve or damper manipulation. Rather, it involves verification that those SCIDs in secondary containment that are capable of being mispositioned are in the correct position.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
Two Notes have been added to this SR. The first Note applies to valves, dampers, and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these SCIDs, once they have been verified to be in the proper position, is low.
A second Note has been included to clarify that SCIDs that are open under administrative controls are not required to meet the SR during the time the SCIDs are open.
SR  3.6.4.2.2 Verifying the isolation time of each power operated and each automatic SCID is within limits is required to demonstrate OPERABILITY. The isolation time test ensures that the SCID will isolate in a time period less than or equal to that assumed in the safety analyses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).
(continued)
CLINTON                                 B 3.6-93               Revision No. 20-2

SCIDs B 3.6.4.2 BASES SURVEILLANCE   SR  3.6.4.2.3 REQUIREMENTS (continued) Verifying that each automatic SCID closes on a secondary containment isolation signal is required to prevent leakage of radioactive material from secondary containment following a DBA or other accident. This SR ensures that each automatic SCID will actuate to the isolation position on a secondary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES     1. USAR, Section 15.6.5.
: 2. USAR, Section 6.2.3.
: 3. USAR, Section 15.7.4.
: 4. Calculation IP-0-0085.
CLINTON                            B 3.6-94               Revision No. 20-2

SGT System B 3.6.4.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.3 Standby Gas Treatment (SGT) System BASES BACKGROUND        The SGT System is required by 10 CFR 50, Appendix A, GDC 41, Containment Atmosphere Cleanup (Ref. 1). The function of the SGT System is to ensure that radioactive materials that leak from the primary containment into the secondary containment following a Design Basis Accident (DBA) are filtered and adsorbed prior to exhausting to the environment. ASME/ANSI N510-1980, Testing of Nuclear Air Cleaning Systems require that rates are measured with respect to design flow. For the SGT system, the design flow rates are in acfm.
The SGT System consists of two fully redundant subsystems, each with its own set of ductwork, dampers, charcoal filter train, and controls.
Each charcoal filter train consists of (components listed in order of the direction of the air flow):
: a. A flow control damper;
: b. A demister;
: c. An electric heater;
: d. A prefilter;
: e. A high efficiency particulate air (HEPA) filter;
: f. A charcoal adsorber;
: g. A second HEPA filter; and
: h. A centrifugal fan.
The sizing of the SGT System equipment and components is based on the results of an infiltration analysis, as well as an exfiltration analysis of the auxiliary building, fuel building, emergency core cooling system (ECCS) pump rooms, and the gas control boundary. The internal pressure of the SGT System boundary region is maintained at a negative pressure of at least 0.25 inch water gauge when the system is in operation, which represents the internal pressure required to ensure zero exfiltration of air from the building when exposed to a 20 mph wind.
The demister is provided to remove entrained water in the air, while the electric heater reduces the relative humidity of the airstream to less than 70% (Refs. 2 and 5). The prefilter removes large particulate matter, while the HEPA filter is provided to remove fine particulate matter and (continued)
CLINTON                                B 3.6-95              Revision No. 20-2

SGT System B 3.6.4.3 BASES BACKGROUND      protect the charcoal from fouling. The charcoal adsorber (continued) removes gaseous elemental iodine and organic iodides, and the final HEPA filter is provided to collect any carbon fines exhausted from the charcoal adsorber.
The SGT System automatically starts and operates in response to actuation signals indicative of conditions or an accident that could require operation of the system. Following initiation, both charcoal filter train fans start. SGT System flows are controlled by modulating inlet dampers installed on the charcoal filter train inlets.
APPLICABLE      The design basis for the SGT System is to mitigate the SAFETY ANALYSES consequences of a loss of coolant accident and fuel handling accidents (Refs. 3 and 6). For all events analyzed, the SGT System is shown to be automatically initiated to reduce, via filtration and adsorption, the radioactive material released to the environment.
The SGT System satisfies Criterion 3 of the NRC Policy Statement.
LCO             Following a DBA, a minimum of one SGT subsystem is required to maintain the secondary containment at a negative pressure with respect to the environment and to process gaseous releases. Meeting the LCO requirements for two operable subsystems ensures operation of at least one SGT subsystem in the event of a single active failure.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, SGT System OPERABILITY is required during these MODES.
In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the SGT System OPERABLE is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours) in the primary or secondary containment.
ACTIONS         A.1 With one SGT subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE SGT subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is (continued)
CLINTON                             B 3.6-96                Revision No. 20-2

SGT System B 3.6.4.3 BASES ACTIONS A.1  (continued) reduced because a single failure in the OPERABLE subsystem could result in the radioactivity release control function not being adequately performed. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant SGT subsystem and the low probability of a DBA occurring during this period.
B.1 If the SGT subsystem cannot be restored to OPERABLE status within the required Completion Time in MODE 1, 2, or 3, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 9) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
Required Action B.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
C.1 and C.2 During movement of recently irradiated fuel assemblies in the primary or secondary containment, when Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE SGT subsystem should be immediately placed in operation. This Required Action ensures that the remaining subsystem is OPERABLE, that no failures that could prevent automatic actuation have occurred, and that any other failure would be readily detected.
An alternative to Required Action C.1 is to immediately suspend activities that represent a potential for releasing (continued)
CLINTON                     B 3.6-97               Revision No. 20-2

SGT System B 3.6.4.3 BASES ACTIONS C.1 and C.2  (continued) radioactive material to the secondary containment, thus placing the unit in a Condition that minimizes risk. If applicable, movement of recently irradiated fuel assemblies must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
The Required Actions of Condition C have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.
D.1 If both SGT subsystems are inoperable in MODE 1, 2, or 3, the SGT System may not be capable of supporting the required radioactivity release control function. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 9) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Required Action D.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.
(continued)
CLINTON                     B 3.6-98               Revision No. 20-2

SGT System B 3.6.4.3 BASES ACTIONS        E.1 (continued)
When two SGT subsystems are inoperable, if applicable, movement of recently irradiated fuel assemblies in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
SURVEILLANCE   SR  3.6.4.3.1 REQUIREMENTS Operating each SGT subsystem from the main control room for
               > 15 continuous minutes ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to operating time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 10).
SR  3.6.4.3.2 This SR verifies that the required SGT filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber bypass leakage and efficiency, minimum system flow rate, combined HEPA filter and charcoal adsorber pressure drop, and heater dissipation.
The frequencies for performing the SGT System filter tests are in accordance with Regulatory Guide 1.52 (Ref. 4) and include testing initially, after 720 hours of system operation, once per 24 months, and following painting, fire, or chemical release in any ventilation zone communicating with the system. The laboratory test results will be verified to be within limits within 31 days of removal of the sample from the system. Additional information is discussed in detail in the VFTP.
With regard to filter testing values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).
(continued)
CLINTON                            B 3.6-99               Revision No. 20-2

SGT System B 3.6.4.3 BASES SURVEILLANCE   SR  3.6.4.3.3 REQUIREMENTS (continued) This SR requires verification that each SGT subsystem automatically starts upon receipt of an actual or simulated initiation signal.
The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide complete testing of the safety function.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.6.4.3.4 This SR requires verification that the SGT filter cooling bypass damper can be opened and the fan started. This ensures that the ventilation mode of SGT System operation is available. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES     1. 10 CFR 50, Appendix A, GDC 41.
: 2. USAR, Section  6.2.3.
: 3. USAR, Section  15.6.5.
: 4. Regulatory Guide 1.52.
: 5. USAR, Section  6.5.1.
: 6. USAR, Section  15.6.4.
: 7. USAR Appendix A.
: 8. ASME/ANSI N510-1980.
: 9. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002
: 10. Calculation IP-0-0086.
: 11. Calculation IP-0-0087.
CLINTON                            B 3.6-100               Revision No. 20-2

Drywell B 3.6.5.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.1  Drywell BASES BACKGROUND         The drywell houses the reactor pressure vessel (RPV), the reactor coolant recirculating loops, and branch connections of the Reactor Coolant System (RCS), which have isolation valves at the primary containment boundary. The function of the drywell is to maintain a pressure boundary that channels steam from a loss of coolant accident (LOCA) to the suppression pool, where it is condensed. Air forced from the drywell is released into the primary containment through the suppression pool. The pressure suppression capability of the suppression pool assures that peak LOCA temperature and pressure in the primary containment are within design limits. The drywell also protects accessible areas of the containment from radiation originating in the reactor core and RCS.
To ensure the drywell pressure suppression capability, the drywell bypass leakage must be minimized to prevent overpressurization of the primary containment during the drywell pressurization phase of a LOCA. This requires periodic testing of the drywell bypass leakage, confirmation that the drywell air lock is leak tight, OPERABILITY of the drywell isolation valves, and confirmation that the drywell vacuum relief valves are closed.
The drywell air lock forms part of the drywell pressure boundary. Not maintaining air lock OPERABILITY may result in degradation of the pressure suppression capability, which is assumed to be functional in the unit safety analyses.
The drywell air lock does not need to meet the requirements of 10 CFR 50, Appendix J (Ref. 2), since it is not part of the primary containment leakage boundary. However, it is prudent to specify a leakage rate requirement for the drywell air lock. A seal leakage rate limit and an air lock overall leakage rate limit have been established to assure the integrity of the seals.
The isolation devices for the drywell penetrations are a part of the drywell barrier. To maintain this barrier:
: a. The drywell air lock is OPERABLE except as provided in LCO 3.6.5.2, Drywell Air Lock; (continued)
CLINTON                                B 3.6-101              Revision No. 20-2

Drywell B 3.6.5.1 BASES BACKGROUND      b. The drywell penetrations required to be closed during (continued)         accident conditions are either:
: 1. capable of being closed by an OPERABLE automatic drywell isolation valve, or
: 2. closed by a manual valve, blind flange, or de-activated automatic valve secured in the closed position except as provided in LCO 3.6.5.3, Drywell Isolation Valves;
: c. All drywell equipment hatches are closed;
: d. The Drywell Post-LOCA Vacuum Relief System is OPERABLE except as provided in LCO 3.6.5.6, Drywell Post-LOCA Vacuum Relief System;
: e. The suppression pool is OPERABLE, except as provided in LCO 3.6.2.2, Suppression Pool Water Level; and
: f. The drywell leakage rate is within the limits of this LCO.
This Specification is intended to ensure that the performance of the drywell in the event of a DBA meets the assumptions used in the safety analyses (Ref. 1).
APPLICABLE      Analytical methods and assumptions involving the drywell are SAFETY ANALYSES presented in Reference 1. The safety analyses assume that for a high energy line break inside the drywell, the steam is directed to the suppression pool through the horizontal vents where it is condensed. Maintaining the pressure suppression capability assures that safety analyses remain valid and that the peak LOCA temperature and pressure in the primary containment are within design limits.
The drywell satisfies Criteria 2 and 3 of the NRC Policy Statement.
LCO             Maintaining the drywell OPERABLE is required to ensure that the pressure suppression design functions assumed in the safety analyses are met. The drywell is OPERABLE if the drywell structural integrity is intact and the bypass (continued)
CLINTON                             B 3.6-102              Revision No. 20-2

Drywell B 3.6.5.1 BASES LCO             leakage is within limits, except prior to the first startup (continued) after performing a required drywell bypass leakage test. At this time, the drywell bypass leakage must be d 10% of the drywell bypass leakage limit.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the drywell is not required to be OPERABLE in MODES 4 and 5.
ACTIONS         A.1 In the event the drywell is inoperable, it must be restored to OPERABLE status within 1 hour. The 1 hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining the drywell OPERABLE during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring drywell OPERABILITY) occurring during periods when the drywell is inoperable is minimal. Also, the Completion Time is the same as that applied to inoperability of the primary containment in LCO 3.6.1.1, Primary Containment.
B.1 and B.2 If the drywell cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE    SR  3.6.5.1.1 REQUIREMENTS This SR requires a test to be performed to verify seal leakage of the drywell air lock doors at pressures t 3.0 psig. A seal leakage rate limit of d 2 scfh has been established to ensure the integrity of the seals. The (continued)
CLINTON                             B 3.6-103              Revision No. 20-2

Drywell B 3.6.5.1 BASES SURVEILLANCE SR  3.6.5.1.1  (continued)
REQUIREMENTS Surveillance is only required to be performed once within 72 hours after each closing. The Frequency of 72 hours is based on operating experience.
With regard to seal leakage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).
SR  3.6.5.1.2 This SR requires a test to be performed to verify overall air lock leakage of the drywell air lock at pressures t 3.0 psig. Prior to performance of this test, the air lock must be pressurized to 19.7 psid. This differential pressure is the assumed peak drywell pressure expected from the accident analysis. Since the drywell pressure rapidly returns to a steady state maximum differential pressure of 3.0 psid (due to suppression pool vent clearing), the overall air lock leakage is allowed to be measured at this pressure.
An overall air lock leakage limit of d 2 scfh has been established to ensure the integrity of the seals. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR has been modified by a Note indicating that an inoperable air lock door does not invalidate the previous successful performance of an overall air lock leakage test.
This is considered reasonable, since either air lock door is capable of providing a fission product barrier in the event of a DBA.
With regard to air lock leakage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).
(continued)
CLINTON                          B 3.6-104              Revision No. 20-2

Drywell B 3.6.5.1 BASES SURVEILLANCE   SR  3.6.5.1.3 REQUIREMENTS (continued) The analyses in Reference 1 are based on a maximum drywell bypass leakage. This Surveillance ensures that the actual drywell bypass leakage is less than or equal to the acceptable A / k design value of 1.0 ft2 assumed in the safety analysis. As left drywell bypass leakage, prior to the first startup after performing a required drywell bypass leakage test, is required to be d 10% of the drywell bypass leakage limit. At all other times between required drywell leakage rate tests, the acceptance criteria is based on the design A / k . At the design A / k the containment temperature and pressurization response are bounded by the assumptions of the safety analysis. One drywell air lock door is left open during each drywell bypass leakage test such that each drywell air lock door is leak tested during at least every other drywell bypass leakage test. This ensures that the leakage through the drywell air lock is properly accounted for in the measured bypass leakage and that each air lock door is tested periodically.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This Frequency is modified by a note that allows for a one-time deferral of this surveillance until November 23, 2008. If during the performance of this required Surveillance the drywell bypass leakage is determined to be greater than the leakage limit, the Surveillance Frequency is increased to at least once every 48 months. If during the performance of the subsequent consecutive Surveillance the drywell bypass leakage is determined to be less than or equal to the drywell bypass leakage limit, the Frequency specified in the Surveillance Frequency Control Program may be resumed. If during the performance of the subsequent consecutive Surveillance the drywell bypass leakage is determined to be greater than the drywell bypass leakage limit, the Surveillance Frequency is increased to at least once every 24 months. The 24-month Frequency must be maintained until the drywell bypass leakage is determined to (continued)
CLINTON                             B 3.6-105               Revision No. 20-2

Drywell B 3.6.5.1 BASES SURVEILLANCE SR  3.6.5.1.3  (continued)
REQUIREMENTS be less than or equal to the leakage limit during the performance of two consecutive Surveillances, at which time the Frequency specified in the Surveillance Frequency Control Program may be resumed. For two Surveillances to be considered consecutive, the Surveillances must be performed at least 12 months apart.
With regard to bypass leakage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).
SR  3.6.5.1.4 The exposed accessible drywell interior and exterior surfaces are inspected to ensure there are no apparent physical defects that would prevent the drywell from performing its intended function. This SR ensures that drywell structural integrity is maintained. The Frequency was chosen so that the interior and exterior surfaces of the drywell can be inspected in conjunction with the inspections of the primary containment required by 10 CFR 50, Appendix J (Ref. 2). Due to the passive nature of the drywell structure, the specified Frequency is sufficient to identify component degradation that may affect drywell structural integrity.
REFERENCES   1. USAR, Chapter 6 and Chapter 15.
: 2. 10 CFR 50, Appendix J, Option B.
: 3. Calculation IP-0-0088.
CLINTON                          B 3.6-106              Revision No. 20-9

Drywell Air Lock B 3.6.5.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.2  Drywell Air Lock BASES BACKGROUND        The drywell air lock forms part of the drywell boundary and provides a means for personnel access during MODES 2 and 3 during low power phase of unit startup. For this purpose, one double door drywell air lock has been provided, which maintains drywell isolation during personnel entry and exit from the drywell. Under the normal unit operation, the drywell air lock is kept sealed.
The drywell air lock is designed to the same standards as the drywell boundary. Thus, the drywell air lock must withstand the pressure and temperature transients associated with the rupture of any primary system line inside the drywell and also the rapid reversal in pressure when the steam in the drywell is condensed by the Emergency Core Cooling System flow following loss of coolant accident flooding of the reactor pressure vessel (RPV). It is also designed to withstand the high temperature associated with the break of a small steam line in the drywell that does not result in rapid depressurization of the RPV.
The air lock is nominally a right circular cylinder, 9 ft 10 inches in diameter, with doors at each end that are interlocked to prevent simultaneous opening. During periods when the drywell is not required to be OPERABLE, the air lock interlock mechanism may be disabled, allowing both doors of the air lock to remain open for extended periods when frequent drywell entry is necessary. Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA). The drywell air lock forms part of the drywell pressure boundary. Not maintaining air lock OPERABILITY may result in degradation of the pressure suppression capability, which is assumed to be functional in the unit safety analyses.
(continued)
CLINTON                               B 3.6-107              Revision No. 20-2

Drywell Air Lock B 3.6.5.2 BASES   (continued)
APPLICABLE          Analytical methods and assumptions involving the drywell are SAFETY ANALYSES     presented in Reference 2. The safety analyses assume that for a high energy line break inside the drywell, the steam is directed to the suppression pool through the horizontal vents where it is condensed. Since the drywell air lock is part of the drywell pressure boundary, its design and maintenance are essential to support drywell OPERABILITY, which assures that the safety analyses are met.
The drywell air lock satisfies Criterion 3 of the NRC Policy Statement.
LCO                 The drywell air lock forms part of the drywell pressure boundary. The air lock safety function assures that steam resulting from a DBA is directed to the suppression pool.
Thus, the air locks structural integrity is essential to the successful mitigation of such an event.
The air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, and both air lock doors must be OPERABLE.
The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of the drywell does not exist when the drywell is required to be OPERABLE.
Air lock leakage is excluded from this Specification. The air lock leakage rate is part of the drywell leakage rate and is controlled as part of OPERABILITY of the drywell in LCO 3.6.5.1, Drywell.
Closure of a single door in the air lock is necessary to support drywell OPERABILITY following postulated events.
Nevertheless, both doors are kept closed when the air lock is not being used for entry into and exit from the drywell.
APPLICABILITY       In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are (continued)
CLINTON                                 B 3.6-108               Revision No. 20-2

Drywell Air Lock B 3.6.5.2 BASES APPLICABILITY reduced due to the pressure and temperature limitations in (continued these MODES. Therefore, the drywell air lock is not required to be OPERABLE in MODES 4 and 5.
ACTIONS       The ACTIONS are modified by a Note which allows entry and exit to perform repairs on the affected air lock component.
If the outer door is inoperable, then it may be easily accessed to repair. If the inner door is inoperable, however, then there is a short time during which the drywell boundary is not intact (during access through the outer door). The ability to open the OPERABLE door, even if it means the drywell boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the drywell during the short time in which the OPERABLE door is expected to be open. The OPERABLE door must be immediately closed after each entry and exit.
A.1, A.2, and A.3 With one drywell air lock door inoperable, the OPERABLE door must be verified closed (Required Action A.1). This ensures that a leak tight drywell barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.5.1, which requires that the drywell be restored to OPERABLE status within 1 hour.
In addition, the air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour Completion Time. The Completion Time is considered reasonable for locking the OPERABLE air lock door, considering that the OPERABLE door is being maintained closed.
(continued)
CLINTON                           B 3.6-109              Revision No. 20-2

Drywell Air Lock B 3.6.5.2 BASES ACTIONS A.1, A.2, and A.3  (continued)
Required Action A.3 verifies that the air lock has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable drywell boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls that ensure that the OPERABLE air lock door remains closed.
The Required Actions are modified by two Notes. Note 1 ensures only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. The exception of the Note does not affect tracking the Completion Times from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls.
Drywell entry may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside the drywell that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS-required activities) if the drywell was entered, using the inoperable air lock, to perform an allowed activity listed above. The administrative controls required consist of the stationing of a dedicated individual to assure closure of the OPERABLE door except during the entry and exit, and assuring the OPERABLE door is relocked after completion of the drywell entry and exit. In addition, Note 2 allows an OPERABLE air lock door to remain unlocked, but closed, when the door is under the control of a dedicated individual stationed at the air lock. This allowance is acceptable due to the low probability of an event that could pressurize the drywell during the short time that the OPERABLE door is expected to be open.
B.1, B.2, and B.3 With the drywell air lock interlock mechanism inoperable, the Required Actions and associated Completion Times consistent with Condition A are applicable.
(continued)
CLINTON                     B 3.6-110               Revision No. 20-2

Drywell Air Lock B 3.6.5.2 BASES ACTIONS B.1, B.2, and B.3  (continued)
The Required Actions are modified by two Notes. Note 1 ensures only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. Note 2 allows entry and exit into the drywell under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock). In addition, Note 2 allows an OPERABLE air lock door to remain unlocked, but closed, when the door is under the control of a dedicated individual stationed at the air lock.
C.1 and C.2 With the air lock inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires that one door in the drywell air lock must be verified to be closed. This Required Action must be completed within the 1 hour Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.5.1, which requires that the drywell be restored to OPERABLE status within 1 hour.
Additionally, the air lock must be restored to OPERABLE status within 24 hours or in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable if leakage exceeds limits or if there is a loss of function. The 24 hour Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status, considering that at least one door is maintained closed in the air lock.
(continued)
CLINTON                     B 3.6-111              Revision No. 21-7

Drywell Air Lock B 3.6.5.2 BASES ACTIONS        D.1 and D.2 (continued)
If the inoperable drywell air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE   SR  3.6.5.2.1 REQUIREMENTS The air lock door interlock is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of the air lock are designed to withstand the maximum expected post accident drywell pressure, closure of either door will support drywell OPERABILITY. Thus, the door interlock feature supports drywell OPERABILITY while the air lock is being used for personnel transit in and out of the drywell. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                            B 3.6-112              Revision No. 20-2

Drywell Air Lock B 3.6.5.2 BASES   (continued)
SURVEILLANCE         SR  3.6.5.2.1  (continued)
REQUIREMENTS The Surveillance is modified by a Note requiring the Surveillance to be performed only upon entry into the drywell.
REFERENCES          1. 10 CFR 50, Appendix J, Option B.
: 2. USAR, Chapters 6 and 15.
CLINTON                                 B 3.6-113              Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.3  Drywell Isolation Valves BASES BACKGROUND        The drywell isolation valve(s), in combination with other accident mitigation systems, function to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.
The OPERABILITY requirements for drywell isolation valves help ensure that valves are closed, when required, and isolation occurs within the time limits specified for those isolation valves designed to close automatically.
Therefore, the OPERABILITY requirements support maintaining the drywell boundary and minimizing drywell bypass leakage below the value assumed in the safety analysis (Ref. 1) for a DBA. Typically, two barriers in series are provided for each penetration so that no credible single failure or malfunction of an active component can result in a loss of isolation. The isolation devices addressed by this LCO are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position, check valves with flow through the valve secured, and blind flanges are considered passive devices. Check valves and automatic valves designed to close without operator action following an accident, are considered active devices.
The drywell post-LOCA vacuum relief subsystems serve a dual function, one of which is drywell isolation. However, since the other function of vacuum relief would not be available if the normal drywell isolation ACTIONS were taken, the drywell isolation valve OPERABILITY requirements are not applicable to the drywell post-LOCA vacuum relief subsystems. Similar surveillance requirements provide assurance that the isolation capability is available without conflicting with the vacuum relief function.
The Drywell Vent and Purge System is a high capacity system with 24-inch drywell penetrations, which have isolation valves covered by this LCO. The drywell vent and purge supply penetration contains two 24-inch isolation valves (1VQ001A and 1VQ001B), one inside the drywell and the other outside the drywell. The drywell vent and purge exhaust (continued)
CLINTON                               B 3.6-114              Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES BACKGROUND      penetration contains a 24-inch (1VQ002) and a 10-inch (continued) (1VQ005) isolation valve in parallel inside the drywell and a 36-inch (1VQ003) drywell isolation valve outside the drywell in parallel with a 36-inch containment isolation valve (1VQ004B) which is connected to the containment ventilation system. The system is used to remove trace radioactive airborne products prior to personnel entry. The Drywell Vent and Purge System is seldom used in MODE 1, 2, or 3; therefore, the drywell purge isolation valves are seldom open during power operation.
The drywell vent and purge isolation valves fail closed on loss of instrument air or power. The drywell vent and purge exhaust isolation valves are fast closing valves (approximately 2 to 4 seconds). These valves are qualified to close against the differential pressure induced by a loss of coolant accident (LOCA). The drywell vent and purge supply isolation valves are required to be sealed closed in MODES 1, 2, and 3.
APPLICABLE      This LCO is intended to ensure that releases from the core SAFETY ANALYSESdo not bypass the suppression pool so that the pressure suppression capability of the drywell is maintained. Therefore, as part of the drywell boundary, drywell isolation valve OPERABILITY minimizes drywell bypass leakage. Therefore, the safety analysis of any event requiring isolation of the drywell is applicable to this LCO.
The limiting DBA resulting in a release of steam, water, or radioactive material within the drywell is a LOCA. In the analysis for this accident, it is assumed that drywell isolation valves either are closed or function to close within the required isolation time following event initiation.
The drywell isolation valves and drywell vent and purge isolation valves satisfy Criterion 3 of the NRC Policy Statement.
LCO             The drywell isolation valve safety function is to form a part of the drywell boundary.
The power operated drywell isolation valves are required to have isolation times within limits. Power operated automatic drywell isolation valves are also required to (continued)
CLINTON                             B 3.6-115              Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES LCO             actuate on an automatic isolation signal. Additionally, (continued) drywell vent and purge supply valves are required to be sealed closed. While drywell post-LOCA vacuum relief system valves isolate drywell penetrations, they are excluded from this Specification. Controls on their isolation function are adequately addressed in LCO 3.6.5.6, Drywell post-LOCA Vacuum Relief System.
The normally closed isolation valves or blind flanges are considered OPERABLE when, as applicable, manual valves are closed or opened in accordance with applicable administrative controls, automatic valves are de-activated and secured in their closed position, check valves with flow through the valve secured, or blind flanges are in place.
The valves covered by this LCO are included (with their associated stroke time, if applicable, for automatic valves) in Reference 2.
Drywell isolation valve leakage is excluded from this Specification. The drywell isolation valve leakage rates are part of the drywell leakage rate and are controlled as part of OPERABILITY of the drywell in LCO 3.6.5.1, Drywell.
For the purpose of meeting this LCO, only one drywell isolation valve or blind flange is required to be OPERABLE in each drywell penetration flow path (with the exception of drywell vent and purge valves, and Drywell Post-LOCA Vacuum Relief System valves). This single isolation is acceptable on the basis that these lines do not communicate directly with the drywell or containment atmospheres. Thus, steam bypass of the suppression pool is not possible without failure of the required isolation valve in conjunction with failures of the piping both inside the drywell and outside the drywell within the containment. Further, failure of multiple flow paths would be required to exceed the containment design limitations.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the drywell isolation valves are not required to be OPERABLE in MODES 4 and 5.
(continued)
CLINTON                             B 3.6-116              Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES   (continued)
ACTIONS             The ACTIONS are modified by three Notes. The first Note allows penetration flow paths, except for the drywell vent and purge supply and exhaust penetration flow paths, to be unisolated intermittently under administrative controls.
Due to the size of the drywell vent and purge line penetrations and the fact that they communicate directly with the containment atmosphere, bypassing the suppression pool, these flow paths are not allowed to be unisolated under administrative controls. These controls consist of stationing a dedicated individual, who is in continuous communication with the control room, at the controls of the valve. In this way, the penetration can be rapidly isolated when a need for drywell isolation is indicated.
The second Note provides clarification that for the purpose of this LCO separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable drywell isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable drywell isolation valves are governed by subsequent Condition entry and application of associated Required Actions.
The third Note requires the OPERABILITY of affected systems to be evaluated when a drywell isolation valve is inoperable. This ensures appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable drywell isolation valve.
A.1 and A.2 With one or more penetration flow paths with one required drywell isolation valve inoperable, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.
Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. In this condition, the remaining OPERABLE drywell isolation valve is adequate to perform the isolation function for drywell vent and purge system penetrations.
(continued)
CLINTON                                 B 3.6-117              Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES ACTIONS A.1 and A.2  (continued)
The associated system piping is adequate to perform the isolation function for other drywell penetrations. However, the overall reliability is reduced because a single failure could result in a loss of drywell isolation. The 8 hour Completion Time is acceptable, due to the low probability of the inoperable valve resulting in excessive drywell leakage and the low probability of the limiting event for drywell leakage occurring during this short time. In addition, the Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting drywell OPERABILITY during MODES 1, 2, and 3.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
For affected penetration flow paths that have been isolated in accordance with Required Action A.1, the affected penetrations must be verified to be isolated on a periodic basis. This is necessary to ensure that drywell penetrations that are required to be isolated following an accident, and are no longer capable of being automatically isolated, will be isolated should an event occur. This Required Action does not require any testing or valve manipulation; rather, it involves verification that those devices outside drywell and capable of potentially being mispositioned are in the correct position. Since these devices are inside primary containment, the time period specified as prior to entering MODE 2 or 3 from MODE 4, if not performed within the previous 92 days, is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and other administrative controls that will ensure that misalignment is an unlikely possibility. Also, this Completion Time is consistent with the Completion Time specified for PCIVs in LCO 3.6.1.3, Primary Containment Isolation Valves (PCIVs).
Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative controls.
Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.
(continued)
CLINTON                     B 3.6-118              Revision No. 21-7

Drywell Isolation Valves B 3.6.5.3 BASES ACTIONS        B.1 (continued)
With one or more drywell vent and purge penetration flow paths with two drywell isolation valves inoperable, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. The 4 hour Completion Time is acceptable, due to the low probability of the inoperable valves resulting in excessive drywell leakage and the low probability of the limiting event for drywell leakage occurring during this short time. In addition, the Completion Time is reasonable, considering the time required to isolate the penetration, and the probability of a DBA, which requires the drywell isolation valves to close, occurring during this short time is very low.
Condition B is modified by a Note indicating this Condition is only applicable to drywell vent and purge penetration flow paths. For other penetration flow paths, only one drywell isolation valve is required OPERABLE and, Condition A provides the appropriate Required Actions.
C.1 and C.2 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE   SR  3.6.5.3.1 REQUIREMENTS Each 24-inch drywell vent and purge supply isolation valve is required to be periodically verified sealed closed. This Surveillance applies to drywell vent and purge supply isolation valves since they are not qualified to close under accident conditions. This SR is designed to ensure that a gross breach of drywell is not caused by an inadvertent or spurious drywell vent and purge isolation (continued)
CLINTON                            B 3.6-119              Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES SURVEILLANCE SR  3.6.5.3.1  (continued)
REQUIREMENTS valve opening. Detailed analysis of these 24-inch drywell vent and purge supply valves failed to conclusively demonstrate their ability to close during a LOCA in time to support drywell OPERABILITY. Therefore, these valves are required to be in the sealed closed position during MODES 1, 2, and 3. These 24-inch drywell vent and purge supply valves that are sealed closed must be under administrative control to assure that they cannot be inadvertently opened.
Administrative control includes mechanical devices to seal or lock the valve closed, or to prevent power from being supplied to the valve operator. This can be accomplished by removing the air supply to the valve operator or tagging the control switches in the main control room in the closed position. In this application, the term sealed has no connotation of leakage within limits. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.6.5.3.2 This SR ensures that the 36-inch and either the 10-inch or the 24-inch drywell vent and purge exhaust isolation valves are closed as required or, if open, open for an allowable reason. These drywell vent and purge isolation valves are fully qualified to close under accident conditions; therefore, these valves are allowed to be open for limited periods of time. This SR has been modified by a Note indicating the SR is not required to be met when the 36-inch and either the 10-inch or the 24-inch drywell vent and purge exhaust valves are open for pressure control, ALARA or air quality considerations for personnel entry, or Surveillances or special testing of the purge system that require the valves to be open (e.g., testing of the containment and drywell ventilation radiation monitors) provided both the 12-inch and 36-inch primary containment purge system supply and exhaust lines are isolated. Normally, the 36-inch drywell vent and purge exhaust isolation valve is open to support operation of the 12-inch Continuous Containment Purge System. This is considered to be within the allowances of the Note. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                          B 3.6-120              Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES SURVEILLANCE  SR  3.6.5.3.3 REQUIREMENTS (continued) This SR requires verification that each drywell isolation manual valve and blind flange that is required to be closed during accident conditions is closed. The SR helps to ensure that drywell bypass leakage is maintained to a minimum. Due to the location of these devices, the Frequency specified as prior to entering MODE 2 or 3 from MODE 4, if not performed in the previous 92 days, is appropriate because of the inaccessibility of the devices and because these devices are operated under administrative controls and the probability of their misalignment is low.
Two Notes are added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since access to these areas is typically restricted during MODES 1, 2, and 3. Therefore, the probability of misalignment of these devices, once they have been verified to be in their proper position, is low. A second Note is included to clarify that the drywell isolation valves that are open under administrative controls are not required to meet the SR during the time that the devices are open.
SR  3.6.5.3.4 Verifying that the isolation time of each power operated and each automatic drywell isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the INSERVICE TESTING PROGRAM.
With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).
(continued)
CLINTON                           B 3.6-121              Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES SURVEILLANCE   SR  3.6.5.3.5 REQUIREMENTS (continued) Verifying that each automatic drywell isolation valve closes on a drywell isolation signal is required to prevent bypass leakage from the drywell following a DBA. This SR ensures each automatic drywell isolation valve will actuate to its isolation position on a drywell isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.6 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES     1. USAR, Section 6.2.4.
: 2. CPS ISI Manual.
: 3. Calculation IP-0-0091.
CLINTON                            B 3.6-122              Revision No. 20-2

Drywell Pressure B 3.6.5.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.4  Drywell Pressure BASES BACKGROUND        Drywell-to-primary containment differential pressure is an assumed initial condition in the analyses that determine the primary containment thermal hydraulic and dynamic loads during a postulated loss of coolant accident (LOCA).
If drywell pressure is less than the primary containment airspace pressure, the water level in the weir annulus will increase and, consequently, the liquid inertia above the top vent will increase. This will cause top vent clearing during a postulated LOCA to be delayed, and that would increase the peak drywell pressure. In addition, an inadvertent upper pool dump occurring with a negative drywell-to-primary containment differential pressure could result in overflow over the weir wall.
The limitation on negative drywell-to-primary containment differential pressure ensures that changes in calculated peak LOCA drywell pressures due to differences in water level of the suppression pool and the drywell weir annulus are negligible. It also ensures that the possibility of weir wall overflow after an inadvertent upper pool dump is minimized. The limitation on positive drywell-to-primary containment differential pressure helps ensure that the horizontal vents are not cleared with normal weir annulus water level and limits drywell pressure during an accident to less than the drywell design pressure.
APPLICABLE        Primary containment performance is evaluated for the entire SAFETY ANALYSES   spectrum of break sizes for postulated LOCAs. Among the inputs to the design basis analysis is the initial drywell internal pressure (Ref. 1). The initial drywell internal pressure affects the drywell pressure response to a LOCA (Ref. 1) and the suppression pool swell load definition (Ref. 2).
Additional analyses (Refs. 3, 4, and 5) have been performed to show that if initial drywell pressure does not exceed the negative pressure limit, the suppression pool swell and vent clearing loads will not be significantly increased and the (continued)
CLINTON                               B 3.6-123              Revision No. 20-2

Drywell Pressure B 3.6.5.4 BASES APPLICABLE      probability of weir wall overflow is minimized after an SAFETY ANALYSES inadvertent upper pool dump.
(continued)
Drywell pressure satisfies Criterion 2 of the NRC Policy Statement.
LCO             A limitation on the drywell-to-primary containment differential pressure of t -0.2 and d +1.0 psid is required to ensure that suppression pool water is not forced over the weir wall, vent clearing does not occur during normal operation, containment conditions are consistent with the safety analyses, and LOCA drywell pressures and pool swell loads are within design values.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining the drywell-to-primary containment differential pressure limitation is not required in MODE 4 or 5.
ACTIONS         A.1 With drywell-to-primary containment differential pressure not within the limits of the LCO, it must be restored within 1 hour. The Required Action is necessary to return operation to within the bounds of the safety analyses. The 1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.5.1, Drywell, which requires that the drywell be restored to OPERABLE status within 1 hour.
B.1  and B.2 If drywell-to-primary containment differential pressure cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and (continued)
CLINTON                             B 3.6-124              Revision No. 20-2

Drywell Pressure B 3.6.5.4 BASES ACTIONS      B.1and B.2  (continued) to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE SR  3.6.5.4.1 REQUIREMENTS This SR provides assurance that the limitations on drywell-to-primary containment differential pressure stated in the LCO are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to drywell-to-primary containment differential pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 6).
REFERENCES   1. USAR, Section 6.2.1.
: 2. USAR, Section 3.8.
: 3. USAR, Section 6.2.1.1.6.
: 4. USAR, Section 6.2.7.
: 5. USAR, Section 3.8, Attachment A3.8.
: 6. Calculation IP-0-0092.
CLINTON                          B 3.6-125              Revision No. 20-2

Drywell Air Temperature B 3.6.5.5 B 3.6   CONTAINMENT SYSTEMS B 3.6.5.5   Drywell Air Temperature BASES BACKGROUND         The drywell contains the reactor vessel and piping, which add heat to the airspace. Drywell coolers remove heat and maintain a suitable environment. The drywell average air temperature affects equipment OPERABILITY, personnel access, and the calculated response to postulated Design Basis Accidents (DBAs). The limitation on drywell average air temperature ensures that the peak drywell temperature during a design basis loss of coolant accident (LOCA) does not exceed the design temperature of 330qF. The limiting DBA for drywell atmosphere temperature is a small steam line break, assuming no heat transfer to the passive steel and concrete heat sinks in the drywell.
APPLICABLE         Primary containment performance for the DBA is evaluated for SAFETY ANALYSES    the entire spectrum of break sizes for postulated LOCAs inside containment (Ref. 1). Among the inputs to the design basis analysis is the initial drywell average air temperature. Increasing the initial drywell average air temperature could change the calculated results of the design bases analysis. The safety analyses (Ref. 1) assume an initial average drywell air temperature of 150&deg;F. This limitation ensures that the safety analyses remain valid by maintaining the expected initial conditions and ensures that the peak LOCA drywell temperature does not exceed the maximum allowable temperature of 330&deg;F. The consequence of exceeding this design temperature may result in the degradation of the drywell structure under accident loads.
Equipment inside the drywell that is required to mitigate the effects of a DBA is designed and qualified to operate under environmental conditions expected for the accident.
Drywell average air temperature satisfies Criterion 2 of the NRC Policy Statement.
LCO                If the initial drywell average air temperature is less than or equal to the LCO temperature limit, the peak accident temperature can be maintained below the drywell design (continued)
CLINTON                                B 3.6-126              Revision No. 20-2

Drywell Air Temperature B 3.6.5.5 BASES LCO             temperature during a DBA. This ensures the ability of the (continued) drywell to perform its design function.
APPLICABILITY   In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining drywell average air temperature within the limit is not required in MODE 4 or 5.
ACTIONS         A.1 When the drywell average air temperature is not within the limit of the LCO, it must be restored within 8 hours. The Required Action is necessary to return operation to within the bounds of the safety analyses. The 8 hour Completion Time is acceptable, considering the sensitivity of the analyses to variations in this parameter, and provides sufficient time to correct minor problems.
B.1 and B.2 If drywell average air temperature cannot be restored to within limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE    SR  3.6.5.5.1 REQUIREMENTS Verifying that the drywell average air temperature is within the LCO limit ensures that operation remains within the limits assumed for the drywell analysis. In order to determine the drywell average air temperature, an arithmetic average is calculated, using measurements taken at locations within the drywell selected to provide a representative sample of the overall drywell atmosphere. The arithmetical (continued)
CLINTON                             B 3.6-127              Revision No. 20-2

Drywell Air Temperature B 3.6.5.5 BASES SURVEILLANCE SR  3.6.5.5.1  (continued)
REQUIREMENTS average must consist of at least one reading from each elevation (with the exception that elevations 729 ft. 0 inches and 732 ft. 0 inches may be considered the same elevation) as described in Ref. 3. However, all available instruments should be used in determining the arithmetical average.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to drywell average air temperature values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties.
This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 4).
REFERENCES   1. USAR, Section 6.2.1.
: 2. USAR, Section 9.4.7.
: 3. USAR, Section 7.5.1.4.2.4.
: 4. Calculation IP-0-0093.
CLINTON                          B 3.6-128              Revision No. 20-2

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.6 Drywell Post-LOCA Vacuum Relief System BASES BACKGROUND        The Mark III pressure suppression containment is designed to condense, in the suppression pool, the steam released into the drywell in the event of a loss of coolant accident (LOCA). The steam discharging to the pool carries the noncondensibles from the drywell. Therefore, the drywell atmosphere changes from low humidity air to nearly 100%
steam (no air) as the event progresses. When the drywell subsequently cools and depressurizes, noncondensibles in the drywell must be replaced to avoid excessive weir wall overflow into the drywell. Rapid weir wall overflow must be controlled in a large break LOCA, so that essential equipment and systems located above the weir wall in the drywell are not subjected to excessive drag and impact loads. The drywell post-LOCA vacuum relief subsystems are the means by which noncondensibles are transferred from the primary containment back to the drywell during operation of the hydrogen mixing compressors. At least two 10 inch lines must be available for opening to support operation of the hydrogen mixing system. Three 10-inch lines were assumed to open for reducing post-LOCA suppression pool drag and impact loadings.
The vacuum relief subsystems are a potential source of drywell bypass leakage (i.e., some of the steam released into the drywell from a LOCA bypasses the suppression pool and leaks directly to the primary containment airspace).
Since excessive drywell bypass leakage could degrade the pressure suppression function, the Drywell Post-LOCA Vacuum Relief System has been designed with two valves in series in each vacuum relief line. This minimizes the potential for a stuck open valve to threaten drywell OPERABILITY. The four drywell post-LOCA vacuum relief subsystems use separate 10 inch lines penetrating the drywell, and each subsystem consists of a series arrangement of two check valves.
APPLICABLE        The Drywell Post-LOCA Vacuum Relief System must function in SAFETY ANALYSES   the event of a large break LOCA to control rapid weir wall overflow that could cause drag and impact loadings on essential equipment and systems in the drywell above the weir wall.
(continued)
CLINTON                               B 3.6-129              Revision No. 20-2

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES APPLICABLE      The drywell post-LOCA vacuum relief subsystems are required SAFETY ANALYSIS to assist in hydrogen dilution but not to protect the (continued) structural integrity of the drywell following a large break LOCA. Their passive operation (remaining closed and not leaking during drywell pressurization) is implicit in all of the LOCA analyses (Ref. 1).
The Drywell Post-LOCA Vacuum Relief System satisfies Criterion 3 of the NRC Policy Statement.
LCO             The LCO ensures that in the event of a LOCA, four drywell post-LOCA vacuum relief subsystems are available to support operation of the hydrogen mixing system and to reduce suppression pool drag and impact loads in the event of a large break LOCA. Each vacuum relief subsystem is OPERABLE when capable of opening at the required setpoint but is maintained in the closed position during normal operation.
APPLICABILITY   In MODES 1, 2, and 3, a Design Basis Accident could cause pressurization of primary containment. Therefore, drywell post-LOCA vacuum relief subsystem OPERABILITY is required during these MODES. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the drywell post-LOCA vacuum relief subsystem OPERABLE is not required in MODE 4 or 5.
ACTIONS         The ACTIONS are modified by a Note, which ensures appropriate remedial actions are taken, if necessary, if the drywell is rendered inoperable by inoperable drywell post-LOCA vacuum relief subsystems.
A.1 With one or more drywell post-LOCA vacuum relief subsystems open, the affected penetration flow path must be closed within 4 hours. This assures that drywell leakage would not result if a postulated LOCA were to occur. The 4 hour Completion Time is acceptable, since the drywell design bypass leakage ( A / k ) of 1.0 ft2 is maintained, and is considered a reasonable length of time needed to complete the Required Action.
(continued)
CLINTON                              B 3.6-130                Revision No. 20-2

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES ACTIONS A.1  (continued)
A Note has been added to provide clarification that separate Condition entry is allowed for each vacuum relief subsystem not closed.
B.1 With one drywell post-LOCA vacuum relief subsystem inoperable for reasons other than Condition A, the inoperable subsystem must be restored to OPERABLE status within 30 days. In these Conditions, the remaining OPERABLE vacuum relief subsystems are adequate to perform the depressurization mitigation function since three 10-inch lines remain available. The 30 day Completion Time takes into account the redundant capability afforded by the remaining subsystems, a reasonable time for repairs, and the low probability of an event requiring the vacuum relief subsystems to function occurring during this period.
C.1 With two or more drywell post-LOCA vacuum relief subsystems inoperable for reasons other than Condition A, the inoperable subsystems must be restored to OPERABLE status within 72 hours. The 72 hour Completion Time takes into account a reasonable time for repairs, and the low probability of an event requiring the vacuum relief subsystems to function occurring during this period.
D.1 and D.2 If the inoperable drywell post-LOCA vacuum relief subsystem(s) cannot be closed within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach (continued)
CLINTON                     B 3.6-131              Revision No. 20-2

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES ACTIONS      D.1  (continued) the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
E.1 If one drywell post-LOCA vacuum relief subsystem is inoperable for reasons other than Condition A or two or more drywell post-LOCA vacuum relief subsystems are inoperable for reasons other than Condition A, and not restored within the provided Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Required Action E.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.
SURVEILLANCE SR  3.6.5.6.1 REQUIREMENTS Each drywell post-LOCA vacuum relief valve is verified to be closed (except when being tested in accordance with SR 3.6.5.6.2 and SR 3.6.5.6.3 or when the drywell post-LOCA vacuum relief valves are performing their intended design function) to ensure that this potential large drywell bypass leakage path is not present. This Surveillance is normally performed by observing the drywell post-LOCA vacuum relief valve position indication. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                          B 3.6-132              Revision No. 20-2

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES   (continued)
SURVEILLANCE        SR  3.6.5.6.1  (continued)
REQUIREMENTS Two Notes are added to this SR. The first Note allows drywell post-LOCA vacuum relief valves opened in conjunction with the performance of a Surveillance to not be considered as failing this SR. These periods of opening drywell post-LOCA vacuum relief valves are controlled by plant procedures and do not represent inoperable drywell post-LOCA vacuum relief valves. A second Note is included to clarify that valves open due to an actual differential pressure, are not considered as failing this SR.
SR 3.6.5.6.2 Each drywell post-LOCA vacuum relief valve must be cycled to ensure that it opens adequately to perform its design function and returns to the fully closed position. This provides assurance that the safety analysis assumptions are valid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.6.5.6.3 Verification of the drywell post-LOCA vacuum relief valve opening differential pressure is necessary to ensure that the safety analysis assumptions of < 0.2 psid for drywell vacuum relief are valid. The safety analysis assumes that the drywell post-LOCA vacuum relief valves will start opening when the dry well pressure is approximately 0.2 psid less than the containment and will be fully open when this differential pressure is 0.5 psid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES          1. USAR, Section 6.2.
: 3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
CLINTON                                 B 3.6-133              Revision No. 20-2

Division 1 and 2 SX Subsystems and UHS B 3.7.1 B 3.7   PLANT SYSTEMS B 3.7.1   Division 1 and 2 Shutdown Service Water (SX) Subsystems and Ultimate Heat Sink (UHS)
BASES BACKGROUND         The SX System is designed to provide cooling water for the removal of heat from unit auxiliaries, such as Residual Heat Removal (RHR) System heat exchangers, standby diesel generators (DGs), and room coolers for Emergency Core Cooling System equipment required for a safe reactor shutdown following a Design Basis Accident (DBA) or transient. The SX System also provides cooling to unit components, as required, during normal shutdown and reactor isolation modes. During a DBA, the equipment required for normal operation only is isolated from the SX System, and cooling is directed only to safety related equipment.
The SX System consists of three independent cooling water headers (Divisions 1, 2, and 3), and their associated pumps, piping, valves, and instrumentation. Any two SX pumps provide sufficient cooling capacity to support the required safety related systems during safe shutdown of the unit following a loss of coolant accident (LOCA).
The UHS consists of a portion of Clinton Lake which provides sufficient water inventory for all SX System post LOCA cooling requirements for a 30 day period with no external makeup water source available (Regulatory Guide 1.27, Ref. 1).
Cooling water is pumped from the UHS by the SX pumps to the essential components through the supply headers (Divisions 1, 2, and 3). After removing heat from the components, the water is discharged to the UHS where the heat is rejected.
The SX System supplies cooling water to equipment required for a safe reactor shutdown. Additional information on the design and operation of the SX System and UHS along with the specific equipment for which the SX System supplies cooling water is provided in the USAR, Section 9.2.1.2 and the USAR, Table 9.2-3 (Refs. 2 and 3, respectively). The SX System is designed to withstand a single active or passive failure, (continued)
CLINTON                              B 3.7-1                      Revision No. 0

Division 1 and 2 SX Subsystems and UHS B 3.7.1 BASES BACKGROUND      coincident with a loss of offsite power, without losing the (continued)   capability to supply adequate cooling water to equipment required for safe reactor shutdown.
Following a DBA or transient, the SX System will operate automatically without operator action. Manual initiation of supported systems (e.g., suppression pool cooling) is, however, performed for long term cooling operations.
APPLICABLE      The UHS is such that sufficient water inventory is available SAFETY ANALYSES for all SX System post LOCA cooling requirements for a 30 day period with no additional makeup water source available (Ref. 1). The ability of the SX System to support long term cooling of the reactor or containment is assumed in evaluations of the equipment required for safe reactor shutdown presented in the USAR, Sections 9.2.1.2, 6.2.1.1.3.3, and Chapter 15, (Refs. 2, 4, and 5, respectively). These analyses include the evaluation of the long term primary containment response after a design basis LOCA. The Division 1 and 2 SX subsystems provide cooling water for the RHR suppression pool cooling mode to limit suppression pool temperature and primary containment pressure following a LOCA. This ensures that the primary containment can perform its intended function of limiting the release of radioactive materials to the environment following a LOCA. The Division 1 and 2 SX subsystems also provide cooling to other components assumed to function during a LOCA (e.g., RHR and Low Pressure Core Spray systems). Also, the ability to provide onsite emergency AC power is dependent on the ability of the SX System to cool the DGs.
The safety analyses for long term containment cooling were performed, as discussed in the USAR, Sections 6.2.1.1.3.3 and 6.2.2.3 (Refs. 4 and 6, respectively), for a LOCA, concurrent with a loss of offsite power, and minimum available DG power. The worst case single failure affecting the performance of the SX System is the failure of the Division 1 or 2 standby DGs, which would in turn affect one SX subsystem. The SX flow assumed in the analyses is 5800 gpm per pump to the RHR heat exchanger (USAR, Table 6.2-2, Ref. 7). Reference 2 discusses SX System performance during these conditions.
(continued)
CLINTON                           B 3.7-2                      Revision No. 0

Division 1 and 2 SX Subsystems and UHS B 3.7.1 BASES APPLICABLE        The SX System, together with the UHS, satisfy Criterion 3 of SAFETY ANALYSES   the NRC Policy Statement.
(continued)
LCO               The OPERABILITY of Division 1 and Division 2 of the SX System is required to ensure the effective operation of the RHR System in removing heat from the reactor, and the effective operation of other safety related equipment during a DBA or transient. Requiring both Division 1 and 2 subsystems to be OPERABLE ensures that either the Division 1 or 2 subsystem will be available to provide adequate capability to meet cooling requirements of the equipment required for safe shutdown in the event of a single failure.
A subsystem is considered OPERABLE when:
: a. The associated pump is OPERABLE; and
: b. The associated piping, valves, instrumentation, and controls required to perform the safety related function are OPERABLE.
OPERABILITY of the UHS is based on a contained water volume of t 593 acre-feet excluding sediment.
The isolation of the SX System to components or systems may render those components or systems inoperable, but may not affect the OPERABILITY of the associated SX subsystem.
OPERABILITY of the Division 3 SX subsystem is addressed by LCO 3.7.2, "Division 3 SX Subsystem."
APPLICABILITY     In MODES 1, 2, and 3, the UHS and the Division 1 and 2 subsystems of the SX System are required to be OPERABLE to support OPERABILITY of the equipment serviced by the Division 1 and 2 SX subsystems and the UHS and required to be OPERABLE in these MODES.
In MODES 4 and 5, the OPERABILITY requirements of the SX System and UHS are determined by the systems they support.
(continued)
CLINTON                             B 3.7-3                      Revision No. 0

Division 1 and 2 SX Subsystems and UHS B 3.7.1 BASES (continued)
ACTIONS           A.1 If the UHS is inoperable (i.e., the UHS water volume is not within the limit), action must be taken to restore the inoperable UHS to OPERABLE status within 90 days. The 90 day Completion Time is reasonable considering the time required to restore the required UHS volume, the margin contained in the available heat removal capacity, and the low probability of a DBA occurring during this period.
B.1 If the Division 1 or 2 SX subsystem is inoperable, it must be restored to OPERABLE status within 72 hours or in accordance with the Risk Informed Completion Time Program.
With the unit in this condition, the remaining OPERABLE Division 1 or 2 SX subsystem is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE Division 1 or 2 SX subsystem could result in loss of the SX function.
The 72 hour Completion Time was developed taking into account the redundant capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.
Condition B is modified by a Note. The Note indicates that this Condition is not applicable during replacement of the Division 2 SX pump during the Division 2 SX system outage window from October 26 through November 8, 2015.
The Required Action is modified by two Notes indicating that the applicable Conditions of LCO 3.8.1, "AC Sources Operating," and LCO 3.4.9, "Residual Heat Removal (RHR)
Shutdown Cooling System  Hot Shutdown," be entered and the Required Actions taken if the inoperable SX subsystem results in an inoperable DG or RHR shutdown cooling subsystem, respectively. This is in accordance with LCO 3.0.6 and ensures the proper actions are taken for these components.
C.1 During replacement of the Division 2 SX pump in the Division 2 SX system outage window from October 26 through November 8, 2015, the Division 2 SX subsystem is inoperable, and it must be restored to OPERABLE status within 7 days.
This Completion Time is based upon a risk-informed assessment that concluded that the associated risk with the system in the specified configuration is acceptable.
(continued)
CLINTON                             B 3.7-4                   Revision No. 21-7

Division 1 and 2 SX Subsystems and UHS B 3.7.1 BASES ACTIONS C.1  (continued)
Condition C is modified by a Note. The Note indicates that this Condition is only applicable during replacement of the Division 2 SX pump during the Division 2 system outage window from October 26 through November 8, 2015.
Required Action C.1 is modified by two Notes as described in Action B.1 above.
D.1 If the Required Action and associated Completion Time of Condition B or C is not met, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 8) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Required Action D.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.
E.1 and E.2 If the Required Action and associated Completion Time of Condition A or B are not met, or both Division 1 and 2 SX subsystems are inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
(continued)
CLINTON                   B 3.7-5                  Revision No. 21-7

Division 1 and 2 SX Subsystems and UHS B 3.7.1 BASES   (continued)
SURVEILLANCE        SR  3.7.1.1 REQUIREMENTS This SR verifies UHS water volume is t 593 acre-feet (excluding sediment). The Surveillance Frequency is in accordance with UHS Erosion, Sediment Monitoring and Dredging Program.
With regard to UHS water volume values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).
SR  3.7.1.2 Verifying the correct alignment for each manual, power operated, and automatic valve in each Division 1 and 2 SX subsystem flow path provides assurance that the proper flow paths will exist for Division 1 and 2 SX subsystem operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position and yet considered in the correct position, provided it can be automatically realigned to its accident position within the required time.
This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
Isolation of the SX subsystem to components or systems does not necessarily affect the OPERABILITY of the associated SX subsystem. As such, when all SX pumps, valves, and piping are OPERABLE, but a branch connection off the main header is isolated, the associated SX subsystem needs to be evaluated to determine if it is still OPERABLE. Alternatively, it is acceptable and conservative to declare an SX subsystem inoperable when a branch connection is isolated.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                               B 3.7-6                  Revision No. 16-3

Division 1 and 2 SX Subsystems and UHS B 3.7.1 BASES SURVEILLANCE      SR  3.7.1.3 REQUIREMENTS (continued)    This SR verifies that the automatic isolation valves of the Division 1 and 2 SX subsystems will automatically switch to the safety or emergency position to provide cooling water exclusively to the safety related equipment during an accident event. This is demonstrated by use of an actual or simulated initiation signal and is performed with the plant shut down. This SR also verifies the automatic start capability of the SX pump in each subsystem.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. Regulatory Guide 1.27, Revision 2, January 1976.
: 2. USAR, Section 9.2.1.2.
: 3. USAR, Table 9.2-3.
: 4. USAR, Section 6.2.1.1.3.3.
: 5. USAR, Chapter 15.
: 6. USAR, Section 6.2.2.3.
: 7. USAR, Table 6.2-2.
: 8. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 9. Calculation IP-0-0095.
CLINTON                             B 3.7-7                   Revision No. 14-2

Division 3 SX Subsystem B 3.7.2 B 3.7   PLANT SYSTEMS B 3.7.2   Division 3 Shutdown Service Water Subsystem (SX)
BASES BACKGROUND         The Division 3 SX subsystem is designed to provide cooling water for the removal of heat from components of the Division 3 High Pressure Core Spray (HPCS) System.
The Division 3 SX subsystem consists of one cooling water header (Division 3 subsystem of the SX System), and the associated subsystem pump, piping, and valves. The Ultimate Heat Sink (UHS) is considered part of the SX System (LCO 3.7.1, "Division 1 and 2 Shutdown Service Water (SX)
Subsystems and Ultimate Heat Sink (UHS)").
Cooling water is pumped from a UHS water source by the Division 3 SX pump to the essential components through the Division 3 SX supply header. After removing heat from the components, the water is discharged to the UHS.
The Division 3 SX subsystem specifically supplies cooling water to the Division 3 HPCS diesel generator jacket water coolers and HPCS pump room cooler. The Division 3 SX pump is sized such that it will provide adequate cooling water to the Division 3 equipment required for safe shutdown.
Following a Design Basis Accident or transient, the Division 3 SX subsystem will operate automatically and without operator action as described in the USAR, Section 9.2.1.2 (Ref. 1).
APPLICABLE         The ability of the Division 3 SX to provide adequate cooling SAFETY ANALYSES    to the HPCS System is an implicit assumption for safety analyses evaluated in the USAR, Chapters 6 and 15 (Refs. 2 and 3, respectively).
The Division 3 SX subsystem satisfies Criterion 3 of the NRC Policy Statement.
LCO                The Division 3 SX subsystem is required to be OPERABLE to ensure that the HPCS System will operate as required. An OPERABLE Division 3 SX subsystem consists of an OPERABLE (continued)
CLINTON                              B 3.7-8                  Revision No. 14-2

Division 3 SX Subsystem B 3.7.2 BASES LCO               pump; and an OPERABLE Division 3 SX flow path, capable of (continued)     taking suction from the UHS source and transferring the water to the appropriate unit equipment.
The OPERABILITY of the Division 1 and 2 SX subsystems and the UHS is discussed is LCO 3.7.1.
APPLICABILITY     In MODES 1, 2, and 3, the UHS and Division 3 SX subsystem is required to be OPERABLE to support OPERABILITY of the HPCS System since it is required to be OPERABLE in these MODES.
In MODES 4 and 5, the OPERABILITY requirements of the Division 3 SX subsystem and the UHS are determined by the HPCS System.
ACTIONS           A.1 When the Division 3 SX subsystem is inoperable, the capability of the HPCS System to perform its intended function cannot be ensured. Therefore, if the Division 3 SX subsystem is inoperable, the HPCS System must be declared inoperable immediately and the applicable Condition(s) of LCO 3.5.1, "ECCS  Operating," or LCO 3.5.2, "RPV Water Inventory Control," entered.
SURVEILLANCE      SR  3.7.2.1 REQUIREMENTS Verifying the correct alignment for each required manual, power operated, and automatic valve in the Division 3 SX subsystem flow path provides assurance that the proper flow paths will exist for Division 3 SX subsystem operation.
This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in correct position prior to locking, sealing, or securing.
A valve is also allowed to be in the nonaccident position and yet considered in the correct position, provided it can be automatically realigned to its accident position within the required time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.
(continued)
CLINTON                              B 3.7-9                   Revision No. 20-2

Division 3 SX Subsystem B 3.7.2 BASES SURVEILLANCE      SR  3.7.2.1  (continued)
REQUIREMENTS Isolation of the Division 3 SX subsystem to components or systems does not necessarily affect the OPERABILITY of the Division 3 SX subsystem. As such, when the Division 3 SX pump, valves, and piping are OPERABLE, but a branch connection off the main header is isolated, the Division 3 SX subsystem needs to be evaluated to determine if it is still OPERABLE. Alternatively, it is acceptable and conservative to declare an SX subsystem inoperable when a branch connection is isolated or a supported ventilation system is inoperable.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.7.2.2 This SR verifies that the automatic isolation valves of the Division 3 SX subsystem will automatically switch to the safety or emergency position to provide cooling water exclusively to the safety related equipment during an accident event. This is demonstrated by use of an actual or simulated initiation signal and is performed with the plant shut down. This SR also verifies the automatic start capability of the Division 3 SX pump.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
REFERENCES        1. USAR, Section 9.2.1.2.
: 2. USAR, Chapter 6.
: 3. USAR, Chapter 15.
CLINTON                            B 3.7-10                   Revision No. 14-2

Control Room Ventilation System B 3.7.3 B 3.7   PLANT SYSTEMS B 3.7.3   Control Room Ventilation System BASES BACKGROUND         The Control Room Ventilation System provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals or smoke.
The safety related function of the Control Room Ventilation System used to control radiation exposure consists of two independent and redundant high efficiency air filtration subsystems for treatment of recirculated air or outside supply air and a CRE boundary that limits the inleakage of unfiltered air. Each subsystem contains a makeup air filter and a recirculation adsorber, a fan, and the associated ductwork, dampers, doors, barriers, and instrumentation.
The makeup filter consists of a demister, an electric heater, a prefilter, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section, and a second HEPA filter. The recirculation adsorber consists of a prefilter and an activated charcoal adsorber section.
Demisters remove water droplets from the airstream.
Prefilters and HEPA filters remove particulate matter that may be radioactive. The charcoal adsorbers provide a holdup period for gaseous iodine, allowing time for decay. For filter train test performed in accordance with ASME/ANSI N510-1980 flow rates are measured with respect to design flow. For the Control Room Ventilation System, the design flows are in scfm.
The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions.
This area encompases the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected for normal operation, natural events, and accident conditions. The CRE is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE.
The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage assumed in the licensing basis analysis of Design basis accident (DBA) consequences to the CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.
In addition to the safety related standby emergency filtration function, parts of the Control Room Ventilation (continued)
CLINTON                             B 3.7-11                   Revision No. 14-2

Control Room Ventilation System B 3.7.3 BASES BACKGROUND        System are operated to maintain the CRE environment during (continued)     normal operation. Upon receipt of the initiation signal(s)
(indicative of conditions that could result in radiation exposure to CRE occupants), the Control Room Ventilation System automatically switches to the high radiation mode of operation to minimize infiltration of contaminated air into the CRE (outside makeup air is routed through the makeup air filters, the recirculation adsorber is placed in service, and the locker room exhaust is isolated).
The Control Room Ventilation System is designed to maintain a habitable environment in the CRE for a 30 day continuous occupancy after a DBA, without exceeding 5 rem total effective dose equivalent (TEDE). Control Room Ventilation System operation in maintaining the CRE habitability is discussed in the USAR, Sections 6.5.1 and 9.4.1 (Refs. 1 and 2, respectively).
APPLICABLE        The ability of the Control Room Ventilation System to SAFETY ANALYSES   maintain the habitability of the CRE is an explicit assumption for the safety analyses presented in the USAR, Chapters 6 and 15 (Refs. 3 and 4, respectively). The high radiation mode of the Control Room Ventilation System is assumed to operate following a DBA. The radiological doses to CRE occupants as a result of the various DBAs are summarized in Reference 4. No single active or passive failure will cause the loss of outside or recirculated air from the CRE.
The Control Room Ventilation System provides protection from smoke and hazardous chemicals to the CRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref 5). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 6).
The Control Room Ventilation System satisfies Criterion 3 of the NRC Policy Statement.
(continued)
CLINTON                            B 3.7-12                  Revision No. 14-2

Control Room Ventilation System B 3.7.3 BASES   (continued)
LCO                 Two redundant subsystems of the Control Room Ventilation System are required to be OPERABLE to ensure that at least one is available, if a single active failure disables the other subsystem. Total Control Room Ventilation System failure, such as from a loss of both ventilation subsystems or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem TEDE to the CRE boundary occupants in the event of a DBA.
Each Control Room Ventilation subsystem is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE. A subsystem is considered OPERABLE when its associated:
: a. Fan is OPERABLE;
: b. HEPA filter and charcoal adsorber are not excessively restricting flow and are capable of performing their filtration functions; and
: c. Heater, demister, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.
In order for the Control Room Ventilation subsystems to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequences analysis for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.
The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls.
This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.
(continued)
CLINTON                              B 3.7-13                   Revision No. 14-2

Control Room Ventilation System B 3.7.3 BASES   (continued)
APPLICABILITY       In MODES 1, 2, and 3, the Control Room Ventilation System must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA, since the DBA could lead to a fission product release.
In MODES 4 and 5, the probability and consequences of a DBA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the Control Room Ventilation System OPERABLE is not required in MODE 4 or 5, except during CORE ALTERATIONS, and during movement of irradiated fuel assemblies in the primary or secondary containment.
ACTIONS             A.1 With one Control Room Ventilation subsystem inoperable for reasons other than an inoperable CRE boundary, the inoperable Control Room Ventilation subsystem must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE Control Room Ventilation subsystem is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE subsystem could result in loss of Control Room Ventilation System function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and that the remaining subsystem can provide the required capabilities.
B.1 In MODE 1, 2, or 3, if the inoperable Control Room Ventilation subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE that minimizes overall plant risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 7) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed (continued)
CLINTON                              B 3.7-14                  Revision No. 20-2

Control Room Ventilation System B 3.7.3 BASES ACTIONS B.1  (continued)
Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
Required Action B.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.
C.1, C.2, and C3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals and smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.
During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e, actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional.
The 24 hour Completion Time is reasonable based on the low probability of a DBA during this time period, and the use of mitigating actions. The 90 day Completion Time is (continued)
CLINTON                  B 3.7-15                  Revision No. 14-2

Control Room Ventilation System B 3.7.3 BASES ACTIONS C.1, C.2, and C3   (continued) reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability the CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.
D.1 and D.2 In MODE 1, 2, or 3, if the CRE boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes accident risk.
To achieve this status, the unit must be placed in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
E.1, E.2.1, and E.2.2 The Required Actions of Condition E are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.
Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.
During movement of irradiated fuel assemblies in the primary or secondary containment or during CORE ALTERATIONS, if the inoperable Control Room Ventilation subsystem cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE Control Room Ventilation subsystem may be placed in the high radiation mode. This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent automatic actuation will occur, and that any active failure will be readily detected.
An alternative to Required Action E.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require the Control Room Ventilation subsystem to be in the high radiation mode of operation. This places the unit in a condition that minimizes the accident risk.
(continued)
CLINTON                  B 3.7-16                    Revision No. 20-2

Control Room Ventilation System B 3.7.3 BASES ACTIONS E.1, E.2.1, and E.2.2  (continued)
If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
F.1 If both Control Room Ventilation subsystems are inoperable in MODE 1, 2, or 3 for reasons other than an inoperable CRE boundary (i.e., Condition C), the Control Room Ventilation System may not be capable of performing the intended function and the unit is in a condition outside of the accident analyses. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 7) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions is an orderly manner and without challenging plant systems.
Required Action F.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.
(continued)
CLINTON                  B 3.7-17                   Revision No. 20-2

Control Room Ventilation System B 3.7.3 BASES ACTIONS           G.1 and G.2 (continued)
During movement of irradiated fuel assemblies in the primary or secondary containment or during CORE ALTERATIONS with two Control Room Ventilation subsystems inoperable or with one or more Control Room Ventilation subsystems inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that present a potential for releasing radioactivity that might require treatment of the control room air. This places the unit in a condition that minimizes the accident risk.
If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
SURVEILLANCE      SR  3.7.3.1 and SR  3.7.3.2 REQUIREMENTS This SR verifies that a subsystem in a standby mode starts on demand and continues to operate. Standby systems should be checked periodically to ensure that they start and function properly. As the environmental and normal operating conditions of this system are not severe, testing each subsystem provides an adequate check on this system.
Operation with the heaters on for t 15 continuous minutes demonstrates OPERABILITY of the system. Periodic operation ensures that heater failure, blockage, fan or motor failure, or excessive vibration can be detected for corrective action. The Recirculation Filter System (without heaters) need only be operated for t 15 minutes to demonstrate the function of the system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                            B 3.7-18                   Revision No. 20-2

Control Room Ventilation System B 3.7.3 BASES SURVEILLANCE SR  3.7.3.1 and SR  3.7.3.2  (continued)
REQUIREMENTS With regard to subsystem operation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8, 9).
SR  3.7.3.3 This SR verifies that the required Control Room Ventilation System testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber bypass leakage and efficiency, minimum system flow rate (scfm), combined HEPA filter and charcoal adsorber pressure drop, and heater dissipation in accordance with Regulatory Guide 1.52 (Ref. 10). The Frequencies for performing the Control Room Ventilation System filter tests are also in accordance with Regulatory Guide 1.52 (Ref.10). Specific test frequencies and additional information are discussed in detail in the VFTP.
SR  3.7.3.4 This SR verifies that each Control Room Ventilation subsystem starts and operates on an actual or simulated high radiation initiation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                       B 3.7-19                  Revision No. 14-2

Control Room Ventilation System B 3.7.3 BASES SURVEILLANCE  SR  3.7.3.5 REQUIREMENTS (continued) This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room envelope Habitability Program.
The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem TEDE and the CRE occupants are protected from hazardous chemicals and smoke.
This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition C must be entered. Required Action C.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref.
: 11) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 12). These compensatory measures may also be used as mitigating actions as required by Required Action C.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 13).
Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.
(continued)
CLINTON                        B 3.7-20                  Revision No. 14-2

Control Room Ventilation System B 3.7.3 BASES   (continued)
REFERENCES          1. USAR, Section 6.5.1.
: 2. USAR, Section 9.4.1.
: 3. USAR, Chapter 6.
: 4. USAR, Chapter 15.
: 5. USAR, Section 6.4.
: 6. USAR, Section 9.5.
: 7. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002
: 8. Calculation IP-O-0096.
: 9. Calculation IP-O-0097.
: 10. Regulatory Guide 1.52, Revision 2, March 1978.
: 11. Regulatory Guide 1.196.
: 12. NEI 99-03, Control Room Habitability Assessment, June 2001.
: 13. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated January 10, 2004, NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability. (ADAMS Accession No. ML040300694).
CLINTON                              B 3.7-21                  Revision No. 14-2

Control Room AC System B 3.7.4 B 3.7   PLANT SYSTEMS B 3.7.4   Control Room Air Conditioning (AC) System BASES BACKGROUND         The Control Room AC System provides temperature control for the control room.
The Control Room AC System consists of two independent, redundant subsystems that provide cooling, heating, and humidification of recirculated control room air. Each subsystem consists of heating coils, a humidification boiler, cooling coils, fans, chillers, compressors, ductwork, dampers, and instrumentation and controls to provide for control room temperature control.
The Control Room AC System is designed to provide a controlled environment under both normal and accident conditions. The Control Room AC System operation in maintaining the control room temperature is discussed in the USAR, Sections 6.4 and 9.4.1 (Refs. 1 and 2, respectively).
APPLICABLE         The design basis of the Control Room AC System is to SAFETY ANALYSES    maintain the control room temperature for a 30 day continuous occupancy.
The Control Room AC System components are arranged in redundant safety related subsystems. During emergency operation, the Control Room AC System maintains a habitable environment and ensures the OPERABILITY of components in the control room. A single active failure of a component of the Control Room AC System, assuming a loss of offsite power, does not impair the ability of the system to perform its design function. Redundant detectors and controls are provided for control room temperature control. The Control Room AC System is designed in accordance with Seismic Category I requirements. The Control Room AC System is (continued)
CLINTON                              B 3.7-22                 Revision No. 14-2

Control Room AC System B 3.7.4 BASES APPLICABLE      capable of removing sensible and latent heat loads from the SAFETY ANALYSES control room, including consideration of equipment (continued)   heat loads and personnel occupancy requirements to ensure equipment OPERABILITY.
The Control Room AC System satisfies Criterion 3 of the NRC Policy Statement.
LCO             Two independent and redundant subsystems of the Control Room AC System are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other subsystem. Total system failure could result in the equipment operating temperature exceeding limits.
The Control Room AC System is considered OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in both subsystems. These components include the cooling coils, fans, chillers, compressors, ductwork, dampers, and associated instrumentation and controls. The heating coils and humidification equipment are not required for Control Room AC System OPERABILITY.
APPLICABILITY   In MODE 1, 2, or 3, the Control Room AC System must be OPERABLE to ensure that the control room temperature will not exceed equipment OPERABILITY limits.
In MODES 4 and 5, the probability and consequences of a Design Basis Accident are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the Control Room AC System OPERABLE is not required in MODE 4 or 5, except during CORE ALTERATIONS and during movement of irradiated fuel assemblies in the primary or secondary containment.
(continued)
CLINTON                           B 3.7-23                 Revision No. 20-2

Control Room AC System B 3.7.4 BASES   (continued)
ACTIONS             A.1 With one control room AC subsystem inoperable, the inoperable control room AC subsystem must be restored to OPERABLE status within 30 days. With the unit in this condition, the remaining OPERABLE control room AC subsystem is adequate to perform the control room air conditioning function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in loss of the control room air conditioning function. The 30 day Completion Time is based on the low probability of an event occurring requiring Control Room Ventilation System operation in the high radiation mode, the consideration that the remaining subsystem can provide the required protection, and the availability of alternate cooling methods.
B.1 and B.2 If both control room AC subsystems are inoperable, the Control Room AC System may not be capable of performing its intended function. Therefore, the control room area temperature is required to be monitored to ensure that temperature is being maintained low enough that equipment in the control room is not adversely affected. With the control room temperature being maintained within the temperature limit, 7 days is allowed to restore a control room AC subsystem to OPERABLE status. This Completion Time is reasonable considering that the control room temperature is being maintained within limits, the low probability of an event occurring requiring control room isolation, and the availability of alternate cooling methods.
C.1 In MODE 1, 2, or 3, if the control room area temperature cannot be maintained d 86oF or if the inoperable control room AC subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE that minimizes overall plant risk. To achieve this status the unit must be placed in at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref.
: 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
(continued)
CLINTON                              B 3.7-24                  Revision No. 14-2

Control Room AC System B 3.7.4 BASES   (continued)
ACTIONS             C.1  (continued)
Required Action C.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
(continued)
CLINTON                              B 3.7-25                  Revision No. 14-2

Control Room AC System B 3.7.4 BASES ACTIONS       D.1, D.2.1, and D.2.2 (continued)
The Required Actions of Condition D are modified by a Note indicating that LCO 3.0.3 does not apply.
If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.
During movement of irradiated fuel assemblies in the primary or secondary containment or during CORE ALTERATIONS, if Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE control room AC subsystem may be placed immediately in operation.
This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent actuation will occur, and that any active failure will be readily detected.
An alternative to Required Action D.1 is to immediately suspend activities that present a potential for releasing radioactivity that might require operation of the Control Room Ventilation System in the high radiation mode. This places the unit in a condition that minimizes risk.
If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
E.1 and E.2 The Required Actions of Condition E.1 are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.
Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.
(continued)
CLINTON                        B 3.7-26                  Revision No. 20-2

Control Room AC System B 3.7.4 BASES ACTIONS      E.1 and E.2  (continued)
During movement of irradiated fuel assemblies in the primary or secondary containment, during CORE ALTERATIONS, if the Required Action and associated Completion Time of Condition B is not met, action must be taken to immediately suspend activities that present a potential for releasing radioactivity that might require operation of the Control Room Ventilation System in the high radiation mode. This places the unit in a condition that minimizes risk.
If applicable, CORE ALTERATIONS and handling of irradiated fuel in the primary and secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position.
SURVEILLANCE SR  3.7.4.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to remove the control room heat load assumed in the safety analysis. The SR consists of a combination of testing and calculation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to heat removal capability values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).
REFERENCES   1. USAR, Section 6.4.
: 2. USAR, Section 9.4.1.
: 3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 4. Calculation IP-0-0102.
CLINTON                       B 3.7-27                  Revision No. 20-2

Main Condenser Offgas B 3.7.5 B 3.7   PLANT SYSTEMS B 3.7.5   Main Condenser Offgas BASES BACKGROUND         During unit operation, steam from the low pressure turbine is exhausted directly into the condenser. Air and noncondensible gases are collected in the condenser, then exhausted through the steam jet air ejectors (SJAEs) to the Main Condenser Offgas System. The offgas from the main condenser normally includes radioactive gases.
The Main Condenser Offgas System has been incorporated into the unit design to reduce the gaseous radwaste emission.
This system uses a catalytic recombiner to recombine radiolytically dissociated hydrogen and oxygen. The gaseous mixture is cooled by the cooler condenser; the water and condensibles are stripped out by the cooler condenser. The radioactivity of the remaining gaseous mixture (i.e., the offgas recombiner effluent) is monitored downstream of the cooler condenser prior to entering the dessicant dryers and charcoal adsorbers.
APPLICABLE         The main condenser offgas radioactivity rate is an SAFETY ANALYSES    initial condition of the Main Condenser Offgas System failure event as discussed in the USAR, Section 15.7.1 (Ref. 1). The analysis assumes a gross failure in the Main Condenser Offgas System that results in the rupture of the Main Condenser Offgas System pressure boundary. The radioactivity rate is controlled to ensure that during the event, the calculated offsite doses will be well within the limits (NUREG-0800, Ref. 2) of 10 CFR 100 (Ref. 3), or the NRC staff approved licensing basis.
The main condenser offgas limits satisfy Criterion 2 of the NRC Policy Statement.
LCO                To ensure compliance with the assumptions of the Main Condenser Offgas System failure event (Ref. 1), the fission product release rate should be consistent with a noble gas release to the reactor coolant of 100 PCi/MWt-second after decay of 30 minutes. The LCO is conservatively established at 2894 MWt x 100 PCi/MWt-second = 289 mCi/second.
(continued)
CLINTON                             B 3.7-28                  Revision No. 14-2

Main Condenser Offgas B 3.7.5 BASES   (continued)
APPLICABILITY       The LCO is applicable when steam is being exhausted to the main condenser and the resulting noncondensibles are being processed via the Main Condenser Offgas System. This occurs during MODE 1, and during MODES 2 and 3 with any main steam line not isolated and the SJAE in operation. In MODES 4 and 5, steam is not being exhausted to the main condenser and the requirements are not applicable.
ACTIONS             A.1 If the offgas radioactivity rate limit is exceeded, 72 hours is allowed to restore the gross gamma activity rate to within the limit. The 72 hour Completion Time is reasonable, based on engineering judgment considering the time required to complete the Required Action, the large margins associated with permissible dose and exposure limits, and the low probability of a Main Condenser Offgas System rupture occurring.
B.1, B.2, and B.3 If the radioactivity rate is not restored to within the limits within the associated Completion Time, all main steam lines or the SJAE must be isolated. This isolates the Main Condenser Offgas System from the source of the radioactive steam. The main steam lines are considered isolated if at least one main steam isolation valve in each main steam line is closed, and at least one main steam line drain valve in each drain line is closed. The 12 hour Completion Time is reasonable, based on operating experience, to perform the actions from full power conditions in an orderly manner and without challenging unit systems.
An alternative to Required Actions B.1 and B.2 is to place the unit in a MODE in which the overall plant risk is minimized. To achieve this status, the unit must be placed (continued)
CLINTON                               B 3.7-29                 Revision No. 14-2

Main Condenser Offgas B 3.7.5 BASES ACTIONS           B.1, B.2, and B.3 (continued) in at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 4) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
Required Action B.3 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE      SR  3.7.5.1 and SR  3.7.5.2 REQUIREMENTS SR 3.7.5.2 requires an isotopic analysis of an offgas sample to ensure that the required limits are satisfied. The noble gases to be sampled are Xe-133, Xe-135, Xe-138, Kr-85m, Kr-87, and Kr-88 (Ref. 5). If the measured release rate of radioactivity increases significantly (by t 50% after correcting for expected increases due to changes in THERMAL POWER), an isotopic analysis is also performed within 4 hours after the increase is noted, as required by SR 3.7.5.1, to ensure that the increase is not indicative of a sustained increase in the radioactivity rate. The required isotopic analysis is intended to support determination of the cause for the increase in offgas radiation release rates, such as the onset of leakage from a fuel pin(s).
However, there are certain evolutions (e.g., swapping of the steam jet air ejectors and regeneration of the offgas system desiccant dryers) which are known to result in a predictable and (continued)
CLINTON                            B 3.7-30                  Revision No. 14-2

Main Condenser Offgas B 3.7.5 BASES SURVEILLANCE SR  3.7.5.1 and SR  3.7.5.2  (continued)
REQUIREMENTS temporary increase in the indicated offgas radioactivity release rate. These indicated increases in offgas radioactivity release rates can be caused solely by increases in offgas flow. Since these increases are due to an evolution(s) known to cause such an increase and not due to an actual increase in the "nominal steady state fission gas release rate," isotopic analysis of an offgas sample is not required for these evolutions. In any of these cases, it is prudent to ensure that the offgas radiation level (radioactivity release rate) returns to previous or expected levels within four hours or as soon as possible following the evolution. This will confirm that there are no other causes for the increase in the radioactivity release rate indication. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.5.2 is modified by a Note indicating that the SR is not required to be performed until 31 days after any main steam line is not isolated and the SJAE is in operation.
Only in this condition can radioactive fission gases be in the Main Condenser Offgas System at significant rates.
With regard to radioactivity rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 6).
REFERENCES   1. USAR, Section 15.7.1.
: 2. NUREG-0800.
: 3. 10 CFR 100.
: 4. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 5. NEDE-24810, "Station Nuclear Engineering," Volume 1A.
: 6. Calculation IP-0-0103.
CLINTON                       B 3.7-31                   Revision No. 14-2

Main Turbine Bypass System B 3.7.6 B 3.7   PLANT SYSTEMS B 3.7.6   Main Turbine Bypass System BASES BACKGROUND         The Main Turbine Bypass System is designed to control steam pressure when reactor steam generation exceeds turbine requirements during unit startup, sudden load reduction, and cooldown. It allows excess steam flow from the reactor to the condenser without going through the turbine. The bypass capacity of the system is 28.8% of the Nuclear Steam Supply System rated steam flow. Sudden load reductions within the capacity of the steam bypass can be accommodated without reactor scram. The Main Turbine Bypass System consists of two valve chests (each with three bypass valves) connected to the main steam lines between the main steam isolation valves and the turbine stop valves. Each of the bypass valves is sequentially operated by hydraulic cylinders. The bypass valves are controlled by the pressure regulation function of the Turbine Electro Hydraulic Control System, as discussed in the USAR, Section 7.7.1.5 (Ref. 1). The bypass valves are normally closed, and the pressure regulator controls the turbine control valves, directing all steam flow to the turbine. If the speed governor or the load limiter restricts steam flow to the turbine, the pressure regulator controls the system pressure by opening the bypass valves. When the bypass valves open, the steam flows from the bypass chests, through connecting piping, to the main condenser.
APPLICABLE         The Main Turbine Bypass System is assumed to function during SAFETY ANALYSES    the design basis feedwater controller failure, maximum demand event, described in the USAR, Section 15.1.2 (Ref. 2). Opening the bypass valves during the pressurization event mitigates the increase in reactor vessel pressure, which affects the MCPR and LHGR during the event. An inoperable Main Turbine Bypass System may result in reactor power limitations and MCPR and LHGR penalties.
An inoperable MTBS is defined as one or more bypass valves being inoperable.
The Main Turbine Bypass System satisfies Criterion 3 of the NRC Policy Statement.
LCO                The Main Turbine Bypass System is required to be OPERABLE to limit peak pressure in the main steam lines and maintain reactor pressure within acceptable limits during events that cause rapid pressurization, such that the Safety Limit MCPR (continued)
CLINTON                              B 3.7-32                 Revision No. 14-3

Main Turbine Bypass System B 3.7.6 BASES LCO           is not exceeded. With an inoperable Main Turbine Bypass (continued) System, reactor power may be limited in accordance with the cycle-dependent COLR and modification to MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") AND LHGR limits (LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)") may be applied in accordance with the cycle-dependent COLR to allow continued operation. An OPERABLE Main Turbine Bypass System requires the bypass valves to open in response to increasing main steam line pressure. This response is within the assumptions of the applicable analysis (Ref. 2).
The reactor power limitations and the MCPR and LHGR limits for an inoperable Main Turbine Bypass System are specified in the COLR.
APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at t 21.6% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated during the feedwater controller failure, maximum demand event. As discussed in the Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," sufficient margin to these limits exists
              < 21.6% RTP. Therefore, these requirements are only necessary when operating at or above this power level.
ACTIONS       A.1 If the Main Turbine Bypass System is inoperable (one or more bypass valves inoperable), and the reactor power limit for an inoperable Main Turbine Bypass System, and the MCPR and LHGR limits for an inoperable Main Turbine Bypass System, as specified in the COLR, are not applied, the assumptions of the design basis transient analysis may not be met. Under such circumstances, prompt action should be taken to restore the Main Turbine Bypass System to OPERABLE status or limit reactor power and apply the MCPR and LHGR limits as specified in the COLR. The 2 hour Completion Time is reasonable, based on the time to complete the Required Action and the low probability of an event occurring during this period requiring the Main Turbine Bypass System.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
B.1 If the Main Turbine Bypass System cannot be restored to OPERABLE status within the associated Completion Time, or the reactor power limit for an inoperable Main Turbine (continued)
CLINTON                        B 3.7-33                  Revision No. 21-7

Main Turbine Bypass System B 3.7.6 BASES ACTIONS      B.1  (continued)
Bypass System, as specified in the COLR is not applied, and the MCPR and LHGH limits for an inoperable Main Turbine Bypass System, as specified in the COLR, are not applied within the associated Completion Time, THERMAL POWER must be reduced to < 21.6% RTP. As discussed in the Applicability section, section, operation at < 21.6% RTP results in sufficient margin to the required limits, and the Main Turbine Bypass System is not required to protect fuel integrity during the feedwater controller failure, maximum demand event. The 4 hour Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEILLANCE SR  3.7.6.1 REQUIREMENTS Cycling each main turbine bypass valve through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will function when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.7.6.2 The Main Turbine Bypass System is required to actuate automatically to perform its design function. This SR demonstrates that, with the required system initiation signals, the valves will actuate to their required position.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR  3.7.6.3 This SR ensures that the TURBINE BYPASS SYSTEM RESPONSE TIME is in compliance with the assumptions of the appropriate safety analysis. The response time limits (bypass valve begins to open in d 0.1 seconds and 80% of turbine bypass system capacity is established in d 0.3 seconds) are specified in applicable surveillance test procedures. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to TURBINE BYPASS SYSTEM RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).
(continued)
CLINTON                       B 3.7-34                  Revision No. 21-7

Main Turbine Bypass System B 3.7.6 BASES   (continued)
REFERENCES          1. USAR, Section 7.7.1.5.
: 2. USAR, Section 15.1.2.
: 3. Calculation IP-0-0104.
CLINTON                       B 3.7-35                 Revision No. 14-3

Fuel Pool Water Level B 3.7.7 B 3.7   PLANT SYSTEMS B 3.7.7   Fuel Pool Water Level BASES BACKGROUND         The minimum water level in the spent fuel storage pool and upper containment fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident.
A general description of the spent fuel storage pool and upper containment fuel storage pool design is found in the USAR, Section 9.1.2 (Ref. 1). The assumptions of the fuel handling accident are found in the USAR, Section 15.7.4 (Ref. 2).
APPLICABLE         The water level above the irradiated fuel assemblies is an SAFETY ANALYSES    explicit assumption of the fuel handling accident. A fuel handling accident is evaluated to ensure that the radiological consequences (calculated whole body and thyroid doses at the exclusion area and low population zone boundaries) are d 25% (NUREG-0800, Section 15.7.4, Ref. 3) of the 10 CFR 100 (Ref. 4) exposure guidelines. A fuel handling accident could release a fraction of the fission product inventory by breaching the fuel rod cladding as discussed in the Regulatory Guide 1.25 (Ref. 5).
The fuel handling accident is evaluated for the dropping of an irradiated fuel assembly onto stored fuel bundles. The consequences of a fuel handling accident inside the fuel building and inside containment are documented in Reference 2. The water levels in the spent fuel storage pool and upper containment fuel storage pool provide for absorption of water soluble fission product gases and transport delays of soluble and insoluble gases that must pass through the water before being released to the primary or secondary containment atmosphere, as applicable. This absorption and transport delay reduces the potential radioactivity of the release during a fuel handling accident.
The fuel pool water level satisfies Criterion 2 of the NRC Policy Statement.
(continued)
CLINTON                              B 3.7-36                 Revision No. 14-3

Fuel Pool Water Level B 3.7.7 BASES   (continued)
LCO                 The specified water level preserves the assumption of the fuel handling accident analysis (Ref. 2). As such, it is the minimum required for fuel movement within the spent fuel storage pool and upper containment fuel storage pool.
APPLICABILITY       This LCO applies whenever movement of irradiated fuel assemblies occurs in the associated fuel storage racks since the potential for a release of fission products exists.
ACTIONS             A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not a sufficient reason to require a reactor shutdown.
When the initial conditions for an accident cannot be met, steps should be taken to preclude the accident from occurring. With either fuel pool level less than required, the movement of irradiated fuel assemblies in the associated storage pool is suspended immediately. Suspension of this activity shall not preclude completion of movement of an irradiated fuel assembly to a safe position. This effectively precludes a spent fuel handling accident from occurring in the associated fuel storage pool.
SURVEILLANCE        SR  3.7.7.1 REQUIREMENTS This SR verifies that sufficient water is available in the event of a fuel handling accident. The water level in the spent fuel storage pool and upper containment fuel storage pool must be checked periodically. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to fuel pool water level values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 6).
(continued)
CLINTON                              B 3.7-37                  Revision No. 14-3

Fuel Pool Water Level B 3.7.7 BASES   (continued)
REFERENCES          1. USAR, Section 9.1.2.
: 2. USAR, Section 15.7.4.
: 3. NUREG-0800, Section 15.7.4, Revision 1, July 1981.
: 4. 10 CFR 100.
: 5. Regulatory Guide 1.25, March 1972.
: 6. Calculation IP-0-0105.
CLINTON                            B 3.7-38                  Revision No. 14-3

AC Sources  Operating B 3.8.1 3.8   ELECTRICAL POWER SYSTEMS B 3.8.1   AC Sources  Operating BASES BACKGROUND         The unit Class 1E AC Electrical Power Distribution System AC sources consist of the offsite power sources and the onsite standby power sources (diesel generators (DGs) 1A, 1B, and 1C). As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1),
the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.
The Class 1E AC distribution system supplies electrical power to three divisional load groups, with each division powered by an independent Class 1E 4.16 kV ESF bus (refer to LCO 3.8.9, "Distribution Systems  Operating"). Each ESF bus has two separate and independent offsite sources of power.
Each ESF bus has a dedicated onsite DG. The ESF systems of any two of the three divisions provide for the minimum safety functions necessary to shut down the unit and maintain it in a safe shutdown condition.
Offsite power is supplied to the switchyard from the transmission network. From the switchyard one 345 kV circuit provides AC power to each 4.16 kV ESF bus. An electrically and physically independent 138 kV power source provides a second completely independent circuit to each 4.16 kV ESF bus. The offsite AC electrical power sources are designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A detailed description of the offsite power network and circuits to the onsite Class 1E ESF buses is found in USAR, Chapter 8 (Ref. 2).
An offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1E ESF bus(es). An onsite, permanently installed static VAR compensator (SVC) is also available for connection to the offsite circuit to support required voltage for the ESF busses.
The onsite standby power source for each 4.16 kV ESF bus is a dedicated DG. A DG starts automatically on loss of coolant accident (LOCA) signal (i.e., low reactor water (continued)
CLINTON                              B 3.8-1                    Revision No. 3-5

AC Sources  Operating B 3.8.1 BASES BACKGROUND      level signal or high drywell pressure signal) or on an ESF (continued)   bus degraded voltage or undervoltage signal (refer to LCO 3.3.8.1, "Loss of Power (LOP) Instrumentation").
In the event of a loss of offsite power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a LOCA.
Ratings for DGs satisfy the requirements of Regulatory Guide 1.9 (Ref. 3). The continuous service rating is 3869 kW for DG 1A, 3875 kW for DG 1B, and 2200 kW for DG 1C, each with 10% overload permissible for up to 2 hours in any 24 hour period.
APPLICABLE      The initial conditions of DBA and transient analyses in the SAFETY ANALYSES USAR, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.
The OPERABILITY of the AC electrical power sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit as discussed in Reference 2. This includes maintaining the onsite or offsite AC sources OPERABLE during accident conditions in the event of:
: a. An assumed loss of all offsite power or all onsite AC power; and
: b. A worst case single failure.
AC sources satisfy the requirements of Criterion 3 of the NRC Policy Statement.
(continued)
CLINTON                           B 3.8-2                      Revision No. 0

AC Sources  Operating B 3.8.1 BASES   (continued)
LCO                 Two qualified circuits between the offsite transmission network and the onsite Class 1E Distribution System and three separate and independent DGs (1A, 1B, and 1C), ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA.
Qualified offsite circuits are those that are described in the USAR and are part of the licensing basis for the unit.
Each offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the ESF buses. Each offsite circuit consists of incoming breaker and disconnect to the respective reserve auxiliary transformer (RAT) or emergency reserve auxiliary transformer (ERAT) and the respective circuit path including feeder breakers to each of the 4.16 kV ESF buses. An onsite, permanently installed SVC is also available for connection to each offsite circuit to support required voltage for the ESF busses. Connection of the SVCs to the offsite circuits is via circuit breakers to the secondary side of the RAT and/or ERAT.
Connection and operation of the SVCs is dictated by the existing need for voltage support of the offsite electrical power sources based on prevailing grid conditions. Thus, OPERABILITY of the offsite electrical power sources is normally supported by, but is not necessarily dependent on, connection and operation of the SVCs. The resultant impact on OPERABILITY of the offsite electrical sources from disconnecting the SVCs from the offsite circuits can be determined by analysis based on use of an established model of the offsite transmission network and existing grid conditions, including available generating sources, which can be updated on a daily or more frequent basis. The model provides the capability to predict or determine what the onsite voltages would be at the RAT and/or ERAT (while connected to the offsite electrical sources) in the event of a DBA LOCA, including consideration of the loss of grid voltage support that would occur with a plant trip.
(continued)
CLINTON                               B 3.8-3                   Revision No. 3-5

AC Sources  Operating B 3.8.1 BASES LCO               Each DG must be capable of starting, accelerating to rated (continued)     speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby with engine hot and DG in standby with engine at ambient conditions. Additional DG capabilities must be demonstrated to meet required Surveillances, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode.
Proper sequencing of loads, including tripping of nonessential loads, is a required function for DG 1A and DG 1B OPERABILITY.
The AC sources in one division must be separate and independent (to the extent possible) of the AC sources in the other division(s). For the DGs, the separation and independence are complete. For the offsite AC sources, the separation and independence are to the extent practical. A circuit may be connected to more than one ESF bus, with fast transfer capability to the other circuit OPERABLE, and not violate separation criteria. A circuit that is not connected to an ESF bus is required to have fast transfer capability for the circuit to be considered OPERABLE.
APPLICABILITY     The AC sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
(continued)
CLINTON                             B 3.8-4                   Revision No. 5-9

AC Sources  Operating B 3.8.1 BASES APPLICABILITY A Note has been added taking exception to the Applicability (continued) requirements for Division 3 sources, provided the HPCS System is declared inoperable. This exception is intended to allow declaring of the HPCS System inoperable either in lieu of declaring the Division 3 source inoperable, or at any time subsequent to entering ACTIONS for an inoperable Division 3 source. This exception is acceptable since, with the HPCS System inoperable and the associated ACTIONS entered, the Division 3 AC sources provide no additional assurance of meeting the above criteria.
AC power requirements for MODES 4 and 5 are covered in LCO 3.8.2, "AC Sources  Shutdown."
ACTIONS       A Note prohibits the application of LCO 3.0.4.b to an inoperable DG. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
A.1 To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in the Required Action not met. However, if a second circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.
(continued)
CLINTON                         B 3.8-5                  Revision No. 21-7

AC Sources  Operating B 3.8.1 BASES ACTIONS       A.2 (continued)
According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E distribution system.
The Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.
B.1 To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.
(continued)
CLINTON                         B 3.8-6                  Revision No. 21-7

AC Sources  Operating B 3.8.1 BASES ACTIONS       B.2 (continued)
Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single division systems are not included, although, for this Required Action, Division 3 is considered redundant to Division 1 and 2 Emergency Core Cooling System (ECCS)).
Redundant required features failures consist of inoperable features associated with a division redundant to the division that has an inoperable DG.
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."
In this Required Action, the Completion Time only begins on discovery that both:
: a. An inoperable DG exists; and
: b. A required feature on another division is inoperable.
If, at any time during the existence of this Condition (one DG inoperable), a required feature subsequently becomes inoperable, this Completion Time begins to be tracked.
Discovering one required DG inoperable coincident with one or more required support or supported features, or both, that are associated with the OPERABLE DG(s), results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.
(continued)
CLINTON                         B 3.8-7                   Revision No. 3-5

AC Sources  Operating B 3.8.1 BASES ACTIONS B.2  (continued)
The remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period.
B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG(s), SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DG(s), the other DG(s) are declared inoperable upon discovery, and Condition E and potentially Condition G of LCO 3.8.1 is entered. Once the failure is repaired, and the common cause failure no longer exists, Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s),
performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of those DG(s).
In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the Corrective Action Program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour constraint imposed while in Condition B.
If while a DG is inoperable, a new problem with the DG is discovered that would have prevented the DG from performing its specified safety function, a separate entry into Condition B is not required. The new DG problem should be addressed in accordance with the Corrective Action Program.
According to Generic Letter 84-15 (Ref. 7), 24 hours is reasonable time to confirm that the OPERABLE DG(s) are not affected by the same problem as the inoperable DG.
(continued)
CLINTON                   B 3.8-8                  Revision No. 20-4

AC Sources  Operating B 3.8.1 BASES ACTIONS       B.4 (continued)
In Condition B, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E distribution system. Although Condition B applies to a single inoperable DG, several Completion Times are specified for this Condition.
The first Completion Time applies to an inoperable Division 3 DG. The 72-hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA during this period. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time begins only upon discovery of an inoperable Division 3 DG and, as such, provides an exception to the normal time zero for beginning the allowed outage time clock (i.e., for beginning the clock for an inoperable Division 3 DG when Condition B may have already been entered for another equipment inoperability and is still in effect).
The second Completion Time (14 days) applies to an inoperable Division 1 or 2 DG and is a risk-informed allowed out-of-service time (AOT) based on a plant-specific risk analysis performed to establish this AOT for the Division 1 and 2 DGs.
The evaluation that supports this Completion Time considered both planned and unplanned DG outage time. Based on this evaluation, it is intended that use of the full, 14-day completion time would be limited to once per DG per cycle (24 months) to perform a planned DG overhaul.
To mitigate increased risk during the period beyond 72 hours and up to 14 days, the following actions must be completed prior to exceeding 72 hours:
x Verification that the RAT and ERAT are operable.
x Verification of the correct breakers alignment and indicated power availability for each offsite circuit.
(continued)
CLINTON                         B 3.8-9                  Revision No. 21-7

AC Sources  Operating B 3.8.1 BASES ACTIONS B.4   (continued) x  The DG extended Completion Time will not be entered for scheduled maintenance purposes if severe weather conditions are expected.
x  Additional elective equipment maintenance or testing that requires the equipment to be removed from service will be evaluated and activities that yield unacceptable results will be avoided.
x  The condition of the offsite power supply and switchyard, including transmission lines and ring bus breakers, will be evaluated.
x  No elective maintenance will be scheduled within the switchyard that would challenge the RAT connection or offsite power availability.
x  Operating crews will be briefed on the DG work plan with consideration given to actions that would be required in the event of a loss of offsite power or station blackout.
Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
C.1 and C.2 Required Action C.1 addresses actions to be taken in the event of concurrent failure of redundant required features.
Required Action C.1 reduces the vulnerability to a loss of function. The rationale for the 12 hours is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours for two required offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE.
When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours is appropriate. These features are designed with redundant safety related divisions (i.e.,
single division systems are not included in the list, although, for this Required Action, Division 3 is considered redundant to Division 1 and 2 ECCS). Redundant required features failures consist of any of these features that are inoperable, because any inoperability is on a division redundant to a division with inoperable offsite circuits.
(continued)
CLINTON                   B 3.8-10                   Revision No. 21-7

AC Sources  Operating B 3.8.1 BASES ACTIONS C.1 and C.2   (continued)
The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:
: a. All offsite circuits are inoperable; and
: b. A required feature is inoperable.
If, at any time during the existence of this Condition (two offsite circuits inoperable), a required feature subsequently becomes inoperable, this Completion Time begins to be tracked.
According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition C for a period that should not exceed 24 hours. This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.
Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this degradation level:
: a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and (continued)
CLINTON                   B 3.8-10a                  Revision No. 3-5

AC Sources  Operating B 3.8.1 BASES ACTIONS C.1 and C.2   (continued)
: b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.
With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.
According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours. If two offsite sources are restored within 24 hours, unrestricted operation may continue. If only one offsite source is restored within 24 hours, power operation continues in accordance with Condition A. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
(continued)
CLINTON                   B 3.8-10b                Revision No. 21-7

AC Sources  Operating B 3.8.1 BASES ACTIONS       D.1 and D.2 (continued)
According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 12 hours. In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
E.1 With two DGs inoperable, there is one remaining standby AC source. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for the majority of ESF equipment at this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.
(continued)
CLINTON                        B 3.8-11                  Revision No. 21-7

AC Sources  Operating B 3.8.1 BASES ACTIONS E.1  (continued)
According to Regulatory Guide 1.93 (Ref. 6), with both DGs inoperable, operation may continue for a period that should not exceed 2 hours. This Completion Time assumes complete loss of onsite (DG) AC capability to power the minimum loads needed to respond to analyzed events. In the event Division 3 DG in conjunction with Division 1 or 2 DG is inoperable, with Division 1 or 2 remaining, a significant spectrum of breaks would be capable of being responded to with onsite power. Even the worst case event would be mitigated to some extent  an extent greater than a typical two division design in which this condition represents complete loss of onsite power function. Given the remaining function, a 24 hour Completion Time is appropriate. At the end of this 24 hour period, Division 3 systems could be declared inoperable (see Applicability Note) and this Condition could be exited with only one required DG remaining inoperable. However, with a Division 1 or 2 DG remaining inoperable and the HPCS declared inoperable, a redundant required feature failure exists, according to Required Action B.2.
F.1 If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the unit must be brought to MODE 3 within 12 hours.
Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 8) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
Required Action F.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
(continued)
CLINTON                  B 3.8-12                   Revision No. 13-2

AC Sources  Operating B 3.8.1 BASES ACTIONS        G.1 (continued)
Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.
(continued)
CLINTON                         B 3.8-13                  Revision No. 13-2

AC Sources  Operating B 3.8.1 BASES   (continued)
SURVEILLANCE      The AC sources are designed to permit inspection and testing REQUIREMENTS      of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, GDC 18 (Ref. 9). Periodic component tests are supplemented by extensive functional tests during refueling outages under simulated accident conditions. The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 (Refs. 3 and 16),
Regulatory Guide 1.108 (Ref. 10), and Regulatory Guide 1.137 (Ref. 11).
Where the SRs discussed herein specify voltage and frequency tolerances, the minimum and maximum steady state output voltages of 4084 V and 4300 V respectively, are equal to
                  - 2% and + 3.37% of the nominal 4160 V output voltage. The specified minimum and maximum frequencies of the DG is 58.8 Hz and 61.2 Hz, respectively, are equal to +/- 2% of the 60 Hz nominal frequency. The specified steady state voltage and frequency ranges are derived from the recommendations given in Regulatory Guide 1.9 (Ref. 3). However, the minimum voltage was increased to ensure adequate voltage to operate all safety-related loads during a DBA (Ref. 15).
Analyses in References 26, 27, and 28 specify that the maximum acceptable voltage on the 4.16 kV safety-related buses is 4454 V for 30 minutes and 4300 V for continuous operation. These analyses evaluated the effects of the overvoltage condition on the connected loads in the 120 V distribution panels and determined that continuous operation above 4300 V on the 4.16 kV 1E buses would result in voltages above allowable for certain 120 V devices. The analyses allow for elevated voltages up to 4454 V for 30 minutes to account for overvoltage conditions that can occur if the Reserve Auxiliary Transformer Static VAR Compensator trips coincident with high 345 kV transmission system voltages. The 30-minute duration was considered sufficient time to restore 4.16 kV voltages to within specification without damaging downstream AC loads.
In general, surveillances performed for each of the required DGs are similar, with one notable difference due to the fact that the Division 3 DG utilizes a mechanical governor, while the Division 1 and 2 DGs utilize an electronic governor. As such, the Division 1 and 2 DGs are capable of operating in both an isochronous mode as well as a droop mode for when the DGs are paralleled to the offsite source during testing.
The Division 3 DG, on the other hand, is capable of operating only in the droop mode (through a droop setting of zero can be utilized). This difference may affect the Division 3 DGs capability to achieve rated frequency following automatic switchover from the test mode to ready-to-load operation upon receipt of a LOCA initiation signal (as verified per SR 3.8.1.17).
(continued)
CLINTON                            B 3.8-13a                 Revision No. 15-1

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE  For the Division 1 and 2 DGs, DG operation is returned to REQUIREMENTS  the isochronous mode upon switchover such that rated (continued) speed/frequency is automatically attained. For the Division 3 DG, however, with the DG governor initially operating in the droop condition during the test mode, operator action may be required to reset the governor for ready-to-load operation at the required frequency. This difference is acknowledged in the Bases for SR 3.8.1.17 to address compliance with that SR. Notwithstanding, the condition also requires the Division 3 DG to be considered inoperable if it cannot be ensured that the required frequency would be attained in the event of a LOCA and a loss of offsite power concurrent with the Division 3 DG being operated or tested with the existing droop setting in effect. Thus, the Division 3 DG is generally considered inoperable while the droop setting is in effect during the performance of SRs that require the DG to be paralleled to the offsite source.
SR  3.8.1.1 This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source and that appropriate independence of offsite circuits is maintained.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.1.2 and SR 3.8.1.7 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and maintain the unit in a safe shutdown condition.
To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs have been modified by Notes (the Note for SR 3.8.1.7 and Note 2 for SR 3.8.1.2) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading.
(continued)
CLINTON                        B 3.8-13b                 Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 (continued)
REQUIREMENTS For the purposes of this testing, the DGs are started from standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures. For the purposes of these SRs, the DG may be started using a manual start signal, a simulated loss of offsite power test signal by itself, a simulated loss of offsite power test signal in conjunction with an ECCS actuation test signal, or an ECCS actuation test signal by itself.
In order to reduce stress and wear on diesel engines, the manufacturer recommends that the starting speed of DGs be limited, that warmup be limited to this lower speed, and that DGs be gradually accelerated to synchronous speed prior to loading. These modified start procedures are the intent of Note 3, which is only applicable when such procedures are used.
SR 3.8.1.7 requires that the DG starts from standby conditions and achieves required voltage and frequency within 12 seconds. The 12 second start requirement supports the assumptions in the design basis LOCA analysis (Ref. 5).
The 12 second start requirement may not be applicable to SR 3.8.1.2 (see Note 3 of SR 3.8.1.2), when a modified start procedure as described above is used. If a modified start is not used, the 12 second start requirement of SR 3.8.1.7 applies. Since SR 3.8.1.7 does require a 12 second start, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2. This is the intent of Note 1 of SR 3.8.1.2. Similarly, the performance of SR 3.8.1.12 or SR 3.8.1.19 also satisfies the requirements of SR 3.8.1.2 and SR 3.8.1.7.
In addition to the SR requirements, the time for the DG to reach steady state operation, unless the modified DG start method is employed, is periodically monitored and the trend evaluated to identify degradation of governor and voltage regulator performance.
(continued)
CLINTON                       B 3.8-14                  Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7  (continued)
REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to required voltage and frequency values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties.
This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Refs. 17, 18, 19, 22, 23).
SR 3.8.1.3 This Surveillance demonstrates that the DGs are capable of synchronizing and accepting greater than or equal to the equivalent of the maximum expected accident loads. However, consistent with the recommendations of Regulatory Guide 1.9, Revision 3 (Ref. 16), this surveillance is performed with a DG load equal to or greater than 90 percent of its continuous rating. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.
Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation to ensure circulating currents are minimized.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                       B 3.8-15                  Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued)
REQUIREMENTS Note 1 modifies this Surveillance to indicate that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized.
Note 2 modifies this Surveillance by stating that momentary transients because of changing bus loads do not invalidate this test.
Note 3 indicates that this Surveillance shall be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.
Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.
With regard to DG loading values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 20).
SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the low level alarm setpoint.
The level is expressed as an equivalent volume in gallons, and is selected to ensure adequate fuel oil for a minimum of 1 hour of DG operation at maximum expected post LOCA loads.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to fuel oil level values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 21).
(continued)
CLINTON                       B 3.8-16                  Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE  SR 3.8.1.5 REQUIREMENTS (continued) Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Periodic removal of water from the fuel oil day tanks eliminates the necessary environment for bacterial survival. This is an effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is for preventive maintenance. The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of this Surveillance.
SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. It is required to support the continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.1.7 See SR 3.8.1.2.
(continued)
CLINTON                        B 3.8-17                  Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE  SR  3.8.1.8 REQUIREMENTS (continued) Transfer of each 4.16 kV ESF bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note. The reason for the Note is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems (The Note is not applicable to Division 3 AC Sources). Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this surveillance, for which adequate documentation of the required performance is available; and
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
SR  3.8.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject a load equivalent to at least as large as the largest single load while maintaining a specified margin to the overspeed trip.
(continued)
CLINTON                        B 3.8-18                  Revision No. 14-4

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE      SR  3.8.1.9  (continued)
REQUIREMENTS The referenced load for DG 1A is the low pressure core spray pump; for DG 1B, the residual heat removal (RHR) pump; and for DG 1C the HPCS pump. The Shutdown Service Water (SX) pump values are not used as the largest load since the SX supplies cooling to the associated DG. If this load were to trip, it would result in the loss of the DG. The use of larger loads for reference purposes is acceptable. This Surveillance may be accomplished by:
: 1)   Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest load while paralleled to offsite power, or while supplying the bus, or
: 2)   Tripping its associated single largest load with the DG supplying the bus.
As required by IEEE-308 (Ref. 14), the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous speed and the overspeed trip setpoint, or 15% above synchronous speed, whichever is lower.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR has been modified by two Notes. The intent of Note 1 is to indicate that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
___________________________________________________________________(continued)
CLINTON                            B 3.8-19                  Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR  3.8.1.9  (continued)
REQUIREMENTS
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, Note 2 requires that, if synchronized to offsite power, testing be performed using a power factor d 0.9.
This power factor is chosen to be representative of the actual design basis inductive loading that the DG could experience.
Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related (and non-safety related) distribution systems are aligned to the other offsite source (or unit auxiliary transformers). This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.
With regard to diesel speed values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 24).
SR 3.8.1.10 This Surveillance demonstrates the DG capability to reject a full load, i.e., maximum expected accident load, without overspeed tripping or exceeding the predetermined voltage limits. However, consistent with the recommendations of Regulatory Guide 1.9, Revision 3 (Ref. 16), this surveillance is performed with a DG load equal to or greater than 90 percent of its continuous rating.
The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions.
This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG does not trip upon loss of the load.
These acceptance criteria provide DG damage protection.
(continued)
CLINTON                       B 3.8-19a                 Revision No. 13-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR  3.8.1.10   (continued)
REQUIREMENTS While the DG is not expected to experience this transient during an event and continue to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.
In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, testing must be performed using a power factor d 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG would experience.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR has been modified by a Note. The intent of the Note is to indicate that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
: 2)    Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related (and non-safety related) distribution systems are aligned to the other offsite source (or unit auxiliary transformers). This minimizes the possibility of common cause failure resulting from offsite/grid voltage perturbations.
This Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite of grid perturbations.
With regard to DG load and voltage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 24).
(continued)
CLINTON                        B 3.8-19b                 Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE  SR  3.8.1.11 REQUIREMENTS (continued) As required by Regulatory Guide 1.108 (Ref. 10),
paragraph 2.a.(1), this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the Division 1 and 2 nonessential loads and energization of the emergency buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.
With regard to required voltage and frequency values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties.
This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Refs. 17, 18, 19).
The DG auto-start time of 12 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The  Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.
With regard to DG auto-start time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 22).
The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, ECCS injection valves are not desired to be stroked open, systems are not capable of being operated at (continued)
CLINTON                        B 3.8-20                  Revision No. 13-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR  3.8.1.11  (continued)
REQUIREMENTS full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of the connection and loading of these loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems (Note 2 is not applicable to the Division 3 DG). Credit may be taken for unplanned events that satisfy this SR.
Examples of unplanned events may include:
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
(continued)
CLINTON                       B 3.8-21                  Revision No. 14-4

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE  SR  3.8.1.12 REQUIREMENTS (continued) This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (12 seconds) from the design basis actuation signal (LOCA signal) and operates for t 5 minutes.
The 5 minute period provides sufficient time to demonstrate stability.
With regard to DG start time, required voltage and frequency values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Refs. 17, 18, 19, 22, 23).
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures. The reason for Note 2 is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems (Note 2 is not applicable to the Division 3 DG). Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:
(continued)
CLINTON                        B 3.8-22                  Revision No. 14-4

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR  3.8.1.12  (continued)
REQUIREMENTS
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
SR  3.8.1.13 This Surveillance demonstrates that DG non-critical protective functions (e.g., high jacket water temperature) are bypassed on an ECCS initiation test signal and critical protective functions trip the DG to avert substantial damage to the DG unit. The non-critical trips are bypassed during DBAs and provide alarms on abnormal engine conditions.
These alarms provide the operator with necessary information to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
The SR is modified by a Note. The intent of the Note is to indicate that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and (continued)
CLINTON                       B 3.8-23                  Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR  3.8.1.13  (continued)
REQUIREMENTS
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
SR  3.8.1.14 Regulatory Guide 1.9, Revision 3 (Ref. 16) requires demonstration that the DGs can start and run continuously at or near full-load capability for an interval of not less than 24 hours. The DGs are to be loaded equal to or greater than 105 percent of the continuous rating for at least 2 hours and equal to or greater than 90 percent of the continuous rating for the remaining hours of the test (i.e.,
22 hours) (Ref. 16). The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.
In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, testing must be performed using a power factor d 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG could experience.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test. The intent of Note 2 is to indicate that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:
(continued)
CLINTON                       B 3.8-24                  Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR  3.8.1.14  (continued)
REQUIREMENTS
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related (and non-safety related) distribution systems are aligned to the other offsite source (or unit auxiliary transformers). This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.
With regard to DG loading capability values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 20).
SR  3.8.1.15 This Surveillance is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(5), and demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 12 seconds. The 12 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.
With regard to DG loading values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 20).
With regard to DG start time, frequency and voltage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Refs. 17, 18, 19, 22, 23).
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
__     (continued)
CLINTON                       B 3.8-25                  Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR  3.8.1.15  (continued)
REQUIREMENTS This SR has been modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The requirement that the diesel has operated for at least 2 hours at full load conditions (i.e., equal to or greater than 90 percent of the continuous rating) prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.
SR  3.8.1.16 As required by Regulatory Guide 1.108 (Ref. 10),
paragraph 2.a.(6), this Surveillance ensures that the manual synchronization and load transfer from the DG to each offsite power source can be made and that the DG can be returned to ready-to-load status when offsite power is restored. It also ensures that the undervoltage logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready-to-load status when the DG is at rated speed and voltage, the output breaker is open and can receive an auto-close signal on bus undervoltage, and the load sequence timers are reset.
Portions of the synchronization circuit are associated with the DG and portions with the offsite circuit. If a failure in the synchronization requirement of the Surveillance occurs, depending on the specific affected portion of the synchronization circuit, either the DG or the associated offsite circuit is declared inoperable.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                        B 3.8-26                 Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR  3.8.1.16  (continued)
REQUIREMENTS This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems (This Note is not applicable to the Division 3 DG). Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
SR  3.8.1.17 Demonstration of the test mode override is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 10),
paragraph 2.a.(8)and ensures that the DG availability under accident conditions is not compromised as the result of testing. Except as clarified below for the Division 3 DG, interlocks to the LOCA sensing circuits cause the DG to automatically reset to ready-to-load operation if an ECCS initiation signal is received during operation in the test mode. Ready-to-load operation is defined as the DG running at rated speed and voltage with the DG output breaker open.
These provisions for automatic switchover are required by IEEE-308 (Ref. 14), paragraph 6.2.6(2), as further amplified by IEEE 387, sections 5.6.1 and 5.6.2. (Clarification regarding conformance of the Division 3 DG design to these standards is provided in the USAR, Chapter 8 (Reference 2).)
Automatic switchover from the test mode to ready-to-load operation for the division 3 DG is also demonstrated, as described above, by ensuring that DG control logic automatically resets in response to a LOCA signal during the test mode and confirming that ready-to-load operation is attained (as evidenced by the DG running with the output breaker open). However, with the DG governor initially operating in a droop condition during the test mode, operator action may be required to reset the governor for (continued)
CLINTON                       B 3.8-27                  Revision No. 14-4

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR  3.8.1.17   (continued)
REQUIREMENTS ready-to-load operation in order to complete the surveillance for the Division 3 DG. Resetting the governor ensures that the DG will supply the Division 3 bus at the required frequency in the event of a LOCA and a loss of offsite power while the DG is in a droop condition during the test mode.
The requirement to automatically energize the emergency loads with offsite power is essentially identical to that of SR 3.8.1.12. The intent in the requirement associated with SR 3.8.1.17.b is to show that the emergency loading is not affected by the DG operation in test mode. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable.
This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR has been modified by a Note. The intent of this note is to indicate that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related (and non-safety related) distribution systems are aligned to the other offsite source (or unit auxiliary transformers). This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.
(continued)
CLINTON                        B 3.8-28                 Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE  SR  3.8.1.18 REQUIREMENTS (continued) Under accident conditions with a loss of offsite power, loads are sequentially connected to the bus by the load sequencing logic (except for Division 3 which has no load sequence timers). The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents.
The 10% load sequence time tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated and is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 10), paragraph 2.a.(2).
Reference 2 provides a summary of the automatic loading of ESF buses. The scope of SR 3.8.1.18 is limited to those DG loads listed in USAR Table 8.3-13, Item A (Reference 2).
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note. The reason for the Note is that performing the Surveillance during these MODES may perturb the electrical distribution system, and challenge plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
With regard to sequence time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 25).
(continued)
CLINTON                        B 3.8-29                  Revision No. 21-1

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE  SR  3.8.1.19 REQUIREMENTS (continued) In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.
This Surveillance demonstrates the DG operation, as discussed in the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal. For load shedding effected via shunt trips that are actuated in response to a LOCA signal (i.e., "ECCS initiation signal"), this surveillance includes verification of the shunt trips (for Divisions 1 and 2 only) in response to LOCA signals originating in the ECCS initiation logic as well as the Containment and Reactor Vessel Isolation and Control System actuation logic. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems (Note 2 is not applicable to the Division 3 DG).
Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:
(continued)
CLINTON                        B 3.8-30                  Revision No. 14-4

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR  3.8.1.19 (continued)
REQUIREMENTS
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
With regard to DG start time, required voltage and frequency values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Refs. 17, 18, 19, 22).
SR  3.8.1.20 This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures.
With regard to required voltage and frequency values obtained pursuant to this SR, as read from plant indication (continued)
CLINTON                       B 3.8-31                  Revision No. 20-7

AC Sources  Operating B 3.8.1 BASES SURVEILLANCE SR   3.8.1.20 (continued)
REQUIREMENTS instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties.
This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Refs. 17, 18, 19, 22, 23).
(continued)
CLINTON                       B 3.8-32                  Revision No. 14-2

AC Sources  Operating B 3.8.1 BASES (continued)
REFERENCES        1. 10 CFR 50, Appendix A, GDC 17.
: 2. USAR, Chapter 8.
: 3. Regulatory Guide 1.9, Revision 2.
: 4. USAR, Chapter 6.
: 5. USAR, Chapter 15.
: 6. Regulatory Guide 1.93.
: 7. Generic Letter 84-15, July 2, 1984.
: 8. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 9. 10 CFR 50, Appendix A, GDC 18.
: 10. Regulatory Guide 1.108.
: 11. Regulatory Guide 1.137.
: 12. ANSI C84.1, 1982.
: 13. NUMARC 87-00, Revision 1, August 1991.
: 14. IEEE Standard 308.
: 15. IP Calculation 19-AN-19.
: 16. Regulatory Guide 1.9, Revision 3.
: 17. Calculation IP-C-0050.
: 18. Calculation IP-C-0051.
: 19. Calculation IP-C-0054.
: 20. Calculation IP-0-0114.
: 21. Calculation IP-C-0111.
: 22. Calculation IP-0-0106.
: 23. Calculation IP-0-0143.
: 24. Calculation IP-0-0110.
: 25. Calculation IP-0-0116.
: 26. Calculation 19-AJ-74.
(continued)
CLINTON                           B 3.8-32a                  Revision No. 15-1

AC Sources  Operating B 3.8.1 BASES REFERENCES    27. Calculation 19-AK-06.
(continued)
: 28. Calculation 19-AK-13.
CLINTON                      B 3.8-32b      Revision No. 15-1

AC Sources  Shutdown B 3.8.2 B 3.8   ELECTRICAL POWER SYSTEMS B 3.8.2   AC Sources  Shutdown BASES BACKGROUND         A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC Sources  Operating."
APPLICABLE         The OPERABILITY of the minimum AC sources during MODES 4 SAFETY ANALYSES    and 5 and during movement of irradiated fuel assemblies in the primary and secondary containment ensures that:
: a. The unit can be maintained in the shutdown or refueling condition for extended periods;
: b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
: c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.
In general, when the unit is shut down the Technical Specifications (TS) requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or loss of all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no specific analyses in MODES 4 and 5. Worst case bounding events are deemed not credible in MODES 4 and 5 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence significantly reduced or eliminated, and minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCOs for required systems.
During MODES 1, 2, and 3, various deviations from the analysis assumptions and design requirements are allowed within the ACTIONS. This allowance is in recognition that (continued)
CLINTON                              B 3.8-33                  Revision No. 20-2

AC Sources  Shutdown B 3.8.2 BASES APPLICABLE      certain testing and maintenance activities must be conducted SAFETY ANALYSES provided an acceptable level of risk is not exceeded.
(continued)   During MODES 4 and 5, performance of a significant number of required testing and maintenance activities is also required. In MODES 4 and 5, the activities are generally planned and administratively controlled. Relaxations from typical MODE 1, 2, and 3 LCO requirements are acceptable during shutdown MODES based on:
: a. The fact that time in an outage is limited. This is a risk prudent goal as well as utility economic consideration.
: b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both.
: c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems.
: d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, and 3 OPERABILITY requirements) with systems assumed to function during an event.
In the event of an accident during shutdown, this LCO ensures the capability of supporting systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite (diesel generator (DG)) power.
The AC sources satisfy Criterion 3 of the NRC Policy Statement.
LCO             One offsite circuit capable of supplying onsite Class 1E power distribution subsystem(s) of LCO 3.8.10, "Distribution Systems  Shutdown," ensures that all required loads are powered from offsite power. An OPERABLE DG, associated with a Division 1 or Division 2 Distribution System Engineered Safety Feature (ESF) bus required OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide (continued)
CLINTON                           B 3.8-34                     Revision No. 0

AC Sources  Shutdown B 3.8.2 BASES LCO           electrical power support, assuming a loss of the offsite (continued) circuit. Similarly, when the high pressure core spray (HPCS) is required to be OPERABLE, a separate offsite circuit to the Division 3 Class 1E onsite electrical power distribution subsystem, or an OPERABLE Division 3 DG, ensure an additional source of power for the HPCS. Together, OPERABILITY of the required offsite circuit(s) and the ability to manually start a DG(s) ensures the availability of sufficient AC sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
The qualified offsite circuit(s) must be capable of maintaining rated frequency and voltage while connected to their respective ESF bus(es), and accepting required loads during an accident. Qualified offsite circuits are those that are described in the USAR and are part of the licensing basis for the plant. The offsite circuit consists of incoming breaker and disconnect to the respective reserve auxiliary transformer (RAT) or emergency reserve auxiliary transformer (ERAT), and the respective circuit path including feeder breakers to all 4.16 kV ESF buses required by LCO 3.8.10. In addition, an onsite, permanently installed static VAR compensator (SVC) is available for connection to the offsite circuits to support required voltage for the ESF busses. Connection of the SVC to the offsite circuit is via circuit breakers to the secondary side of the RAT and/or ERAT.
Connection and operation of the SVC(s) is dictated by the existing need for voltage support of the offsite electrical power source(s) based on prevailing grid conditions. Thus, OPERABILITY of the offsite electrical power source(s) is normally supported by, but is not necessarily dependent on, connection and operation of the SVC(s). The resultant impact on OPERABILITY of the offsite electrical source(s) from disconnecting the SVC(s) from the offsite circuit(s) can be determined by analysis based on use of an established model of the offsite transmission network and existing grid conditions, including available generating sources, which can be updated on a daily or more frequent basis. The model provides the capability to predict or determine what the onsite voltages would be at the RAT and/or ERAT (while connected to the offsite electrical sources) under maximum postulated load conditions.
(continued)
CLINTON                        B 3.8-35                  Revision No. 21-9

AC Sources  Shutdown B 3.8.2 BASES LCO           The required DG must be capable of being manually started, (continued) accelerating to rated speed and voltage, and connecting to its respective ESF bus, and accepting required loads.
It is acceptable for divisions to be cross tied during shutdown conditions, permitting a single offsite power circuit to supply all required AC electrical power distribution subsystems. No fast transfer capability is required for offsite circuits to be considered OPERABLE for this LCO.
As described in Applicable Safety Analyses, in the event of an accident during shutdown, the TS are designed to maintain the plant in a condition such that the plant will not be in immediate difficulty.
APPLICABILITY The AC sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment provide assurance that:
: a. Systems that provide core cooling are available;
: b. Systems needed to mitigate a fuel handling accident are available; (continued)
CLINTON                        B 3.8-36                  Revision No. 21-9

AC Sources  Shutdown B 3.8.2 BASES APPLICABILITY c. Systems necessary to mitigate the effects of events (continued)      that can lead to core damage during shutdown are available; and
: d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
The AC power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.1.
ACTIONS       The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require reactor shutdown.
A.1 A required offsite circuit is considered inoperable if no qualified circuit is supplying power to one required ESF division. If two or more ESF 4.16 kV buses are required per LCO 3.8.10, division(s) with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and movement of irradiated fuel. By the allowance of the option to declare required features inoperable which are not powered from offsite power, appropriate restrictions can be implemented in accordance with the required feature(s) LCOs' ACTIONS.
Required features remaining powered from offsite power (even though that circuit may be inoperable due to failing to power other features) are not declared inoperable by this Required Action.
A.2.1, A.2.2, A.2.3, B.1, B.2, and B.3 With the offsite circuit not available to all required divisions, the option still exists to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With the required DG inoperable, the minimum required diversity of AC (continued)
CLINTON                        B 3.8-37                  Revision No. 20-2

AC Sources  Shutdown B 3.8.2 BASES ACTIONS A.2.1, A.2.2, A.2.3, B.1, B.2, and B.3  (continued) power sources is not available. It is, therefore, required to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment.
Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.
These actions minimize probability of the occurrence of postulated events. It is further required to initiate action immediately to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the plant safety systems.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.
Pursuant to LCO 3.0.6, the Distribution System ACTIONS are not entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A have been modified by a Note to indicate that when Condition A is entered with no AC power to any required ESF bus, ACTIONS for LCO 3.8.10 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit whether or not a division is de-energized. LCO 3.8.10 provides the appropriate restrictions for the situation involving a de-energized division.
C.1 When the HPCS is required to be OPERABLE, and the additional required Division 3 AC source is inoperable, the required diversity of AC power sources to the HPCS is not available.
Since these sources only affect the HPCS, the HPCS is declared inoperable and the Required Actions of the affected Emergency Core Cooling Systems LCO entered.
In the event all sources of power to Division 3 are lost, Condition A will also be entered and direct that the ACTIONS of LCO 3.8.10 be taken. If only the Division 3 (continued)
CLINTON                  B 3.8-38                   Revision No. 21-2

AC Sources  Shutdown B 3.8.2 BASES ACTIONS      C.1   (continued) additional required AC source is inoperable, and power is still supplied to HPCS, 72 hours is allowed to restore the additional required AC source to OPERABLE. This is reasonable considering HPCS will still perform its function, absent an additional single failure.
SURVEILLANCE SR  3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, and 3. SR 3.8.1.8 is not required to be met since only one offsite circuit is required to be OPERABLE. SR 3.8.1.7, SR 3.8.1.11, SR 3.8.1.12, SR 3.8.1.13, SR 3.8.1.15, SR 3.8.1.18, and SR 3.8.1.19 are not required to be met because DG start and load within a specified time and response on an offsite power or ECCS initiation signal is not required. In MODES 4 and 5 ECCS injection/spray subsystems are manually controlled in accordance with LCO 3.5.2, "Reactor Pressure Vessel (RPV)
Water Inventory Control." No ECCS initiation signals are credited for initiation of these subsystems. Adequate time is available to manually start and load DGs from the Main Control Room in support of RPV inventory control, if required. Therefore, SR 3.8.1.12 and SR 3.8.1.19, which verify the DG's capability to start automatically on actual or simulated ECCS initiation signals, are not required to be met in MODES 4 and 5. SR 3.8.1.17 is not required to be met because the required OPERABLE DG(s) is not required to undergo periods of being synchronized to the offsite circuit. SR 3.8.1.20 is excepted because starting independence is not required with the DG(s) that is not required to be OPERABLE. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.
This SR is modified by a Note which precludes requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during the performance of SRs, and preclude de-energizing a required 4.16 kV ESF bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs must still be capable of being met, but actual performance is not required for any DG or offsite circuit.
REFERENCES   None.
CLINTON                        B 3.8-39                 Revision No. 21-9

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 B 3.8   ELECTRICAL POWER SYSTEMS B 3.8.3   Diesel Fuel Oil, Lube Oil, and Starting Air BASES BACKGROUND         Each diesel generator (DG) is provided with a storage tank having a fuel oil capacity sufficient to operate that DG for a period of 7 days while the DG is supplying maximum post loss of coolant accident load demand (Ref. 1). This onsite fuel oil capacity is sufficient to operate the DGs for longer than the time to replenish the onsite supply from outside sources.
Fuel oil is transferred from each storage tank to its respective day tank by a transfer pump associated with each storage tank. Redundancy of pumps and piping precludes the failure of one pump, or the rupture of any pipe, valve, or tank to result in the loss of more than one DG. All tanks, pumps, and piping are located within the DG building. The fuel oil level in the storage tank is indicated in the control room.
For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 3). The fuel oil properties governed by these SRs are the water and sediment content, the kinematic viscosity, specific gravity (or API gravity), and impurity level.
The DG lubrication system is designed to provide sufficient lubrication to permit proper operation of its associated DG under all loading conditions. The system is required to circulate the lube oil to the diesel engine working surfaces and to remove excess heat generated by friction during operation. Each engine oil sump contains an inventory capable of supporting a minimum of 7 days of operation.
This supply is sufficient to allow the operator to replenish lube oil from outside sources.
Each DG has an air start system with adequate capacity for five successive start attempts on the DG without recharging the air start receiver(s). The diesel generator starting systems for the Divisions I, II, and III diesel engines are independent and redundant for each division. Each DG starting system consists of two full-capacity air starting (continued)
CLINTON                             B 3.8-40                   Revision No. 3-2

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES BACKGROUND        subsystems. Each subsystem has a rated air capacity capable (continued)     of starting its respective engine set five times without recharging the associated air receiver. The rated air capacity is 93 ft3 at 250 psig for the Division I and II DGs and 64 ft3 at 240 psig for the Division III DG. All three DGs are capable of multiple successive starts without recharging the air receiver tank when the air receiver pressure is below the rated air pressure but above 200 psig.
APPLICABLE        The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES   transient analyses in USAR, Chapter 6 (Ref. 4) and Chapter 15 (Ref. 5), assume Engineered Safety Feature (ESF) systems are OPERABLE. The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, reactor coolant system, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.
Since diesel fuel oil, lube oil, and starting air subsystems support the operation of the standby AC power sources, they satisfy Criterion 3 of the NRC Policy Statement.
LCO               Stored diesel fuel oil is required to have sufficient supply for 7 days of full load, i.e., maximum expected post LOCA load, operation. It is also required to meet specific standards for quality. Additionally, sufficient lube oil supply must be available to ensure the capability to operate at full load for 7 days. This requirement, in conjunction with an ability to obtain replacement supplies within 7 days, supports the availability of DGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power. DG day tank fuel requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources  Operating," and LCO 3.8.2, "AC Sources 
Shutdown."
The starting air system is required to have a sufficient capacity for multiple DG start attempts without recharging the air start receivers.
(continued)
CLINTON                             B 3.8-41                   Revision No. 3-2

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES   (continued)
APPLICABILITY       The AC sources, LCO 3.8.1 and LCO 3.8.2, are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated DBA. Since stored diesel fuel oil, lube oil, and starting air subsystem support LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil, lube oil, and starting air are required to be within limits when the associated DG is required to be OPERABLE.
ACTIONS             The Actions Table is modified by a Note indicating that separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DG subsystem. Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG subsystem(s) are governed by separate Condition entry and application of associated Required Actions.
A.1 In this Condition, the 7 day fuel oil supply for a DG is not available. However, the Condition is restricted to fuel oil level reductions that maintain at least a 6 day supply. The fuel oil level equivalent to a 6 day supply for the Division 1 DG is 43,810 gallons, for the Division 2 DG is 38,572 gallons, and for the Division 3 DG is 25,286 gallons.
These circumstances may be caused by events such as:
: a. Full load operation required after an inadvertent start while at minimum required level; or
: b. Feed and bleed operations that may be necessitated by increasing particulate levels or any number of other oil quality degradations.
This restriction allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of the fuel oil to the tank. A period of 48 hours is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity (> 6 days), the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.
(continued)
CLINTON                               B 3.8-42                  Revision No. 14-4

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS       B.1 (continued)
In this condition, the 7 day lube oil inventory, i.e., sufficient lube oil to support 7 days of continuous DG operation at full load conditions, is not available.
However, the Condition is restricted to lube oil volume reductions that maintain at least a 6 day supply. The lube oil equivalent to a 6 day supply for each 16 cylinder diesel engine is 327 gallons and for each 12 cylinder diesel engine is 269 gallons. This restriction allows sufficient time for obtaining the requisite replacement volume. A period of 48 hours is considered sufficient to complete restoration of the required volume prior to declaring the DG inoperable.
This period is acceptable based on the remaining capacity
(> 6 days), the low rate of usage, the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.
C.1 This Condition is entered as a result of a failure to meet the acceptance criterion for particulates. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability. Poor sample procedures (bottom sampling),
contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend.
Since the presence of particulate does not mean failure of the fuel oil to burn properly in the diesel engine, since particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and since proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable. The 7 day Completion Time allows for further evaluation, resampling, and re-analysis of the DG fuel oil.
D.1 With the new fuel oil properties defined in the Bases for SR 3.8.3.3 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, to restore the stored fuel oil properties. This restoration (continued)
CLINTON                        B 3.8-43                  Revision No. 14-4

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS      D.1  (continued) may involve feed and bleed procedures, filtering, or a combination of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is high likelihood that the DG would still be capable of performing its intended function.
E.1 With the required starting air receiver pressure < 200 psig, sufficient capacity for multiple DG start attempts may not exist. However, as long as the receiver pressure is t 140 psig, there is adequate capacity for at least one start attempt, and the DG can be considered OPERABLE while the air receiver pressure is restored to the required limit.
A period of 48 hours is considered sufficient to complete restoration to the required pressure prior to declaring the DG inoperable. This period is acceptable based on the remaining air start capacity, the fact that most DG starts are accomplished on the first attempt, and the low probability of an event during this brief period.
F.1 With a Required Action and associated Completion Time not met, or the stored diesel fuel oil, lube oil, or starting air subsystem not within limits for reasons other than addressed by Conditions A through E, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.
SURVEILLANCE SR  3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for 7 days at maximum expected post LOCA loading. The fuel oil level equivalent to a 7 day supply at the maximum post-LOCA load demand for the Division 1 DG is 51,000 gallons, for the Division 2 DG is 45,000 gallons, and for the Division 3 DG is 29,500 gallons. The required fuel storage volume is determined using the known correlation of diesel fuel oil absolute specific gravity or API gravity to energy content, the required diesel generator output, and the corresponding fuel consumption rate. SR 3.8.3.3 requires new fuel to be tested to verify that the absolute specific gravity or API gravity is within the range assumed in the diesel fuel oil consumption calculations. The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.
(continued)
CLINTON                       B 3.8-44                  Revision No. 14-4

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.1  (continued)
REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to fuel oil inventory values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).
SR  3.8.3.2 This Surveillance ensures that sufficient lube oil inventory is available to support at least 7 days of maximum expected post LOCA load operation for each DG. The lube oil level equivalent to a 7 day supply for each 16 cylinder diesel engine is 347 gallons and for each 12 cylinder diesel engine is 284 gallons and is based on the DG manufacturer's consumption values for the run time of the DG. Implicit in this SR is the requirement to verify the capability to transfer the lube oil from its storage location to the DG when the DG lube oil sump does not hold adequate inventory for 7 days of maximum expected post LOCA load operation without the level reaching the manufacturer's recommended minimum level.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to lube oil inventory values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).
SR  3.8.3.3 The tests of fuel oil prior to addition to the storage tanks are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate detrimental impact on diesel engine combustion and operation. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between the sample (and corresponding results) of new fuel and addition of new fuel oil to the storage tanks to exceed 31 days. The limits and applicable ASTM Standards for the (continued)
CLINTON                       B 3.8-45                  Revision No. 14-4

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR  3.8.3.3  (continued)
REQUIREMENTS tests listed in the Diesel Fuel Oil Testing Program of Specification 5.5.9 are as follows:
: a. Sample the new fuel oil in accordance with ASTM D4057-95 (Ref. 6);
: b. Verify in accordance with the tests specified in ASTM D1298-99 (Ref. 6) that the sample has an API gravity at 60qF of t 30q and d 38q, and in accordance with the tests specified in ASTM D975-06b (Ref. 6) that the sample has a kinematic viscosity at 40qC of t 1.9 centistokes and d 4.1 centistokes; and
: c. Verify that the new fuel oil has clear and bright appearance with proper color when tested in accordance with ASTM D4176-93 (Ref. 6), or a water and sediment content d 0.05 v/o when tested in accordance with ASTM-D975-06b.
Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO since the fuel oil is not added to the storage tanks.
Following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-06b (Ref. 6) are met for new fuel oil when tested in accordance with ASTM D975-06b (Ref. 6).
These additional analyses are required by Specification 5.5.9, Diesel Fuel Oil Testing Program, to be performed within 31 days following sampling and addition. This 31 days is intended to assure: 1) that the sample taken is not more than 31 days old at the time of adding the fuel oil to the storage tank, and 2) that the results of a new fuel oil sample (sample obtained prior to addition but not more than 31 days prior to) are obtained within 31 days after addition. The 31 day period is acceptable because the fuel oil properties of interest, even if not within stated limits, would not have an immediate effect on DG operation.
This Surveillance ensures the availability of high quality fuel oil for the DGs.
(continued)
CLINTON                       B 3.8-46                   Revision No. 11-5

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR  3.8.3.3  (continued)
REQUIREMENTS Fuel oil degradation during long term storage shows up as an increase in particulate, mostly due to oxidation. The presence of particulate does not mean that the fuel oil will not burn properly in a diesel engine. However, the particulate can cause fouling of filters and fuel oil injection equipment, which can cause engine failure.
Particulate concentrations should be determined in accordance with ASTM D6217-98(Ref. 6). This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l.
It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing.
The Frequency of this Surveillance takes into consideration fuel oil degradation trends indicating that particulate concentration is unlikely to change between Frequency intervals.
With regard to fuel oil property values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).
SR  3.8.3.4 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available. The system design provides for multiple start attempts without recharging when pressurized above the low pressure alarm setpoint. The pressure specified in this SR reflects a value at which multiple starts can be accomplished, but is not so high as to result in failing the limit due to normal cycling of the recharge compressor.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
(continued)
CLINTON                       B 3.8-47                  Revision No. 14-2

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR  3.8.3.4  (continued)
REQUIREMENTS With regard to air start capacity values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 10).
SR  3.8.3.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Periodic removal of water from the storage tanks eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, contaminated fuel oil, and from breakdown of the fuel oil by bacteria.
Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is for preventive maintenance.
The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of the Surveillance.
REFERENCES   1. USAR, Section 9.5.4.
: 2. Regulatory Guide 1.137.
: 3. ANSI N195, 1976.
: 4. USAR, Chapter 6.
: 5. USAR, Chapter 15.
: 6. ASTM Standards: D4057-95; D1298-99; D975-06b; D4176-93; D6217-98.
: 7. Deleted.
: 8. Calculation IP-0-0120.
: 9. Calculation IP-0-0121.
: 10. Calculation IP-0-0122.
: 11. Calculation IP-C-0006.
CLINTON                       B 3.8-48                   Revision No. 14-4

DC SourcesOperating B 3.8.4 3.8   ELECTRICAL POWER SYSTEMS B 3.8.4   DC Sources  Operating BASES BACKGROUND         The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment. As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure.
The DC electrical power system also conforms to the requirements of Regulatory Guide 1.6 (Ref. 2) and IEEE-308 (Ref. 3).
The 125 VDC electrical power system consists of four independent Class 1E DC electrical power subsystems, Divisions 1, 2, 3, and 4. Each subsystem consists of a battery, associated battery charger, and all the associated control equipment and interconnecting cabling.
During normal operation, the DC loads are powered from the battery chargers with the batteries floating on the system.
In case of loss of normal power to the battery charger, the DC loads are automatically powered from the Engineered Safety Feature (ESF) batteries.
Each of the Division 1 and 2 electrical power subsystems provides the control power for its associated Class 1E AC power load group, 4.16 kV switchgear, and 480 V load centers. Also, these DC subsystems provide DC electrical power to the Division 1 and 2 inverters, which in turn power the respective uninterruptible AC buses. The Division 3 DC electrical power subsystem provides DC motive and control power as required for the High Pressure Core Spray (HPCS)
System diesel generator (DG) set control and protection.
The DC subsystem also provides power to the Division 3 inverter, which in turn powers the Division 3 uninterruptible AC bus. The Division 4 DC electrical power subsystem provides DC electrical power to the Division 4 inverter, which in turn powers the Division 4 uninterruptible AC bus.
(continued)
CLINTON                             B 3.8-49                      Revision No. 0

DC Sources  Operating B 3.8.4 BASES BACKGROUND    The DC power distribution system is described in more detail (continued) in Bases for LCO 3.8.9, "Distribution Systems  Operating,"
and LCO 3.8.10, "Distribution Systems  Shutdown."
Each Division 1, 2, 3, and 4 battery has adequate storage capacity to meet the duty cycle(s) discussed in the USAR, Section 8.3.2 (Ref. 4). The battery is designed with additional capacity above that required by the design duty cycle to allow for temperature variations and other factors.
Each DC battery subsystem is separately housed in a ventilated room apart from its charger and distribution centers. Each subsystem is located in an area separated physically and electrically from the other subsystems to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. There is no sharing between redundant Class 1E subsystems such as batteries, battery chargers, or distribution panels.
The batteries for a DC electrical power subsystem are sized to produce required capacity at 80% of nameplate rating.
The minimum design voltage limit is 105 V. The battery cells are flooded lead acid construction with a nominal specific gravity of 1.215. This specific gravity corresponds to an open circuit battery voltage of approximately 120 V for a 58-cell battery (i.e., cell voltage of 2.065 volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage > 2.065 Vpc, the battery cell will maintain its capacity for 30 days without further charging per manufacturers instructions. Optimal long-term performance, however, is obtained by maintaining a float voltage of 2.20 to 2.25 Vpc. This provides adequate over-potential, which limits the formation of lead sulfate and self discharge.
The nominal float voltage of 2.22 Vpc corresponds to a total float voltage output of 128.8 V for a 58 cell battery as discussed in USAR 8.3.2 (Ref. 4).
Each battery charger of Division 1, 2, 3, and 4 DC electrical power subsystems has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged. Each battery charger has sufficient excess capacity to restore the battery bank from the design minimum charge to its fully charged state within 12 hours while supplying normal steady state loads (Ref. 4).
The battery charger is normally in the float charge mode.
Float charge is the condition in which the charger is supplying the connected loads and the battery cells are (continued)
CLINTON                        B 3.8-50                   Revision No. 16-1

DC Sources  Operating B 3.8.4 BASES BACKGROUND      receiving adequate current to optimally charge the battery.
(continued)     This assures the internal losses of a battery are overcome and the battery is maintained in a fully charged state.
When desired, the charger can be placed in the equalize mode. The equalize mode is at a higher voltage than the float mode and charging current is correspondingly higher.
The battery charger is operated in the equalize mode after a battery discharge or for routine maintenance. Following a battery discharge, the battery recharge characteristic accepts current at the current limit of the battery charger (if the discharge was significant, e.g., following a battery service test) until the battery terminal voltage approaches the charger voltage setpoint. Charging current then reduces exponentially during the remainder of the recharge cycle.
Lead-calcium batteries have recharge efficiencies of greater than 95%, so once at least 105% of the ampere-hours discharged have been returned, the battery capacity would be restored to the same condition as it was prior to the discharge. This can be monitored by direct observation of the exponentially decaying charging current or by evaluating the amp-hours discharged from the battery and amp-hours returned to the battery.
APPLICABLE      The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the USAR, Chapter 6 (Ref. 5) and Chapter 15 (Ref. 6), assume that ESF systems are OPERABLE.
The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.
The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. As described in Ref. 4, only Division 1, Division 2, and Division 3 DC electrical power subsystems are assumed to be available for the safe shutdown analysis of the plant. These requirements include maintaining DC sources OPERABLE during accident conditions in the event of:
: a. An assumed loss of all offsite AC power or of all onsite AC power; and
: b. A worst case single failure.
The DC sources satisfy Criterion 3 of the NRC Policy Statement.
(continued)
CLINTON                          B 3.8-51                   Revision No. 6-5

DC Sources  Operating B 3.8.4 BASES LCO           The DC electrical power subsystems, each subsystem consisting of one battery, one battery charger, and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the divisions, are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. Loss of any DC electrical power subsystem does not prevent the minimum safety function from being performed (Ref. 4).
APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure safe unit operation and to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.
The DC electrical power requirements for MODES 4 and 5 are addressed in the Bases for LCO 3.8.5, "DC Sources 
Shutdown."
ACTIONS       A.1, A.2 and A.3 Condition A represents one division with one battery charger inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 12 hours, the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability.
(continued)
CLINTON                        B 3.8-52                   Revision No. 6-5

DC Sources  Operating B 3.8.4 BASES ACTIONS     A.1, A.2 and A.3 (continued)
(continued)
A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus, there is good assurance of fully recharging the battery within 12 hours, avoiding a premature shutdown with its own attendant risk.
If established battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours, and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.
If the charger is operating in the current limit mode after 2 hours that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged conditions in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged with 12 hours (Required Action A.2).
Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it has now been fully recharged. If at the expiration of the initial 12 hour period, the battery float current is not less than or equal to 2 amps, this indicates there may be additional battery problems and the battery must be declared inoperable.
Required Action A.3 limits the restoration time for the inoperable battery charger to 7 days or in accordance with the Risk Informed Completion Time Program. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The output of the swing charger will be capable of being connected to any one of the Class 1E DC buses for Division 1, 2 or 4 using a 400 Amp disconnect switch. The connection through this switch will be provided with padlocks on the switches which will be administratively controlled to allow connection to only on of the Class 1E divisions at any time. The 7 day completion time reflects a reasonable time to effect restoration of the qualified battery charger to operable status.
(continued)
CLINTON                      B 3.8-53                  Revision No. 21-7

DC Sources  Operating B 3.8.4 BASES ACTIONS     B.1 (continued)
Condition B represents one division with one battery inoperable. With one battery inoperable, the DC bus is being supplied by the OPERABLE battery charger. Any event that results in a loss of the AC buss supporting the battery charger will also result in loss of DC to that division.
Recovery of the AC bus, especially if it is due to a loss of offsite power, will be hampered by the fact that many of the components necessary for the recovery (e.g., diesel generator control and field flash, AC load shed and diesel generator output circuit breakers, etc.) likely rely upon the battery.
In addition, the energization transients of any DC loads that are beyond the capability of the battery charger and normally require the assistance of the battery will not be able to be brought online. The 2 hour limit allows sufficient time to effect restoration of an inoperable battery given that the majority of the conditions that lead to battery inoperability (e.g., loss of battery charger, battery cell voltage less than 2.07 V, etc.) are identified in Specifications 3.8.4, 3.8.5, and 3.8.6 together with additional specific completion times. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
C.1 Condition C represents one division with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected division. The 2 hour limit is consistent with the allowed time for an inoperable DC distribution system division. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
If one of the required Division 1 or 2 DC electrical power subsystems is inoperable for reasons other than Condition A or B (e.g., inoperable battery charger and associated inoperable battery), the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could, however, result in the loss of minimum necessary DC electrical subsystems, continued power operation should not exceed 2 hours. The 2 hour Completion Time is based on Regulatory Guide 1.93 (Ref. 7) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.
(continued)
CLINTON                      B 3.8-54                  Revision No. 21-7

DC Sources  Operating B 3.8.4 BASES ACTIONS (continued) D.1 If a Division 1 or 2 DC electrical power subsystem is inoperable and not restored within the provided Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 8) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Required Action D.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.
E.1 With one or more Division 3 or 4 DC electrical power subsystems inoperable, the HPCS System may be incapable of performing its intended functions and must be immediately declared inoperable. This declaration also requires entry into applicable Conditions and Required Actions of LCO 3.5.1, ECCS  Operating.
F.1 and F.2 If the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The Completion Time to bring the unit to MODE 4 is consistent with the time required in Regulatory Guide 1.93 (Ref. 7).
(continued)
CLINTON                       B 3.8-55                 Revision No. 13-2

DC Sources  Operating B 3.8.4 BASES (continued)
SURVEILLANCE      SR  3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge helps to ensure the effectiveness of the battery chargers, which support the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery (or battery cell) and maintain the battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to continually charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer (2.20 Vpc or 127.6 V at the battery terminals).
This voltage maintains the battery plates in a condition that supports maintaining the grid life (expected to be approximately 20 years). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to battery terminal voltage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 13).
SR  3.8.4.2 This SR verifies the design capacity of the battery chargers. According to Regulatory Guide 1.32 (Ref. 10), the battery charger supply is recommended to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences. The minimum required amperes and duration ensure that these requirements can be satisfied. This SR provides two options. One option requires that each battery charger be capable of supplying 300 amps for Divisions 1 and 2 (100 amps for Divisions 3 and 4) at the minimum established float voltage for 4 hours. The ampere requirements are based on the output rating of the chargers.
The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time period is sufficient for the charger temperature to have stabilized and to have been maintained for at least 2 hours.
The other option requires that each battery charger be capable of recharging the battery after a service test coincident with supplying the largest coincident demands of the various continuous steady state loads (irrespective or the status of the plant during which these demands occur).
(continued)
CLINTON                            B 3.8-56                  Revision No. 14-2

DC Sources  Operating B 3.8.4 BASES SURVEILLANCE SR  3.8.4.2 (continued)
REQUIREMENTS This level of loading may not normally be available following the battery service test and will need to be supplemented with additional loads. The duration for this test may be longer than the charger sizing criteria since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current.
The battery is recharged when the measured charging current is < 2 amps.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to minimum required amperes and duration values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 13).
SR  3.8.4.3 A battery service test is a special test of the battery's capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length are established with a dummy load that corresponds to the design duty cycle requirements as specified in Reference 4.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by two Notes. Note 1 allows the performance of a modified performance discharge test SR 3.8.6.6 in lieu of SR 3.8.4.3. This substitution is acceptable because SR 3.8.6.6 represents an equivalent test of battery capability as SR 3.8.4.3. The reason for Note 2 is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. Credit may be taken for unplanned events that satisfy the Surveillance. Examples of unplanned events may include:
(continued)
CLINTON                       B 3.8-57                  Revision No. 20-2

DC Sources  Operating B 3.8.4 BASES SURVEILLANCE SR  3.8.4.3 (continued)
REQUIREMENTS
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
With regard to battery capacity values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 12).
REFERENCES   1. 10 CFR 50, Appendix A, GDC 17.
: 2. Regulatory Guide 1.6, March 10, 1971.
: 3. IEEE Standard 308, 1978.
: 4. USAR, Section 8.3.2.
: 5. USAR, Chapter 6.
: 6. USAR, Chapter 15.
: 7. Regulatory Guide 1.93, December 1974.
: 8. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 9. IEEE Standard 450, 1995.
: 10. Regulatory Guide 1.32, February 1977.
: 11. Regulatory Guide 1.129, December 1974.
: 12. Calculation IP-0-0123.
CLINTON                       B 3.8-58                  Revision No. 13-2

DC Sources  Shutdown B 3.8.5 B 3.8   ELECTRICAL POWER SYSTEMS B 3.8.5   DC Sources  Shutdown BASES BACKGROUND         A description of the DC sources is provided in the Bases for LCO 3.8.4, "DC Sources  Operating."
APPLICABLE         The initial conditions of Design Basis Accident and SAFETY ANALYSES    transient analyses in the USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume that Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.
The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
The OPERABILITY of the minimum DC electrical power sources during MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment ensures that:
: a. The facility can be maintained in the shutdown or refueling condition for extended periods;
: b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
: c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.
The DC sources satisfy Criterion 3 of the NRC Policy Statement.
LCO                One DC electrical power subsystem (consisting of one battery, one battery charger, and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the division) associated with the (continued)
CLINTON                              B 3.8-59                  Revision No. 20-2

DC Sources  Shutdown B 3.8.5 BASES LCO           Division 1 or Division 2 onsite Class 1E DC electrical power (continued)   distribution subsystem(s) required OPERABLE by LCO 3.8.10, "Distribution Systems - Shutdown," is required to be OPERABLE. Similarly, when the High Pressure Core Spray (HPCS) System is required to be OPERABLE, the Division 3 and Division 4 DC electrical power subsystems associated with the Division 3 and Division 4 onsite Class 1E DC electrical power distribution subsystems required OPERABLE by LCO 3.8.10 are required to be OPERABLE. In addition to the preceding subsystems required to be OPERABLE, a Class 1E battery or battery charger and the associated control equipment and interconnecting cabling capable of supplying power to the remaining Division 1 or Division 2 onsite Class 1E DC electrical power distribution subsystem(s), when portions of both Division 1 and Division 2 DC electrical power distribution subsystems are required to be OPERABLE by LCO 3.8.10. This ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment provide assurance that:
: a. Required features to provide core cooling are available;
: b. Required features needed to mitigate a fuel handling accident are available;
: c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
: d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
The DC electrical power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.4.
(continued)
CLINTON                        B 3.8-60                  Revision No. 20-2

DC Sources  Shutdown B 3.8.5 BASES ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require reactor shutdown.
A.1, A.2, and A.3 Condition A represents one division with one battery charger inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The ACTIONS provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2 hours. This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring the battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 12 hours, the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability. A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus, there is good assurance of fully recharging the battery within 12 hours, avoiding a premature shutdown with its own attendant risk.
If established battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours, and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.
If the charger is operating in the current limit mode after 2 hours, that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in (continued)
CLINTON                  B 3.8-61                   Revision No. 6-5

DC Sources  Shutdown B 3.8.5 BASES ACTIONS       A.1, A.2, and A.3 (continued)
(continued) this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours (Required Action A.2).
Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery and been discharged as the results of the inoperable battery charger, it has now been fully recharged. If, at the expiration of the initial 12 hour period, the battery float current is not less than or equal to 2 amps, this indicates there may be additional battery problems and the battery must be declared inoperable.
Required Action A.3 limits the restoration time for the inoperable battery charger to 7 days. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The 7 day completion time reflects a reasonable time to effect restoration of the qualified battery charger to operable status.
B.1, B.2.1, B.2.2, and B.2.3 If more than one DC distribution subsystem is required according to LCO 3.8.10, the DC subsystems remaining OPERABLE with one or more DC power sources inoperable may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement. By allowing the option to declare required features inoperable with associated DC power source(s) inoperable, appropriate restrictions are implemented in accordance with the affected system LCOs' ACTIONS. In many instances this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies).
Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.
These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystems and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the plant safety systems.
(continued)
CLINTON                        B 3.8-62                  Revision No. 20-2

DC Sources  Shutdown B 3.8.5 BASES ACTIONS           The Completion Time of immediately is consistent with the (continued)     required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.
SURVEILLANCE      SR  3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires performance of all Surveillances required by SR 3.8.4.1 through SR 3.8.4.3. Therefore, see the corresponding Bases for LCO 3.8.4 for a discussion of each SR.
This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required.
REFERENCES        1. USAR, Chapter 6.
: 2. USAR, Chapter 15.
CLINTON                            B 3.8-63                  Revision No. 21-4

Battery Parameters B 3.8.6 B 3.8   ELECTRICAL POWER SYSTEMS B 3.8.6   Battery Parameters BASES BACKGROUND         This LCO delineates the limits on battery float current as well as electrolyte temperature, level and float voltage for the DC power source batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources  Operating," and LCO 3.8.5, "DC Sources  Shutdown."
In addition to the limitations of this Specification, the Battery Maintenance and Monitoring Program, specified in Specification 5.5.14, is a program that monitors various battery parameters based on the recommendations of IEEE Standard 450-1995, IEEE Recommended Practice for Maintenance, Testing, and Replacement of Vented Lead-Acid Batteries for Stationary Applications (Ref. 3).
The battery cells are of flooded lead acid construction with a nominal specific gravity of 1.215. This specific gravity corresponds to an open circuit battery voltage of approximately 120 V for a 58-cell battery (i.e., cell voltage of 2.065 Volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Once fully charged with its open circuit voltage > 2.065 Vpc, the battery cell will maintain its capacity for 30 days without further charging per manufacturers instructions. Optimal long-term performance however, is obtained by maintaining a float voltage 2.20 to 2.25 Vpc. This provides adequate overpotential which limits the formation of lead sulfate and self discharge. The nominal float voltage of 2.22 Vpc corresponds to a total float voltage output of 128.8 V for a 58-cell battery as discusses in the USAR, Section 8.3.2 (Ref. 6).
APPLICABLE         The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES    transient analyses in USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The DC electrical power subsystems provide normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.
The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining at least one division of DC sources OPERABLE during accident conditions, in the event of:
: a. An assumed loss of all offsite AC power or all onsite AC power; and
: b. A worst case single failure.
(continued)
CLINTON                             B 3.8-64                    Revision No. 6-5

Battery Parameters B 3.8.6 BASES APPLICABLE SAFETY Since battery parameters support the operation of the ANALYSES          DC power sources, they satisfy Criterion 3 of the NRC (continued)     Policy Statement.
LCO               Battery parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA.
Battery parameter limits are conservatively established, allowing continued DC electrical system function even with limits not met.
Additional preventive maintenance, testing, and monitoring is performed in accordance with the Battery Maintenance and Monitoring Program as specified in Specification 5.5.14.
APPLICABILITY     The battery parameters are required solely for the support of the associated DC electrical power subsystem. Therefore, battery parameter limits are only required when the DC power source is required to be OPERABLE. Refer to the Applicability discussion in Bases for LCO 3.8.4 and LCO 3.8.5.
ACTIONS           A.1, A.2, and A.3 With parameters of one or more cells in a battery in one division < 2.07 V, the battery cell is degraded. Within 2 hours, verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage (SR 3.8.4.1) and of the overall battery state of charge by monitoring the battery float charge current (SR 3.8.6.1). This assures that there is still sufficient battery capacity to perform the intended function.
Therefore, the affected battery is not required to be considered inoperable solely as a result of one or more cells in one or more batteries < 2.07 V, and continued operation is permitted for a limited period up to 24 hours.
Since the Required Actions only specify perform, a failure of SR 3.8.4.1 or SR 3.8.6.1 acceptance criteria does not result in this Required Action not met. However, if one of the SRs is failed, the appropriate Condition(s), depending on the cause of the failures, is entered. If SR 3.8.6.1 is failed, then there is not assurance that there is still sufficient battery capacity to perform the intended function and the battery must be declared inoperable immediately.
(continued)
CLINTON                             B 3.8-65                  Revision No. 6-5

Battery Parameters B 3.8.6 BASES ACTIONS       B.1 and B.2 (continued)
A battery in one division with float current > 2 amps indicates that a partial discharge of the battery capacity has occurred. This may be due to one or more battery cells in a low voltage condition reflecting some loss of capacity.
Within 2 hours, verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage. If the terminal voltage is found to be less than the minimum established float voltage, there are two possibilities: the battery charger is inoperable, or is operating in the current limit mode. Condition A addressed charger inoperability. If the charger is operating in the current limit mode after 2 hours, that is an indication that the battery has been substantially discharged and likely cannot perform its required design functions. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours (Required Action B.2). The battery must therefore be declared inoperable.
If the float voltage is found to be satisfactory but there are one or more battery cells with float voltage less than 2.07 V, the associated OR statement in Condition F is applicable and the battery must be declared inoperable immediately. Plant analysis has demonstrated that each battery charger has sufficient capacity to restore the battery bank from the design minimum charge to its fully charged state within 12 hours while supplying normal steady state loads. Therefore, if float voltage is satisfactory and there are no cells less than 2.07 V, there is good assurance that, within 12 hours, the battery will be restored to its fully charged condition (Required Action B.2) from any discharge that might have occurred due to a temporary loss of the battery charger. A discharged battery with float voltage (the charger setpoint) across its terminals, indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus, there is good assurance of fully recharging the battery within 12 hours, avoiding a premature shutdown with its own attendant risk.
If the condition is due to one or more cells in a low voltage condition but is still greater than 2.07 V, and float voltage is found to be satisfactory, this is not (continued)
CLINTON                        B 3.8-66                   Revision No. 6-5

Battery Parameters B 3.8.6 BASES ACTIONS       B.1 and B.2 (continued)
(continued) indication of a substantially discharged battery and 12 hours is a reasonable time prior to declaring the battery inoperable. Since Required Action B.1 only specifies perform, a failure of SR 3.8.4.1 acceptance criteria does not result in the Required Action not met. However, if SR 3.8.4.1 is failed, the appropriate Condition(s), depending on the cause of the failure, is entered.
C.1, C.2 and C.3 With a battery in one division with one or more cells electrolyte level above the top of the plates, but below the minimum established design limits, the battery still retains sufficient capacity to perform the intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of electrolyte level not met. Within 31 days, the minimum established design limits for electrolyte level must be re-established.
With electrolyte level below the top of the plates, there is a potential for dryout and plate degradation. Required Actions C.1 and C.2 address this potential (as well as provisions in Specification 5.5.14, Battery Monitoring and Maintenance Program). They are modified by a note that indicates they are only applicable if electrolyte level is below the top of the plates. Within 8 hours, level is required to be restored to above the top of the plates. The Required Action C.2 requirement to verify that there is no leakage by visual inspection and the Specification 5.5.14, Item b, to initiate action to equalize and test in accordance with manufacturers recommendation are taken from Annex D of IEEE Standard 450-1995. They are performed following the restoration of the electrolyte level to above the top of the plates. Based on the results of the manufacturers recommended testing, the battery may have to be declared inoperable and the affected cell(s) replaced.
D.1 With a battery in one division with pilot cell temperature less than the minimum established design limits, 12 hours is Allowed to restore the temperature to within limits. A low Electrolyte temperature limits the current and power available. Since the battery is sized with margin, while battery capacity is degraded, sufficient capacity exists to perform the intended function and the affected battery is not required to be considered inoperable solely as result of the pilot cell temperature not met.
(continued)
CLINTON                        B 3.8-67                   Revision No. 6-5

Battery Parameters B 3.8.6 BASES ACTIONS (continued) E.1 Batteries in redundant trains with battery parameters not within limits, there is not sufficient assurance that battery capacity has not been affected to the degree that the batteries can still perform their required function, given that redundant batteries are involved. With redundant batteries involved, this potential could result in a total loss of function on multiple systems that rely upon the batteries. The longer completion times specified for battery parameters on non-redundant batteries not within limits are therefore not appropriate, and the parameters must be restored to within limits on at least one train within 2 hours.
F.1 When any battery parameter is outside the allowances of the Required Actions for Condition A, B, C, D, or E, sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding battery must be declared inoperable. Additionally, discovering a battery in one train with one or more battery cells float voltage less than 2.07 V and float current greater tan 2 amps, indicates that the battery capacity may not be sufficient to perform the intended functions. The battery must therefore be declared inoperable immediately.
SURVEILLANCE  SR  3.8.6.1 REQUIREMENTS Verifying battery float current while on float charge is used to determine the state of charge of the battery. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a charged state. The float current requirements are based on the float current indicative of a charged battery. Use of float current to determine the state of charge of the battery is consistent with IEEE Standard 450-1995 (Ref. 3). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
This SR is modified by a Note that states the float current requirement is not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1. When this float voltage is not maintained, the Required Actions of LCO 3.8.4, ACTION A, are being taken, which provide the necessary and appropriate verifications of the battery condition. Furthermore, the float current limit of 2 amps is established based on the nominal float voltage value and is not directly applicable when this voltage is not maintained.
(continued)
CLINTON                        B 3.8-68                  Revision No. 14-2

Battery Parameters B 3.8.6 BASES SURVEILLANCE  SR  3.8.6.2 and 3.8.6.5 REQUIREMENTS (continued) Optimal long-term battery performance is obtained by maintaining a float voltage greater than or equal to the minimum established design limits provided by the battery manufacturer, which corresponds to 127.6 V at the battery terminals, or 2.20 Vpc. This provides adequate overpotential, which limits the formation of lead sulfate and self discharge, which could eventually render the battery inoperable. Float voltage, in this range or less, but greater than 2.07 Vpc, are addressed in Specification 5.5.14. SRs 3.8.6.2 and 3.8.6.5 require verification that the cell float voltages are equal to or greater than the short-term absolute minimum voltage of 2.07 V. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.6.3 The limit specified for electrolyte level ensures that the plates suffer no physical damage and maintains adequate electron transfer capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.6.4 This surveillance verifies that the pilot cell temperature is greater than or equal to the minimum established design limit (i.e., 65 degrees F). Pilot cell electrolyte temperature is maintained above this temperature to assure the battery can provide the required current and voltage to meet the design requirements. Temperatures lower than assumed in battery sizing calculations act to inhibit or reduce battery capacity. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.8.6.6 A battery performance test is a test of constant current capacity of a battery, normally done in the as-found condition, after having been in service, to detect any change in the capacity determined by the acceptance test.
The test is intended to determine overall battery degradation due to age and usage.
The acceptance criteria for this Surveillance is consistent with IEEE Standard 450-1995 (Ref. 3) and IEEE Standard 485 (Ref. 5). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturers rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements. Furthermore, the battery is (continued)
CLINTON                        B 3.8-68a                 Revision No. 21-4

Battery Parameters B 3.8.6 BASES SURVEILLANCE SR  3.8.6.6 (continued)
REQUIREMENTS sized to meet the assumed duty cycle loads when the battery design capacity reaches this 80% limit.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. If the battery shows degradation, or if the battery has reached 85% of its expected life and capacity is < 100% of the manufacturer's rating, the Surveillance Frequency is reduced to 12 months.
However, if the battery shows no degradation but has reached 85% of its expected life, the Surveillance Frequency is only reduced to 24 months for batteries that retain capacity
             > 100% of the manufacturer's rating. Degradation is indicated, according to IEEE-450 (Ref. 3), when the battery capacity drops by more than 10% relative to its capacity on the previous performance test or when it is > 10% below the manufacturer's rating. All these Frequencies are consistent with the recommendations in IEEE-450 (Ref. 3).
This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. Credit may be taken for unplanned events that satisfy the Surveillance. Examples of unplanned events may include:
: 1)   Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and
: 2)   Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.
REFERENCES   1. USAR, Chapter 6.
: 2. USAR, Chapter 15.
: 3. IEEE Standard 450, 1995.
: 4. Calculation IP-0-0123.
: 5. IEEE Standard 485, 1983
: 6. USAR, Chapter 8.
CLINTON                       B 3.8-68b                 Revision No. 21-4

Inverters  Operating B 3.8.7 B 3.8   ELECTRICAL POWER SYSTEMS B 3.8.7   Inverters  Operating BASES BACKGROUND         The inverters are the preferred source of power for the uninterruptible AC buses and the Reactor Protection System (RPS) solenoid buses because of the stability and reliability they achieve. There is one inverter per uninterruptible AC bus, making a total of four divisional inverters and one inverter per RPS solenoid bus, making a total of two RPS solenoid bus inverters. The function of the inverter is to provide AC electrical power to these buses. The inverters are powered from both AC and DC sources. The DC source provides an uninterruptible power source for the instrumentation and controls for the RPS, the Emergency Core Cooling Systems (ECCS) initiation, miscellaneous isolations, and the RPS and main steam isolation valve (MSIV) solenoids.
The divisional inverters contain a solid-state transfer switch to automatically transfer to an alternate source if the inverter detects abnormal conditions, such as an internal inverter component failure or for handling fault clearing or inrush current demands. The transfer of the divisional inverters to their alternate source will occur if the alternate source is either energized or deenergized.
Specific details on inverters, such as type, capacity, operating limits, and number and status of spares, can be found in the USAR, Chapter 8 (Ref. 1).
APPLICABLE         The initial conditions of Design Basis Accident (DBA)
SAFETY ANALYSES    and transient analyses in the USAR, Chapter 6 (Ref. 2) and Chapter 15 (Ref. 3), assume Engineered Safety Feature systems are OPERABLE. The divisional inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the RPS and ECCS instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems. The RPS solenoid bus inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the RPS and MSIV solenoids function and are not damaged.
The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining electrical power sources OPERABLE during accident conditions in the event of:
(continued)
CLINTON                             B 3.8-69                   Revision No. 5-4

Inverters  Operating B 3.8.7 BASES APPLICABLE      a. An assumed loss of all offsite AC or all onsite AC SAFETY ANALYSES      electrical power; and (continued)
: b. A worst case single failure.
Inverters are a part of the distribution system, and as such, satisfy Criterion 3 of the NRC Policy Statement.
LCO             The inverters ensure the availability of AC electrical power for the instrumentation for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA.
Maintaining the required inverters OPERABLE ensures that the redundancy incorporated into the design of the RPS and ECCS instrumentation and controls is maintained. The four battery powered divisional inverters, and the two RPS solenoid bus inverters, ensure an uninterruptible supply of AC electrical power to the uninterruptible AC buses and RPS solenoid buses, respectively, even if the 4.16 kV safety buses are de-energized.
OPERABLE NSPS inverters require that the associated bus is powered by the inverter via inverted DC voltage from the required Class 1E DC bus, with the output within the design voltage and frequency tolerances. OPERABLE RPS solenoid bus inverters require that the associated RPS solenoid bus is powered by the inverter with the output within the design voltage and frequency tolerances.
APPLICABILITY   The inverters are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.
(continued)
CLINTON                          B 3.8-70                   Revision No. 5-4

Inverters  Operating B 3.8.7 BASES APPLICABILITY     Inverter requirements for MODES 4 and 5 are covered in the (continued)     Bases for LCO 3.8.8, "Inverters  Shutdown."
ACTIONS           With a required inverter inoperable, its associated uninterruptible AC bus is inoperable if not energized.
LCO 3.8.9 addresses this action; however, pursuant to LCO 3.0.6, these actions would not be entered even if the uninterruptible AC bus were de-energized. Therefore, the ACTIONS are modified by a Note stating that ACTIONS for LCO 3.8.9 must be entered immediately. This ensures the uninterruptible bus is re-energized within 8 hours.
A.1 Required Action A.1 allows 7 days to restore an inoperable inverter and return it to service. Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. The 7 day limit is a risk-informed Completion Time based on a plant-specific risk analysis performed to establish this Completion Time for the Division 1 and 2 inverters. This risk has to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems that such a shutdown might entail. When the uninterruptible AC bus is powered from its constant voltage source, it is relying upon interruptible AC electrical power sources (offsite and onsite). The uninterruptible inverter source to the uninterruptible AC buses is the preferred source for powering instrumentation trip setpoint devices.
An inverter may be removed from service to perform planned preventive maintenance so long as the inverter is restored to operable status within 24 hours (this is an administrative limit intended to allow preventive maintenance to be performed). The intent of the 7 day limit (i.e., the extended completion time (CT) beyond the initial 24 hours) is to restore an inoperable inverter following an inverter failure (i.e., to support online corrective maintenance).
With a required inverter inoperable, the following compensatory actions will be taken:
: 1. Entry into Required Action A.1 will not be planned concurrent with Emergency Diesel Generator (EDG) maintenance on the associated train.
: 2. Entry into Required Action A.1 will not be planned concurrent with planned maintenance on another RPS or ECCS/RCIC actuation logic channel that could result in that channel being in a tripped condition.
These actions are taken because it is recognized that with an inverter inoperable and the instrument bus being powered by the regulating transformer, instrument power for that train is dependent on power from the associated EDG following a loss of offsite power event.
(continued)
CLINTON                             B 3.8-71                  Revision No. 21-7

Inverters  Operating B 3.8.7 BASES ACTIONS A.1   (continued)
When the Division 1 NSPS inverter is unavailable, the following compensatory actions will be taken.
: 1. Entry into the extended inverter CT will not be planned concurrent with shutdown service water maintenance.
: 2. Entry into the extended inverter CT will not be planned concurrent with Division 3 (HPCS) maintenance including the Division 3 battery or charger.
: 3. Entry into the extended inverter CT will not be planned concurrent with maintenance unavailability of the Division 1 or 2 DC components (i.e., batteries or chargers).
: 4. Entry into the extended inverter CT will not be planned concurrent with maintenance unavailability of the Division 1 NSPS regulating transformer.
During Modes 1, 2 and 3, should the Division 1 NSPS inverter be removed from service for more than 24 hours, then, within 24 hours of removal from service the following will be performed.
: 1. Conduct walkdowns in Fire Zones A-2k, A-3d, A-3f, CB-1f, CB-2, CB-3a, CB-4, R-1i (southwest corner of R-S line), R-1p (southwest corner of R-S line), R-1t, and T-1f (south end of R-S line), confirming that there are no unauthorized combustibles or other unusual fire hazards in these areas.
: 2. Inspect Main Control Room panel 1H13-P870, confirming that there are no unauthorized combustibles or other unusual fire hazards in the cabinet.
: 3. Ensure that the fire protection sprinklers are available for Fire Zones CB-2, CB-3a and CB-4.
: 4. Hot work will not be permitted in the above areas during this extended maintenance period.
To minimize the potential for a plant trip, when either a Division 1 or 2 NSPS inverter is unavailable, the following compensatory action will be taken.
: 1. Entry into the extended inverter CT will not be planned concurrent with planned maintenance on another RPS channel that could result in that channel being in a tripped condition.
(continued)
CLINTON                   B 3.8-71a                 Revision No. 12-3

Inverters  Operating B 3.8.7 BASES ACTIONS A.1   (continued)
In addition to the above, the following evaluations will be performed as part of the CPS risk management program whenever inverter maintenance is required.
: 1. Evaluate simultaneous switchyard maintenance and reliability.
: 2. Evaluate concurrent maintenance or inoperable status of any of the remaining three instrument bus inverters for the unit.
: 3. Evaluate simultaneous EDG maintenance.
B.1 If a Division 1 or 2 inverter is inoperable and not restored within the provided Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 4) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
Required Action B.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Condiseration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.
(continued)
CLINTON                   B 3.8-71b                 Revision No. 13-2

Inverters  Operating B 3.8.7 BASES ACTIONS        C.1 (continued)
With one or more Division 3 or 4 inverters inoperable, the associated Division 3 ECCS subsystem may be incapable of performing intended function and must be immediately declared inoperable. This also requires entry into applicable Conditions and Required Actions for LCO 3.5.1, "ECCS  Operating."
D.1.1, D.1.2, and D.2 With one RPS solenoid bus inverter inoperable it may be incapable of providing voltage and frequency regulated power sufficient to protect the loads connected to the bus. In this condition, the source of power must be transferred or removed from service. If the RPS bus power is transferred to its alternate source, an additional ACTION is required to periodically monitor the frequency on the bus. This frequency is designed to be limited by the in-line RPS electric power monitoring assembly (required by LCO 3.3.8.2, "RPS Electric Power Monitoring"), however, in the event of a single failure, frequency protection would not be available.
Should frequency be discovered < 57 Hz, additional ACTIONS are required in LCO 3.3.8.2 due to the inoperable RPS electric power monitoring assembly.
The 1 hour Completion Time is sufficient for plant personnel to take corrective actions and is acceptable because it minimizes risk while allowing time for restoration, transfer or removal of the RPS bus power supply from service.
E.1 With both RPS solenoid bus inverters inoperable both RPS buses may be incapable of providing voltage and frequency regulated power sufficient to protect the loads connected to the buses. In this condition, the source of power must be transferred or removed from service, however, only one RPS bus is allowed to be powered from an alternate source at any one time. Therefore, at least one RPS solenoid bus must be de-energized. The remaining affected bus will be de-energized or powered from its alternate source in accordance with Condition D.
The 1 hour Completion Time is sufficient for plant personnel to take corrective actions and is acceptable because it minimizes risk while allowing time for restoration or removal of the RPS bus power supply from service.
(continued)
CLINTON                          B 3.8-72                 Revision No. 13-2

Inverters  Operating B 3.8.7 BASES ACTIONS        F.1 and F.2 (continued)
If the inoperable devices or components cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE   SR  3.8.7.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and uninterruptible AC buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation connected to the uninterruptible AC buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to voltage and frequency values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 5).
REFERENCES     1. USAR, Chapter 8.
: 2. USAR, Chapter 6.
: 3. USAR, Chapter 15.
: 4. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 5. Calculation IP-0-0131.
CLINTON                         B 3.8-73                  Revision No. 14-2

Inverters  Shutdown B 3.8.8 B 3.8   ELECTRICAL POWER SYSTEMS B 3.8.8   Inverters  Shutdown BASES BACKGROUND         A description of the inverters is provided in the Bases for LCO 3.8.7, "Inverters  Operating."
APPLICABLE         The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES    transient accident analyses in the USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The DC to AC divisional inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the Reactor Protection System (RPS) and Emergency Core Cooling Systems instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.
The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
The OPERABILITY of the minimum inverters to each uninterruptible AC bus during MODES 4 and 5, and during movement of irradiated fuel assemblies in the primary or secondary containment ensures that:
: a. The facility can be maintained in the shutdown or refueling condition for extended periods;
: b. Sufficient instrumentation and control capability are available for monitoring and maintaining the unit status; and
: c. Adequate power is available to mitigate events postulated during shutdown, such as a fuel handling accident.
The inverters were previously identified as part of the Distribution System and, as such, satisfy Criterion 3 of the NRC Policy Statement.
(continued)
CLINTON                              B 3.8-74                  Revision No. 20-2

Inverters  Shutdown B 3.8.8 BASES   (continued)
LCO                 One Divisional inverter associated with the Division 1 or Division 2 onsite Class 1E uninterruptible AC bus electrical power distribution subsystem(s) required OPERABLE by LCO 3.8.10, "Distribution Systems - Shutdown," is required to be OPERABLE. Similarly, when the High Pressure Core Spray (HPCS) System is required to be OPERABLE, the Division 3 and Division 4 inverters associated with the Division 3 and Division 4 onsite Class 1E uninterruptible AC bus electrical power distribution subsystems required OPERABLE by LCO 3.8.10 are required to be OPERABLE.
The inverters ensure the availability of electrical power for the instrumentation for systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or postulated DBA. The four battery powered divisional inverters provide uninterruptible supply of AC electrical power to the uninterruptible AC buses even if the 4.16 kV safety buses are de-energized. OPERABLE NSPS inverters require the associated bus be powered by the inverter through inverted DC voltage from the required Class 1E DC bus, with the output within the design voltage and frequency tolerances.
This ensures the availability of sufficient inverter power sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
APPLICABILITY       The divisional inverters required to be OPERABLE in MODES 4 and 5 and also any time during movement of irradiated fuel assemblies in the primary or secondary containment provide assurance that:
: a. Systems that provide core cooling are available;
: b. Systems needed to mitigate a fuel handling accident are available;
: c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and (continued)
CLINTON                              B 3.8-75                  Revision No. 20-2

Inverters  Shutdown B 3.8.8 BASES APPLICABILITY d. Instrumentation and control capability is available (continued)      for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.
Inverter requirements for MODES 1, 2, and 3 are covered in LCO 3.8.7.
ACTIONS       The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require reactor shutdown.
A.1, A.2.1, A.2.2, and A.2.3 If two divisions are required by LCO 3.8.10, "Distribution Systems  Shutdown," the remaining OPERABLE divisional inverters may be capable of supporting sufficient required feature(s) to allow continuation of CORE ALTERATIONS and fuel movement. By the allowance of the option to declare required feature(s) inoperable with the associated divisional inverter(s) inoperable, appropriate restrictions are implemented in accordance with the affected required feature(s) of the LCOs' ACTIONS. In many instances, this option may involve undesired administrative efforts.
Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment).
Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.
These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required divisional inverters and to continue this action until restoration is accomplished in order to provide the necessary divisional inverter power to the plant safety systems.
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required divisional inverters should be (continued)
CLINTON                         B 3.8-76                  Revision No. 20-2

Inverters  Shutdown B 3.8.8 BASES ACTIONS           A.1, A.2.1, A.2.2, A.2.3, and A.2.  (continued) completed as quickly as possible in order to minimize the time the plant safety systems may be without power or powered from a constant voltage source transformer.
SURVEILLANCE      SR  3.8.8.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and uninterruptible AC buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation connected to the uninterruptible AC buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to voltage and frequency values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).
REFERENCES        1. USAR, Chapter 6.
: 2. USAR, Chapter 15.
: 3. Calculation IP-0-0131.
CLINTON                            B 3.8-77                  Revision No. 14-2

Distribution SystemsOperating B 3.8.9 B 3.8   ELECTRICAL POWER SYSTEMS B 3.8.9   Distribution Systems  Operating BASES BACKGROUND         The onsite Class 1E AC and DC electrical power distribution systems are divided by division into three independent AC, four independent DC, and four divisional uninterruptible AC bus electrical power distribution subsystems.
The primary AC distribution system consists of each 4.16 kV Engineered Safety Feature (ESF) bus that has at least one separate and independent offsite source of power, as well as a dedicated onsite diesel generator (DG) source. Each 4.16 kV ESF bus is normally connected to a preferred source.
If all offsite sources are unavailable, the onsite emergency DGs supply power to the 4.16 kV ESF buses. The DC distribution system provides control power for the 4.16 kV breakers which is supplied from the Class 1E batteries.
Additional description of this system may be found in the Bases for LCO 3.8.1, "AC Sources  Operating," and the Bases for LCO 3.8.4, "DC Sources  Operating."
The secondary plant AC distribution system includes 480 V ESF load centers and associated loads, motor control centers, and transformers.
The 120 V uninterruptible AC buses are arranged in four divisions and are normally powered from an inverter supplied with DC. The alternate power supply for the uninterruptible AC buses is a Class 1E constant voltage source transformer powered from the same division as the associated inverter; its use is governed by LCO 3.8.7, "Inverters  Operating."
Each constant voltage source transformer is powered from AC.
There are four independent 125 VDC electrical power distribution subsystems. The list of distribution buses is located in Table B 3.8.9-1.
APPLICABLE         The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES    transient analyses in the USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume ESF systems are OPERABLE. The AC, DC, and uninterruptible AC bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure (continued)
CLINTON                              B 3.8-78                     Revision No. 0

Distribution Systems  Operating B 3.8.9 BASES APPLICABLE      the availability of necessary power to ESF systems so that SAFETY ANALYSES the fuel, Reactor Coolant System, and containment design (continued)   limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.
The OPERABILITY of the AC, DC, and uninterruptible AC bus electrical power distribution systems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the plant (Ref. 4). This includes maintaining the AC and DC electrical power sources and associated distribution systems OPERABLE during accident conditions in the event of:
: a. An assumed loss of all offsite or onsite AC electrical power; and
: b. A worst case single failure.
The AC, DC, and uninterruptible AC bus electrical power distribution systems satisfy Criterion 3 of the NRC Policy Statement.
LCO             The required AC, DC, and uninterruptible AC bus power distribution subsystems listed in Table B 3.8.9-1 ensure the availability of AC, DC, and uninterruptible AC bus electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. The required AC, DC, and uninterruptible AC bus electrical power primary distribution subsystems are required to be OPERABLE.
Maintaining the required AC, DC, and uninterruptible AC bus electrical power distribution subsystems OPERABLE ensures that the redundancy incorporated into the design of ESF is not defeated. Any two of the three divisions of the AC distribution system are capable of providing the necessary electrical power to the associated ESF components.
Therefore, a single failure within any system or within the electrical power distribution subsystems does not prevent safe shutdown of the reactor.
(continued)
CLINTON                          B 3.8-79                     Revision No. 0

Distribution Systems  Operating B 3.8.9 BASES LCO           OPERABLE electrical power distribution subsystems require (continued) the associated buses to be energized to their proper voltages. OPERABILITY of the power sources for the electrical power distribution subsystems addressed by this LCO are addressed by their respective LCOs.
APPLICABILITY The electrical power distribution subsystems are required to be OPERABLE in MODES 1, 2, and 3 to ensure that:
: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and
: b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained, in the event of a postulated DBA.
A Note has been added taking exception to the Applicability requirements for the Division 3 and 4 electric power distribution subsystems, provided the HPCS System is declared inoperable. This exception is intended to allow declaring of HPCS inoperable either in lieu of declaring the Division 3 or 4 electric power distribution subsystem inoperable, or at any time subsequent to entering ACTIONS for an inoperable Division 3 or 4 electric power distribution subsystem. This exception is acceptable since, with HPCS inoperable and the associated ACTIONS entered, the Division 3 and 4 AC electric power distribution subsystems provide no additional assurance of meeting the above criteria.
Electrical power distribution subsystem requirements for MODES 4 and 5 are covered in the Bases for LCO 3.8.10, "Distribution Systems  Shutdown."
(continued)
CLINTON                        B 3.8-80                   Revision No. 1-1

Distribution Systems  Operating B 3.8.9 BASES   (continued)
ACTIONS             A.1 With one or more Division 1 or 2 required AC buses, load centers, motor control centers, or distribution panels (except uninterruptible AC buses), in one division inoperable, the remaining AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure.
The overall reliability is reduced, however, because a single failure in the remaining power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the required AC buses, load centers, motor control centers, and distribution panels must be restored to OPERABLE status within 8 hours or in accordance with the Risk Informed Completion Time Program. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable if there is a loss of function.
The Condition A worst scenario is one division without AC power (i.e., no offsite power to the division and the associated DG inoperable). In this Condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operators' attention be focused on minimizing the potential for loss of power to the remaining division by stabilizing the unit, and on restoring power to the affected division. The 8 hour time limit before requiring a unit shutdown in this Condition is acceptable because:
: a. There is potential for decreased safety if the unit operators' attention is diverted from the evaluations and actions necessary to restore power to the affected division to the actions associated with taking the unit to shutdown within this time limit.
: b. The potential for an event in conjunction with a single failure of a redundant component in the division with AC power. (The redundant component is verified OPERABLE in accordance with Specification 5.5.10, "Safety Function Determination Program (SFDP).")
(continued)
CLINTON                              B 3.8-81                  Revision No. 21-7

Distribution Systems  Operating B 3.8.9 BASES ACTIONS       B.1 (continued)
With one or more Division 1 or 2 uninterruptible AC bus inoperable, the remaining OPERABLE uninterruptible AC buses are capable of supporting the minimum safety functions necessary to shut down and maintain the unit in the safe shutdown condition. Overall reliability is reduced, however, because an additional single failure could result in the minimum required ESF functions not being supported.
Therefore, the required uninterruptible AC bus distribution subsystems must be restored to OPERABLE status within 8 hours or in accordance with the Risk Informed Completion Time Program by powering the bus from the associated Class 1E constant voltage source transformer. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable if there is a loss of function.
Condition B may represent one uninterruptible AC bus distribution subsystem without power; potentially both the DC source and the associated AC source nonfunctioning. In this situation, the plant is significantly more vulnerable to a complete loss of all noninterruptible power. It is, therefore, imperative that the operator's attention focus on stabilizing the plant, minimizing the potential for loss of power to the remaining uninterruptible AC buses, and restoring power to the affected buses.
This 8 hour limit is more conservative than Completion Times allowed for the majority of components that are without adequate uninterruptible AC power. Taking exception to LCO 3.0.2 for components without adequate uninterruptible AC (continued)
CLINTON                        B 3.8-82                  Revision No. 21-7

Distribution Systems  Operating B 3.8.9 BASES ACTIONS B.1  (continued) power, that would have Required Action Completion Times shorter than 8 hours if declared inoperable, is acceptable because of:
: a. The potential for decreased safety when requiring a change in plant conditions (i.e., requiring a shutdown) while not allowing stable operations to continue;
: b. The potential for decreased safety when requiring entry into numerous applicable Conditions and Required Actions for components without adequate uninterruptible AC power, while not providing sufficient time for the operators to perform the necessary evaluations and actions to restore power to the affected division;
: c. The potential for an event in conjunction with a single failure of a redundant component.
The 8 hour Completion Time takes into account the importance to safety of restoring the uninterruptible AC bus distribution subsystems to OPERABLE status, the redundant capability afforded by the other OPERABLE bus distribution subsystems, and the low probability of a DBA occurring during this period.
(continued)
CLINTON                  B 3.8-83                 Revision No. 20-10

Distribution Systems  Operating B 3.8.9 BASES ACTIONS       C.1 (continued)
With one or more Division 1 or 2 DC electrical power distribution subsystems in one division inoperable, the remaining DC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the required DC buses must be restored to OPERABLE status within 2 hours or in accordance with the Risk Informed Completion Time Program by powering the bus from the associated battery or charger. A Note has been provided to indicate that the Risk Informed Completion Time Program is not applicable if there is a loss of function.
Condition C may represent one division without adequate DC power, potentially with both the battery significantly degraded and the associated charger nonfunctioning. In this situation, the plant is significantly more vulnerable to a complete loss of all DC power. It is, therefore, imperative that the operator's attention focus on stabilizing the plant, minimizing the potential for loss of power to the remaining divisions, and restoring power to the affected division.
This 2 hour limit is more conservative than Completion Times allowed for the majority of components that could be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, that would have Required Action Completion Times shorter than 2 hours, is acceptable because of:
: a. The potential for decreased safety when requiring a change in plant conditions (i.e., requiring a shutdown) while not allowing stable operations to continue; (continued)
CLINTON                        B 3.8-84                  Revision No. 21-7

Distribution Systems  Operating B 3.8.9 BASES ACTIONS C.1  (continued)
: b. The potential for decreased safety when requiring entry into numerous applicable Conditions and Required Actions for components without DC power while not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected division; and
: c. The potential for an event in conjunction with a single failure of a redundant component.
The 2 hour Completion Time for DC buses is consistent with Regulatory Guide 1.93 (Ref. 3).
D.1 If the inoperable electrical power distribution system cannot be restored to OPERABLE status within the associated Completion Times, the plant must be bought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours. Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 4) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.
(continued)
CLINTON                  B 3.8-85                 Revision No. 20-10

Distribution Systems  Operating B 3.8.9 BASES ACTIONS D.1 (continued)
Required Action D.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.
However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
E.1 With one or more Division 3 or 4 electrical power distribution system(s) inoperable, the Division 3 or 4 powered systems are not capable of performing their intended functions. Immediately declaring the high pressure core spray inoperable allows the ACTIONS of LCO 3.5.1, "ECCS-Operating," to apply appropriate limitations on continued reactor operation.
F.1 Condition F corresponds to a level of degradation in the electrical distribution system that causes a required safety function to be lost. When more than one Condition is entered, and this results in the loss of a required function, the plant is in a condition outside the accident analysis. Therefore, no additional time is justified for continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown.
(continued)
CLINTON                  B 3.8-86                  Revision No. 13-2

Distribution Systems  Operating B 3.8.9 BASES (continued)
SURVEILLANCE      SR  3.8.9.1 REQUIREMENTS Meeting this Surveillance verifies that the required AC, DC, and uninterruptible AC bus electrical power distribution systems are functioning properly, with the correct circuit breaker alignment. The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained, and the appropriate voltage is available to each required bus. The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to voltage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 6).
REFERENCES        1. USAR, Chapter 6.
: 2. USAR, Chapter 15.
: 3. Regulatory Guide 1.93, December 1974.
: 4. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.
: 5. USAR, Section 8.3.
: 6. Calculation IP-0-0132.
CLINTON                            B 3.8-87                   Revision No. 14-2

Distribution Systems  Operating B 3.8.9 Table B 3.8.9-1 (page 1 of 1)
AC, DC, and Uninterruptible AC Bus Electrical Power Distribution Systems NOMINAL           DIVISION        DIVISION         DIVISION        DIVISION TYPE           VOLTAGE              1*              2*               3*              4*
AC Electrical       4160 V             1A1              1B1             1C1             ---
Power Distribution      480 V Unit          A, 1A            B, 1B            ---             ---
System         Substation 480 V MCCs        Aux. Bldg. Aux. Bldg. 1B1, Aux. Bldg. 1C1,       ---
1A1, 1A2, 1A3,   1B2, 1B3, 1B4         1C 1A4            SSW 1B           SSW 1C SSW 1A           DG 1B DG1A       Cont. Bldg. F1, Cont. Bldg.         F2, H E1, E2, G        Damper B Damper A 120 V Dist.      Aux. Bldg. 1A1  Aux. Bldg. 1B1     Aux. Bldg.
Panels        Cont. Bldg. E2  Cont. Bldg. F2      1C, 1C1 Uninterruptible      120 V           1C71-S001A      1C71-S001B       1C71-S001C      1C71-S001D AC Bus      Uninterruptible Electrical      Dist. Panel Power Distribution System DC Electrical       125 V             Bus 1A          Bus 1B           Bus 1C          Bus 1D Power Distribution     Dist. Panels           1A              1B               1C              1D System
* Each division of the AC and DC electrical power distribution systems is a subsystem.
CLINTON                                        B 3.8-88                           Revision No. 4-8

Distribution Systems  Shutdown B 3.8.10 B 3.8   ELECTRICAL POWER SYSTEMS B 3.8.10   Distribution Systems  Shutdown BASES BACKGROUND         A description of the AC, DC, and uninterruptible AC bus electrical power distribution systems is provided in the Bases for LCO 3.8.9, "Distribution Systems  Operating."
APPLICABLE         The initial conditions of Design Basis Accident and SAFETY ANALYSES    transient analyses in the USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC, DC, and uninterruptible AC bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.
The OPERABILITY of the AC, DC, and uninterruptible AC bus electrical power distribution systems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.
The OPERABILITY of the minimum AC, DC, and uninterruptible AC bus electrical power sources and associated power distribution subsystems during MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment ensures that:
: a. The facility can be maintained in the shutdown or refueling condition for extended periods;
: b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and
: c. Adequate power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.
The AC and DC electrical power distribution systems satisfy Criterion 3 of the NRC Policy Statement.
(continued)
CLINTON                              B 3.8-89                  Revision No. 20-2

Distribution Systems  Shutdown B 3.8.10 BASES   (continued)
LCO                 Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the electrical distribution system necessary to support OPERABILITY of Technical Specifications' required systems, equipment, and components  both specifically addressed by their own LCOs, and implicitly required by the definition of OPERABILITY.
OPERABILITY of the power sources for the electrical power distribution subsystem(s) addressed by this LCO are addressed by their respective LCOs.
Maintaining these portions of the distribution system energized to the proper voltages ensures the availability of sufficient power to operate the plant in a safe manner to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).
APPLICABILITY       The AC, DC, and uninterruptible AC bus electrical power dis-tribution subsystems required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary and secondary containment provide assurance that:
: a. Systems that provide core cooling are available;
: b. Systems needed to mitigate a fuel handling accident are available;
: c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and
: d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown or refueling condition.
The AC, DC, and uninterruptible AC bus electrical power distribution subsystem requirements for MODES 1, 2, and 3 are covered in LCO 3.8.9.
(continued)
CLINTON                               B 3.8-90                  Revision No. 20-2

Distribution Systems  Shutdown B 3.8.10 BASES   (continued)
ACTIONS             The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require reactor shutdown.
A.1, A.2.1, A.2.2, A.2.3, and A.2.4 Although redundant required features may require redundant divisions of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem division may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystem LCO's Required Actions.
In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment).
Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.
These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the plant safety systems.
Notwithstanding performance of the above conservative Required Actions, a required residual heat removal-shutdown cooling (RHR-SDC) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR-SDC ACTIONS would not be entered. Therefore, Required Action A.2.5 is provided to direct declaring RHR-SDC inoperable, which results in taking the appropriate RHR-SDC ACTIONS.
(continued)
CLINTON                              B 3.8-91                  Revision No. 20-2

Distribution Systems  Shutdown B 3.8.10 BASES ACTIONS           A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5  (continued)
The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the plant safety systems may be without power.
SURVEILLANCE      SR  3.8.10.1 REQUIREMENTS This Surveillance verifies that the required AC, DC, and uninterruptible AC bus electrical power distribution subsystems are functioning properly, with the buses energized. The verification of proper voltage availability on the required buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
With regard to voltage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).
REFERENCES        1. USAR, Chapter 6.
: 2. USAR, Chapter 15.
: 3. Calculation IP-0-0132.
CLINTON                            B 3.8-92                  Revision No. 14-2

SVC Protection Systems B 3.8.11 B 3.8   ELECTRICAL POWER SYSTEMS B 3.8.11   Static Var Compensator (SVC) Protection Systems BASES BACKGROUND         As described in the Bases for LCO 3.8.1, "AC Sources-Operating," each Engineered Safety Feature (ESF) electrical bus within the Class 1E AC Electrical Power Distribution system has two separate and independent offsite sources of power. From the plant switchyard, a 345-kV circuit provides AC power to each 4.16-kV ESF bus via the reserve auxiliary transformer (RAT). In addition, an electrically and physically independent 138-kV offsite power source provides AC power to each 4.16-kV ESF bus via the emergency reserve auxiliary transformer (ERAT). For each of these circuits, a permanently installed static VAR compensator (SVC) is provided which can be connected to the secondary side of the associated auxiliary power transformer (RAT or ERAT) via two (in-series) circuit breakers. The ERAT SVC and RAT SVC provide steady state, dynamic and transient voltage support to ensure that the Class 1E loads will operate as required during anticipated or postulated events. However, as noted in the Bases for LCO 3.8.1, SVC support of the offsite power sources may not be required at all times, depending on prevailing grid conditions relative to the requirements of the facility.
The internal control system for each SVC includes control and protective functions. However, backup protection is provided by a fully redundant and independent protection system, consisting of two redundant subsystems for each SVC, for fail safe performance of the overall SVC system. The redundant protection subsystems are powered from independent DC supplies. Each subsystem activates separate and independent relays, which in turn will automatically open the two main SVC circuit breakers to automatically disconnect the SVC from the 4.16-kV circuit in response to various SVC failure conditions. The SVC main circuit breakers are redundant for increased protection against breaker failure.
APPLICABLE         As noted in the Bases for LCO 3.8.1, "AC Sources-Operating,"
SAFETY ANALYSES    the initial conditions of DBA and transient analyses in the USAR assume ESF systems are OPERABLE. The AC electrical power sources, including the offsite electrical power (continued)
CLINTON                             B 3.8-93                   Revision No. 3-5

SVC Protection Systems B 3.8.11 BASES APPLICABLE      sources, are designed to provide sufficient capacity, SAFETY ANALYSES capability, redundancy and reliability to ensure the (continued)   availability of necessary power to ESF systems so that the fuel, reactor coolant system, and containment design limits are not exceeded. The RAT and ERAT SVCs provide voltage support, when required, from the associated offsite source circuits to the ESF busses and equipment supplied by those circuits. At the same time, failure and risk analyses performed for the SVCs demonstrate that a protection system for each SVC is necessary to protect ESF equipment from potential SVC failure modes that could damage or degrade the Class 1E equipment. OPERABILITY of the SVC Protection Systems is thus consistent with minimizing the potential for SVC failures to damage or degrade required ESF equipment.
Probabilistic risk assessment has shown the SVC Protection Systems to be important for the protection of required ESF systems and equipment. Therefore, the SVC Protection Systems satisfy Criterion 4 of the NRC Policy Statement.
LCO             Both redundant protection subsystems of a required SVC protection system are required to be OPERABLE to ensure no single failure will preclude protection on a valid signal.
Total SVC Protection System failure introduces the possibility of ESF equipment failure or degradation of ESF equipment connected or capable of being automatically connected to the busses supported by the SVC(s).
An SVC Protection System is considered OPERABLE when each of both SVC protection subsystems is capable of automatically opening the associated SVC main circuit breakers in response to postulated SVC failures that could potentially degrade or damage ESF equipment. OPERABILITY of an SVC protection subsystem exists when it is energized and all essential components are OPERABLE, including the associated relays and sensors (e.g., current transformers and potential transformers).
(continued)
CLINTON                          B 3.8-94                   Revision No. 4-1}}