ML16061A073

Changes to Technical Specification Bases

ML16061A073
Person / Time
Site:	Millstone
Issue date:	02/23/2016
From:	Stanley B L Dominion Nuclear Connecticut
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
16-078
Download: ML16061A073 (390)

Text

{{#Wiki_filter:Dominion Nuclea Connecticut, Inc.Rope Ferry Rd., Waterford, CT 06385omn n Mailing Address: P.O. Box 128" Waterford, CT 06385 dom. com FEB 2 32016 U. S. Nuclear Regulatory Commission Serial No. 16-078 Attention: Document Control Desk NSS&LIWEB R0 Washington, DC 20555 Docket No. 50-336 50-423 License No. DPR-65, NPF-49 ': DOMINION NUCLEAR CONNECTICUT. INC.MILLSTONE POWER STATION UNITS 2 AND 3 CHANGES TO TECHNICAL SPECIFICATION BASES In accordance with the requirements of Millstone Power Station Unit 2 (MPS2)Technical Specification (TS) 6.23.d and Millstone Power Station Unit 3 (MPS3)TS 6.18.d, Dominion Nuclear Connecticut, Inc. (DNC) is providing the Nuclear Regulatory Commission (NRC) with changes to the MPS2 and MPS3 TS Bases.DNC is submitting a complete copy of the TS Bases for both MPS2 and MPS3.These TS Bases are provided for information only. Any changes to the Bases sections were made in accordance with the provisions of 10 CFR 50.59. These changes have been reviewed and approved by the Facility Safety Review Committee. Attachments 1 and 2 provide the TS Bases in their entirety for MPS2 and MPS3, respectively. If you have any questions or require additional information, please contact Mr.Thomas G. Cleary at (860) 444-4377.Sincerely, .-B. L. Stanley Director -Nuclear Station and Licensing Serial No. 16-078 Docket Nos. 50-336 and 50-423 Changes to MPS2 and MPS3 TS Bases Page 2 of 2 Attachments:

1. Bases Pages for Millstone Power Station Unit 2 2. Bases Pages for Millstone Power Station Unit 3 Commitments made in this letter: None.cc: U.S. Nuclear Regulatory Commission Region I 2100 Renaissance Blvd. Suite 100 King of Prussia, PA 19406-2713 Richard V. Guzman NRC Senior Project Manager U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop 08 C2 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector Millstone Power Station Serial No. 16-078 Docket No. 50-336 ATTACHMENT I BASES PAGES FOR MILLSTONE POWER STATION UNIT 2 DOMINION NUCLEAR CONNECTICUT, INC.MILLSTONE POWER STATION UNIT 2 August 1, 1975 BASES FOR SECTION 2.0 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS Y

2.1 SAFETY

LIMITS May 1, 2002 BASES 2.1.1 REACTOR CORE The restrictions of this safety ]imit prevent overheating of the fuel cladding and possible cladding perforation which would result in the release Qf fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate at or less than the fuel centerline melt linear heat rate limit. Centerline fuel melting will not occur for this peak linear heat rate. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature. Operation above the upper boundary of the nucleate boI-lIing regime could result in excessive cladding temperatures because of the onset of departure from nucleate boiling (DNB) and the resultant sharp reduction in heat transfer coefficient. DNB is not a directly measurable parameter during operation and therefore THERMAL POWER and Reactor Coolant Temperature and Pressure have been related to DNB through the HIP correlation. The HIP DNB correlation has been developed to predict the DNB flux and the location of DNB for axially uniform and non-uniform heat flux distributions. The local DNB heat flux ratio, DNBR, defined as the ratio of the heat flux that would cause DNB at a particular core location to the local heat flux, is indicative of the margin to DNB.The value of the DNBR during steady state operation, normal operational transients, and anticipated transients is limited to be no less than the DNB correlation limit. The correlation limit corresponds to a 95 percent probability at a 95 percent confidence level (i.e., 95/95 limit),that DNB will not occur and is chosen as an appropriate margin to DNB for all operating conditions. The curves of Figure 2.1-1 show the loci of points of THERMAL POWER, Reactor Coolant System pressure and maximum cold leg temperature with four Reactor Coolant Pumps operating for which the minimum DNBR is no less than the 95/95 limit for the DNB correlation. The limits in Figure 2.1-1 were calculated for reactor coolant inlet temperatures less than or equal to 580°F.The dashed line at 580°F coolant inlet temperatures is not a safety limit;however, operation above 580°F is not possible because of the actuation of the main steam line safety valves which limit the maximum value of reactor inlet temperature. Reactor operation at THERMAL POWER levels higher than 111.6% of RATED THERMAL POWER is prohibited by the high power level trip setpoint specified in Table 2.2-1. The area of saf~e operation is below and to the left of these lines.Revised by NRC Letter A15689 MILLSTONE -UNIT 2 B 2-1 Amendment No. 7, Jfl, 0803 October 6, 1980 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE UNIT 2 B 2-2 MILLTONE-UNT 2 2-2Amendment No. 61 LBDCR 04-MP2-016 February 24, 2005 SAFETY LIMITS BASES: The conditions for the Thermal Margin Safety Limit curves in figure 2.1-i to be valid are shown on the figure.The reactor protective system in combination with the Limiting Conditi~ons for Operation, is designed to prevent any anticipated combination of transient conditions for reactor coolant system temperature, pressure, and THERMAL POWER level that would result in a DNBR below the 95/95 limit for DNB correlation, and preclude the existence of flow instabilities.

2.1.2 REACTOR

COOLANT SYSTEM PRESSURE The restriction of this Safety Limit protects~the integrity of the Reactor Coolant System from overpressurization and thereby prevents the release of radionuclides contained in the reactor.coolant fr-om reaching the containment atmosphere. The reactor pressure vessel and pressurizer are designled to Section III of the ASME Code for Nuclear Power Plant Components which permits a maximum transient pressure of 110%(2750 psia) of design pressure. The Reactor Coolant System piping, valves and fittings, are designed to ANSI B3 1.7, Class I which permits a maximum transient pressure of 110% (2750 psia) of component design pressure. The Safety Limit of 2750 psia is therefore consistent with the design criteria and associated code requirements. The entire Reactor Coolant System is hydrotested at 3125 psia to demonstrate integrity prior to initial operation. MILLSTONE -UNIT 2 B 2-3 Amendment No. :g, gg, 64-, l-39, 26, Acknowledged by NRC letter dated 6/28/05 October 4, 2001 2.2 LIMITING SAFETY SYSTEM SETTINGS BASES: 2.2.1t REACTOR TRIP SET POINTS The Reactor Trip Setpoints specified in Table 2.2-il are the values at which the Reactor Trips are set for each parameter. The Trip Values have been selected to ensure that the reactor core and reactor coolant system are prevented from exceeding their safety limits. Operation with a Trip Setpoint less conservative than its setpoint but within its specified Allowable 'Value is acceptable on the basis that each Allowable Value is equal to or less than the drift allowance assumed to occur for each trip used in the accident analyses.Manual Reactor Trip The Manual Reactor Trip is a redundant channel to the automatic protective instrumentation channels and provides manual reactor trip capability. Power Level-Hig~h The Power Level-High trip provides reactor core protection against reactivity excursions which are too rapid to be protected by a Pressurizer Pressure-High or Thermal Margin/Low Pressure trip.The Power Level-High trip setpoint is operator adjustable and can be set no higher than 9.6% above the indicated THERMAL POWER level. Operator action is required to increase the trip set'point as THERMvAL POWER is increased. The trip setpoint is automatically decreased as THERMAL POWER decreases. The trip setpoint has a maximum value of 106.6% of RATED THERMAL POWER and a minimum setpoint of 14.6% of RATED THERMAL POWER.Adding to this maximum value the possible variation in trip point due to calibration and instrument errors, the maximum actual steady-state THERMAL POWER level at which a trip would be actuated is 111.6% of RATED THERMAL POWER, which is the value used in the accident analyses.Reactor Coolant Flow-Low The Reactor Coolant Flow-Low trip provides core protection to prevent DNB in the event of a sudden significant decrease in reactor coolant flow.MILLSTONE -UNIT 2 B 2-4 kAmendment No. 6t-, 226, Revised by NRC Letter dated October 4, 2001 May 1, 2002 LIMIINGSAFT YTMSTIG BASES Reactor Coolant Flow-Low (Continued) The low-flow trip setpoint and Allowable Value have been derived in consideration of instrument errors and response times of equipment involved to maintain the DNBR above the 95/95 limit for the DNB correlation under normal operation and expected transients."Pressurizer Pressure-High The pressurizer Pressure-High trip, backed up by the pressurizer code safety valves and main steam line safety valves, provides reactor coolant system protection against overpressurization in the event of loss of load without reactor trip. This trip's setpoint is approximately 100 psi below the nominal lift setting (2500 psia) of the pressurizer code safety valves and it~s concurrent operation with the power-operated relief valves avoids the undesirable operation of the pressurizer code safety valves.Containment Pressure-High The Containment Pressure-High trip provides assurance that a reactor trip is initiated concurrently with a safety injection. The setpont for this trip is identical to the safety injection setpoint.Steam Generator Pressure-Low The Steam Generator Pressure-Low trip provides protection against an excessive rate of heat extraction from the steam generators and subsequent cooldown of the reactor coolant. The trip setting is sufficiently below the full-load operating point so as not to interfere with normal operation, but still high enough to provide the required protection in the event of excessively high steam flow.MILLSTONE -UNIT 2 B 2-5 Revised by NRC letter A15689 Amendment No. 5-2, 641, 4-3-9, 2-2-6, February 20, 2003 LBDCR 2-21-02 LIMITING SAFETY SYSTEM SETTINGS BASES: Steam Generator Water Level -Low The Steam Generator Water Level-Low Trip provides core protection by preventing operation with the steam generator water level below the minimum volume required for adequate heat removal capacity and assures that the design pressure of the reactor coolant system will not be exceeded.Local Power Density-High The Local Power Density-High trip, functioning from AXIAL SHAPE INDEX monitoring, is provided to ensure that the peak local power density in the fuel which corresponds to fuel centerline melting will not occur as a consequence of axial power maldistributions. A reactor trip is initiated whenever the AXIAL SHAPE INDEX exceeds the allowable limits of Figure 2.2-2. The AXIAL SHAPE INDEX is calculated from the upper and lower ex-core neutron detector channels. The calculated setpoints are generated as a function of THERMAL POWER level. The trip is automatically bypassed below 15 percent power as sensed by the power range nuclear instrument Level 1 bistable.The maximum AZIMUTHAL POWER TILT and maximum CEA misalignment permitted for continuous operation are assumed in generation of the setpoints. In addition, CEA group sequencing in accordance with the Specifications 3.1.3.5 and 3.1.3.6 is assumed. Finally, the maximum insertion of CEA banks which can occur during any anticipated operational occurrence prior to a Power Level-High trip is assumed.Thermal Margin/Low Pressure The Thermal Margin/Low Pressure trip is provided to prevent operation when the DNBR is below the 95/95 limit for the DNB correlation. MILLSTONE -UNIT 2 B 2-6 Amendment No. 3-s, 4t-, g-, 6-1-, 4-3-3, Corrected by letter dated 11/26/2003. LBDCR 14-MP2-009 May 8, 2014 LIMITING SAFETY SYSTEM SETTINGS BASES: Thermal Margin/Low Pressure (Continued) The trip is initiated whenever the reactor coolant system pressure signal drops below either 1865 psia or a computed value as described below, whichever is higher. The computed value is a function of the higher of AT power or neutron power, reactor inlet temperature, the number of reactor coolant pumps operating and the AXIAL SHAPE INDEX. The minimum value of reactor coolant flow rate, the maximum AZIMUTHAL POWER TILT and the maximum CEA deviation permitted for continuous operation are assumed in the generation of this trip function. In addition, CEA group sequencing in accordance with Specifications 3.1.3.5 and 3.1.3.6 is assumed. Finally, the maximum insertion of CEA banks which can occur during any anticipated operational~occurrence prior to a Power Level-High trip is assumed.Thermal Margin/Low Pressure trip setpoints are derived from the core safety limits. A safety margin is provided which includes allowances for equipment response times, core power, RCS tempeiature, and pressurizer pressure measurement uncertainties, processing errors, and a further allowance to compensate for the time delay associated with providing effective termination of the occurrence that exhibits the most rapid decrease in margin to the safety limit.Loss of Turbine A Loss of Turbine trip causes a direct reactor trip when operating above 15% of RATED THERMAL POWER as sensed by the power range nuclear instrument Level 1 bistable. This trip provides turbine protection, reduces the severity of the ensuing transient and helps avoid the lifting of the main steam line safety valves during the ensuing transient, thus extending the service life of these valves. No credit was taken in the accident analyses for operation of this trip. Its functional capability at the specified trip setting is required to enhancethe overall reliability of the Reactor Protection System.The Wide Range Logarithmic Neutron Flux Monitor -Shutdown, Reactor Protection System Logic Matrices, Reactor Protection System Logic Matrix Relays, and Reactor Trip Breakers flmctional units are components of the Reactor Protective System for which OPERABILITY requirements are provided within the Technical Specifications (see Technical Specification 3.3.1.1, "Reactor Protective Instrumentation). These functional units do not have specific trip set-points or allowable values, similar to the manual reactor trip functional unit.However, these functional units are provided here for completeness and consistency with the RPS Instrumentation identified in Technical Specification 3.3.1.1.MILLSTONE -UNMT 2 B 2-7 Amendment No. 5-2, 4-39, -I-5-3, 22-6,.... , ..... September 25, 2003 LIMITING SAFETY SYSTEM SETTINGS BASES: DELETED 0)MILLSTONE -UNIT 2 -" ...... ....... -........ B 2-8......... ..... ............. ..... ............ -......E- KI2 B -_ ._ -A 64-2,--t ---- .... " August 1, *1975...SECTIONS 3.0 AND 4.03 LIMITING CONDITIONS FOR ORPEATION* AND SURVEILLANCE REQUIREMENTS February 26, 1991 3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS 3/4.0 APPLICABILITY BASES Specification

3.0.1 through

3.0.4 establish the general requirements applicable to Limiting Conditions for Operation. These requirements are based on the requirements fdr Limiting Conditions for Operation stated in the Code of Federal Regulations, 10OCFR5O.36(c)(2): "Limiting conditions for oper'ation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. 'When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specification until the condition can be met." Specification

3.0.1 establishes

the Applicability statement within each individual specification as the requirement for when (i.e., in which OPERATIONAL MODES or other specified conditions) conformance to the Limiting Conditions for Operation is required for safe operation of the facility. The ACTION requirements establish those remedial measure that must be taken within specified time limits when the requirements of a Limiting Condition for Operation are not met.There are two basic types of ACTION requirements. The first specifies the remedial measures that permit continued operation of the facility which is not further restricted by the time limits of the ACTION requirements. In this case, conformance to the ACTION requirements provides an acceptable level of safety for unlimited continued operation as long as the ACTION requirements continue to be met. The second type of ACTION requirement specifies a time limit in which conformance to the conditions of the Limiting Condition for Operation must be met. This time limit is the allowable outage time to restore an inoperable system or component to OPERABLE status or for restoring parameters within specified limits. If these actions are not completed within the allowable outage time limits, a shutdown is required to place the facility in a MODE or condition in which the specification no longer applies. It is not intended that the shutdown ACTION requirements be used as an operational convenience which permits (routine) voluntary removal of a system(s) or component(s) from service in lieu of other alternatives that would not result in redundrant systems or components being inoperable. The specific time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. The time limits of the ACTION requirements are also applicable when a system or component is removed from service for surveillance testing or investigation of operational problems. Individual specifications may.include a specified time limit for the completion of a Surveillance Requirement when equipment is removed from service. In this case, the allowable outage time MILLSTONE -UNIT 2 B 3/40-1 MILLTONE-UIT 2B 3/0-IAmendment Nos. 61, 151 LBDCR 04-MP2-016 February 24, 2005 3/4.0 APPLICABILITY BASES (Con't) 0 )limits of ACTION requirements are applicable when this limit expires if the surveillance has not been completed. When a shutdown is required to comply with ACTION requirements, the plant may have entered a MODE in which a new specification becomes applicable. In this case, the time limits of the ACTION requirements would apply from the point in time that~the new specification becomes applicable if the requirements of the Limiting Condition for Operation are not met.Specification

3.0.2 establishes

that noncompliance with a specification exists when the requirements of the Limiting Condition for Operation are not met and the associated ACTION requirements have not been implemented within the specified time interval. The purpose of this specification is to clarify that (1) implementation of the ACTION requirements within the specified time interval constitutes compliance with a specification and (2) completion of the remedial measures of the ACTION requirements is not required when compliance with a Limiting Condition of Operation is restored within the time interval specified in the associated ACTION requirements. Specification

3.0.3 establishes

the shutdown ACTION requirements that must be implemented when a Limiting Condition for Operation is not met and the condition is not specifically addressed by the associated ACTION requirements. The purpose of thlis specification is to delineate the time limits for placing the unit in a safe operation defined by the Limiting Conditions for Operation and its ACTION requirements. It is not intended to be used as an operational convenience which permits (routing) voluntary removal of .redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. This time permits the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the cooldown capa~bilities of the facility assuming only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the primarY coolant system and the potential for a plant upset that could challenge safety systems under conditions for which this specification applies.If remedial measure permitting limited continued operation of the facility under the provisions of the ACTION requirements are completed, the shutdown may be terminated. The time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. Therefore, the shutdown may be terminated if the ACT[ON requirements have been met or the time limits of the ACTION requirements have not expired, thus providing an allowance for the completion of the required ACTIONS.0 " MILLSTONE -UNIT 2 B 3/4 0-2 Amendment Nos. 6-2, 4-5--, Acknowledged by NRC letter dated 6/28/05 February 26, 1991 APPLICABILITY BASES (Con't)The time limits of Specification

3.0.3 allow

37 hours for the plant to be in the COLD SHUTDOWN MODE when a shutdown is required duiing the POWER MODE of operation. If the plant is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE of operation applies. However, if a lower MODSE of operation is reached in less time than allowed, the total allowance time to reach COLD SHUTDOWN, or other applicable MODE, is not reduced. For example, if HOT STANDBY is reached in 2 hours, the time allowed to reach HOT SHUTDOWN is the next 11 hours because the total time to reach HOT SHUTDOWN is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to POWER operation, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.The same principle applies with regard to the allowable outage time limits of the ACTION requirements, if compliance with the ACTION requirements for one specification results in ently into a MODE or condition of operation for another specification in which the requirements of the Limiting Condition for Operation are not met. If the new specification becomes applicable in less time than specified, the difference may be added to the allowable outage time limits of the second specification. However, the allowable outage time limits of ACTION requirements for a higher MODE of operation may not be used to extend the allowable outage time that is applicable when a Limiting Condition for 'Operation is not met in a lower MODE of operation. The shutdown requirements of Specification 3.0.3 do not apply in MODES 5 and 6, because the ACTION requirements of individual specifications define the remedial measures to be taken.Specification

3.0.4 establishes

limitations on MODE changes when a Limiting Condition for Operation is not met. It precludes placing the facility in a higher MODE of operation when the requirements for a Limiting Condition for Operation are not met and continued noncompliance to these conditions would result in a shutdown to comply with the ACTION requirements if a change in MODES were permitted. The purpose of this specification is to ensure that facility operation is not initiated or that higher MODES of operation are not entered wheni corrective action is being traken to obtain compliance with a specification by restoring equipment to OPERABLE status or parameters to specified limits. Compliance with ACTION requirements that permit continued operation of the facility for an unlimited period of time provides an acceptable level of safety for continued operation without regard to the status of the plant before.or after a MODE change. Therefore, in this case, entry into an OPERATIONAL MODE or other specified condition may be made in accordance 'with the provision of the ACTION requirements. The provisions of this specification should not, however, be interpreted as endorsing the failure to exercise good practice in restoring systems or components to OPERABLE status before plant startup.MILLSTONE -UNIT 2 B 3/4 0-3 MILLTON -NIT2 B3/40-3Amendment Nos. 62, 15 l LBDCR 04-MP2-016 February 24, 2005 APPLICABILITY BASES (Con't) 0 : When a shutdown is required to comply with ACTION requirements, the provisions of Specification 3.0.4 do not apply because they would delay placing the facility in a lower MODE of operation. Specification

3.0.5 delineates

what additional conditions must be satisfied to permit operation to continue, consistent with the ACTION statements for power sources, when a normal or emergency power source in not OPERABLE. It specifically prohibits operation when one division is inoperable because its normal or emergency power source is inoperable and a system, subsystem, train, component or device in another division is inoperable for another reason.The provisions of this specification permit the ACTION statements associated with individual systems, subsystems, trains, components, or devices to be consistent with the ACTION statements of the associated electrical power source. It allows operation to be governed by the time limits of the ACTION statement associated with the Limiting Condition for Operation for the normal or emergency power source, not the individual ACTION statements for each system, subsystem, train, component or device that is determined to be inoperable solely because of the inoperability of its normal emergency power source.For example, Specification 3.8.1.1 requires in part that two emergency diesel generators be OPERABLE. The ACTION statement provides for a 72-hour out-of-service time when one emergency diesel generator is not OPERABLE. If the definition of OPERABLE were applied without consideration of Specification 3.0.5, all systems, subsystems, trains, components and devices supplied by the inoperable emergency power source would also be inoperable. This would dictate invoking the applicable ACTION statement for each of the applicable Limiting Conditions for Operation. However, the provisions of Specification

3.0.5 permit

the time limits for continued operation to be consistent with the ACTION statement for the inoperable emergency diesel generator instead, provided the other specified conditions are satisfied. In this case, this would mean that the corresponding normal power source must be OPERABLE, and all redundant systems, subsystems, trains, components, and devices must be OPERABLE, or otherwise satisfy.Specification 3.0.5 (i.e., be capable of performing their design function and have at least one normal or one emergency power source OPERABLE). If they, are not satisfied, ACTION is required in accordance with this specification. As a further example, Specification 3.8.1.1 requires in part that two physically independent circuits between the offsite transmission network and the onsite Class 1 E distribution system be OPERABLE. The ACTION statement provides a 24-hour out-of-service time when both required offsite circuits are not OPERABLE. If the definition of OPERABLE were applied without consideration of Specification 3.0.5, all systems, subsystems, trains, components and devices supplied by the inoperable normal power sources, both of the offsite circuits, would also be inoperable. This would dictate invoking the applicable ACTION statements for each of the applicable LCOs. However, the provisions of Specification

3.0.5 permit

the time limits for continued operation toV MILLSTONE -UNIT 2 B 3/4 0-4 Amendment Nos. 7:4, 4-54-, Acknowledged by NRC letter dated 6/28/05 LB DCR 04-MP2-016 February 24, 2005 BASES (Can't)be consistent with the ACTION statement for the inoperable normal power sources instead, provided the other specified conditions are satisfied. In this case, this would mean that for one division the emergency power source must be OPERABLE (as must be the components supplied by the emergency power source) and all redundant systemas, subsystems, trains, components and devices in the other divisions must be OPERABLE, or likewise satisfy Specification 3.0.5 (i.e., bel capable of performing their design functions and have an emergency power source OPERABLE). In other words, both emergency power sources must be OPERABLE and all redundant systems, subsystems, trains, components and devices in both divisions must also be OPERABLE. If these conditions are not satisfied, ACTION is required in accordance with this specification. In MODES 5 and 6 Specification 3.0.5 is not applicable, and thus 'the individual ACTION statements for each applicable Limiting Condition for Operation in these MODES must be adhered to.Specification

3.0.6 establishes

the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to' provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required ACTION(s)) to allow the performance of surveillance requirements to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allo~ved surveillance requirements. The Specification does not provide time to perform any other preventive or corrective maintenance. An example of demonstrating the OPERABILITY of equipment being returned to service is reopening a containment isolation valve that has been closed to comply with the Required ACTIONS andTnust be reopened to perform the surveillance requirements. An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of a surveillance requirement on another channel in the other trip system.A similar example of demonstrating the OPERABILITY of other equipment is taking an-inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of a surveillance requirement on another channel in the same trip system.MILLSTONE -UNIT 2 B 3/4 0-5 Amendment No. 4-54, 4-52, 30, Acknowledged by NRC letter dated 6/28/05 October 15, 2002 BASES (Con't).9O Specification 4.0.1l through 4.0.5 establish the general requirements applicable to Surveillance Requirements. These requirements are based on the Surveillance Requirements stated in the Code of Federal Regulations, 10OCFR50.3 6(c)(3): "Surveillance requirements are requirements relating to test, calibration, or inspection to ensure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met.".Specification

4.0.1 establishes

the requirement that surveillances must be met during the OPERATIONAL MODES or other conditions for which the requirements of the Limiting Conditions for Operation apply unless otherwise stated in an individual Surveillance Requirements. The purpose of this specification is to ensure that surveillances are performed to verify the OPERABILITY of systems and components and that parameters are within specified limits to ensure safe operation of the facility when the plant is in a MODE or other specified condition for which the associated Limiting Conditions for Operation are applicable. Failure to meet a Surveillance within the specified surveillance interval, in accordance with Specification

4.0.2 constitutes

a. failure to meet a Limiting Condition for Operation.

Systems and components are assumed to be OPERABLE when the associated Surveillance Requirements have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when either: a. The system or components are known to be inoperable, although still meeting the Surveillance Requirements or 9.b. The requirements of the Surveillance(s) are known to be not met between required Surveillance performances. Surveillance Requirements do not have to be performaed when the facility is in an Operational Mode or other specified conditions for which the requirements of the associated Limiting Condition for Operation do not apply unless otherwise specified. The Surveillance Requirements associated with a Special Test Exception are only applicable when the Special Test Exception is used as an allowable exception to the requirements of a specification. Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given Surveillaiice Requirement. In this case, the unplanned event may be credited as fulfilling the performance of the Surveillance Requirement. This allowance includes those Surveillance Requirements whose performance is normally precluded in a given Mode or other specified condition. Surveillance Requirements, including Surveillances invoked by ACTION requirements, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with Specification 4.0.2, prior to returning equipment to Operable status.Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with Specification 4.0.2. Post maintenance testing may not be MILLSTONE -UNIT 2 B 3/4 0-5a Amendment No. 30, 271 LBDCR No. 04-MP2-016 February 24, 2005 BASES (Can't)possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed. -..Some examples of this process are: a. Auxiliary feedwater (AFW) pump turbine maintenance during refueling that requires testing at steam pressure > 800 psi. However, if other appropriate testing.is satisfactorily completed, the AFW System can be considered OPERABLE. This allows startup and other necessary testing to proceed until the plant reaches the..steam pressure required to perform the testing.b. High pressure safety injection (HPSI) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPSI considered OPERABLE.This allows operation to reach the specified pressure to complete the necessary" post maintenance testing.Specification 4.0.2 This specification establishes the limit for which the specified time interval for Surveillance Requirements may be extended. It permits an allowable extension of the formal.surveillance interval to facilitate surveillance scheduling and consideration of plant operating conditions that may not be suitable for conducting the surveillance; e.g., transient conditions or .other ongoing surveillance or maintenance activities. It also provides flexibility to accommodate the length of a fuel cycle for surveillances that are performed at each refueling outage and are specified with an 18-month surveillance interval. It is not intended that this provision be used repeatedly as a convenience to extend surveillance intervals beyond that specified for surveillances that are not performed during refueling outages. The limitation of Specification 4.0.2 is based on engineering judgment and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the Surveillance; Requirements. This provision is sufficient to ensure that the reliability ensured through surveillance activities is not significantly degraded beyond that obtained from the specified.surveillance interval.Specification

4.0.3 establishes

the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified surveillance interval. A delay period of up to 24 hours or up to the limit of the specified siurveillance interval, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with Specification 4.0.2, and not at the time that the specified surveillance interval was not met.This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with ACTION requirements or other remedial measures that mnight preclude completion of the Surveillance. MILLSTONE -UNIT 2 B 3/4 0-Sb Amendment No. 23-0, 2-7-1-, Acknowledged by NRC letter dated 6/28/05 LBDCR 04-MP2-016 February 24, 2005 BASES (Con't)0: The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements. When a Surveillance. with a surveillance interval based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations, (e.g., prioft0 entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, Specification

4.0.3 allows

for the full delay period of up to the specified surveillance interval to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity. Specification

4.0.3 provides

a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by ACTION requirements. Failure to comply with specified surveillance intervals for the Surveillance Requirements is expected to be an infrequent occurrence. Use of the delay period established by Specification 4.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours or the limit of the specified surveillance interval is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to d : perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, *planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1. 182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration* of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent cofidition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action- All missed Surveillances will be placed in the licensee's Corrective Action Program.If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the entry into the ACTION requirements for the applicable Limiting Condition for Operation begins immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and entry into the ACTION requirements for the applicable Limiting Condition for Operation begins immediately upon the failure of the Surveillance. Completion of the Surveillance within the delay period allowed by this Specification, or within the Allowed Outage Time of the applicable ACTIONS, restores compliance with Specification 4.0. l. 0: MILLSTONE -UNIT 2 B 3/4 0 -6 Amendment No. 2-7-1-, Acknowledged by NRC letter dated 6/28/05 -June 19, 2007 LBDCR 07-MP2-014 3/4.0 APPLICABILITY BASES (Con't)Specification

4.0.4 establishes

the requirement that all applicable surveillances must be met before entr}, into and OPERATIONAL MODE or other condition of operation specified in the Applicability statement. The purpose of this specification is to ensure that system and component OPERABILITY requirements or parameter limits are met before entry into a MODE or condition for which these systems and components ensure safe operation of the facility. This provision applies to changes in OPERATIONAL MODES or other specified conditions associated with plant shutdown as well as startup.Under the provisions of this specification, the applicable Surveillance Requirements must be performed within the specified surveillance interval to ensure that the Limiting Conditions for Operation are met during initial plant startup or following a plant outage.When a shutdown is required to comply with ACTION requirements, the provisions of Specification 4.0.4 do not apply because this would delay placing the facility in a lower MODE of operation. Specification

4.0.5 establishes

the requirement that inservice testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with a periodically updated version of the ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code) and applicable Addenda as required by 10 CFR 50.55a(f). These requirements apply except when relief has been provided in writing by the Commission. This specification includes a clarification of the frequencies for performing the inservice testing activities required by the ASME OM Code and applicable Addenda. This clarification is provided to ensure consistency in surveillance intervals throughout the Technical Specifications and to remove any ambiguities relative to the frequencies for performing the required inservice testing activities. Under the terms of this specification, the more restrictive requirements of the Technical Specifications take precedence over the ASME OM Code and applicable Addenda. The requirements of Specification 4.0.4 to perform surveillance activities before entry into an OPERATIONAL MODE or other specified condition takes precedence over the ASME OM Code provision which allows pumps and valves to be tested up to one week after return to normal operation. MILLSTONE -UNIT 2B3/0-AmnetNo---I B 3/4 0-7 Amendment No. 4-54 REVERSE OF PAGE B 3/4 0-7 INTENTI.ONALLY LEFT BLANK September 25, 2003 3/4.1 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1 REACTIVITY CONTROL SYSTEMS 3/4.1.1.1 SHUTDOWN MARGIN A sufficient SHUTDOWN MARGIN ensures that 1) the reactor can be made subcritical from all operating conditions, 2) the reactivity transients associated with postulated accident conditions are controllable within acceptable limits, and 3) the reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition. SHUTDOWN MARGIN requirements vary throughout core life as a function of fuel depletion, RCS boron concentration, and RCS Tavg The most restrictive conditiori occurs at EOL, with Tav at no load operating temperature, and is associated with a postulated steam line break accident and resulting uncontrolled RCS cooldown. In the analysis of this accident, the minimum SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT is initially required to control the reactivity transient. Accordingly, the SHUTDOWN MARGIN required by Specification 3.1.1.1 is based upon this limiting condition and is consistent with FSAR accident analysis assumptions. For earlier periods during the fuel cycle, this value is conservative. The SHUTDOWN MARGIN is verified by performing a reactivity balance calculation, considering the listed reactivity effects: a. RCS boron concentration;

b. CEA positions;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;

e. Xenon concentration;

f. Samarium concentration; and g. Isothermal temperature coefficient (ITC).Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical and the fuel temperature will be changing at the same rate as the RCS temperature.

3/4.1.1.2 REACTIVITY BALANCE Reactivity balance is used as a measure of the predicted versus measured core reactivity during power operation. The periodic confirmation of core reactivity is necessary to ensure that Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity difference could be the result of unanticipated changes in fuel, control element assembly (CEA) worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity, and could potentially result in a loss of SHUTDOWN MARGIN (SDM) or violation of acceptable fuel design limits. Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analy sis and supports the SDM demonstrations (LCO 3.1.1.1,"SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to cold, subcritical conditions. The normalization of predicted RCS boron concentration to the measured value is typically performed after reaching RATED THERMAL POWER following startup from a refueling outage, with the CEAs in their normal positions for power operation. The normalization is performed at BOC conditions, so that core MILLSTONE -UNIT 2 B3/4 1-1 MILLTON -NIT2 B3/41-1Amendment No. 39, 4-48, 8-, 280 September 9, 2004 3/4.1 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1 REACTIVITY CONTROL SYSTEMS (Continued) 3/4.1.1.2 REACTIVITY BALANCE (Continued) reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.When measured core reactivity is within +1% Ak/k of the predicted value at steady state thermal conditions, the core is considered to be operating within acceptable design limits.The limits on core reactivity must be maintained during MODES 1 and 2 because a reactivity balance must exist when the reactor is critical or producing THERMAL POWER. This Specification does not apply in MODES 3 ,4 and 5 because the reactor is shut down and the reactivity balance is not changing.In MODE 6, fuel loading results in a continually changing core reactivity. Boron concentration requirements (LCO 3.9.1, "Boron Concentration") ensure that fuel movements are performed within the bounds of the safety analysis.3/4.1.1.3 BORON DILUTION A minimum flow rate of at least 1000 GPM provides adequate mixing, prevents stratification and ensures that reactivity changes will be gradual during reductions in Reactor Coolant System boron concentration. The 1000 GPM limit is the minimum required shutdown cooling flow to satisfy the boron dilution accident analysis. This 1000 GPM flow is an analytical limit. Plant operating procedures maintain the minimum shutdown cooling flow at a higher value to accommodate flow measurement uncertainties. While the plant is operating in reduced inventory operations, plant operating procedures also specify an upper flow limit to prevent vortexing in the shutdown cooling system. A flow rate of at least 1000 GPM will circulate the full Reactor Coolant System volume in approximately 90 minutes. With the RCS in mid-loop operation, the Reactor Coolant System volume will circulate in approximately 25 minutes. The reactivity change rate associated with reductions in Reactor Coolant System boron concentration will be within the capability for operator recognition and control.A maximum of two charging pumps capable of injecting into the RCS when RCS cold leg temperature is < 300°F ensures that the maximum inadvertent dilution flow rate assumed in the boron dilution analysis is not exceeded.MILLSTONE -UNIT 2 B 3/4 1-la Amendment No. 4-39, 4.4&, 8-5, 2,80, 283 LBDCR 09-MP2-017 September 15, 2009 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1.3 BORON DILUTION (Continued~) A charging pump can be considered to be not capable of injecting into the RCS by use of any of the following methods and the appropriate administrative controls.1. Placing the motor circuit breaker in the open position.2. Removing the charging pump motor overload heaters from the charging pump circuit.3. Removing the charging pump motor controller from the motor control center.4. Placing a charging pump control switch in the Pull-To-Lock (PTL) position.3/4.1.1.4 MODERATOR TEMPERATURE COEFFICIENT (MTC)The limitations on MTC are provided to ensure that the assumptions used in the accident and transient analyses remain valid through each fuel cycle. The surveillance requirements for measurement of the MTC during each fuel cycle are adequate to confirm the MTC value since this coefficient changes slowly due principally to the reduction in RCS boron concentration associated with fuel burnup. The confirmation that the measured MTC value is within its limit provides assurance that the coefficient will be maintained within acceptable values throughout each fuel cycle.3/4.1.1.5 MINIMUM TEMPERATURE FOR CRITICALITY The MTC is expected to be slightly negative at operating conditions. However, at the beginning of the fuel cycle, the MTC may be slightly positive at operating conditions and since it will become more positive at lower temperatures, this specification is provided to restrict reactor operation when Tav is significantly below the normal operating temperature. .3/4.1.2 DELETED 3/4.1.3 MOVEABLE CONTROL ASSEMBLIES The specifications of this section ensure that (1) acceptable power distribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effects of a CEA ejection accident are limited to acceptable levels.The ACTION statements which permit limited variations from the basic requirements are accompanied by additional restrictions which ensure that the original criteria are met.MILLSTONE -UNIT 2 B 3/4 1-2 Amendment No. -3~, 3g, 3-39, 4&, 2N-l-, 28-, Page B 3/4 1-3 has been removed from Technical Specifications September 25, 2003 BASES 3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued) A CEBA may become misaligned, yet remain trippable. In this condition, the CEA can still perform its required function of adding negative reactivity should a reactor trip be necessary. If one or more CEAs (regulating or shutdown) are misaligned by > 10 steps and < 20 steps but trippable, or one CEA is misaligned by >20 steps but trippable, continued operation in MODES 1 and 2 may continue, provided, within 1 hour, the power is reduced to < 70% RATED THERMAL POWER, and within 2 hours CEA alignment is restored. If negative reactivity insertion is required to reduce THERMAL POWER, boration shall be used. Regulating CEA alignment can be restored by either aligning the misaligned CEA(s) to within 10 steps of all other CEAs in its group or aligning the misaligned CEA's group to within 10 steps of the misaligned CIBA. A Regulating CEA is considered fully inserted when either the Dropped Rod indication or lower Electrical Limit indication lights on the core mimic display are illuminated. A Regulating CEA is considered to be fully withdrawn when withdrawn > 176 steps. Shutdown CIBA alignment can only be restored by aligning the misaligned CIBA(s) to within 10 steps of its group.Xenon redistribution in the core starts to occur as soon as a CIBA becomes misaligned. Reducing THERMAL POWER ensures acceptable power distributions are maintained. For small misalignments (< 20 steps) of the CEAs, there is: a. A small effect on the time dependent long term power distributions relative to those used in generating LCOs and limiting safety system settings (LSSS)set-points;

b. A negligible effect on the available SHUTDOWN MARGIN; and c. A small effect on the ejected CIBA worth used in the accident analysis.With a large CIBA misalignment ( > 20 steps), however, this misalignment would cause distortion of the core power distribution.

This distortion may, in turn, have a significant effect on the time dependent, long term power distributions relative to those used in generating LCOs and LSSS setpoints. The effect on the available SHUTDOWIN MARGIN and the ejected CEA worth used in the accident analysis remain small. Therefore, this condition is limited to a single CEBA misalignment, while still allowing 2 hours for recovery.In both cases, a 2 hour time period is sufficient to: a. Identifyr cause of a misaligned CIBA;b. Take appropriate corrective action to realign the CEAs; and c. Minimize the effects of xenon redistribution. If a CIBA is untrippable, it is not available for reactivity insertion during a reactor trip. With an untrippable CIBA, meeting the insertion limits of LCO 3.1.3.5 and LCO 3.1.3.6 does not ensure that adequate SHUTDOWN MARGIN exists. With one or more CIBAs untrippable the plant is transitioned to MODE 3 within 6 hours.MILLSTONE -UNIT 2 B 3/4 1-4 MILLTONE-UNT 2 3/41-4Amendment No. 3-8, 4-t-9,280 LBDCR 14-MP2-016 September 4, 2014 BASES 3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued), The CEA motion inhibit permits CEA motion within the requirements. of LCO 3.1.3.6,"Regulating Control Element Assembly (CEA) Insertion Limits," and the CEA deviation circuit prevents regulating CEAs from being misaligned from other CEAs in the group. With the CEA motion inhibit inoperable, a time of 6 hours is allowed for restoring the CEA motion inhibit to OPERABLE status, or placing and maintaining the CEA drive switch in either the "off' or"manual" position, fully withdrawing all CEAs in group 7 to < 5% insertion. Placing the CEA drive switch in the "off' or "manual" position ensures the CEAs will not move in response to Reactor Regulating System automatic motion commands. Withdrawal of the CEAs to the positions required in the Required ACTION B.2 ensures that core perturbations in local bumup, peaking factors, and SHUTDOWN MARGIN will not be more adverse than the Conditions assumed in the safety analyses and LCO setpoint determination. Required ACTION B.2 is modified by a Note indicating that performing this Required ACTION is not required when in conflict with Required ACTIONS A.1 or C. 1.Continued operation is not allowed in the case of more than one CEA misaligned from any other CEA in its group by >20 steps, or one or more CEAs untr-ippable. This is because these cases are indicative of a loss of SHUTDOWN MARGIN and power distribution changes, and a loss of safety function, respectively. OPERABILITY of the CEA position indicators (Specification 3.1.3.3) is required to determine CEA positions and thereby ensure compliance with the CEA alignmaent and insertion limits and ensures proper operation of the CEA Motion Inhibit and CEA deviation block circuit.The CEA "Full In" and "Full Out" limit Position Indicator channels provide an additional independent means for determining the CEA positions when the CEAs are at either their fully inserted or fully withdrawn positions. Therefore, the ACTION statements applicable to inoperable CEA position indicators permit continued operations when the positions of CEAs with inoperable position indicators can be verified by the "Full In" or "Full Out" limit Position Indicator channels.CEA positions and OPERABILITY of the CEA position indicators are required to be verified at the frequency specified in the Surveillance Frequency Control Program with more frequent verifications required if ani automatic monitoring channel is inoperable. The surveillance frequency is controlled under the Surveillance Frequency Control Program.The maximum CEA drop time permitted by Specification 3.1.3.4 is the assumed CEA drop time used in the accident analyses. Measurement with Tavg > 51 5°F and with all reactor coolant pumps operating ensures that the measured drop times will be representative of insertion times experienced during a reactor trip at operating conditions. MILLSTONE -UNIT 2 B 3/4 1-4a Amendment No. -t-33, 24-6, 29-g, September 25, 2003 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued) The LSSS setpoints and the power distribution LCOs were generated based upon a core burnup which would be achieved with the core operating in an essentially unrodded configuration. Therefore, the CEA insertion limit specifications require that during MODES 1 and 2, the CEAs be nearly fully withdrawn. The amount of CEA insertion permitted by the Long Term Steady State Insertion Limits of Specification 3.1.3.6 will not hav~e a significant effect upon the unrodded burnup assumption but will still provide sufficient reactivity control. The Transient Insertion Limits of Specification 3.1.3.6 are provided to ensure that (1) acceptable power distribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effects of a CEA ejection accident are limited to acceptable levels; however, long term operation at these insertion limits could have adverse effects on core power distribution during subsequent operation in an unrodded configuration. The PDIL alarm, CEA Motion Inhibit and CEA deviation circuit are provided by the CEAPDS computer.The control rod drive mechanism requirement of specification 3.1.3.7 is provided to assure that the consequences of an uncontrolled CEA withdrawal from subcritical transient will stay within acceptable levels. This specification assures that reactor coolant system conditions exist which are consistent with the plant safety analysis prior to energizing the control rod drive mechanisms. The accident is precluded when conditions exist which are inconsistent with the safety analysis since deenergized drive-mechanisms cannot withdraw a CEA. The drive mechanisms may be energized with the boron concentration greater than or equal to the refueling concentration since, under these conditions, adequate SHUTDOWN MARGIN is maintained, even if all CEAs are fully withdrawn from the core.MILLSTONE -UNIT 2 B 3/4 1-5 MILLTONE-UNT 2 3/41-5Amendment No. 3-&, 446, 24-6, 280 REVERSE OF PAGE B 3/4 1-5 INTENTIONALLY LEFT BLANK LBDCR 04-MP2-016 February 24, 2005 3/4.2 POWER DISTRIBUTION LIMvITS BASES 3/4.2.1 LINEAR HEAT RATE The limitation on linear heat rate ensures that in the event of a LOCA, the peak temperature of the fuel cladding will not exceed 2200°F.Either of the two core power distribution monitoring systems, the Excore Detector Monitoring System and the Incore Detector Monitoring System, provide adequate monitoring of the core power distribution and are capable of verifying that the linear heat rate does not exceed its limits. The Excore Detector Monitoring System perfonus this function by continuously monitoring the AXIAL SHAPE INDEX with two OPERABLE excore neutron flux detectors and verifying that the AXIAL SHAPE INDEX is maintained within the allowable limits specified in the CORE OPERATING LIMITS REPORT using the Power Ratio Recorder. The power[dependent limits of the Power Ratio Recorder are less than or equal to the limits specified in the CORE OPERATING LIMITS REPORT. In conjunction with the use of the excore monitoring [system and in establishing the AXIAL SHAPE INDEX limits, the following assumptions are made: 1) the CEA insertion limits of Specifications 3.1.3.5 arid 3.1.3.6 are satisfied, 2) the AZIIMUTHAL POWER TILT restrictions of Specification 3.2.4 are satisfied, and 3) the TOTAL TINRODDED INTEGRATED RADIAL PEAKING FACTOR does not exceed the limits of Specification 3.2.3.The Incore Detector Monitoring System continuously provides a direct measure of the peaking factors and the alarms which have been established for the individual incore detector segments ensure that the peak linear heat rates will be maintained within the allowable limits specified in the CORE OPERATING LIMITS REPORT. The setpoints for these alarms include allowances, set in the conservative direction. The Incore Detector Monitoring System is not used to monitor linear heat rate below 20% of RATED THERMAL POWER.. The accuracy of the neutron flux infonnation from the incore detectors is not reliable at THERMAL POWER < 20%RATED THERMAL POWER.3/4.2.3 ANT) 3/4.2.4 TOTAL UNIRODDED INTEGRATED RADIAL PEAKING FACTORS FTr ANT) AZIMUTHAL POWER TILT -T~q The limitations on Far and Tq are provided to 1) ensure that the assumptions used in the analysis for establishing the Linear Heat Rate and Local power Density -High LCOs and LSSS setpoints remain valid during operation at the various allowable CEA group insertion limits, and, 2) ensure that the assumptions used in the analysis establishing the DNB Margin LCO, and Thermal Margin/Low Pressure LSSS setpoints remain valid during operation at the various allowable CEA group insertion limits. If F'r or Tq exceed their basic limitations, operation may continue under the additional restrictions imposed MILLSTONE -UNIT 2 B 3/4 2-1 Amendment No. g3g, 5-2,4-2-2,1439, 448, 4-5-5~,-1-94,-2-30,220g, Acknowledged by NRC letter dated 6/28/05 LBDCR 14-MP2-016 September 4, 2014 POWER DISTRIBUTION LIMITS BASES by the ACTION statements since these additional restrictions provide adequate provisions to assure that the assumptions used in establishing the Linear Heat Rate, Thermal Margin!Low Pressure and Local Power Density -High LCOs and LSSS setpoints remain valid. An AZIMUTHAL POWER TILT > 0.10 is not expected and i~fit should occur, subsequent operation would be restricted to only those operations required to identify the cause of this unexpected tilt.Core power distribution is a concern any time the reactor is critical. The Total Integrated Radial Peaking Factor -FTr LCO, however, is only applicable in MODE 1 above 20% of RATED THERMAL POWER. The reasons that this LCO is not applicable below 20% of RATED THERMAL POWER are: a. Data from the incore detectors are used for determining the measured radial peaking factors. Technical Specification 3.2.3 is not applicable below 20% of RATED THERMAL POWER because the accuracy of the neutron flux information from the incore detectors is not reliable at THERMAL POWER< 20% RATED THERMAL POWER.b. When core power is below 20% of RATED THERMAL POWER, the core is operating well below its th~ermal limits, and the Local Power Density (fuel pellet.melting) and Thermal Margin/Low Pressure (DN-B) trips are highly conservative. The surveillance requirements for verifying that FTr and Tq are within their limits provide assurance that the actual values ofFTr and Tq do not exceed the assumed values. These surveillance frequencies are controlled under the Surveillance Frequency Control Program.Verifying FTr after each fuel loading prior to exceeding 70% of RATED THERMAL POWER provides additional assurance that the core was properly loaded. '" 3/4.2.6 DNB MARGIN The limitations provided in this specification ensure that the assumed margins to DNB are maintained. The limiting values of the parameters in this specification are those assumed as the initial conditions in the accident and transient analyses; therefore, operation must be maintained within the specified limits for the accident and transient analyses to remain valid.MILLSTONE -UNIT 2 B 3/4 2-2 Amendment No. , 4-,--22, -3~9, 55,-2--0, O LBDCR 14-MP2-016 September 4, 2014 3/4.3 INSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF' INSTRUMENTATION The OPERABILITY of the protective and ESF instrumentation systems and bypasses ensure that 1) the associated ESF action and/or reactor trip will be initiated when the parameter monitored by each channel or combination thereof exceeds its setpoint, 2) the specified coincidence logic is maintained, 3) sufficient redundancy is maintained to permit a channel to be out of service for testing or maintenance, and 4) sufficient system functional capability is available for protective and ESE purposes from diverse parameters. The OPERABILITY of these systems is required to provide the overall reliability, redundance and diversity assumed available in the facility design for the protection and mitigation of accident and transient conditions. The integrated operation of each of these systems is consistent with the assumptions used in the accident analyses.ACTION Statement 2 of Tables 3.3-1 and 3.3-3 requires an inoperable Reactor Protection System (RPS) or Engineered Safety Feature Actuation System (ESFAS) channel to be placed in the bypassed or tripped condition within 1 hour. The inoperable channel may remain in the bypassed condition for a maximum of 48 hours. While in the bypassed condition, the affected functional unit trip coincidence will be 2 out of 3. After 48 hours, the channel must either be declared OPERABLE, or placed in the tripped condition. If the channel is placed in the tripped condition, the affected functional unit trip coincidence will become 1 out of 3. One additional channel may be removed from service for up to 48 hours, provided one of the inoperable channes is placed in the tripped condition. Plant operation with an inoperable pressurizer high pressure reactor protection channel in the tripped condition is restricted because of the potential inadvertent opening of both pressurizer power operated relief valves (PORVs) if a second pressurizer high pressure reactor protection channel failed while the first channel was in the tripped condition. This plant operating restriction is contained in the Technical Requirements Manual.The reactor trip switchgear consists of eight reactor trip circuit breakers, which are operated in four sets of two breakers (four channels). Each of the four trip legs consists of two reactor trip circuit breakers in series. The two reactor trip circuit breakers within a trip leg are actuated by separate initiation circuits. For example, if a breaker receives an open signal in trip leg A, an identical breaker in trip leg B will also receive an open signal. This arrangement ensures that power is intenrupted to both Control Element Drive Mechanism buses, thus preventing a trip of only half of the control element assemblies (a half trip). Any one inoperable breaker in a channel will make the entire channel inoperable. The surveillance requirements specified for these systems ensure that the overall system functional capability is maintained comparable to the original design standards. TheseJ surveillance frequencies are controlled under the Surveillance Frequency Control Program.The surveillance testing verifies OPERABILITY of the RPS by overlap testing of the four interconnected modules: measurement channels, bistable trip units, RPS logic, and reactor trip circuit breakers. When testing the measurement channels or bistable trip units that provide an automatic reactor trip function, the associated RPS channel will be removed from service, MILLSTONE -UNIT 2 B 3/4 3-1 Amendment No.4-67-, 4-1-gg 4-98, 2-2-5, 2-82, Azkncl ...... N.., C lcttDz" 1 at- d 6/28,-f/'05I LBDCR 06-MP2-036 October 12, 2006 3/4.3 INSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF) INSTRUMENTATION (continued') declared inoperable, and ACTION Statement 2 of Technical Specification 3.3.1.1 entered. When testing the RPS logic (matrix testing), the individual RPS channels will not be affected. Each of the parameters within each RPS channel supplies three contacts to make up the 6 different logic ladders/matrices (AB, AC, AD, BC, BD, and CD). During matrix testing, only one logic matrix is tested at a time. Since each RPS channel supplies 3 different logic ladders, testing one ladder matrix at a time will not remove an RPS channel from the overall logic matrix. Therefore, matrix testing will not remove an RPS channel from service or make the RPS channel inoperable. It is not necessary to enter an ACTION Statement for any of the parameters associated with each RPS channel while performling matrix testing. This also applies when testing the reactor trip circuit breakers since this test will not remove an RPS channel from service or make the RPS channel inoperable. ACTION Statements for the RP'S logic matrices and RIPS logic matrix relays are required to be entered during matrix testing as these functional units become inoperable when the "HOLD" button is depressed during testing.The RIPS bypasses and their allowable values are addressed in footnotes to Table 3.3-1. They are I not otherwise addressed as specific table entries.0 The RPS automatic bypass removal features must function as a backup to manual actions for all safety related trips to ensure the trip functions are not operationally bypassed when the safety analysis assumes the functions are available. The RPS automatic bypass removal feature of all four operating bypass channels must be OPERABLE for each RIPS function with an operating bypass in the MODES addressed in the specific LCO for each function. All four bypass removal channels must be OPERABLE to ensure that none of the four RP'S channels are inadvertently bypassed.ACTION Statements 7 and 8 apply to the RPS bypass removal feature only. If the bypass enable function is failed so as to prevent entering a bypass condition, operation may continue.ACTION Statement 7 applies to one automatic bypass removal channel inoperable. If the bypass removal channel for any operating bypass cannot be restored to OPERABLE status, the associated RIPS channel may be considered OPERABLE only if the bypass is not in effect.Otherwise, the affected RP'S channel must be declared inoperable, as in ACTION Statement 2, and the bypass either removed or the bypass removal channel repaired. The allowed outage times are the same as for ACTION Statement 2.MILLSTONIE.-UNIIT2 B 3/4 3-la Amendment No. 2-2--, 3, 245-, 2-82, LBDCR 14-MiP2-016 September 4, 2014 3/4.3 INSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 PROTECTIVE ANT) ENGINEERED SAFETY FEATUIRES (ESE) INSTRUMENTATION (continued) ACTION Statement 8 applies to two inoperable automatic bypass removal channels. If the bypass removal channels cannot be restored to OPERABLE status, the associated RPS channel may be considered OPERABLE only if the bypass is not in effect. Otherwise, the affected RPS channels must be declared inoperable, and the bypass either removed or the bypass removal channel repaired. Also, ACTION Statement 8 provides for the restoration of the one affected automatic trip channel to OPERABLE status within the allowed outage time specified under ACTION Statement 2.ACTION Statements 7 and 8 contain the term "disable the bypass channel." Compliance with ACTION Statements 7 or 8 is met by placing or verifying the Zero Mode Bypass Switch(es) in"Off." No further action (i.e., key removal, periodic verification, etc.) is required. These switches are administratively controlled via station procedures; therefore the requirements of ACTION Statements 7 and 8 are continuously met.SR 4.3.1.1.2 and SR 4.3 .2.1.2 specify a CHANNEL FUNCTIONAL TEST of the bypass function and automatic bypass removal once within 92 days prior to each reactor startup. The total bypass function shall be demonstrated OPERABLE periodically during CHANNEL CALIBRATION testing of each channel affected by bypass operation. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL FUNCTIONAL TEST is similar to the CHANNEL FUNCTIONAL TESTS already required by SR 4.3.1.1.1 and SR 4.3.2.1.1, except the CHANNEL FUNCTIONAL TEST is applicable only to bypass functions and is performed once within 92 days prior to each startup. The MPS2 RPS is an analog system while the design of the MIPS2 ESFAS includes both an analog portion and a digital portion. With respect to the analog portion of the systems, a successful test of the required contact(s) of a channel relay may be perfonnted by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other TS tests at least once per refueling interval with applicable extensions. Proper operation of bypass permissives is critical during plant startup because the bypasses must be in place to allow startup operation and must be removed at the appropriate points during power ascent to enable certain reactor trips. Consequently, the appropriate time to verify bypass removal function OPERABILITY is just prior to start-up. The allowance to conduct this test within 92 days of startup is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation," which is referenced in NUREG-1432 and is applicable to MIPS2. Once the operating bypasses are removed, the bypasses must not fail in such a way that the associated trip function gets inadvertently bypassed. This feature is verified by the trip function CHANNEL FUNCTIONAL TESTS SR 4.3.1.1.1 and SR 4.3.2.1.1. Therefore, further testing of the bypass function after startup is unnecessary. MILLSTONE -UNIT 2 B343l mnmn o B 3/4 3-1b Amendment No. LBDCR 14-MIP2-016 September 4, 2014 3/4.3 TINSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF) INSTRUMENTATION (continued) The ESFAS includes four sensor subsystems and two actuation subsystems for each of the functional units identified in Table 3.3-3. Each sensor subsystem includes measurement channels and bistable trip units. Each of the four sensor subsystem channels monitors redundant and independent process measurement channels. Each sensor is monitored by at least one bistable.The bistable associated with each ESFAS Function will trip when the monitored variable exceeds the trip setpoint. When tripped, the sensor subsystems provide outputs to the two actuation subsystems. The two independent actuation subsystems each compare the four associated sensor, subsystem outputs. If a trip occurs in two or more sensor subsystem channels, the two-out-of-four automatic actuation logic will initiate one train of ESFAS. An Automatic Test Inserter (ATI), for which the automatic actuation logic OPERABILITY requirements of this specification do not apply, provides automatic test capability for both the sensor subsystems and the actuation subsystems. The provisions of Specification 4.0.4 are not applicable for the CI-ANNEL FUNCTIONAL TEST of the Engineered Safety Feature Actuation System automatic actuation logic associated with Pressurizer Pressure Safety Injection, Pressurizer Pressure Containment Isolation, Steam Generator Pressure Main Steam Line Isolation, and Pressurizer Pressure Enclosure Building Filtration for entry into MODE 3 or other specified conditions. After entering MODE 3, pressurizer pressure and steam generator pressure will be increased and the blocks of the ESF actuations on low pressurizer pressure and low steam generator pressure will be automatically removed. After the blocks have been removed, the CHANNEL FUNCTIONAL TEST of the ESF automatic actuation logic can be performed. The CHANNEL FUNCTIONAL TEST of the ESF automatic actuation logic must be perfonrned within 12 hours after establishing the appropriate plant conditions, and prior to entry into MODE 2.The periodic measurement of response time provides assurance that the protective and ESF action function associated with each channel is completed within the time limit assumed in the accident analyses. These surveillance frequencies are controlled under the Surveillance Frequency Control Program. No credit was taken in the analyses for those channels with response times indicated as not applicable. The Reactor Protective and Engineered Safety Feature response times are contained in the Millstone Unit No. 2 Technical Requirements Manual. Changes to the Technical Requirements Manual require a 10OCFR5O.59 review as well as a review by the Site Operations Review Cormnittee. MILLSTONE -UNIT 2 B343i mnmn o B 3/4 3-1e Amendment No. LBDCR 04-MP2-016 February 24, 2005 INSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF)INSTRUMENTATION (Continued) SRAS LOGIC MODIFICATION ACTION Statement 4 of Table 3.3-3, which applies only to the SRAS logic, specifies that during surveillance testing the second inoperable channel must also be placed in the bypassed condition. For the SRAS logic, placing the second inoperable channel in the tripped condition (as in ACTION Statement

2) could result in the false generation of a SRAS signal due to an additional failure which causes a trip signal in either of the remaining channels at the onset of a LOCA. The false generation of the SRAS signal leads to unacceptable consequences for LOCA mitigation.

With ACTION Statement 4, during the two-hour period when two channels are bypassed, no additional failure can result in the false generation of the SRAS signal. However, an additional failure that prevents a trip of either of the two remaining channels may prevent the generation of a true SRAS signal while in this ACTION Statement. If no SRAS is generated at the appropriate time, operating procedures instruct the operator to ensure that the SRAS actuation occurs when the refueling water storage tank level decreases. Due to the limited period of vulnerability, and the existence of operator requirements to manually initiate an SPAS if an automatic initiation does not occur, this risk is considered acceptable. STEAM GENERATOR BLOWDOWN ISOLATION Automatic isolation of steam generator blowdown will occur on low steam generator water level. An auxiliary feedwater actuation signal will also be generated at this steam generator water level. Isolation of steam generator blowdown will conserve steam generator water inventory following a loss of main feedwater. SENSOR CABINET POWER SUPPLY AUCTIONEERING The auctioneering circuit of the ESFAS sensor cabinets ensures that two sensor cabinets do not de-energize upon loss of a D.C. bus, thereby resulting in the false generation of an SRAS.Power source VA-10 provides normal power to sensor cabinet A and backup power to sensor cabinet D. VA-40 provides normal power to sensor cabinet D and backup power to cabinet A.Power sources VA-20 and VA-30 and sensor cabinets B and C are similarly arranged.If the normal or backup power source for an ESFAS Sensor Cabinet is lost, two sensor cabinets would be supplied from the same power source, but would still be operating with no subsequent trip signals present. However, any additional failure associated with this power source would result in the loss of the two sensor cabinets, consequently generating a false SPAS.The 48-hour ACTION Statement ensures that the probability of a ACTION Statement and an additional failure of the remaining power source, while in this ACTION Statement is sufficiently small.MILLSTONE -UNIT 2 B 3/4 3-2 Amendment No. 4-5-7, 4-7-9, -226, 5, Acknowledged by NRC letter dated 6128105 LBDCR 09-MP2-013 July 7, 2009 BASES(Continued) 3/4.3.3 MONITORING INSTRUMENTATION 3/4.3.3.1 RADIATION MONITORING INSTRUMENTATION The OPERABILITY of the radiation monitoring channels ensures that 1) the radiation levels are continually measured in the areas served by the individual channels and 2) the alarm or automatic action is initiated when the radiation level trip setpoint is exceeded.The analyses for a Steam Generator Tube Rupture, Waste Gas System Failure, Cask Tip and Fuel Handling Accident credit the control room ventilation inlet duct radiation monitors with closure of the Unit 2 control room isolation dampers. In the event of a single failure in either channel (1 per train), the control room isolation dampers automatically close. The response time test for the control room isolation dampers includes signal generation time and damper closure.The response time for the control room isolation dampers is maintained within the applicable facility surveillance procedure. The containment airborne radiation monitors (gaseous and particulate) provide early indication of leakage from the Reactor Coolant System as specified in Technical Specification 3.4.6.1.MILLSTONE -UNIT 2 B 3/4 3-2a Amendment No. 4-5-7-, 4-7-9, -2~--, 30, 2-28-, 284, LBDCR 14-MP2-016 September 4, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.3 RELIEF VALVES (Continued) discovered to be inoperable, or if both block valves are discovered to be inoperable at the same time. In the event of a loss of feedwater, the PORVs would be used to remove core heat. In order to minimize the consequences of a loss of feedwater while two block valves are inoperable, Required Action e. 1 requires that LCO 3.7.1.2, "Auxiliary Feedwater Pumps," be verified to be met within 1 hour. The inoperability of two block valves during the 8 hour allowed outage time has been shown to be acceptable based on the infrequent use of the Required Actions and the small incremental effect on plant risk (Ref. 1).SURVEILLANCE REQUIREMENT 4.4.3.1 .C requires operating each PORV through one complete cycle of full travel at conditions representative of MODES 3 or 4. This is nonnally perfonned in MODE 3 or 4 as the unit is descending in power to commence a refueling outage.This test will normally be a static test, whereby a P0RV will be exposed to MODE 3 or 4 temperatures, the block valve closed, and the PORV tested to verifyr it strokes through one complete cycle of full travel. PORV cycling demonstrates its function. SURVEILLANCE REQUIREMENT 4.4.3.1 .C is consistent with the NRC staff position outlined in Generic Letter 90-06, which requires that the PORV stroke test be performed at conditions representative of MODE 3 or 4. The surveillance frequency is controlled under the Surveillance Frequency Control Program. Testing in the manner described is also consistent with the guidance in NI-REG 1482,"Guidelines for Inservice Testing at Nuclear Power Plants," Section 4.2.10, that describes the PORVs function during reactor startup and shutdown to protect the reactor vessel and coolant system from low-temperature overpressurization conditions, and indicates they should be exercised before system conditions warrant vessel protection. If post maintenance retest is warranted, the affected valve(s) will be stroked under amabient conditions while in Mode 5, 6, or defueled. A Hot Functional Test is required to be performed in MODE 4 prior to entry into MODE 3. The actual stroke time in the open? and close direction will be measured, recorded and compared to the test results obtained during pre-installation testing to assess acceptability of the affected valve(s).SURVEILLANCE REQUIREMENT 4.4.3.2 verifies that a block valve(s) can be closed if necessary. This SURVEILLANCE REQUIREMENT is not required to be performed with the block valve(s) closed in accordance with the ACTIONS of TS 3.4.3. Opening the block valve(s)in this condition increases the risk of an unisolable leak from the RCS since the PORV(s) is already inoperable. REFERENCE 1. WCAP-16 125-NP-A, "Justification for Risk-Infonned Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B 3/4 4-2b Amendment No. 2a2, 3-7-, 5, 66, 8-, 444,1---2-1-, 4-3g, 94 LBDCR 14-MVP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.4 PRESSURIZER An OPERABLE pressurizer provides pressure control for the reactor coolant system during operations with both forced reactor coolant flow and with natural circulation flow. The minimum water level in the pressurizer assures the pressurizer heaters, which are required to achieve and maintain pressure control, remain covered with water to prevent failure, which occurs*if the heaters are energized uncovered. The maximum water level in the pressurizer ensures that this parameter is maintained within the envelope of operation assumed in the safety analysis. The maxfimum water level also ensures that the RCS is not a hydraulically solid system and that a steam bubble will be provided to accommodate pressure surges during operation. The steam bubble also protects the pressurizer code safety valves and power operated relief valve against water relief. With pressurizer water level not within the limit, action must be taken to restore the plant to operation within the bounds of the safety analyses. To achieve this status, the unit must be brought to at least HOT STANDBY with the reactor trip breakers open within 6 hours and in HOT SHUTDOWN within the following 6 hours. This takes the plant out of the applicable MODES and restores the plant to operation within the bounds of the safety analyses. The requirement that a minimum number of pressurizer heaters be OPERABLE enhances the capability of the plant to control Reactor Coolant System pressure and establish and maintain natural circulation. If two required groups of pressurizer heaters are inoperable, restoring at least one group of pressurizer heaters to OPERABLE status is required within 24 hours. The Condition is modified by a Note stating it is not applicable if the second group of required pressurized heaters is intentionally declared inoperable. The Condition is not intended for voluntary removal of redundant systems or components from service. The Condition is only applicable if one group of required pressurized heaters is inoperable for any reason and the second group of required pressurized heaters is discovered to be inoperable, or if both groups of required pressurized heaters are discovered to be inoperable at the same time. If both required groups of pressurizer heaters are inoperable, the pressurizer heaters may not be available td help maintain subcooling in the RCS loops during a natural circulation cooldown following a loss of offsite power. The inoperability of two groups of required pressurizer heaters during the 24 hour allowed outage time has been shown to be acceptable based on the infrequent use of the Required Action and the small incremental effect on plant risk (Ref. 1).The requirement for two groups of pressurizer heaters, each having a capacity of 130 kW, is met by verifying the capacity of the pressurizer proporlional heater groups 1 and 2. Since the pressurizer proportional heater groups 1 and 2 are supplied from the emergency 480V electrical buses, there is reasonable assurance that these heaters can be energized during a loss of off'site power to maintain natural circulation at HOT STANDBY.REFERENCE 1. WCAP- 161 25-NP-A, "Justification for Risk-Infonrmed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B3442 mnmn o B 3/4 4-2c Amendment No. I NSTRUMENTAT ION July 13, 1g99 BASES 3/4.3.3.2 -DELETED 3/4.3.3.3 -DELETED 3/4.3.3.4 -DELETED 3/4.3,3.5 REMOTE SHUTDOWN INSTRUMENTATION The OPERABILITY of the remote shutdown instrumentation ensures that sufficient -capability is available to permit shutdown and maintenance of HOT SHUTDOWN of the facility from locations outside of the control room. This capability is required in the event control room habitability is lost and is consistent with General Design Criteria 19 of 10 CFR 50.MILLSTONE -UNIT 2 e 3/4 3-3 MILLTON -NIT2 B3/43-3Amendment N~o XF, 237 November 3, 1995 INSTRUMENTATI ON BASES 3/4.3.3.6 DELETED 3_/4.3.3.7 DELETED 3L/4.3.3,8 Accident Monitoring Instrumentation The OPERABILITY of the accident monitoring instrumentation ensures that sufficient information is available on selected plant parameters to monitor and assess these variables during and following an accident. This capability is consistent with the recommnendations of NUREG-0578, "TMI-2 Lessons Learned Task Force Status Report and Short-Term Reconvnendations". 0:I MILLSTONE -UNIT 2 01 .B 3/4 3-4191 November 28, 2000 THIS PAGE INTENTIONALLY LEFT BLANK OMILLSTONE -UNIT 2 B 3/4 3-5 MILLTON -N~t2 B3/43-5Amendment No. 4-04, 5, 250 LBDCR 04-MP2-0 11 December 8, 2005 INSTRUMENTATION BASES 3/4.3.3.9 -DELETED 3/4.3.3.10 -DELETED 3/4.3.4 -DELETED MILLSTONE-UNIT 2 B 3/4 3-6 MILSTOE -UXIT B /4 -6Amendment No. 4-04, 24-5, 5, 84, May 1, 2002 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION The plant is designed to operate with both Reactor Coolant System (RCS) loops and associated reactor coolant pumps (RCPs) in operation, and maintain the DNBR above the 95/95 limit for the DN-B correlation during all normal operations and anticipated transients. In MODES 1 and 2, both RCS loops and associated RCPs are required to be OPERABLE and in operation. In MODE 3 , a single RCS loop with one RCP and adequate steam generator secondary water inventory provides sufficient heat removal capability. However, both RCS loops with at least one RCP per loop are required to be OPERABLE to provide redundant paths for decay heat removal. In addition, as a minimum, one RCS loop must be in operation. Any exceptions to these requirements are contained in the LCO Notes.In MODE 4, one RCS loop with onae RCP and adequate steam generator secondary water inventory, or one shutdown cooling. (SDC) train provides sufficient heat removal capability. However, two loops or trains, consisting of any combination of RCS loops or SDC trains, are required to be OPERABLE to provide redundant paths for decay heat removal. In addition, as a minimum, one RCS loop or SDC train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.In MODES 3 and 4 , an OPERABLE RCS loop consists of the RCS loop, associated steam generator, and at least one RCP. The steam generator must have sufficient secondary water inventory for heat removal.In MODE 5, with the RCS loops filled, the SDC trains are the primary means of heat removal. One SDC train provides sufficient heat removal capability. However, to provide redundantpaths for decay heat removal either two SDC trains are required to be OPERABLE, or one SDC train is required to be OPERABLE and both steam generators are reqtiired to have adequate steam generator secondary water inventory. In addition, as a minimum, one SDC train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.By maintaining adequate secondary water inventory and makeup capability, the steam generators will be able to support natural circulation in the RCS loops. In addition, the ability to pressurize and control RCS pressure is necessary to support RCS natural circulation. If the pressurizer steam bubble has been collapsed and the RCS has been depressurized or drained sufficiently that voiding of the steam generator U-tubes may have occurred, the RCS loops should be considered not filled unless ana evaluation is performed to verify the ability of the RCS to suppornt natural circulation. If the RCS loops are considered not filled, the RCS must be refilled, pressurized, and the RCPs bumped (unless a vacuum fill of the RCS was performed) before the RCS loops can be considered filled.In MODE 5, with the RCS loops not filled, the SDC trains are the only means of heat removal. One SDC train provides sufficient heat removal capability. However, to provide redundant paths for decay heat removal, two SDC trains are required to be OPERABLE. In addition, as a mininmumn, one SDC MILLSTONE -UNIT 2 B 3/4 4-1 Revised by NRC Letter A15689 Amendment No. &O, 6-6, 69, 9, 24--I8, 2n19, LBDCR 15-MP2-003 March 26, 2015 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued') train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.An OPERABLE SDC train, for plant operation in MODES 4 and 5, includes a pump, heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine RCS temperature. The flow path starts at the RCS hot leg and is returned to the RCS cold legs.In MODE 4, an OPERABLE SDC train consists of the following equipment:

1. An OPERABLE SDC pump (low pressure safety injection pump);2. The associated SDC heat exchanger from the same facility as the SDC pump;3. The associated reactor building closed cooling water loop from the same facility as the SDC pump;4. The associated service water loop from the same facility as the SDC pump; and 5. All valves required to support SDC System operation are in the required position or are capable of being placed in the required position.In MODE 4, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchangers, 2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headers and 2 SW headers are required to support the SDC heat exchangers, consistent wvith the requirements of Technical Specifications 3.7.3.1 and 3.7.4.1.In MODE 5, an OPERABLE SDC ti-ain consists of the following equipment:

1. An OPERABLE SDC pump (low pi'essure safety injection pump);2. The associated SDC heat exchanger fr'om the same facility as the SDC pump;3. An: RBCCW pump, powered from the same facility as the SDC pump, and RBCCW heat exchanger capable of cooling the associated SDC heat exchanger;

4. A SW pump, powered from the same facility as the SDC pump, capable of supplying cooling water to the associated RBCCW heat exchanger; and 5. All valves required to support SDC System operation are in the required position or are capable of being placed in the required position MILLSTONE -UNIT 2 B 3/4 4-la Rovisod. ,by1:rr NR Lot. ^tcrM5GS Amendment No. 5-0, 66, 69-9, 4--, 2-i-s, LBDCR 06-MP2-030 September 14, 2006 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)

In MODE 5, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchangers, 2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headers are required to provide cooling to the SDC heat exchangers, but only 1 SW header is required to support the SDC trains. The equipment specified is sufficient to address a single active failure of the SDC System and associated support systems.In addition, twvo SDC trains can be considered OPERABLE, with only one 125-volt D.C.bus train OPERABLE, in accordance with Limiting Condition for Operation (LCO) 3.8.2.4. 2-SI-306 and 2-SI-657 are b~oth p.ow..r~ed:. from.the~same 125.-volt D.C. bus, on Facility I. Should.these .~e~ikndr~&i w~P~oidnkneb lge to c o ol thf RCS:.-: ttowever~a ldesignated': operator.isqas~signed~ toTeposi~ti~orrth~e al~e as ness'ary in thd: &v~rit*125-volt D.C. power is lost. Consistent with the bases for LCO 3.8.2.4, the 125-volt D.C. support system operability requirements for both trains of SDC are satisfied in MODE 5 with at least one 125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied. The operation of one Reactor Coolant Pump or one shutdown cooling pump provides adequate..flow t stratificati~on _anproduce~graduat reacti~v4iy changes..... during boron concentration reductions in the Reactor Coolant System. The reactivity change rate associated with boron reductions will, therefore, be within the capability of operator recognition and control. : The restrictions on starting a Reactor Coolant Pump in MODE 4 with one or more RCS cold legs < 275°F and in MODE 5 are provided to prevent RCS pressure transients, caused by energy additions from the secondary system, which could exceed the limits of Appendix G to 10 CFR Part 50. The RCS will be protected against overpressure transients and will not exceed the limits of Appendix G by: 1. Restricting pressuriz'er water volume to ensure sufficient steam volume is available to accommodate the insurge;: 2. Restricting pressurizer pressure to establish an initial pressure that will ensure system pressure does not exceed the limit; and 3. Restricting primary-to secondary system delta-T to reduce the energy addition from the secondary system.If these restrictions are met, the steam bubble in the pressurizer is sufficient to ensure the Appendix G limits will not be exceeded. No credit has been taken for PORV actuation to limit RCS pressure in the analysis of the energy addition transient. MILLSTONE -UNIT 2 B 3/4 4-lb Amendment No. -50, 66, 69, 41-39, 2---8, :28 Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030 September 14, 2006 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued) The limitations on pressurizer water level, pressurizer pressure, and primary to secondary delta-T.are necessary to ensure the validity of the analysis of the energy addition due to starting an RCP.The values for pressurizer water level and pressure can be obtained from control room indications. The. primary to secondary system delta-T can be obtained from Shutdown Cooling (SDC) System outlet temperature and the saturation temperature for indicated steam generator pressure. If there is no indicated steam generator pressure, the steam generator shell temperature indicators can be used. If these indications are not available, other appropriate instrumentation can be used.Th~e ROP starting:gi--riiriavalu~s for pressui'izer water level; pressurizer-pressure, and primairy to adjusted for instrument uncertainty. The values for these parameters contained in the procedures that will be used to start an RCP have been adjusted to compensate for instrument uncertainty. The value of RCS cold leg temperature (_< 275 0 F ) used to determine if the RCP start criteria applies, will be obtained from SDC return temperature if SDC is in service. If SDC is not in servdc~e,_oranatural..cireculation~is.nccurrng, .RCS~cold ieg.temp eraturewiUlbenuse~cL ................. Average Coolant Temperature (Tavg) values are derived under the following 3 plant conditions, using the designated formula as appropriate for use in Unit 2 operating procedures.

• RCP Operation: (Tcold1 + Tcold2 + ThotI + Thot2) / 4 = Tv Natural circulation only flow: (Tcodld + Tcold2 + Thotl + Thot2) / 4 =Tv*SDC flow greater than 1000 gpm: (SDCoutiet

+/- SDC 1 inlt) / 2 =Tavg (exception: Tavg is not expected to be calculated by this definition during the initial portion of the initiation phase of SDC. The transition point from loop temperature average to SDC system average during cooldowns is when T3 51 Y decreases below Loop Tcold) ...During operation with one or more Reactor Coolant Pumps (RCPs) providing forced flow and during natural circulation conditions, the, loop Resistance Temperature Detectors (RTDs)represent the inlet and outlet temperatures of the reactor and hence the average temperature of the water that the reactor is exposed to. This holds during concurrent RCP/SDC operation also.MILLSTONE -UNIT 2 B 3/4 4-1c Amendment No. 50, 66, 69, 4-3~9, l-, 248, 249, Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030 September 14, 2006 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued) During Shutdown Cooling (SDC) only operation, there is no significant flow past the loo1p RTDs. Core inlet and outlet termperatures are accurately measured during those conditions by using T351lY, SDC return to RCS temperature indication, and T351 X, RCS to SDC temperature indication. The average of these two indicators provides a temperature that is equivalent to the average RCS temperature in the core.During the transition from Steam Generator (SG) and SDC heat removal to SDC only heat removal, actual core average temperature results from a mixture of both SDC flow and loop flow" from T~his ,m.ch~e t!ime co~oling :is .in iti~ated.u~ntil!.$S.G calculatedck However, the .average o~f t~he ,stil;toappropriate, fo r use."Thi-s; .'provides a straightforward process for determining Tavg.During some transient conditions, such as heatups on SDC, the value calculated by this average definition will be slightly higher than the actual core aiverage. During other transients, such as cooldowns where SG heat removal~is Still taking place causing some natural circulation conditions. For the purpose of determining MODE changes and technical specification applicability, these transient condition results are conservative. The Notes in LCOs 3.4.1.2, 3.4.1.3, 3.4.1.4, and 3.4.1.5 permit a limited period of operation without RCPs and shutdown cooling pumps. All RCPs and shuitdown cooling pumps may be removed from operation for _< 1 hour per 8 hour period. This means thatnatural circulation has been established. When in natural circulation,-a reduction in boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1.1t is maintained is prohibited because an even concentration distribution throughout the RCS cannot be ensured.Core outlet temperature is to be maintained at least 10°F below the saturation temperature so that no vapor bubble may form and possibly cause a natural circulation flow obstruction. Concerning TS 3.4.1.2, ACTION b.; 3.4.1.3, ACTION c.; 3.4.1.4, ACTION b.; and 3.4.1.5, ACTION b., if two required loops or trains are inoperable or a required loop or train is not in operation except during conditions permitted by the note in the LCO section, all operations involving introduction of coolant into the RCS with boron concentration less than requiredto meet the minimum SDM of LCO 3.1.1.1 must be suspended and action to restore one RCS loop or SDC train to OPERABLE status and operation must be initiated. The required margin to criticality must not be reduced in this type of operation. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDMo~f LCO 3.1. 1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron MILLSTONE -UNIT 2 B 3/4 4-1d Amendment No. gO, 66, 69, 4-3-9, 8, 248, 249, , Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030 September 14, 2006 3/44SEACOSOLATSSE BASES 3/4A. 1 COOLANT LOOPS AND COOLANT CIRCULATION (continued) concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immnediate completion time~s reflect the, importance of decay heat removal. The ACTION to restore must continue until one ioop or train is restored to operation.* Technical Specification 3.4.1.6 limits the number of reactor co~olant pumps that may be*operational during MODE 5. This will limit the pressure drop across the core when the pumps are operated during low-temperature conditions. Controlling the pressure drop across the core. will maintain maximum RCS pressure within the maximum allowable pressure as calculated in Code Case.No.,,,N-I14. ..Limi~ting two rea~cto~r-..coo1!ptrp~!s. .Qpop..r~tatw~h~e.n.theiRC.S cold-..{.e.. " not exce~eded. .'.Surveillanee, 4,;#:4A 6-.supportw:this-requirement. ... .. ..3/4.4.2 SAFETY VALVES The pressurizer code safety valves operate toprevent the RCS from being, pressurized. above its Safety Limit of 2750 psia. Each safety valve is designed to relieve 296,000 lbs per hour of saturated steam at the valve setpoint. The relief capapcty of a ingles.~fety valve is adequate to_relieve any overpressure condition which could occur during shutdown. If any pressurizer code safety valve is inoperable, and cannot be restored to OPERABLE status, the ACTION statement requires the plant to be shut down and cooled down such that Technical Specification 3.4.9.3 will become applicable and require the Low Temperature Overpressure Protection System to be placed in service to provide overpressure protection MILLSTONE -UNIT 2 B 3/4 4-1e Amendment No. 93-, Acknowledged By NRC July 5, 2007 LBDCR 04-MP2-016 February 24, 2005 3/4.4 REACTOR COOLANT SYSTEM BASES During operation, all pressurizer code safety valves must be OPERABLE to prevent the RCS from being pressurized above its safety limit of 2750 psia. The combined relief capacity of these valves is sufficient to limit the Reactor Coolant System pressure to within its Safety Limit of 2750 psia following a complete loss of turbine generator load while operating at RATED THIERMAL POWER and assuming no reactor trip until the first Reactor Protective System trip setpoint (§Pressurizer Pressure-High) is reached (i.e., no credit is taken for a direct reactor trip on the loss of turbine) and also assuming no operation of the pressurizer power operated relief valve or steam dumrp valves.3/4.4.3 RELIEF VALVES The power operated relief valves (PORVs) operate to relieve RCS pressure below the setting of the pressurizer code safety valves. These relief valves have remotely operated block valves to provide a positive shutoff capability should a relief valve become inoperable. The electrical power for both the relief valves and the block valves is capable of being supplied from an emergency power source to ensure the ability to seal this possible RCS leakage path.The PORVs are also used for low temperature overpressure protection when the RCS is cooled down to or below 275 0 F. This is covered by Technical Specification 3.4.9.3 and discussed in the respective Bases section. The discussion below only addresses the PORVs in MODES 1, 2 and 3.With the PORV inoperable and capable of being manually cycled, either the PORV must be restored, or the flow path isolated within 1 hour. The block valve should be closed, but the power must be maintained to the associated block valve, since removal of power would render the block valve inoperable. Although the PORV mnay be designated inoperable, it may be able to be manually opened and closed and in this manner can be used to perform its function. PORV inoperability may be due to seat leakage, instrumentation problems, aiutomatic control problems, or other causes that do not prevent manual use and do not create a possibility for a small break LOCA. Operation of the plant may continue with the PORV in this inoperable condition for a limited period of time not to exceed the next refueling outage, so that maintenance can be perfolrmed on the PORVs to eliminate the degraded condition. The PORVs should normally be available for automatic mitigation of overpressure events when the plant is at power.Quick access to the PORV for pressure control can be made when power remaints on the closed block valve.If one block valve is inoperable, then it must be restored to OPERABLE status, or the associated PORV prevented from opening automatically. The prime irnportance for the capability to maintain closed the block valve is to isolate a stuck open PORV. Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour, the required ACTION is to prevent the associated PORV from automatically opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable. This may be accomplished by MILLSTONE -UNIT 2 B 3/4 4-2 Amendment No. O, 46,469., 9, 2---8, Acknowledged by NRC letter dated 6128105 LBDCR 14-MP2-001 May 20, 2014 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.3 RELIEF VALVES (Continued) various methods. These methods include, but are not limited to, placing the NORMVAL/ISOLATE switch at the associated Bottle Up Panel in the "ISOLATE" position or pulling the control power fuses for the associated PORV control circuit.Although the block valve may be designated inoperable, it may be able to be manually opened and closed and in this manner can be used to perform its function. B lock valve inoperability may be due to seat leakage, instrumentation problems, or other causes that do not prevent manual use and do not create a possibility for a small break LOCA. This condition is only intended to permit operation of the plant for a limited pei'iod of time. The block valve should normally be available to allow PORV operation for automatic mitigation of overpressure events. The block valves must be returned to OPERABLE status prior to entering MODE 3 after a refueling outage.If two PORVs are inoperable and not capable of being manually cycled, it is necessary to isolate the flow path by closing and removing the power to the associated block valves within 1 hour and to restore at least one PORV within 8 hours. The Condition is modified by a Note stating it is not applicable if the second PORV train is intentionally declared inoperable. The Condition does not apply to voluntamy¢ removal of redundant systems or components from service. The Condition is applicable if one PORV is inoperable for any reason and the second PORV is discovered to be inoperable, or if both PORVs are discovered to be inoperable at the same time.In the event of a loss of feedwater, the PORVs would be used to remove core heat. In order to minimize the consequences of a loss of feedwater while two PORVs are inoperable, Required Action c.3 requires that LCO 3.7.1.2, "Auxiliary Feedwater Pumps," be met to ensure AFEW is available. The inoperability of two PORVs during the 8 hour allowed outage time has been shown to be acceptable based on the infrequent use of the Required Action and the Small incremental effect on plant risk (Ref. 1). If one PORV is restored and one PORV remains inoperable, then the plant will be in Condition

b. with the time clock started at the original declaration of having two P ORVs inoperable.

If two block valves are inoperable, it is necessary to .restore at least one block valve to OPERABLE status within 8 hours. The Condition is modified by a Note stating it is not applicable if the second block valve is intentionally declared inoperable. The Condition does not apply to voluntary removal of redundant systems or components fr'Qm service. The Condition is only applicable if one block valve is inoperable for any reason and the second block valve is MILLSTONE -UNIT 2 B 3/4 4-2a Amendment No. 2, 3-, 66, 9-7, I-8-, 2-l8, 2461-LBDCR 14-MP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES.3/4.4.3 RELIEF VALVES (Continued) discovered to be inoperable, or if both block valves are discovered to be inoperable at the same time. In the event of a loss of feedwater, the PORVs would be used to remove core heat. In order to minimize th~e consequences of a loss of feedwater while two block valves are inoperable, Required Action e. 1 requires that LCO 3.7.1.2, "Auxilia1iy Feedwater Pumps," be verified to be met within 1 hour. The inoperability of two block valves during the 8 hour allowed outage time has been shown to be acceptable based on the infrequent use of the Required Actions and the small incremental effect on plant risk (Ref. 1).SURVEILLANCE REQUIREMENT 4.4.3.l.c requires operating each PQRV through one complete cycle of full travel at conditions representative of MODES 3 or 4. This is normnally performed in MODE 3 or 4 as the unit is descending in power to colmmence a refueling outage.This test will normally be a static test, whereby a PORV will be exposed to MODE 3 or 4 temperatures, the block valve closed, and the PORV tested to verify it strokes through one complete cycle of full travel. PORV cycling demonstrates its function. The Frequency of 18 months is based on a typical refueling cycle and industry accepted practice. SURVEILLANCE REQUIREMENT 4.4.3.1 .c is consistent with the NRC staff position outlined in Generic Letter 90-06, which requires that the 18-month PORV stroke test be performed at conditions representative of MODE 3 or 4. Testing in the manner described is also consistent with the guidance in NUREG 1482, "Guidelines for Inservice Testing at Nuclear Power Plants," Section 4.2.10, that describes the PORVs function during reactor startup and shutdown to protect the reactor vessel and coolant system from low-temperature overpressurization conditions, and indicates they should be exercised before system conditions warrant vessel protection. If post maintenance retest is warranted, the affected valve(s) will be stroked under amabient conditions while in Mode 5, 6, or defueled. A Hot Functional Test is required to .be performed in MODE 4 prior to entry into MODE 3. The actual stroke time in the open and close direction will be measured, recorded and compared to the test results obtained during pre-installation testing to assess acceptability of the affected valve(s).SURVEILLANCE REQUIREMENT 4.4.3.2 verifies that a block valve(s) can be closed if necessary. This SURVEILLANCE REQUIREMENT is not required to be perform~ed with the block valve(s) closed in accordance with the ACTIONS of TS 3.4.3. Opening the block valve(s)in this condition increases the risk of an unisolable leak fr'om the RCS since the PORV(s) is already inoperable. REFERENCE 1. WCAP-16 125-NP-A, "Justification for Risk-Informed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -U/NIT 2 B 3/4 4-2b Amendment No. -22, .3-7, g-2, 66, 89,-14-1, -t2-1, 3-, -t94 LBDCR 14-MiP2-001 Mlay 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.4 PRESSURIZER An OPERABLE pressurizer provides pressure control for the reactor coolant system during operations with both forced reactor coolant flow and with natural circulation flow. The minimum water level in the pressurizer assures the pressurizer heaters, which are required to achieve and maintain pressure control, remain covered with water to prevent failure, which occurs if the heaters are energized uncovered. The maximum water level in the pressurizer ensures that this parameter is maintained within the envelope of operation assumed in the safety analysis. The maximum water level also ensures that the RCS is not a hydraulically solid system and that a steam bubble will be provided to accommodate pressure surges during operation. The steam bubble also protects the pressurizer code safety valves and power operated relief valve against water relief. With pressurizer water level not within the limit, action must be taken to restore the plant to operation within the bounds of the safety analyses. To achieve this status, the unit must be brought to at least HOT STANDBY with the reactor trip breakers open within 6 hours and in HOT S1{UTDOWN within the following 6 hours. This takes the plant out of the applicable MODES and restores the plant to operation within the bounds of the safety analyses. The requirement that a minimum number of pressurizer heaters be OPERABLE enhances the capability of the plant to control Reactor Coolant System pressure and establish and maintain natural circulation. If two required groups of pressurizer heaters are inoperable, restoring at least one group of pressurizer heaters to OPERABLE status is required within 24 hours. The Condition is modified by a Note stating it is not applicable if the second grohp of requi-ed pressurized heaters is intentionally declared inoperable. The Condition is not intended for voluntary removal of redundant systems or components from service. The Condition is only applicable if one group of required pressurized heaters is inoperable for any reason and the second group of required pressurized heaters is discovered to be inoperable, or if both groups of required pressurized heaters are discovered to be inoperable at the same time. If both required groups of pressurizer heaters are inoperable, the pressurizer heaters may not be available to help maintain subcooling in the RCS loops during a natural circulation c ooldown following a loss of' offsite power. The inoperability of two groups of required pressurizer heaters during the 24 hour" allowed outage timae has been shown to be acceptable based on the infrequent use of the Required Action and the small incremental effect on plant risk (Ref. 1).The requirement for two groups of pressurizer heaters, each having a capacity of 130 kW, is met by verifying the capacity of the pressurizer proportional heater groups 1 and 2. Since the pressurizer proportional heater groups 1 and 2 are supplied fr'om the emergency 480V electrical buses, there is reasonable assurance that these heaters can be energized during a loss of offsite power to maintain natural circulation at HOT STANDBY.REFERENCE 1. WCAP-1 6125-NP-A, "Justification for Risk-Informed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2B /42AmnetNo B 3/4 4-2c Amendment No. LBDCR 14-MP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY LCO The LCO requires that steam generator (SG) tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the plugging criteria be plugged in accordance with the Steam Generator Program.During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging. If a tube was determined to satisfy the plugging criteria but was not plugged, the tube may still have tube integrity. In the context of this Specification, a SG tube is defined as the entire length of the tube, including the tube wall between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 6.26, "Steam Generator Program," and describe acceptable SG tube performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria. There are three SG perfolniance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.The structural integrity performance criterion provides a mar'gin of safety against tube burst or collapse under nonanal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as,"The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area inc~reased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance onassessing loads that have a significant effect on burst or collapse. In that context, the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumnferential degradation, axial thermaal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primalmy or secondary loads will be evaluated on a case-by-case basis. The division between primary and secondary classifications will be based on detailed analysis and/or testing.MILLSTONE -UNIT 2 B3442 mnmn o B 3/4 4-2d Amendment No. LBDCR 14-MVP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) LCO (Continued) Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormaal conditions) transients included in the design specification. This includes safety factors and applicable design basis loads based on ASME Code, Section III, Subsection NB (Reference

4) and Draft Regulatory Guide 1.121 (Reference 5).The accident induced leakage performance criterion ensures that the primary to secondaiy' LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions.

The accident analysis assumes that accident induced leakage does not exceed 150 GPD per SG. The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in LCO 3.4.6.2, "Reactor Coolant System Operational LEAKAGE," and limits primary' to secondary LEAKAGE through any one SG to 75 gallons per day. This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative. APPLICABILITY Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced during MODES 1, 2, 3, and 4.RCS conditions are far less challenging during MODES 5 and 6 than during MODES 1, 2, 3, and 4. During MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.ACTIONS The ACTIONS are modified by a NOTE clarifying that the ACTIONS may be entered independently for each SG tube. This is acceptable because the ACTIONS provide appropriate conmpensatory actions for each affected SG tube. Complying with the ACTIONS may allow for continued operation, and subsequent affected SG tubes are governed by subsequent ACTION entry and application of associated ACTIONS.MILLSTONE -UNIT 2 B 3/4 4-2e Amendment No. LBDCR 14-MP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) ACTIONS (Continued) a.1 and a.2 ACTION a. applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube plugging criteria but were not plugged in accordance with the Steam Generator Program as required by TS 4.4.5.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG perfonmance criteria described in the Steam Generator Progr'am. The SG plugging criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the thne the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, ACTION b. applies.A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity. If the evaluation determines that the affected tube(s) have tube integrity, ACTION a.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection intearval continues to be supported by an operational assessment that reflects the affected tube(s). However, the affected tube(s) must be plugged prior to entering HOT SHUTDOWN following the next refueling outage or SG inspection. This Completion Time is ,acceptable since operation until the next inspection is supported by the operational assessment. b.1 and b.2 If the ACTIONS and associated Completion Times of ACTION a. are not met or if SG tube integrity is not being maintained, the reactor must be brought to HOT STANDBY within 6 hours and COLD SHUTDOWN within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.MIILLSTOKE -UITh2 B/4 mnmn o B 3/4 4-2f LBDCR 14-MIP2-001 May 20, 2014 REACTOR. COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) SURVEILLANCE REQUIREMENTS TS 4.4.5.1 During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Progr'am Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices. During S G inspections a condition monitoring assessment of the S G tubes is performed. The condition monitoring assessment determines the "as found" condition of the SG tubes. The purpose of the. condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.The Steam Generator Program determnines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube plugging criteria. Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a fuanction of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation. Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations. The Steam Generator Program defines the Frequency of TS 4.4.5.1. The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Reference 6). The Steam Generator Program uses infonnation on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 6.26 contains prescriptive requirements concerning inspection intervals to provide.added assurance that the SG performance criteria will be met between scheduled inspections. If crack indications are found in any SG tube, the maximum inspection interval for all affected and potentially affected SGs is restricted by Specification 6.26 until subsequent inspections support extending the inspection interval.Tx/ArT T VTC'NTTP _ T ThTTT ) D1 "21A AO,-r A nnchln~pij 1'J 0 O ~II J. -- J.£ .L LBDCR 14-MiP2.-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 314.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) SURVEILLANCE REQUIREMENTS (Continued) TS 4.4.5.2 During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed fr'om service by plugging. The tube plugging criteria delineated in Specification 6.26 are intended to ensure that tubes accepted for continued service satisfy the SG perfonnmace criteria with allowance for error in the flaw size measurement and for future flaw growth. In additioni, the tube plugging criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.The Frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the plugging criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential. BACKGROUND SG tubes are small diameter, thin walled tubes that carry primary coolantt thr-ough the primary to secondary heat exchangers. The SG tubes have a number of imnportant safety functions. SG tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary system's pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primnaly and secondary systems to remove heat from the system. Thtis Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO. 3.4.1.1, "RCS STARTUP AND POWER OPERATION," LCO 3.4.1.2, "RCS HOT STANDBY," LCO 3.4.1.3, "RCS HOT SHUTDOWN," and LCO 3.4.1.4, "RCS COLD SHUTDOWN-LOOPS FILLED." SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements. SG tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively. The SG performance criteria are used to manage SG tube degradation. MILLSTONE -UNIT 2 B3442 mnmn o B 3/4 4-2h Amendment No. LBDCR 14-MP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GEN~ERATOR TUBE INTIEGRITY (Continued) BACKGROUND (Continued) Specification 6.26, "Steam Generator (SG) Program," requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 6.26, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 6.26. Meeting the SG performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions. The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Reference 1).APPLICABLE SAFETY ANALYSES The steam generator tube rupture (SGTR) accident is the limiting design basis event for SG tubes and avoiding an SGTR is the basis for this Specification. The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate equal to the operational LEAKAGE rate limits in LCO 3.4.6.2, "'RCS Operational LEAKAGE," plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumies the contaminated secondary fluid is released to the atmosphere via safety valves or atmospheric dump valves.The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture). In these analyses, the steam discharge to the atmosphere is based on the total primary to secondary LEAKAGE from any one SG of 150 gpd or from all SGs of 300 gpd as a result of accident induced conditions. For accidents that do not involve fuel damage, the primamy coolant activity level of DOSE EQUIVALENT 1-131 is assumed to be equal to the LCO 3.4.8, "RCS Specific Activity" limits.For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Reference 2), 10 CFR 50.67 (Reference

3) or the NRC approved licensing basis (e.g., a small fraction of these limits).Steam Generator tube integrity satisfies Criterion 2 of 10 CER 50.36(c)(2)(ii).

MILLSTONE -UNIT 2B3442AmnetNo B 3/4 4-2i Amendment No. LBDCR 14-.MP2-01l May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/14.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) REFERENCES

1. NEI 97-06, "Steam Generator Program Guidelines." 2. 10 CFR 50 Appendix A, GDC 19.3. 10 CER 50.67.4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines." MILLSTONE

-UNIT 2B3/42AmnetNo B 3/4 4-2j Amendment No. August 08, 2007 07-MP2-0 12 REACTOR COOLANT SYSTEMI BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.1 LEAKCAGE DETECTION SYSTEMS The RCS leakage detection systems requir~ed by this specification are provided to monitor and detect leakage fr~om the Reactor Coolant Pressure Boundary. These detection systems are consistent with the recommendations of Regulatory Guide 1.45, "Reactor Coolant Pressure Boundaiyz Leakage Detection Systems." Action c provides a 72 hour allowed outage time (AOT) when both the containment atmosphere particulate radioactivity mnonitoring channels are inoperable and containment sump level monitoring system is inoperable. The 72 hour AOT is appropriate since additional actions will be taken during this limited time period to ensure RCS leakage, in excess of the unidentified leakage TS limit of 1 gpm (TS 3.4.6.2), will be readily detectable. This will provide reasonable assurance that any significant reactor coolant pressure boundaiy* degradation is detected soon after occurrence to minimize the potential for propagation to a gross failure. This is consistent with the requirements of General Design Criteria (GDC) 30 and also Criterion 1 of 10 CFR 50.36(d)(2)(ii) which requires installed instrumentation to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary. The RCS water inventory balance calculation determines the magnitude of RCS unidentified leakage by use of0 instrumentation readily available to the control room operators.. However, the proposed additional actions will not restore the continuous monitoring capability nonnally provided by the inoperable equipment. The RCS water inventory balance is capable of identifying a one gpmnRCS leak rate. The containment grab samples will also indicate an increase in RCS leak rate which would then be quantified by the RCS water inventory balance. Since these additional actions are sufficient to ensure RCS leakage is within TS limits, it is appropr'iate to provide a limited time period to restore at least one of the TS-required leakage monitoring systems.MILLSTONE -UNIT 2 B 3/4 4-3 Amendment No. t, 38,-22-8, August 08, 2007 07-MP2-0 12 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE LCO RCS operational LEAKAGE shall be limited to: a PRESSURE BOUNDARY LEAKAGE No PRESSURE BOUNDARY LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is notPRESSURE BOUNDARY LEAKAGE.b UNIDENTIFIED LEAKAGE One gallon per minute (gpm) of UNIDENTIFIED LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.c Primary to Secondary_ LEAKAGE through-Any-One Steam Generator The limit of 75 gallons per day per Steam Generator (SG) is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines (Reference

4) and the accident analysis described in the FSAR (Reference 3). The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states,"The RCS operational primary to secondary leakage through any one SG shall be limited to 150 gallons per day." The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational leakage rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.

The main steam line break (MSLB) accident analysis assumes a primary to secondary leakage of 150 gallons per day per 8G.MILLSTONE -UNIT 2 B3443 mnmn o B 3/4 4-3a Amendment No. LBDCR 09-MP2-004 May 28, 2009 .::.REACTOR. COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE LCO (Continued) d IDENTIFIED LEAKAGE Up to 10 gpm of IDENTIFIED LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of UNIDENTIFIED LEAKAGE and is well within the capability of the RCS makeup system. IDENTIFIED LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include PRESSURE BOUNDARY LEAKAGE or CONTROLLED LEAKAGE. Violation of this LCO could result in continued degradation of a component or system.The IDENTIFIED LEAKAGE and UNIDENTIFIED LEAKAGE limits listed in LCO 3.4.6.2 only apply to the RCPB within the containment. Leakage outside of the second isolation valve for containment,, which is included in the RCS Leak Rate Calculation, is not considered RCS LEAKAGE and can be subtracted from RCS UNIDENTIFIED LEAKAGE. The definitions for IDENTIFIED LEAKAGE and UNIDENTIFIED LEAKAGE are provided in the technical .specifications definitions section, Definition 1.14.APPLICABILITY -...In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.' In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.ACTIONS a UNIDENTIFIED LEAKAGE or IDENTIFIED LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify UNIDENTIFIED LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.MILLSTONE -UNIT 2 B 3/4 4-3b Amendment No. ,l Auagust 08, 2007 07-MP2-0 12 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE ACTIONS (Continued) b If any PRESSURE BOUNDARY LEAKAGE exists, or primary to secondary LEAKAGE is not within limits, or if UNIDENTIFIED or IDENTIFIED LEAKAGE cannot be reduced to within limits within 4 hours, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE. The reactor must be brought to HOT STANDBY within 6 hours and COLD SHUTDOWN within 36 hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In COLD SHUTDOWN, the pressure stresses acting on the reactor coolant pressure boundary are much lower, and further deterioration is much less likely.SURVEILLANCE REQUIREMENTS 4.4.6.2.1 Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB is maintained. PRESSURE BOUNDARY LEAKAGE would at first .appear as UNIDENTIFIED LEAKAGE and can only be positively identified by inspection. UNIDENTIFIED LEAKAGE and IDENTIFIED LEAKAGE are determined by performance of an RCS water inventory balance.The RCS water inventory balance must be performed with the reactor at steady state operating conditions (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal leakoff flows). The Surveillance is modified by two Notes. Note 1 states that this SR is not required to be performed until 12 hours after establishing steady state Operation. The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established. MILLSTONE -UNIT 2 B3443 mnmn o B 3/4 4-3c Amendment No. August 08, 2007 07-MP2-0 12 REACTOR COOLANT SYSTEM BASES0 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE SURVEILLANCE REOUIREMENTS (Continued) Steady state operation is required to perform a proper water inventory balance since calculations during maneuvering are not useful. For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal leakoff flows.An early warning of PRESSURE BOUNDARY LEAKAGE or UNIDENTIFIED LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. These leakage detection systems are specified inl LCO 3.4.6.1, "Leakage Detection Systems." Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 75 gallons per day cannot be measured accurately by an RCS water inventory balance.The 72 hour Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. 4.4.6.2.2/ This SR verifies that primary to secondary LEAKAGE is less than or equal to 75 gallons per day through any one SG. Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCO* 3.4.5, "Steam Generator Tube Integrity," should be evaluated.

• The 75 gallons per day limit is measured at room temperature as described in Reference

5. The Operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours after establishment of steady state operation.

For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal leakoff flows.MILLSTONE -UNIT 2 B 3/4 4-3d Amendment No. LBDCR 14-MP2-016 September 4, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE SUIRVEILLANCE REOUIREMENTS (Continued) The frequency specified in the Surveillance Frequency Control Program is a reasonable interval to trend primary to secondary LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPR[ guidelines (Reference 5).BACKGROUNhD Components that contain or transport the coolant to or from the reactor core make up the reactor coolant system (RCS). Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either nonnal operational wear or mechanical deterioration. The purpose of the RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.10 CFR 50, Appendix A, GDC 30 (Reference 1), requires mneans for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Reference

2) describes acceptable methods for selecting leakage detection systems.The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration.

Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIIDENTIFIED LEAKAGE is necessary to provide quantitative information to the. operators, allowing them to take colTective action should a leak occur detrimental to the safety of the facility and the public.A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight. Leakage fronl these systems should be detected, located, and isolated from~.the containment atmosphere, if possible, to not interfere with RCS LEAKAGE detection. This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analysis radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).MILLSTONE -UNIT 2 B/43 mnmn o B 3/4 4-3e Amendment No. August 08, 2007 07-MP2-012 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE APPLICABLE SAFETY ANALYSES -OPERATIONAL LEAKAGE Except for primary to secondary LEAKAGE, the safety analyses do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA;the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGE from any one steam generator (SG) of 150 gpd or from all SGs of 300 gpd as a result of accident induced conditions. The LCO requirement to limit primary to secondary LEAKAGE through any one SG to less than or equal to 75 gallons per day is significantly less than the conditions assumed in the safety analysis.Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a main steam line break (MSLB) accident. To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR). The leakage contaminates the secondary fluid. The FSAR (Reference

3) analysis for SGTR assumes the contaminated secondary fluid is only briefly released via safety valves or atmospheric dump valves.The MSLB is the more limiting accident for MPS2 control room dose. The safety analysis for the MSLB accident assumes 150 gpd primary to secondary.LEAKAGE is through~the affected generator and 150 gpd from the intact SG as an initial condition.

The dose consequences resulting from the MSLB accident are well within the limits defined in 10 CER 50.67 or the staff approved licensing basis (i.e., a small fraction of these limits).The RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). MILLSTONE -UNIT 2 B 3/4 4-3f Amendment No. l March 18, 2008" LBDCR 08-MP2-013 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE REFERENCES 110 CFR 50, Appendix A, GDC 30.2 Regulatory Guide 1.45, May 1973.3 ESAR, Section 14 4 NEI 97-06, "Steam Generator Program Guidelines." 5 EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines." 3/4.4.7 DELETE 3/4.4.8 SPECIFIC ACTIVITY BACKGROUND The maximum dose that an individual at the exclu~sion .a~reaboundary can receive for 2 hours following an accident, or at the low population zone outer boundary for the radiological release duration, is specified in 10 CFR 50.67 (Ref. 1). Doses to control room occupants must be limited per GDC 19. The limits on specific activity ensure that the offsite and Control Room Envelope (CRE) doses are appropriately limited during :analyzed transients and accidents. The RCS specific activity LCO limits the allowable concentration of radionuclides in the reactor coolant. The LCO limits are established to minimize the dose consequences in the event of a steam line break (SLB) or steam generator tube rupture (SGTR) accident.The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and DOSE EQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and CRE doses meet the appropriate acceptance criteria in the Standard Review Plan (Ref. 2).MILLSTONE -UNIT 2 B 3/4 4-4 MILLTON -NIT2 B3/44-4Amendment No. 44--5, -194, 2-66, March 18, 2008 LBDCR 08-MP2-013 REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVITY (continued) APPLICABLE SAFETY ANALYSES The LCO limits on the specific activity of the reactor coolant ensure the resulting offsite and CRE doses meet the appropriate SRP acceptance criteria following a SLB or SGTR accident. The safety analyses (Refs. 3 and 4) assume the specific activity of the reactor coolant is at the LCO limits, and an existing reactor coolant steam generator (SG) tube leakage rate of 150 gpd exists.The~safety analyses assume the specific activity of the secondary coolant is at its limit of 0.1 igCi/gm DOSE EQUIVALENT I- 131 from LCO 3.7.1.4, "Activity." The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specific activity. Reference to these analyses is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.The safety analyses consider two cases of reactor coolant iodine specific activity. One case assumes specific activity at 1.0 jiCi/gm DOSE EQUIVALENT 1- 131 with a concurrent large iodine spike that increases the rate of release of iodine from the fuel rods containing cladding defects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factor of 335), respectively. The second case assumes the initial reactor coolant iodine activity at 60.0 pCi/gm DOSE EQUIVALENT I- 131 due to an iodine spike caused by a reactor or an RCS transient prijor to the accident. In both cases, the noble gas specific activity is assumed to be 1100 p.tCi/gm DOSE EQUIVALENT XE-133.... The SGTR analysis assumes a rise in pressure in the ruptured SG causes radioactively contaminated steam to discharge to the atmosphere through the atmospheric dump valves or the.main steam safety valves. The atmospheric discharge stops when the turbine bypass to the condenser removes the excess energy to rapidly reduce the RCS pressure and close the valves.The unaffected SG removes core decay heat by venting steam until the cooldown ends and the Shutdown Cooling (SDC) system is placed in service.The SLB radiological analysis assumes that offsite power is lost at the same time as the pipe break occurs outside containment. The affected SG blows down completely and steam is vented directly to the atmosphere. The unaffected SG removes core decay heat by venting steam to the atmosphere until the cooldown ends and the SDC system is placed in service.Operation with iodine specific activity levels greater than 1 giCi/gm but less than or equal to 60.0 pCi/gm is permissible for up to 48 hours while efforts are made to restore DOSE EQUIVALENT 1-131 to within the 1 [iCi/gm LCO limit. Operation with iodine specific activity levels greater than 60 jiCi/gm is not permissible. MILLSTONE -UNIT 2 B3444 B 3/4 4-4a March 18, 2008 LBDCR 08-MP2-013 REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVITY (continued) APPLICABLE SAFETY ANALYSES (continued) The RCS specific activity limits are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices. RCS spedific activity satisfies Criterion 2 of 10 CFR 50.3 6(c)(2)(ii). LCO The iodine specific activity in the reactor coolant is limited to 1.0 pCi/gm DOSE EQUIVALENT I-131, and the noble gas specific activity in the reactor coolant is limited to 1 100 pCi/gm DOSE EQUIVALENT XE-133. The limits on specific activity ensure that offsite and CRE doses will meet the appropriate SRP acceptance criteria (Ref. 2).The SLB and SGTR accident analyses (Refs. 3 and 4) show that the calculated doses are within acceptable limits. Operation with activities in excess of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SLB or SGTR, lead to doses that exceed the SRP acceptance criteria (Ref. 2).APPLICABILITY In MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT 1-13 1 and DOSE EQUIVALENT XE- 133 is necessary to limit the potential consequences of a SLB or SGTR to within the SRP acceptance criteria (Ref. 2).In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS and steam generators are depressurized, and primary to secondary leakage is minimal. Therefore, the monitoring of RCS specific activity is not required.MILLSTONE -UNIT 2 B3444 B 3/4 4-4b March 18, 2008 LBDCR 08-MP2-013 REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVITY (continued) ACTIONS a. and b.With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of four hours must be taken to demonstrate that the specific activity is _< 60 jiCi/gm. Four hours is required to obtain and analyze a sample. Sampling is continued every four hours to provide a trend.The DOSE EQUIVALENT I-131 must be restored to within limit within 48 hours. The completion time of 48 hours is acceptable since it is expected that, if there were an iodine spike, the normal coolant iodine concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.A statement in ACTION b. indicates the provisions of LCO 3.0.4 are not applicable. This exception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTIONS a. and b- while the DOSE EQUIVALENT I-131 LCO is not met. This exception is acceptable due to the significant conservatism incorporated into the RCS specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, power operation. c..__If the required action and completion time of ACTION b. is not met, or if the DOSE EQUIVALENT 1-131 is > 60 jpCi/gm, the reactor must be brought to HoT STANDBY (MODE 3)within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.MILLSTONE -UNIT 2 B3444 B 3/4 4-4c LBDCR 14-MP2-016 September 4, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVTY (continued) ACTIONS (continued) d__.With the RCS DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENT XE-133 must be restored to within limit within 48 hours. The allowed completion time of 48 hours is acceptable since it is expected that, if there were a noble gas spike, the normal coolant noble gas concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.A statement in ACTION d. indicates the provisions of LCO 3.0.4 are not applicable. This exception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTION d. while the DOSE EQUIVALENT XE-133 LCO is not met. This exception is acceptable due to the significant conservatism incorporated into the RCS specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, POWER OPERATION. e_.If the required action and completion time of ACTION d. is not met, the reactor must be, brought to HOT STANDBY (MODE 3) within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.*SURVEILLANCE REQUIREMENTS 4.4.8.1 Surveillance Requirement 4.4.8.1 requires performing a gamma isotopic analysis as a measure of the noble gas specific activity of the reactor coolant. This measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance Requirement provides an indication of any increase in the noble gas specific activity. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Trending the results of this Surveillance Requirement allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. MILLSTONE -UNIT 2 B3444 B 3/4 4-4d LBDCR 14-MP2-016 September 4, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVITY (continued). SURVEILLANCE REQUIREMENTS (continued) 4.4.8.1 (continued) Due to the inherent difficulty in detecting Kr-85 in a reactor coolant sample due to masking from radioisotopes with similar decay energies, such as F-18 and 1-134, it is acceptable to include the minimum detectable activity for Kr-85 in the Surveillance Requirement 4.4.8.1 calculation. If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE- 133 is not detected, it should be assumed to be present at the minimum detectable activity.A Note modifies the Surveillance Requirement to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows the Surveillance Requirement to be performed in those MODES, prior to entering MODE 1.4.4.8.2 This Surveillance Requirement is performed to ensure iodine specific activity remains within the LCO limit during normal operation and following fast power changes when iodine spiking is more apt to occur. The frequency specified in the Surveillance Frequency Control Program is adequate to trend changes in the iodine activity level. The frequency of between 2 and 6 hours after a power change __ 15% RTP within a 1 hour period is established because the iodine levels peak during this time following iodine spike initiation; samples at other times would provide inaccurate results.The Note modifies this Surveillance Requirement to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows the Surveillance Requirement to be performed in those MODES, prior to entering MODE 1.REFERENCES

1. 10CFR 50.67.2. Standard Review Plan (SRP) Section 15.0.1 "Radiological Consequence Analyses Using Alternate Source Terms." 3. FSAR, Section 14.1.5.4. FSAR, Section 14.6.3.MILLSTONE

-UNIT 2 B3444 B 3/4 4-4e March 18, 2008 LBDCR 08-MP2-013 REACTOR COOLANT SYSTEM BASES 3/4.4.9 PRESSURE/TEMPERATURE LIMITS*All components in the Reactor Coolant System are designed to with-stand the effects of cyclic loads due to system temperature and pressure changes. These cyclic loads are introduced by normal load transients, reactor trips, and startup and shutdown operations. The various categories of load cycles Used for design purposes are provided in Section 4.0 of the FSAR.During startup and shutdown, the rates of temperature and pressure changes are limited so that the maximum specified heatup and cooldown rates are consistent with the design assumptions and satisfy the stress limits for cyclic operation. In addition, during heatup, and cooldown evolutions, the RCS ferriticmaterials transition between ductile and-brittle (non-ductile) behavior. To provide adequate protection, the pressure/temperature limits were developed in accordance with the 10CFR5O Appendix G requirements to ensure the margins of safety against non-ductile failure are maintained during all normal and anticipated operational occurrences. These pressure!temperature limits are provided in Figures 3.4-2a and 3.4-2b and the heatup and cooldown rates are contained in Table 3.4-2.During heatup, the thermal gradients in the reactor vessel wall produce thermal stresses whichvary from compressive at the inner wall~to tensile at the outer wall. These thermally induced compressive stresses at the inside wall tend to alleviate the tensile stresses induced by the internal pressure. Therefore, a pressure-temperature curve based on steady state conditions (i.e., no thermal stresses) represents a lower bound of all similar curves for finite heatup rates when the inner wall of the vessel is treated as the governing location.The heatup analysis also covers the determination of pressure-temperature limitations for the case in which the outer wall of the vessel *becomes the controlling location. The thermal gradients established during heatup produce tensile stresses at the outer wall of the vessel. These stresses are additive to the pressure induced tensile stresses which are already present. The thermally induced* stresses at the outer wall of the vessel are tensile and are dependent on both the rate of heatup and the time along the heatup ramp; therefore, a lower bound curve similar to that described for the heatup of the inner wall cannot be defined. Subsequently, for the cases in which the outer wall of the vessel becomes the stress controlling location, each heatup rate of interest must be analyzed on an individual basis.MILLSTONE -UNIT 2 B3445AedetN.2lg B 3/4 4-5 Amendment No. 2-t4, July 1, 1998 REACTOR COOLANT SYSTEM BASES The heatup and cooldown limit curves (Figures 3.4-2a and 3.4-2b) are composite curves which were prepared by determining the most conservative case, with either the inside or outside wall controlling, for any heatup or cooldown rates of up to the maximums described in Technical Specification 3.4.9.1, Table 3.4-2. The heatup and cooldown curves were prepared based upon the most limiting value of the predicted adjusted reference temperature at the end of the service period indicated on Figures 3.4-2a and 3.4-2b.Verification that RCS pressure and temperature conditions are within the limits of Figures 3.4-2a and 3.4-2b and Table 3.4-2, at least once per 30 minutes, is required when undergoing planned changes of___ 10°F or _> 100 psi. This frequency is considered reasonable since thie location of interest during cooldown is over two inches (i.e. 1/4 t location) from the interface with the reactor coolant. During heatup the location of interest is over six inches from .the interface with the reactor coolant. This c~ombined with the relatively large heat retention capability of the reactor vessel ensures that small temperature fluctuations such as those expected during normal heatup and cooldown evolutions do not challenge the structural integrity of the reactor vessel when monitored on a 30 minute frequency. The 30 minute time interval permits assessment and correction for minor deviations within a reasonable time.During RCS heatup and cooldown the magnitude of the stresses across the reactor vessel wall are controlled by restricting the rate of temperature change and the system pressure, The RCS pressure/temperature limits are provided in Figures 3.4-2a and 3.4-2b, and the heatup and cooldown rates are contained in Table 3.4-2. The following guidelines should'be used tO ensure compliance with the Technical Specification lim~its. _1. When changing RCS temperature, with any reactor coolant pumps in operation, the rate of temperature change is calculated by using RCS loop cold leg temperature indications. This also applies during parallel reactor coolant pump and shutdown cooling (SDC) pump operation because the RCS loop cold leg temperature is the best indication of the temperature of the fluid in contact with the reactor vessel wall. Even though SDC return temperature may be belowRCS cold leg temperature, the mixing of a large quantity of RCS cold leg water and a small quantity of SDC return water will result in the temperature of the water reaching the reactor vessel wall being very close to RCS cold leg temperature.

2. When changing RCS temperature via natural circulation, the rate of temperature change is calculated by using RCS loop cold leg temperature indications.

3. When changing RCS temperature with only SDC in service, the rate of temperature change is calculated by using SDC return temperature indication.

MILLSTONE -UNIT 2 B 3/4 4-6 MILLTON -NIT2 B3/44-6Amendment No. 94, 4-t--3, 4--70, 218 July 1, 1998 REACTOR COOLANT SYSTEM BASES 4. During the transition from natural circulation flow, to forced flow with SDC pumps, the rate of temperature change is calculated by using RCS loop cold leg temperature indications. SDC return temperature should be used to calculate the rate of temperature change after SDC is in service, RBCCW flow has been established to the SDC heat exchanger(s), and SDC return temperature has decreased below RCS cold leg temperature.

5. During the transition from parallel reactor coolant pump and SDC pump operation, the rate of temperature change is calculated by using RCS loop cold leg temperature indications until all reactor coolant pumps are secured. SDC return temperature should be used to calculate the rate of temperature change after all reactor coolant pumps have been secured.6. The temperature change limits are for a continuous one hour period. Verification of operation within the limit must compare the current RCS water temperature to the value that existed one hour before the current time. If the maximum temperature increase or decrease, during this one hour period, exceeds the Technical Specification limit, appropriate action should be taken.7. When a new, more restrictive temperature change limit is approached, it will be necessary to adjust the current temperature change rate such that as soon as the new rate applies, the total temperature change for the previous one hour does not exceed the new more restrictive rate.The same principle applies when moving from one temperature change limit curve to another. If the new curve is above the current curve (higher RCS pressure for a given RCS temperature), the new curve will reduce the temperature change limit, it will be necessary to first ensure the new more restrictive temperature change limit will not be exceeded by looking at the total RCS temperature change for the previous one hour time period. If the magnitude of the previous one hour temperature change will exceed the new limit, RCS temperature should be stabilized to allow the thermal stresses to dissipate.

This may require up to a one hour soak before RCS pressure may be raised within the limits of the new curve.If the new curve is below the current curve (lower.RCS pressure for a given RCS temperature), the new curve will allow a higher temperature change limit. All that is necessary is to lower RCS pressure, and then apply the new higher temperature change limit.8. When performing evolutions that may result in rapid and significant temperature swings (e.g. placing SDC in service or shifting SDC heat exchangers), the total temperature change limit for the previous one hour period must not be exceeded. If a significant temperature change is anticipated, and an RCS heatup or cooldown is in progress, the plant should be stabilized for up to one hour, before performing this type of evolution. Stabilizing the plant for up to one hour will allow the thernal stresses, from any previous RCS temperature change, to dissipate. This will allow rapid RCS temperature changes up to the applicable Technical Specification temperature change limit.MILLSTONE -UNIT 2B344.6AmnetNo21 B 3/4 4-6a Amendment No. 21 8 LBDCR 05-MP2-003 December 27, 2005 REACTOR COOLANT SYSTEM BASES The reactor vessel materials have been tested to determine their initial RTNDT; the results of these tests are shown in Table 4.6-1 of the Final Safety Analysis Report. Reactor operation and resultant fast neutron irradiation will cause an increase in the RTNDT. Therefore, an adjusted reference temperature, based upon the fluence, can be predicted using the methods described in Revision 2 to Regulatory Guide 1.99.The heatup and cooldown limit curves shown on Figures 3.4-2a and 3.4-2b include predicted adjustments for this shift in RTNDT at the end of the applicable service period, as well as adjustments for possible uncertainties in the pressure and temperature sensing instruments. The adjustments include the pressure and temperature instrument and loop uncertainties associated with the main control board displays, the pressure drop across the core (RCP operation), and the elevation differences between the location of the pressure transmitters and the vessel beltline region. In addition to these curve adjustments, the LTOP evaluation includes adjustments due to valve stroke times, PORV circuitry reaction times, and valve discharge backpressure. The actual shift in RTNDT of the vessel material is established periodically during operation by removing and evaluating, in accordance with 1OCFR5O Appendix H, reactor vessel material irradiation surveillance specimens installed near the inside wall of the reactor vessel in the core area. Since the neutron spectra at the irradiation samples and vessel inside radius are similar, the measured transition shift for a sample can be correlated to the adjacent section of the reactor vessel. The heatup and cooldown curves must be recalculated when the ARTNDT determined from the surveillance capsule exceeds the calculated ARTNDT for the equivalent capsule radiation exposure.The pressure-temperature limit lines shown on Figures 3.4-2a and 3.4-2b for reactor criticality have been provided to assure compliance with the minimum temperature requirements of Appendix G to 10 CFR 50 for reactor criticality. For inservice leak and hydrostatic testing, use of the heatup curve on Figure 3.4-2a and associated rates provide a conservative limit in lieu of a curve developed specifically for inservice leak and hydrostatic testing. Therefore, a separate leak and hydrostatic curve is not explicitly included on Figure 3.4-2a.The maximum RTNDT for all reactor coolant system pressure-retaining materials, with the exception of the reactor pressure vessel, has been determined to be 50°F. The Lowest Service Temperature limit is based upon this RTNDT since Article NB-2332 (Summer Addenda of 1972)of Section III of the ASME Boiler and Pressure Vessel Code requires the Lowest Service Temperature to be RTNDT + I100 0 F for piping, pumps and valves. Below this temperature, the system pressure must be limited to a maximum of 20% of the system's hydrostatic test pressure of 3125 psia. Operation of the RCS within the limits of the heatup and cooldown curves will ensure compliance with this requirement. MILLSTONE -UNIT 2 B 3/4 4-6b Amendment No. 2-18, Acknaowledged by NRC letter dated 12/I19/06 LBDCR 06-MP2-041 November 2, 2006 REACTOR COOLANT SYSTEM BASES Included in this evaluation is consideration of flange protection in accordance with 10 CFR 50, Appendix G. The requirement makes the minimum temperature RTNDT plus 90°F for hydrostatic test and RTND.T plus. 120 0 F fornonmal operation when the pressure .exceeds 20 percent of the preservice system hydrostatic test pressure. Since the flange region RTNDT has been calculated to be 30°F,. the minimum flange pressurization temperature during normal operation is 1 50 0 F (163°F with instrument uncertainty) when the pressure exceeds 20% of the preservice hydrostatic pressure. Operation of the RCS Within the limits of the heatup and cooldown curves will ensure compliance with this requirement. To establish the minimum boltup temperature, ASME Code Section XI, Appendix G, requires thet.ernperature~of the flange and-adjiacent, shell .-ad~head. reg~ion!s .shall! be. abo-ve -the.results in a minimum boltup temperature of 43°F. For additional conservatism, a minimum boltup temperature of 70°F is specified on thie heatup and cooldown curves. The head and vessel flange region temperature must be greater than 70 0 F, whenever any reactor vessel stud is tensioned. The Low Temperature Overpressure Protection (LTOP) System provides a physical barrier :againshtexceeding the IOC-FR50 Appendix G pressure/temaperature.-limits during, low temperature RCS operation either With a steam bubble in the pressurizer or during water solid conditions. This system consists of either two PORVs with a pressure setpoint 415 psia, or an RCS vent of sufficient size. Analysis has confirmed that the design basis mass addition transient discussed below will be mitigated by operation of the PORVs or by establishing an RCS vent of sufficient size.The LTOP System is required to be OPERABLE when RCS cold leg temperature is at or below 275 0 F (Technical Specifidation 3.4.9.3). However, if the RCS is in MODE 6 and the reactor vessel head has been removed, a Vent of sufficient sizehas beenestablished such that RCS pressurization is not possible. Therefore, an LTOP System is not required (Technical Specification 3.4.9.3 is not applicable). Adjusted Referenced Temperature (ART) is the RTNDT adjusted for radiation effects plus a margin term r-equired by Revision 2 of Regul~atory Guide 1.99. The LTOP System' is armed at a temperature which exceeds the limiting l/4t ART plus 50°F as required by ASME Section XI, Appendix G. For the operating period up to 54 EFPY, the limiting 1/4t ART is 175°F whicli results in a minimum LTOP System enable temperature of at least 271 0 F when corrected for instrument uncertainty. The current value of 275 0 F will be retained.MILLSTONE.- UNIT 2 B 3/4 4-7 Amendment No. g0, :70, 94, -1-, 66,2-72, Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-041 November 2, 2006 REACTOR COOLANT SYSTEM BASES The mass input analysis performed to ensure the LTOP System is capable of protecting the reactor vessel assumes that all pumps capable of injecting into the RCS start, and then one PORV fails to actuate (single active failure). Since the PORVs have limited relief capability, certain.administrative restrictions have been implemented to ensure that the mass input transient will not exceed the relief capacity of a PORV. The analysis has determinied two PORVs (assuming one PORV fails) are-sufficient if the mass addition transient is limited to the inadvertent start of one high pressure safety injection (HPSI) pump and two charging pumps when RCS temperature is at or below 275 0 F and above 190°F, and the inadvertent start of one charging pump When RCS temperature is at or below 190°F..The_ LTOP analysis assumes .oly...one PQRV open due. to. sin~gle a~civ.e:fai ue_,of the other Appendix during owwttemperaiurecope~ation.

'if-he-RGS i}s-;.*:-depressurized and vented through at least a 2.2 square inch vent,, the peak RCS pressure, resulting from the maximum mass input transient allowed by Technical specification 3.4.9.3, will not exceed 300 psig (SDC System suction side design pressure).

When the RCS is at or below 190°F, additional pumping capacity can be. made capable of in~ cingj .o ~h ..Q _b~y es~tablis~h~in!g an .R.C .S .ve~ntof _a~t.lea~s~t2.2..s~qu.a~re_.in~ches._ ._R~em ovin~g the_.pressurizer manway cover, pressurizer vent port cover or a pressurizer safety relief valve will result in a passive vent of at least 2.2 square inches. Additionailmethods to establish the required RCS vent are acceptable, provided the proposed Vent has been evaluated to ensure the flow characteris'tics are equivalent to one of these.Establishing a pressurizer steam bubble of sufficient size will be sufficient to protect the reactor vessel from the energy addition transient associated with the start of an RCP, provided the restrictions contained in Technical Specification 3.4.1.3 are met. These restrictions limit the heat input from. the secondary, syistem. They also ensure sufficient Steam *volume. exists in the pressurizer to accommodate thie insurge. No credit for PORV actuation Wvas assumed in the LTOP analysis, of the energy addition transient. The restrictions apply only to the start of the first RCP. Once at least. one RCP is running, equilibrium is achieved between the primary and secondary temperatures, elimina~tipng any significant energy addition associated with the start of the second RCP.The LTOP restrictions are based on RCS cold leg temperature. This temperature Will be determined by using RCS cold leg temperature indication when RCPs are running, or natural circulation if it is occurring. Otherwise, SDC return temperature indication will be used.MILLSTONE -UNIT 2 B 3/4 4-7a Amendment No. S, Acknowledged By NRC July 5, 2007 LBDCR 09-MP2-017 September 15, 2009 REACTOR COOLANT SYSTEM BASES Restrictions on RCS makeup pumping capacity are included in Technical Specification 3.4.9.3. These restrictions are based on balancing the requirements for LTOP and shutdown risk.For shutdown risk reduction, it is desirable to have maximum makeup capacity and to maintain the RCS full (not vented). However, for LTOP it is desirable to minimize makeup capacity and vent the.RCS.. To satisfy these competing requirements, makeup pumps can be made not capable of injecting, but available at short notice.A charging~pump can be considered to be not capable of injecting into the RCS by use of any of the following methods and the, appropriate administrative controls.1. Placing the motor circuit breaker in the open position.2. Removing the charging pump motor overload heaters from the charging pump circuit.3. Removing the charging pump motor controller from the motor control center.4. Placing a charging pump control switch in the. Pull-To-Lock (PTL) position.A HPSI pump can be considered to be not capable of injecting into the RCS by use of any of the following methods and the appropriate administrative controls.1. Racking down the motor circuit breaker from the power supply circuit.2. Shutting and tagging the discharge valve with the key lock on the control panel (2-SI-654 or 2-SI-656).

3. .Placing the pump control switch in the pull-to-lock position and removing the breaker control power fuses.4. Placing the pump control switch in the position and shutting the discharge valve with the key lock on the control panel (2-SI-654 or 2-SI-656).

These methods to prevent charging pumps and UPSI pumps from injecting into the RCS, when combined with the appropriate administrative controls, meet the requirement for two independent means to prevent pump injection as a result of a single failure or inadvertent single action.These methods prevent inadvertent pump injections while allowing manual actions to rapidly restore the makeup capability if conditions require the use of additional charging or HPSI pumps for makeup in the event of a loss of RCS inventory or reduction in SHUTDOWN MARGIN.MILLSTONE -UNIT 2 B 3/4 4-7b MILLTON -NIT B /4 -7bAmendment No. 2-28, -7-, 242-, LBDCR 05-MP2-003 December 27, 2005 REACTOR COOLANT SYSTEM BASES If a loss of RCS inventory or reduction in SHUTDOWN MARGIN event occurs, the appropriate response will be to correct the situation by starting RCS makeup pumps. If the loss of inventory or SHUTDOWN MARGIN is significant, this may necessitate the use of additional RCS makeup pumps that are being maintained not capable of injecting into the RCS in accordance with Technical Specification 3.4.9.3. The use of these additional pumps to restore RCS inventory or SHUTDOWN MARGIN will require entry into the associated ACTION statement. The ACTION statement requires immediate action to comply with the specification. The restoration of RCS inventory or SHUTDOWN MARGIN can be. considered to be part of the immediate actioni to restore the additional RCS makeup pumps to a not capable of injecting status.While recovering RCS inventory or SHUTDOWN MARGIN, RCS pressure will be maintained below the Appendix G limits. After RCS inventory or SHUTDOWN MARGIN has been restored, the additional pumps should be immediately made not capable of injecting and the ACTION statement exited.An exception to Technical Specification 3.0.4 is specified for Technical Specification 3.4.9.3 to allow a plant cooldown to MODE 5 if one or both PORVs are inoperable. MODE 5 conditions may be necessary to repair the PORV(s).3/4.4.10 DELETED MILLSTONE -UNIT 2 B 3/4 4-7c Amendment No. 248-, 3, 24-3, -264, Acknowledged by NRC letter dated 12/119/06 May 8, 2002.BASES 3/4.4.11 DELETED MILLSTONE -UNIT 2 B 314 4-B MILLTON -NIT2 B3/44-8 Amendment No. 266 REVERSE OF PAGE B 3/4 4-8 INTENTIONALLY LEFT BLANK September 3, 1998 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES 3/4.5.1 SAFETY INJECTION TANKS The OPERABILITY of each of the RCS SITs ensures that a sufficient volume of borated water will be immediately forced into the reactor core through each of the cold legs in the event the RCS pressure falls below the pressure of the SITs. This initial surge of water into the core provides the initial cooling mechanism during large RCS pipe ruptures.The limits on SIT volume, boron concentration and pressure ensure thaf the assumptions used for SIT injection in the accident analysis are met.If the boron concentration of one SIT is not within limits, it must be returned to within the limits within 72 hours. In this condition, ability to maintain subcriticality or minimum boron precipitation time may be reduced, but the reduced concentration effects on core subcriticality during reflood are minor. Boiling of the ECCS water in the core during reflood concentrates the boron in the saturated liquid that remains in the core. In addition, the volume of the SIT is still available for injection. Since the boron requirements are based on the average boron concentration of the total volume of three SITs, the consequences are less severe than they would be if a SIT were not available for injection. Thus, 72 hours is allowed to return the boron concentration to within limits.If one SIT is inoperable, for a reason other than boron concentration or the inoperability of water level or pressure channel instrumentation, the SIT must be returned to OPERABLE status within 24 hours. In this condition, the required contents of three SITs cannot be assumed to reach the core during a LOCA as is assumed in Appendix K to 1OCIFR50.Reference 1 provides a series of deterministic and probabilistic analysis findings that support 24 hours as being either "risk beneficial" or "risk neutral" in comparison to shorter periods for restoring the SIT to OPERABLE status. Reference 1 discusses recent best-estimate analysis that confirmed that for large-break LOCAs, core melt can be prevented by either operation of one LPSI pump or the operation of one HPSI piunp and a single SIT. Reference 1 also discusses plant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour recovery period in comparison to shorter recovery periods.If the SIT cannot be restored to OPERABLE status within the associated completion time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this' status, the plant must be brought to at least MODE 3 Reference 1 CE NPSD-994, "CEOG Joint Applications Report on Safety Injection Tank AOT/SIT Extension," April 1995.MILLSTONE -UNIT 2 B 3/4 5-1 MILSTOE -UNI 2 3/4-l Amendment No. 64-, 7-2;, 59, 24--7, 220 September 9, 2004 3/4.5 EMERGENCY CORE COOLING SYSTEMS (EGGS)BASES 3/4.5.1 SAFETY INJECTION TANKS (continued) within 6 hours and pressurizer pressure reduced to < 1750 psia within 12 hours. The allowed completion times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.If more than one SIT is inoperable, the unit is in a condition outside the accident analyses.Therefore, LCO 3.0.3 must be entered immediately. LCO 3.5.1 .a requires that each reactor coolant system safety injection tank shall be OPERABLE with the isolation valve open and the power to the valve operator removed.This is to ensure that the valve is open and cannot be inadvertently closed. To meet LCO 3.5.1.a requirements, the valve operator is considered to be the valve motor and not the motor control circuit. Removing the closing coil while maintaining the breaker closed meets the intent of the Technical Specification by ensuring that the valve cannot be inadvertently closed.Removing the closing coil and verifying that the closing coil is removed (Per SR 4.5.1 .e) meets the Technical Specification because it prevents energizing the valve operator to position the valve in the close direction. noOpeninga ialthe otnbreakersi ein lieu of removing the closing coil, to remove power to the valve operator isO i 1. Millstone Unit 2 Safety Evaluation Report (SER) Docket No. 50-336, dated May 10, 1974, requires two independent means of position indication.

2. Surveillance Requirement 4.5.1 .a requires the control/indication circuit to be energized, to verify that the valve is open.3. Technical Specification 3/4.3.2, Engineered Safety Feature Actuation System Instrumentation, requires these valves to open on a SIAS signal.Opening the breaker would eliminate the ability to satisfy the above three items.3/4.5.2 and 3/4.5.3 EGGS SUBSYSTEMS The OPERABILITY of two separate and independent EGGS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure consideration.

Either subsystem operating in conjunction with the safety injection tanks is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double ended break of the largest RCS cold leg pipe downward.MILLSTONE -UNIT 2 B 3/4 5-2 Amendment No. 6t1-, :h3 59, N-1-7, 20,-2-3, 283 LBDCR 04-MP2-016 February 24, 2005 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued) Each Emergency Core Cooling System (ECCS) subsystem required by Technical Specification 3.5.2 for design basis accident mitigation includes an OPERABLE high pressure safety injection (HIPSI) pump and a low pressure safety injection (LPSI) pump. Each of these pumps requires an OPERABLE flow path capable of taking suction from the refueling water storage tank (RWST)on a safety injection actuation signal (SIAS). Upon depletion of the inventory in the RWST, as indicated by the generation of a Sump Recirculation Actuation Signal (SPAS), the suction for the HPSI pumps will automatically be transferred to the contaimnent sump. The SRAS will also secure the LPSI pumps. The ECCS subsystems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) as design basis accident mitigation equipment. Flow from the charging pumps is no longer required for design basis accident mitigation. The loss of coolant accident analysis has been revised and no credit is taken for charging pump flow.As a result, the charging pumps no longer meet the first three criteria of 10OCFR 50.36 (c)(2)(ii) as design basis accident mitigation equipment required to be controlled by Technical Specifications. In addition, risk evaluations have been performed to demonstrate that the charging system is not risk significant as defined in 1OCFR 50.3 6(c)(2)(ii) Criterion

4. However, the charging system is credited in the PRA model for mitigating two beyond design basis events, Anticipated Transients Without Scram (ATWS) and Complete Loss of Secondary Heat Sink. On this basis, the requirements for charging pump OPERABILITY will be retained in Technical Specification

3.5.2. Consistent

with the surveillance requirements, only the charging pump will be included in determining ECCS subsystem OPERABILITY. As a result of the risk insight, the charging pump will be included as an Emergency Core Cooling System subsystem required by Technical Specification 3.5.2. That is, an. ECCS subsystem will include one OPERABLE charging pump. The charging pump credited for each ECCS subsystem must meet the surveillance requirements specified in Section 4.5.2. Consistent with the risk insights, automatic start of the charging pump is not required for compliance to TS 3.5.2. Thus, Section 4.5.2 does not specify any testing requirements for the automatic start of the credited charging pump. Similarly, since the ECCS flow path is not credited in the riskevaluation, there are no charging flow path requirements included in TS 3.5.2.The requirements for automatic actuation of the charging pumps and the associated boration system components (boric acid pumps, gravity feed valves, boric acid flow path valves), which align the boric acid storage tanks to the charging pump suction on a SIAS have been relocated to the Technical Requirements Manual. These relocated requirements do not affect the OPERABILITY of the charging pumps for Technical Specification

3.5.2 MILLSTONE

-UNIT 2 B 3/4 5-2a Amendment No. 6-t-, 7-2, 4-5-9, 1-, 2-, 36, Acknowledged by NRC letter dated 6/28/05 LBDCR i4-MP2-016 September 4, 2014 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued) Surveillance Requirement 4.5.2.a verifies the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths to provtide assurance that the proper flow paths will exist for ECCS operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position; since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time.This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5.2.b verifies proper valve position to ensure that the flow path from the ECCS pumps to the RCS is maintained. Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removing power to the valve operator ensures that the valves cannot be inadvertently misalig-ned or change position as the result of an active failure. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.5.2.c and 4.5.2.d, which address periodic surveillance testing of the ECCS pumps (high pressure and low pressure safety injection pumps) to detect gross degradation 0-caused by impeller structural damage or other hydraulic component problems, is required by the ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code). This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the perfonnance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program. The ASME OM Code provides the activities and frequencies necessary to satisfy the requirements. Surveillance Requirement 4.5 .2.e, which addresses periodic surveillance testing of the charging pumps to detect gross degradation caused by hydraulic component problems, is required by the ASMIfE OM Code. For positive displacement pumps, this type of testing may be accomplished by comparing the measured pump flow, discharge pressure and vibration to their respective acceptance criteria. Acceptance criteria are verified to bound the assumptions utilized in accident analyses. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test point is greater than or equal to the performance assumed for mitigation of the beyond design basis events. The surveillance requirements are specified in the Inservice Testing Program. The ASIME OM Code provides the activities and frequencies necessary to satisfy the requirements. MILLSTONE -UNIT 2 B 3/4 5-2b Amendment No. 45-, 6-1-, 7-, 4-l-9, 8-5,4-t6,24al-7, -220, 2, 2a34, 2 LBDCR 14-MP2-016 September 4, 2014 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued) Surveillance Requirements 4.5.2.f, 4.5.2.g, and 4.5.2.h demonstrate that each automatic ECCS flow path valve actuates to the required position on, an actual or simulated actuation signal (SIAS or SRAS), that each ECCS pump starts on receipt of an actual or simulated actuation signal (SIAS), and that the LPSI pumps stop on receipt of an actual or simulated actuation signal (SRAS). This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The surveillance frequency is controlled under the Surveillantce Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment perfonnance is monitored as part of the Inservice Testing Program.Surveillance Requirement 4.5.2.i verifies the high and low pressure safety injection valves listed in Table 4.5-1 will align to the required positions on an SIAS for proper. ECCS performance. The safety injection valves have stops to position them properly so that flow is restricted to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5 .2.j addresses periodic inspection of the containment sump to ensure that it is unrestricted and stays in proper operating condition. The surveillance fr'equency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5.2.k verifies that the Shutdown Cooling (SDC) System open permissive interlock is OPERABLE to ensure the SDC suction isolation valves are prevented from being remotely opened when RCS pressure is at or above the SDC suction design pressure of 300 psia. The suction piping of the SDC pumps (low pressure safety injection pumps) is the SDC component with the limiting design pressure rating. The interlock provides assurance that double isolation of the SDC System from the RCS is preserved whenever RCS pressure is at or above the design pressure. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 2 B 3/4 5-2c Amendment No. 4-5, 4-59, Ig-, 2-1-5, 2-46, -220, 22g, 24--6, 28g3 LBDCR 04-MP2-016 February 24, 2005 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES 314.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued Only one EGGS subsystem is required by Technical Specification 3.5.3 for design basis accident mitigation. This ECGS subsystem requires one OPERABLE I-PSI pump and an OPERABLE flow path capable of taking suction from the RWST on a SIAS. Upon depletion of the inventory in the RWST, as indicated by the generation of a SRAS, the suction for the I!WSI pump will automatically be transferred to the containment sump. This ECCS subsystem satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) as design basis accident mitigation equipment. Surveillance Requirement 4.5.3.1 specifies the surveillance requirements of Technical Specification 3.5.3 that are required to demonstrate that the required EGGS subsystem of Technical Specification 3.5.3 is OPERABLE. The required ECCS subsystem of Technical Specification 3.5.3 does not include any LPSI components. LPSI components are not required when Teclnical Specification 3.5.3 is applicable to allow the LPSI components to be used for SDC System operation. In MODE 4 the automatic safety injection signal generated by low pressurizer pressure and high containment pressure and the automatic sump recirculation actuation signal generation by low refueling water storage tank level are not required to be OPERABLE. Automatic actuation in d MODE 4 is not required because adequate time is available for plant operators to evaluate plant 0 conditions and respond by manually operating engineered safety features components. Since the manual actuation (trip pushbuttons) portion of the safety injection and sump recirculation actuation signal generation is required to be OPERABLE in MODE 4, the plant operators can use the manual trip pushbuttons to rapidly position all components to the required accident position.Therefore, the safety injection and sump recirculation actuation trip Pushbuttons satisfy the requirement for generation of safety injection and sump reciixculation a~ctuation signals in MODE 4.In MODE 4, the OPERABLE U-IPSI pump is not required to start automatically on a SIAS.Therefore, the pump control switch for this OPERABLE pump may be placed in the pull-to-lock position without affecting the OPERABILITY of the pump. This will prevent the pump from starting automatically, which could result in overpressurization of the Shutdown Cooling System.Only one H-PSI pump may be OPERABLE in MODE 4 with RCS temperatures less than or equal to 275°F due to the restricted relief capacity with Low-Temperature Oveirpressure Protection System. To reduce shutdown risk by having additional pumping capacity readily available, a HPSI pump may be made inoperable but available at short notice by shutting its discharge valve with the key lock on the control panel.MILLSTONE -UNIT 2 B 3/4 5-2d Amendment No. 4-5, 4-1-g, -,O-2-2-, -, Acknowledged by NRC letter dated 6/28/05 LBDCR 10-MP2-016 May 16, 2011 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES: 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued) The provision in Specification 3.5.3 that Specifications 3.0.4 and 4.0.4 are not applicable for entry into MODE 4 is provided to allow for connecting the HPSI pump breaker to the respective power supply or to remove the tag and open the discharge valve, and perform~ the subsequent testing necessary to declare the inoperable HPSI pump OPERABLE. Specification 3.4.9.3 requires all HPSI pumps to be not capable of injecting into the RCS when RCS temperature is at or below I90°F. Once RCS temperature is above 190°F one HPSI pump can be capable of injecting into the RCS. However, sufficient time may not be available to ensure one HPSI pump isOPERABLE prior to entering MODE 4 as required by Specification

3.5.3. Since

Specifications

• 3.0.4 and 4.0.4 prohibit a MODE change in this situation, this exemption will allow Millstone* Unit No. 2 to enter MODE 4, take the steps necessary to make the HPSI pump capable of"injecting into the RCS, arid then declare the pump OPERABLE.

If it is necessary to use this exemption during plant heatup, the appropriate ACTION statement of Specification

3.5.3 should

be entered as soon as MODE 4 is reached.3/4.5.4 REFUELING WATER STORAGE TANX (RWST)The OPERABILITY of the RWST as part of the ECCS ensures that a sufficient supply of borated water is available for injection by the ECCS in the event of a LOCA. A minimum usable volume of 370,000 gallons is required for ECCS injection above the earliest or highest level of SRAS initiation accounting for indicator accuracy. The limits on RWST minimum volume and boron concentration ensure that 1) sufficient water is available within containment to permit recirculation cooling flow to the core, anid 2) after a LOCA the reactor will remain subcritical in the cold condition following mixing of the RWST and the RCS water volumes. Small break LOCAs assume that all control rods are inserted, except for the control element assembly (CEA)of highest worth, which remains withdrawn from the core. Large break LOCAs assume that all CEAs remain withdrawn from the core.MILLSTONE -UNIT 2 B 3/4 5-2e Amendment No. 28-3-, Acknowledged by NRC letter dated 6/28/05 LBDCR 05-MP2-001 February 10, 2005 EMERGENCY CORE COOLING SYSTEMS BASES 3/45.5 TRISODIUM PHOSPHATE (TSP)BACKGROUND Trisodium phosphate (TSP) is placed on the floor or in the sump of the containment building to ensure that iodine, which may be dissolved in the recirculated reactor cooling water following a loss of coolant accident (LOCA), remains in solution. TSP also helps inhibit stress corrosion cracking (SCC) of austenitic stainless steel components in containment during the recirculation phase following an accident.Fuel that is damaged during a LOCA will release iodine in several chemical forns to the reactor coolant and to the containment atmosphere. A portion of the iodine in the containment atmosphere is washed to the sump by containment sprays. The emergency core cooling water is borated for reactivity control. This borated water causes the sump solution to be acidic. In a low pH (acidic) solution, dissolved iodine will be converted to a volatile form. The yolatile iodine will evolve out of solution into the containment atmosphere, significantly increasing the levels of airborne iodine. The increased levels of airborne iodine in containment contribute to the radiological releases and increase the consequences from the accident due to containment atmosphere leakage.After a LOCA, the components of the core cooling and containment spray systems will be exposed to high temperature borated water. Prolonged exposure to the core cooling water combined with stresses imposed on the components can cause SCC. The SCC is a function of stress, oxygen and chloride concentrations, pH, temperature, and alloy composition of the components. High temperatures and low pH, which would be present after a LOCA, tend to promote SCC. This can lead to the failure of necessary safety systems or components. Adjusting the pH of the recirculation solution to levels above 7.0 prevents a significant fraction of the dissolved iodine from converting to a volatile form. The higher pH thus decreases the level of airborne iodine in containment and reduces the radiological consequences from containment atmosphere leakage following a LOCA. Maintaining the solution pH above 7.0 also reduces the occurrence of SCC of austenitic stainless steel components in containment. Reducing SCC reduces the probability of failure of components. MILLSTONE -UNIT 2 B 3/4 5-3 Amendment No. a-!-7g, Acknowledged by NRC letter dated 12/!19/06 LBDOR 05-MP2-001 February 10, 2005 EMvERGENCY CORE COOLING SYSTEMS BASES 3/4.5.5 TRISODIUM PHOSPIHATE (TSP)BACKGROUND (continued) TSP is employed as a passive form of pHI control for post LOCA containm-ent spray and core cooling water. Baskets of TSP are placed on the floor or in the sump of the containment building to dissolve from released reactor coolant water and containment sprays after a LOCA.Recirculation of the water for core cooling and containment sprays then provides mixing to achieve a uniform solution pH. The hydrated form (45- 57% moisture) of TSP is used because of the high humidity in the containment building during normal operation. Since the TSP is hydrated, it is less likely to absorb large amounts of water from the humid atmosphere and will undergo less physical and chemical change than the anhydrous form of TSP.APPLICABLE SAFETY ANALYSES The LOCA radiological consequences analysis takes credit for iodine retention in the sump solution based on the recirculation water pH being _> 7.0. The radionuclide releases from the containment atmosphere and the consequences of a LOCA would be increased if the pH of the recirculation water were not adjusted to 7.0 or above.LIMITING CONDITION FOR OPERATION The TSP is required to adjust the pH of the recirculation water to > 7.0 after a LOCA. A pH >7.0 is necessary to prevent significant.amounts of iodine released from fuel failures and dissolved in the recirculation water from converting to a volatile fonnl and evolving into the containment atmosphere. Higher levels of airborne iodine in contaimnlent may increase the release of radionuclides and the consequences of the accident. A pH > 7.0 is also necessary to prevent SCC of austenitic stainless steel components in containment. SeCCincreases the probability of failure of components. The required amount of TSP is based upon the extreme cases of Water volume and pH possible in the containment sump after a large break LOCA. The minimum required volume is the volume of TSP that will achieve a sump solution pH of > 7.0 when taking into consideration the maximum possible sump water volume and the minimum possible pH. The amount of TSP needed in the containment building is based on the mass of TSP required to achieve the desired pH. However, a.required volume is specified, rather than mass, since it is not feasible to weigh the entire amount of TSP in containment. The minimum required volume is based on the manufactured density of TSP. Since TSP can have a tendency to agglomerate from high humidity in the containment building, the density may increase and the volume decrease during normal plant operation. Due to possible agglomeration and increase in density, estimating the minimum volume of TSP in contaimnent is conservative with respect to achieving a minimum required pH.MVILLSTONE -UNIT 2 B 3/4 5-4 Amendment No.Acknowledged by NRC letter dated 12/19/06 LBDCR 14-MIP2-016 September 4, 2014 EMERGENCY CORE COOLING SYSTEMS BASES '3/4.5.5 TRISODIUM PHOSPHATE (TSP') (continued) APPLICABILITY In MODES 1, 2, and 3, the RCS is at elevated temperature and pressure, providing an energy potential for a LOCA. The potential for a LOCA results in a need for the ability to control the pH of the recirculated coolant.In MODES 4, 5, and 6, the potential for a LOCA is reduced or nonexistent, and TSP is not required.ACTIONS If it is discovered that the TSP in the containment building sump is not within limits, action must be taken to restore the TSP to within limits. During plant operation the containment sump is not accessible and corrections may not be possible.The completion time of 72 hours is allowed for restoring the TSP within limits because 72 hours is the same time allowed for restoration of other ECCS components. L If the TSP cannot be restored within limits within the 72 hour completion time, the plant must be brought to a MODE inl which the LCO does not apply. The specified completion times for reaching MODES 3 and 4 were chosen to allow reaching the specified conditions from full power in an orderly manner without challenging plant systems.SURVEILLANCE REQUIREMENTS ..Surveillance Requirement 4.5.5.1 Periodic determination of the volume of TSP in containment must be performed due to the possibility of leaking valves and components in the containment building that could cause dissolution of the TSP during normal operation. This periodic surveillance is required to determine visually that a minimum of 282 cubic feet is contained in the TSP baskets. This requirement ensures that there is an adequate volume of TSP to adjust the pH of the post LOCA sump solution to a value _> 7.0. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 2 B 3/4 5-5 Amcndmcnt,.,,, N,, y I'LR " lott.e. d..LLVI LBDCR 14-MrP2-016 September 4, 2014 EMERGENCY COPE COOLING SYSTEMS BASES 3/4.5.5 TRISODITUM PHOSPHATE (TSP') (continued) Surveillance Requirement 4.5.5.2 Testing must be performed to ensure the solubility and buffering ability of the TSP after exposure to the containment environment. Passing this test verifies the TSP is active and provides assurance that the stored TSP will dissolve in borated water at postulated post-LOCA temperatures. This test is performed by submerging a sample of 0 .6662 +/- 0.0266 grams of TSP from one of the baskets in containment in 250 +/- 10 milliliters of water at a boron concentration of 2482 +/- 20 ppm, and a temperature of 77+/-+ 5°F. Without agitation, the solution is allowed to stand for four hours. The liquid is then decanted, mixed, and the pH measured. The pH must be > 7.0.The TSP sample weight is based on the minimum required TSP mass of 12,042 pounds, which at the manufactured density corresponds to the minimum volume of 223 f& (The minimum Technical Specification requirement of 282 ft 3 is based on 223 ft3 of TSP for boric acid neutralization and 59 ft 3 of TSP for neutralization of hydrochloric and nitric acids.), and the maximum sump water volume (at 77°F) following a LOCA of 2,046,441 liters, normalized to buffer a 250 +/- 10 milliliter sample. The boron concentration of the test water is representative of the maximum possible concentration in the sump following a LOCA. Agitation of the test solution is prohibited during TSP dissolution since an adequate standard for the agitation intensity cannot be specified. The dissolution time of four hours is necessary to allow time for the dissolved TSP to naturally diffuse through the sample solution. In the containmnent sump following a LOCA, rapid mixing will occur, significantly decreasing the actual amount of time before the required pH is achieved. The solution is decanted after the four hour period to remove any undissolved TSP prior to mixing and pH measurement. Mixing is necessary for proper operation of the pH instrument. The surveillance frequency is controlled under the Surveillance Frequency [Control Program ...MILLSTONE -UNIT 2 B 3/4 5-6 Amznmon N...÷,T.........d.e by, RC ........r dated REVERSE OF PAGE B 3/4 5-6 INTENTIONALLY LEFT BLANK LBDCR 05-MP2-029 December 9, 2008 3/4.6 CONTAINMENT SYSTEMS BASES 3/4.6.1 PRIMARY CONTAINMENT 3/4.6.1. 1 CONTAINMENT INTEGRITY Primary CONTAINMENT INTEGRITY ensures that the release of radioactive materials from the containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the accident analyses. Thisrestriction, in conjunction with the leakage rate limitation, will limit the SITE BOUNDARY radiation doses to within the limits of 10 CFR 50.67 during accident conditions. Primary CONTAINMENT INTEGRITY is required in MODES 1 through 4. This requires an OPERABLE containment automatic isolation valve system. In MODES 1, 2, and 3 this is satisfied by the automatic containment isolation signals generated by low pressurizer pressure and high containment pressure. In MODE 4 the automatic containment isolation signals generated by low pressurizer pressure and high containment pressure are not required to be OPERABLE.Automatic actuation of the containment isolation system in MODE 4 is not required because adequate time is available for plant operators to evaluate plant. conditions and respond by manually operating engineered safety features components. Since the manual actuation (trip pushbuttons) portion of the containment isolation system is required to be OPERABLE in MODE 4, the plant operators can use the manual pushbuttons to rapidly position all automatic containment isolation valves to the required accident position. Therefore, the containment isolation trip pushbuttons satisfy the requirement for an OPERABLE containment automatic isolation valve system in MODE 4.3/4.6.1.2 CONTAINMENT LEAKAGE The limitations on containment leakage rates ensure that the total containment leakage volume will not exceed the value assumed in the accident analyses at thlepeak accident pressure of Pa. As an added conservatism, the measured overall integrated leakage rate is further limited to< 0.75 La during performance of the periodic tests to account for possible degradation of the containment leakage barriers between leakage tests.The surveillance testing for measuring leakage rates is in accordance with the Containment Leakage Rate Testing Program.The Millstone Unit No. 2 FSAR contains a list of the containment penetrations that have been identified as secondary containment bypass leakage paths.3/4.6.1.3 CONTAINMENT AIR LOCKS The limitations on closure and leak rate for the containment air locks are required to meet the restrictions on CONTAINMENT INTEGRITY and leak rate given in Specifications 3.6.1.1 and MILLSTONE -UNIT 2 B3/4 6-1 MILLTON -NIT2 B3/46-1Amendment No. 41-24, 34, April 14, 1999 3/4.6 CONTAINMENT SYSTEMS BASES 3.6.1.2. The limitations on the air locks allow entry and exit into and out of the containment during operation and ensure through the surveillance testing that air lock leakage will not become excessive through continuous usage.The ACTION requirements are modified by a Note that allows entry and exit to perform repairs on the affected air lock components. This means there may be a short time during which the containment boundary is not intact (e.g., during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed.ACTION a. is only applicable when one air lock door is inoperable. With only one air lock door inoperable, the remaining OPERABLE air lock door must be verified closed within 1 hour.This ensures a leak tight containment barrier is maintained by use of the remaining OPERABLE air lock door. The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, the remaining OPERABLE air lock door must be locked closed within 24 hours and' then verified periodically to ensure an acceptable containment leakage boundary is maintained. Otherwise, a plant shutdown is required.ACTION b. is only applicable when the air lock door interlock mechanism is inoperable. With only the air lock interlock mechanism inoperable, an OPERABLE air lock door must be verified closed within 1 hour. This ensures a leak tight containment is maintained by use of an OPERABLE air lock door. The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, an OPERABLE air lock door must be locked closed within 24 hours and then verified periodically to ensure an acceptable containment leakage boundary is maintained. Otherwise, a plant shutdown is required. In addition, entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock) is permitted. ACTION c. is applicable when both air lock doors are inoperable, or the air lock is inoperable for any other reason excluding the door interlock mechanism. With both air lock doors inoperable or the air lock otherwise inoperable, an evaluation of the overall containment leakage rate per Specification 3.6.1.2 shall be initiated immediately, and an air lock door must be verified closed within 1 hour. An evaluation is acceptable since it is overly conservative to immediately declare the containment inoperable if both doors in the air Jock have failed a seal test or if overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour (per Specification 3.6.1.1) would be provided to restore the air lock to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, the air lock and/or at least one air lock door must be restored to OPERABLE status within 24 hours or a plant shutdown is required.MILLSTONE -UNIT 2 B 3/4 6-1a MILLTON -NIT B /4 -laAmendment No. 34, 267 June 7, 2002 CONTAINMENT SYSTEMS BASES Continued Surveillance Requirement 4.6.1 .3.1 verifies leakage through the containment air lock is within the requirements specified in the Containment Leakage Rate Testing Program. The containment air lock leakage results are accounted for in the combined Type B and C containment leakage rate. Failure of an air lock door does not invalidate the previous satisfactory overall air lock leakage test because either air lock door is capable of providing a fission product barrier in the event of a design basis accident.MILLSTONE -UNIT 2AmnetNo26 B 3/4 6-lb Amendment No. 267 July 25, 2003 CONASNENESSTM BASES 3/4.6.1.4 INTERNAL PRESSURE The limitations on containment internal pressure ensure that the containment peak pressure does not exceed the design pressure of 54 psig during MSLB or LOCA conditions. The maximum peak pressure is obtained from a MSLB event. The limit of 1.0 psig for initial positive containment pressure will limit the total pressure to less than the design pressure and is consistent with the accident analyses.3/4.6.1.5 AIR TEMPERATURE The limitation on containment air temperature ensures that the containment air temperature does not exceed the worst case combined LOCA/MvSLB air temperature profile and the liner temperature of 289°F. The containment air and liner temperature limits are consistent with the accident analyses.The temperature detectors used to monitor primary containment air temperature are located on the 38 ft. 6 in. floor elevation in containment. The detectors are located approximately 6 feet above the floor, on the southeast and southwest containment walls.3/4.6.1.6 DELETED%MILLSTONE -UNIT 2 B 3/4 6-2 Amendment No. 2-5, -3, 1-39, 204,-2-09, 9, 278 LBDCR 14-MIP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 314.6.2 DEPRESSURIZATION ANTD COOLING SYSTEMS 3/4.6.2.1 CONTATNMENT SPRAY AND COOLING SYSTEMS The OPERABILITY of the containment spray system ensures that contaimnent depressurization and cooling capability will be available in the event of a LOCA. The pressure reduction and resultant lower containment leakage rate are consistent with the assumptions used in the accident analyses.The OPERABILITY of the containment cooling system ensures that 1) the containment air temperature will be maintained within limits during normal operation, and 2) adequate heat removal capacity is available when operated in conjunction with the containment spray system during post-LOCA conditions. To be OPERABLE, the two trains of the containment spray system shall be capable of taking a suction from the refueling water storage tank on a containmenat spray actuation signal and automatically transferring suction to the containment surnp on a sump recirculation actuation signal. Each containment spray train flow path fr'om the containmrent sump shall be via an OPERABLE shutdown cooling heat exchanger. 'The containment cooling system consists of two containment cooling trains. Each containment cooling train has two containment air recirculation and cooling units. For the purpose of applying the appropriate ACTION statement, the loss of a single containment air recirculation and cooling unit will make the respective containment cooling train inoperable. Either the containmrent spray system or the containment cooling system is sufficient to mitigate a loss of coolant accident. The containmaent spray system is nmore effective than the containment cooling system in reducing thetemperature of superheated steam inside containment following a mafin steam line break. Because of this, the containment spray system is required to mitigate a main steam line break accidenat inside cdntainmaent, In addition, the containment spray system provides a mechanism for removing iodine fr-om the containment atmosphere. Therefore, at least one train of containment spray is required to be OPERABLE when pressurizer pressure is> 1750 psia, and the allowed outage time for one train of containment spray reflects the dual function of containment spray for heat removal and iodine removal.With one containment spray train inoperable, the inoperable containment spray train must be restored to OPERABLE status within 72 hours. In this Condition, the remaining OPERABLE spray and cooling trains are adequate to perform the iodine removal and containment cooling functions. The 72 hours allowed outage time takes into account the redundant heat removal capability afforded by the Contafinment Spray System and reason~able time for repairs.MILLSTONE -UNIT 2 B 3/4 6-3 Anmendment No. 2-5, 6-, o2---0, 4-l-, 2-s, -6, LBDCR 14-MIP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued) With one required containment cooling train inoperable, the inoperable containment cooling train must be restored to OPERABLE status within 7 days. The components in this degraded condition are capable of providing greater than 100% of the heat removal needs (for the condition of one containment cooling train inoperable) after an accident.With one containmaent spray train and one containment cooling train inoperable, one*required containment spray train or one required containment cooling train must be restored to OPERABLE status within 48 hours. The components in this degraded condition provide iodine removal capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 48 hour allowed outage time was developed taking into account the redundant heat removal capabilities afforded by combinations of the Containment Spray System and Containment Cooling System, the iodine removal function of the Containment Spray System, and the low probability of a DBA occurring during this period.With two required containment spray trains inoperable, at least one of the required containment spray trains must be restored to OPERABLE status within 24 hours. Both trains of containment cooling must be OPERABLE or be in H-OT SI{UTD OWN within the next 12 hours.The Condition is modified by a Note stating it is not applicable if the second containment spray train is intentionally declared inoperable. The Condition does not apply to voluntaiy removal of redundant systems or components fr'om service. The Condition is only applicable if one train is inoperable for any reason and the second train is discovered to be inoperable, or if both trains are discovered to be inoperable at the same time. In addition, LCO 3.7.6.1, "Control Room Emergency Ventilation System," mnust be verified to be met within 1 hour. The components in this degraded condition are capable of providing

greater than 100% of the heat removral needs after an accident.

The allowed outage time is based on Reference 1 which demonstrated that the 24 hour allowed outage time is acceptable based on the redundant heat removal capabilities afforded by the Containment Cooling System, the~iodine removal capability of the Control Room Emergency Air Cleanup System, the infrequent use of the Required Action, and the small incremental effect on plant risk.With two required containment cooling trains inoperable, one of the required containment cooling trains mustbe restored to OPERABLE status within 48 hours. The components in this degraded condition provide iodine removal capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 48 hour allowed outage time was developed taking into account the redundant heat removal capabilities afforded by combinations of the Containment Spray System and Containment Cooling System, the iodine removal function of the Containment Spray System, and the low probability of a DBA occurring during this period.MILLSTONE -UNIT 2 B 3/4 6-3a Amendment No. -l-0, 24-&-, 293~6, 2L7-8, LBDCR 14-MvP2-016 September 4, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued) Surveillance Requirement 4.6.2.1.1 .a verifies the correct alignment for manual, power operated, and automatic valves in the Contailnment Spray System flow paths to provide assurance that the proper flow paths will exist for contaimnent spray operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. R~ather, it involves verification that those valves capable of being mispositioned are in the correct position. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.6.2.1.1 .b, which addresses periodic surveillance testing of the containment spray pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems, is required by the ASME OM Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured perfonnance is within an acceptable tolerance of the original pump baseline performaance and that the performance at the test flow is greater than or equal to the performance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program. The ASME~ OM Code provides the activities and frequencies to satisfy the requirements. Surveillance Requirements 4.6.2.1.1l.c and 4.6.2.1.1.d demonstrate that each automatic containment spray valve actuates to the required position on an actual or simulated actuation signal (CSAS or SRAS), and that each containmaent spray pump starts..on receipt of an actual or simulated actuation signal (CSAS). This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. These surveillance frequencies are controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS)testing, and equipment performance is monitored as part of the Inservice Testing Program.MILLSTONE -UNIT 2 B 3/4 6-3b Amendment No. , 24g, 3, 7-S, LBDCR 14-MP2-01I6 September 4, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued) Surveillance Requirement 4.6.2. 1.1.e requires verification that each spray nozzle is unobstructed following maintenance that could cause nozzle blockage. Normal plant operation and maintenance activities are not expected to trigger performance of this surveillance requirement. However, activities, such as an inadvertent spray actuation that causes fluid flow through the nozzles, a major configuration change, or a loss of foreign material control when working within the respective system boundary may require surveillance performance. An evaluation, based on the specific situation, will determnine the appropriate method (e.g., visual inspection, air or smoke flow test) to verify' no nozzle obstruction. Surveillance Requirement 4.6.2.1 .2.a demonstrates that each containment air recirculation and cooling unit can be operated in slow speed for > 15 minutes to ensure OPERABILITY and that all associated controls are functioning properly. It also ensures fan or motor failure can be detected and corrective action taken. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.6.2.1.2.b demonstrates a cooling water flow rate of> 500 gpm to each containment air recirculation and cooling unit to provide assurance a cooling water flow path through the cooling unit is available. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.6.2.1 .2.c demonstrates that each containment air recirculation and cooling unit starts on receipt of an actual or simulated actuation signal (SIAS). The surveillance frequency is controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety~ Feature Actuation System (ESFAS)testing, and equipment perfonrmance is monitored as part of the Inservice Testing Program.REFERENCE 1. WCAP- 161 25-NP-A, "Justification for Risk-Informed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UJNJIT 2 B 3/4 6-3c Amendment No. 0, 24-4, 2-36, 7-8, LBDCR 14-MP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 314.6.3 CONTAINMENT IS OLATION VALVES The Technical Requirements Manual contains the list of containment isolation valves (except the containment air lock and equipment hatch). Any changes to this list will be reviewed under 10CFR50.59 and approved by the committee(s) as described in the QAP Topical Report.The OPERABILITY of the containment isolation valves ensures that the containment atmosphere will b~e isolated from the outside enviromnent in the event of a release of radioactive material to the containment atmosphere or pressurization of the containment. Containment isolation within the time limnits specified ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a LOCA.The containment isolation valves are used to close all fluid (liquid and gas) penetrations not required for operation of the engineered safety feature systems, to prevent the leakage of radioactive materials to the enviromnent. The fluid penetrations which may require isolation after an accident are categorized as Type P, 0, or N. The penetration types for each containment isolation valve are listed in PSAR Table 5.2-11, Containment Structure Isolation Valve Information. Type P penetrations are lines that connect to the reactor coolant pressure boundary (Criterion 55 of 10OCFR5O, Appendix A). These lines are provided with two containment isolation valves, one inside containment, and one outside containment. Type 0 penetrations are lines that are open to the containment internal atmosphere (Criterion 56 of 10CFR5O, Appendix A). These lines are provided with two containment isolation valves, one inside containment, and one outside containment ... " Type N penetrations are lines that neither connect to the reactor coolant pressure boundary nor are open to the contaimnent internal atmospher~e, but do form a closed system within the containment structure (Criterion 57 of IOCFR50, Appendix A). These lines are provided with single containment isolation valves outside containment. These valves are either remotely operated or locked closed manual valves.With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that carmot be adversely affecte~d by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. MILLSTONE -UNIT 2 B 3/4 6-3d Amendment No. 2-10, , -6, 7, 2g8-, LBDCRI14-MiP2-016 September 4, 2014 CONTAINMENT SYSTEMS BASES 314.6.3 CONTAINMENT ISOLATION VALVES (Continued) If the containment isolation valve on a closed system becomes inoperable, the rem~aining barrier is a closed system since a closed system is an acceptable alternative to an automatic valve.However, ACTIONS must still be taken to meet Technical Specification ACTION 3.6.3.1 .d and the valve, not normally considered as a containment isolation valve, and closest to the containment wall should be put into the closed position. No leak testing of the alternate valve is necessary to satisfy the ACTION statement. Placing the manual valve in the closed position sufficiently deactivates the penetration for Technical Specification compliance. Closed system isolation valves applicable to Technical Specification ACTION 3.6.3.1 .d are included in FSAR Table 5.2-11, and are the isolation valves for those penetrations credited as General Design Criteria 57, (Type N penetrations). The specified time (i.e., 72 hours) of Technical Specification ACTION 3.6.3.l.d is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, aind 4. In the event the affected penetration is isolated in accordance with 3.6.3.1 .d, the affected penetration flow path must be verified to be isolated on a periodic basis, (Surveillance Requirement 4.6.1t.1 .a). This is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The surveillance frequency is controlled under the Surveillance Frequency Control Program.[O For the purposes of meeting this LCO, neither the containment isolation valve, nor any alternate valve on a closed system have a leakage limit associated with valve OPERABILITY. Containment isolation valves may be opened on an intennittent basis provided appropriate administrative controls are established. The position of the NRC concerning acceptable administrative controls is contained in Generic Letter 91-08, "Removal of Component Lists from Technical Specifications," and includes the following considerations: (1) stationing an operator, who is in constant communication with the control room, at the valve controls, (2) instructing this operator to close these valves in an accident situation, and (3) assuring that environmental conditions will not preclude access to close the valve and that this action will prevent the release of radioactivity outside the containment. The appropriate administrative controls, based on the above considerations, to allow containment isolation valves to be opened are contained in the procedures that will be used to operate the valves. Entries should be placed in the Shift Manager Log when these valves are opened and closed. However, it is not necessary to log into any Technical Specification ACTION Statement for these valves, provided the appropriate administrative controls have been established. MILLSTONE -UNIT 2 B 3/4 6-3e Amendment No. 21-O, 2-5~, -236, 2-g, gt LBDCR 14-MvlP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued) If a containment isolation valve is opened while operating in accordance with Abnormal or Emergency Operating Procedures (AOPs and EOPs), it is not necessaiy to establish a dedicated operator. The AOPs and EOPs provide sufficient procedural control over the operation of the conatainment isolation valves.Opening a closed containment isolation valve bypasses a plant design feature that prevents the release of radioactivity outside the containment. Therefore, this should not be done frequently, and the time the valve is opened should be minimized. As a general guideline, a closed containment isolation valve should not be opened longer than the time allowed to restore the valve to OPERABLE status, as stated in the ACTION statement for LCO 3.6.3.1 "Containment Isolation Valves." A discussion of the appropriate administrative controls for the containment isolation valves, that are expected to be opened during operation in MODES 1 through 4, is presented below.Manual contaimnent isolation valve 2-SI-463, safety injection tank (SIT) recirculation header stop valve, is opened to fill or drain the SITs and for Shutdown Cooling System (SDC)boron equalization. While 2-SI-463 is open, a dedicated operator, in continuous commcrunication with the control room, is required.When SDC is initiated, SDC suction isolation remotely operated valves 2-SI-652 and 2-SI-651 (inside containment isolation valve) and manual valve 2-SI-709 (outside containment isolation valve) are opened. 2-SI-65 1 is normally operated from the cbnitrol room. While in MODES 1, 2 or 3, 2-SI-65 1 is closed with manual disconnect switch NSI65 1 locked open to satisfy Appendix R requirements. It does not receive an automatic contailnment isolation closure signal, but is interlocked to prevent opening if Reactor Coolant System (RCS) pressure is greater than approximately 275 psia. When 2-SI-65 1 is opened fr'om the control room, either one of the two required licensed (Reactor Operator) control room operators can be credited as the dedicated operator required for administrative control. It is not necessary to use a separate dedicated operator.When valve 2-SI-709 is opened locally, a separate dedicated operator is not required to remain at the valve. 2-SI-709 is opened before 2-SI-651. Therefore, opening 2-SI-709 will not establish a connection between the RCS and the SDC System. Opening 2-SI-651 will connect the RCS and SDC System. If a problem then develops, 2-SI-651 can be closed from the control room.MILLSTONE -UNIT 2 B 3/4 6-3f Amendment No.24-0, 2-4,-2-36, 2-7-g, 2g3,......l.... by, NR ...C letter ae6//5 LBDCR 14-MP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued) The administrative controls for valves 2-SI-651 and 2-SI-709 apply only during preparations for initiation of SDC, and during SDC operations. They are acceptable because RCS pressure and temperature are significantly below normal operating pressure and temperature when 2-SI-651 and 2-SI-709 are opened, and these valves are not opened until shortly before SDC flow is initiated. The penetration flowpath can be isolated from the control room by closing either 2-SI-652 or 2-SI-651, and the manipulation of these valves, during this evolution, is controlled by plant procedures. The pressurizer auxiliary, spray valve, 2-CH-5 17, can be used as an alternate method to decrease pressurizer pressure, or for boron precipitation control following a loss of coolant accident. When this valve is opened from the control room, either one of the two required licensed (Reactor Operator) control room operators can be credited as the dedicated operator required for administrative control. It is not necessary to use a separate dedicated operator.The exception for 2-CH-517 is acceptable because the fluid that passes through this valve will be collected in the Pressurizer (reverse flow firom the Pressurizer to the charging system is prevented by check valve 2-CH-43 1), and thle penetration associated with 2-CH-5 17 is open during accident conditions to allow flow from the charging pumaps. Also, this valve is normally 9,.: operated from the control room, under the supervision of the licensed control room operators, in accordance with plant procedures. A dedicated operator is not required when opening remotely operated valves associated with Type N fluid penetrations (Criterion 57 of 10OCFR5O, Appendix A). Operating these valves fr'om the control room is sufficient. The main steam isolation valves (2-MS-64A and 64B), atmospheric steam dump valves (2-MS-1 90A and 190B), and the containmaent air recirculation cooler RBCCW discharge valves (2-RB-28.2A-D).are examples of remotely operated contaim~aent isolation valves associated with Type N fluid penetrations. MSIV bypass valves 2-MS-65A and 65B are remotely operated MOVs, but while in MODE 1, they are closed with power to the valve motors removed via lockable disconnect switches located at their respective MCC to satisfy' Appendix "R" requirements. Local operation of the atmospheric steam dump valves (2-MS-i190A and t 90B), or other remotely operated valves associated with Type N fluid penetrations, will require a dedicated operator in constant communication with the control room, except when operating in accordance with AOPs or EOPs. Even though these valves can not be classified as locked or sealed closed, the use of a dedicated operator will satisfy administrative control requirements. Local operation of these valves with a dedicated operator is equivalent to the operation of other manual (locked or sealed closed) containment isolation valves with a dedicated operator.MILLSTONE -UNIT 2 B 3/4 6-3g Amendment No. 21-i-, 2-6, 7-3, 2-7-8, LBDCR 14-MP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued) The main steam supplies to the turbine driven auxiliary feedwater pump (2-MS-201 and 2-MS-202) are remotely operated valves associated with Type N fluid penetrations. These valves are maintained open during power operation. 2-MS-20 1 is maintained energized, so it can be closed fr'om the control room, if necessary, for containment isolation. However, 2-MS-202 is deenergized open by removing power to the valve's motor via a lockable disconnect switch to satisfy Appendix R requirements. Therefore, 2-MS-202 cannot be closed irmmediately fr-om the control room, if necessary, for containment isolation. The disconnect switch key to power for 2-MS-202 is stored in the Unit 2 control room, and can be used to re-power the valve at the MCC;this will allow the valve to be closed fr'om the control room. It is not necessary to maintain a dedicated operator at 2-MS-202 because this valve is already in the required accident position.Also, the steam that passes through this valve should not contain any radioactivity. The steam generators provide the barrier between the containment and the atmosphere. Therefore, it would take an additional structural failure for radioactivity to be released to the environment thr-ough this valve.Steam generator chemical addition valves, 2-F W-15A and 2-F W-15B, are opened to add chemicals to the steam generators using the Auxiliary Feedwater System (AFW). When either 2-F W-15A or 2-F W-15B is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of these valves is expected during plant startup and shutdown.The bypasses around the main steam supplies to the turbine dr'iven auxiliary feedwater pump (2-MS-201 and 2-MS-202), 2-MS-458 and 2-MS-459, are opened to drain water from the steam supply lines. When either 2-MS-458 or 2-MS-459 is opened, a dedicated operator, in continuous communication with the control room, is required. Operatlion of these valves is expected during plant startup.The containment station air header isolatioin, 2-SA- 19, is opened to supply station air to containment. When 2-SA-1 9 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected for maintenance activities inside conatahnment. The backup air supply master stop, 2-IA-5 66, is opened to supply backup air to 2-CH-5 17, 2-CH-5 18, 2-CH-5 19, 2-EB-88, and 2-EIB-89. When 2-IA-566 is opened; a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected in response to a loss of the normal air supply to the valves listed.MILLSTONE -UNIT 2 B 3/4 6-3h Amendment No. 4-0, 1-, 2-l-6, 7-, 2-7 g 2 -83 LBDCR 14-MIP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES: 3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued) The nitrogen header drain valve, 2-S1-045, is opened to depressurize the containment side of the nitrogen supply header stop valve, 2-8I-312. When 2-SI-045 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected after using the high pressure nitrogen system to raise SIT nitrogen pressure.The containment waste gas header test connection isolation valve, 2-GR-63, is opened to sample the drain tank for oxygen and nitrogen. When 2-GR-63 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is expected during plant startup and shutdown.The upstream vent valves for the steam generator atmospheric dump valves, 2-MS-369 and 2-MS-3 71, are opened during steam generator safety valve set point testing to allow steam header pressure instrumentation to be placed in service. When either 2-MS-3 69 or 2-MS-3 71 is opened, a dedicated operator in continuous communication with the control room is required.The detennination of the appropriate administrative controls for these containment isolation valves included an evaluation of the expected enviromnental conditions. This evaluation has concluded environmental conditions will not preclude access to close the valve, and this action will prevent the release of radioactivity outside of contaimntent through the respective penetration. The containment purge supply and exhaust isolation valves are required to be sealed closed during plant operation since these valves have not been demonstr'ated capable of closing during a LOCA or steam line break accident. Such a denmonstration would require justification of the mechanical OPERABILITY of the purgevyalves and consideration of the appropriateniess of the electrical override circuits. Maintaining these valves closed during plant operations ensures that excessive quantities of radioactive materials will not be released via the containment purge system. The containment purge supply and exhaust isolation valves are sealed closed by isolating instrument air and removing power from the valves, This is accomplished by closing the instrument air isolation valves and pulling the control power fuses for. each of the valves. The associated instrument air isolation valves and fuse blocks are then locked. This is consistent with the guidance contained in NUREG-0737 Item II.E.4.2 and Standard Review Plan 6.2.4,"Containment Isolation System," Item II.f.Surveillance Requirement 4.6.3.l.a verifies the isolation time of each power operated automatic containment isolation valve is within limits to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and surveillance frequency are in accordance with the Inservice Testing Progr'am.MILLSTONE -UNIT 2 B 3/4 6-3i Amendment No. 2-3, 9 LBDCR 14-MP2-016 September 4, 2014 CBNASES NSSTM BASES 3/4.6.4 COMBUSTIBLE GAS CONTROL Surveillance Requirement 4.6.3.1 .b demonstrate that each automatic containment isolation valve actuates to the isolation position on an actual or simulated containment isolation signal [containment isolation actuation signal (CIAS) or containment high radiation actuation signal (containment purge valves only)]. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under admninistrative controls. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ES FAS)testing, and equipment performance is monitored as part of the Inservice Testing Program.The OPERABILITY of the equipment and systems required for control of hydrogen gas ensures that this equipment will be available to maintain the hydrogen concentration within contaimnent below its flammable limit during post-LOCA conditions. The post-incident recirculation systems are provided to ensure adequate mixing of the containment atmosphere following a LOCA. This mixing action will prevent localized accumulations of hydrogen from exceeding the flammable limit.MILLSTONE -UNIT 2 B 3/4 6-4 Amendment No .-2~-3-3, Ackncw~gccl y NRC1011(31dAt REVERSE OF PAGE B 3/4 6-4 INTENTIONALLY LEFT BLANK LBDCR 14-MiP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.5 SECONDARY CONTAIN~MENT 3/4.6.5.1 ENCLOSURE BUILDING FILTRATION SYSTEM The OPERABILITY of the Enclosure Building Filtration System ensures that containment leakage occurring during LOCA conditions into the annulus will be filtered through the filters and charcoal adsorber trains prior to discharge to the atmosphere. This requirement is necessary to meet the assumptions used in the accident analyses and limit the SITE BOUNDARY radiation doses to within the limits of 10 CFR 50.67 during LOCA conditions. With one Enclosure Building Filtration System Train inoperable, the inoperable train must be restored to OPERABLE status within 7 days. The components in this degraded condition are capable of providing 100% of the iodine removal needs after a DBA. The 7 day allowed outage tune is based on consideration of such factors as the availability of the OPERABLE redundant Enclosure Building Filtration System Train and the low probability of a DBA occurring during this period.If two Enclosure Building Filtration System Trains are inoperable, at least one Enclosure Building Filtration System Train must be returned to OPERABLE status within 24 hours. The Condition is modified by a Note stating it is not applicable if the second Enclosure Building Filtration System train is intentionally declared inoperable. The Condition does not apply to voluntary removal of redundant systems or components from service. The Condition is only applicable if one train is inoperable for any reason and the second train is discovered to be inoperable, or if both trains are discovered to be inoperable at the same time. In addition, at least one train of containment spray must be verified to be OPERABLE within 1 hour. In the event of an accident, containmaent spray reduces the potential radioactive release from the containment, which reduces the consequences of the inoperable Enclosure Building. Filtration System Trains.The allowed outage time is based on Reference 1 which demonstrated that the 24 hour allowed outage time is acceptable based on the infrequent use of the Required Actions and the small incremental effect on plant risk.The laboratory testing requirement for the charcoal sample to have a removal efficiency of> 95% is more conservative than the elemental and organic iodine removal efficiencies of 90%and 70%, respectively, assumed in the DBA analyses for the EBFS charcoal adsorbers in the Millstone Unit 2 Final Safety Analysis Report. A removal efficiency acceptance criteria of 95%will ensure the charcoal has the capability to perform its intended safety function throughout the length of an operating cycle.MILLSTONE -UNIT 2 B3465AedetN.2~ B 3/4 6-5 Amendment No. gO8, LBDCR 14-MiP2-016 September 4, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.5.1 ENCLOSURE BUILDING FILTRATION SYSTEM (Continued) Surveillance Requirement 4.6.5.1 .b.l dictates the test frequency, method and acceptance criteria for the EBFS trains (cleanup trains). These criteria all originate in the Regulatory Position sections of Regulatory Guide 1.52, Rev. 2, March 1978 as discussed below: Section C.5 .a requires a visual inspection of the cleanup system be made before the following tests, in accordance with the provisions of section 5 of AINSI N5 10-1975:* in-place air flow distribution test* DOP test* activated carbon adsorber section leak test Section C.5 .c requires the in-place Dioctyl phthalate (DOP) test for HiEPA filters to section 10 of ANSI N5 10-1975. The HEPA filters should be tested in place (1) initially, (2) at the frequency specified in the Surveillance Frequency Control Program, and (3) following painting, fire, or chemical release in any ventilation zone communicating with the system. The testing is to confirm a penetration of less than or equal to 1 %* at rated flow. Q Section C.5.d requires the charcoal adsorber section to be leak tested with a gaseous halogenated hydrocarbon refrigerant, in accordance with section 12 of ANSI N5 10-1975 to ensure that bypass leakage through the adsorber section is less than or equal to 1%.** Adsorber leak testing should be conducted (1) initially, (2) at the frequency specified in the Surveillance Freqluency Control Program, (3) following removal of an adsorber sample for laboratorytesting if the integrity of the adsorber section is affected, and (4) following painting, fire, or chemical release in any ventilation zone communicating with the system.REFERENCE 1. WCAP-16 125-NP-A, "Justification for Risk-Informed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.* Means that the lIEPA filter will allow passage of less than or equal to 1% of the test concentration injected at the filter inlet from a standard DOP concentration injection.

• • Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of the injected test concentration around the charcoal adsorber sections.MILLSTONE

-UNIT 2 B 3/4 6-5a Amendment No. 2Og, " LBDCR 14-MIP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.5.2 ENCLOSURE BUILDING The OPERABILITY of the Enclosure Building ensures that the releases of radioactive materials fr'om the primary containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the accident analyses. This restriction, in conjunction with operation of the Enclosure Building Filtration System, will limit the SITE BOUNDARY radiation doses to within the limits of 10 CFR 50.67 during accident conditions. One Enclosure Building Filtration SysteLn tr'ain is required to establish a negative pressure of 0.25 inches W.G. in the Enclosure Building Filtration Region within one minute after an Enclosure Building Filtration Actuation Signal is generated. The one minute time requirement does not include the time necessary for the associated emergency diesel generator to start and power Enclosure Building Filtration System equipment. To enable the Enclosure Building Filtration System to establish the required negative pressure in the Enclosure Building, it is necessary to ensure that all Enclosure Building access openings are closed. For double door access openings, only one door is required to be closed and latched, except for nornal passage. For single door access openings, that door is required to be closed and latched, except for nonnal passage.If a required door that is designated to automatically close and latch is not capable of automatically closing and latching, the door shall be maintained closed and latched, or personnel shall be stationed at the door to ensure that the door is closed and latched after each trafisit through the door. Otherwise, the access opening (door) should be declared inoperable and appropriate technical specification ACTION statement entered.MILLSTONE -UNIT 2 B346S mnmn o 0g B 3/4 6-5b Amendment No. -a@8, [ REVERSE OF PAGE B 314 6-5b INTENTIONALLY LEFT BLANKK May 7, 2003 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES The OPERABILITY of the main steam line code safety valves (MSSVs) ensures that the secondary system pressure will be limited to within 110% of the design pressure during the most severe anticipated system operational transient. The Loss of Electrical Load with Turbine Trip and the single main steam isolation valve (MSIV) closure event were evaluated at various power levels with a corresponding number of inoperable MSSVs. The limiting anticipated system operational transient is the closure of a single MSIV.The specified valve lift settings an~d relieving capacities are in accordance with the requirements of Section III of the ASME Boiler and Pressure Vessel Code, 1971 Edition. The total rated capacity of the main steam line code safety valves is 12.7 x 106 lbs/hr. This is sufficient to relieve in excess of 100% steam flow at RATED THERMAL POWER.The LCO requires all MSSVs to be OPERABLE. An alternative to restoring the inoperable MSSV(s) to OPERABLE status is to reduce power so that the available MSSV relieving capacity meets ASME Code requirements for the power level. POWER OPERATION is allowed with inoperable MSSVs as specified within the limitations of the ACTION requirements. Less than the full number of OPERABLE MSSVs requires limitations on allowable THERMAL POWER and adjustment to the Power Level-High trip setpoint in accordance with ACTIONS a. 1 and a.2. The 4 hours provided for ACTION a. 1 is a reasonable time period to reduce power level and is based on the low probability of an event occurring during this period that would require activation of the MSSVs. ACTION a.2 provides for 36 hours to reduce the Power Level-High trip setpoint. This time for ACTION a.2 is based on a reasonable time to correct the MSSV inoperability, the time required to perform the" power reduction, operating experience in resetting all channels of a protective function, and on the low probability of the occurrence of a transient that could resulf in steam generator overpressure during this period.As described in Section 2.2.1 of the BASES, during a power reduction the Power Level-High trip setpoint automatically tracks TI-ERMAL POWER downward so that it remains a fixed increment above the current power level, subject to a minimum value. Therefore, during short term reduced power evolutions e.g., MSSV testing, it is permissible to only reduce THERMAL POWER in accordance with ACTION a. 1 (the protective function of ACTION a.2 is automatically provided due to the nature of the Power Level-High trip setpoint), provided that the MSSV testing can be completed within the 36 hours provided for ACTION a.2.MILLSTONE -UNIT 2 B 3/4 7-1 MILLTONE-UIT 2B 3/7-IAmendment No. 5-2, 6-1-, 4-, 275 LBDCR 04-MP2.-016 February 24, 2005 3/.7PLNS SSTM 0 BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) The OPERABILITY of the MSSVs is defined as the ability to open within the setpoint tolerances, relieve steam generator overpressure. and reseat when pressure has been reduced. The lift setpoints for the MSSVs are listed in Table 4.7-1. This table allows a + 3% setpoint tolerance (allowable value) on the lift setting for OPERABILITY to account for drift over a cycle. Each MSSV .is demonstrated OPERABLE, with lift settings as shown in Table 4.7-1, in accordance with Specification 4.0.5. A footnote to Table 4.7-1 requires that the lift setting be restored to within 4- 1% of the setpoint (trip setpoint) following testing to allow for drift. While the lift settings are being restored to a tolerance of+ 1-%, the MSSV will remain OPERABLE with lift settings out of tolerance by as much as +- 3%.MILLSTONE -UNIT 2 B 3/4 7-la Amendment No. 6-t-, 2-1-1-, 2t-5-, Acknowledged by NRC letter dated 6/28/05 LBDCR 11-MP2-013 August 25, 2011 3/4.7 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER PUMPS The OPERABILITY of the auxiliary feedwater pumps ensures that the Reactor Coolant System can be cooled down to less than 3 00°F from nornal operating conditions in the event of a total loss of off-site power.The FSAR Chapter 14 Loss of Normal Feedwater: QON-F) analysis evaluates the event occurring with and without offsite power available, and a single active failure. This analysis has determined that one motor driven AFW pump is not sufficient to meet the acceptance criteria.Therefore, two AFW pumps (two motor-driven AFW pumps, or one-motor driven AMW pump and the steam-driven AFW pump) are required to meet the acceptance criteria for this moderate frequency event. To meet the requirement of two AFW pumps available for mitigation, all three pumps must be OPERABLE to accommodate the failure of one pump. This is consistent with the limiting cQndition for operation and ACTION statements of Technical Specification 3.7.1.2.Although not part of the bases of Technical Specification 3.7.1.2, the less conservative FSAR Chapter 10 Best Estimate Analysis of the LONF event was performed to demonstrate that one motor-driven AEW pump is adequate to remove decay heat, prevent steam generator drout, maintain Reactor Coolant System (RCS) subcooling, and prevent pressurizer level from exceeding acceptable limits. This best estimate analysis is performed to demonstrate the automatic start of both motor driven AFW pumps on low steam generator level satisfies the automatic AFW initiation requirements of NUiREG-0737 Item lI.E. 1.2. Automatic start of the turbine driven AFW pump is not required. From this best estimate analysis of the LONE event, an evaluation was performed to demonstrate that a single motor-driven AEW pump has sufficient capacity to reduce the RCS temperature to 3 00°F (in addition to decay heat removal) where the Shutdown Cooling System may be placed into operation for continued cooldown. As a result of these evaluations, one motor-driven AEW pump (or the steam-driven AFW pump which has twice the capacity of a motor-driven AFW pump) can meet the requirements to remove decay heat, prevent steam generator dryout, maintain RCS subcooling, prevent the pressurizer from exceeding acceptable limits, and reduce RCS temperature to 3 00°3 F.+The Auxiliary Feed Water (AFW) system is OPERABLE when the MFW pumps and flow paths required to provide MFW to the steam generators are OPERABLE. Technical Specification 3.7. 1.2 requires three MFW pumps to be OPERABLE and provides ACTIONS to address inoperable AMW pumps. The MFW flow path requirements are separated into MFW pump suction flow path requirements, MFW pump discharge flow path to the common discharge header requirements, and common discharge header to the steam generators flow path requirements. There are two MFW pump suction flow paths from the Condensate Storage Tank to the MFW pumps. One flow path to the turbine driven MFW pump, and one flow path to both motor driven MFW pumps. There are three MFW pump discharge flow paths to the common discharge header, one flow path from each of the three MFW pumps. There are two MFW discharge flow paths from the common discharge header to the steam generators, one flow path to each steam generator. With 2-F W-44 open (normal position), the discharge from any MFW pump will be supplied to both steam generators through the associated MFW regulating valves.MILLSTONE -UN[T 2 B 3/4 7-2 Amendment No. g2, 64-, 6-3, 44-t, 2, 36,'2-4, LBD CR 04-MP2-016 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued) 2-F W-44 should remain open when the AFW system is required to be OPERABLE (MODES 1, 2, and 3). Closing 2-F W-44 places the plant in a configuration not considered as an initial condition in the Chapter 14 accident analyses. Therefore, if 2-F W-44 is closed while the plant is operating in MODES 1, 2, or 3, two AEW pumps should be considered inoperable and the appropriate ACTION requirement of Technical Specification 3.7.1.2 entered to limit plant operation in this configuration. A flow path may be considered inoperable as the result of closing a manual valve, failure of an automatic valve to respond correctly to an actuation signal, or failure of the piping. In the case of an inoperable automatic AFW regulating valve (2-F W-43A or B), flow path OPERABILITY can be restored by use of a dedicated operator stationed at the associated bypass valve (2-F W-56A or B) as directed by OP 2322. Failure of the common discharge header piping will cause both discharge flow paths to the steam generators to be inoperable. An inoperable suction flow path to the turbine driven AFW pump will result in one inoperable AFW pump. An inoperable suction flow path to the motor driven AFW pumps will result in two inoperable MFW pumps. The ACTION requirements of Technical Specification 3.7.1.2 are applicable based on the number of inoperable AFW pumps.An inoperable pump discharge flow path from an MFW pump to the common discharge header will cause the associated AFW pump to be inoperable. The ACTION requirements of Technical Specification 3.7.1.2 for one MFW pump are applicable for each affected pump discharge flow path.MFW must be capable of being delivered to both steam generators for design basis accident mitigation. Certain design basis events, such as a main steam line break or steam generator tube rupture, require that the affected steam generator be isolated, and the RCS decay heat removal safety function be satisfied by feeding and steaming the unaffected steam generator. If a failure in an MFW discharge flow path from the common discharge header to a steam generator prevents delivery of MFW to a steam generator, then the design basis events may not be effectively mitigated. In this situation, the ACTION requirements of Technical Specification 3.0.3 are applicable and an immediate plant shutdown is appropriate. Two inoperable AFW System discharge flow paths from the common discharge header to both steam generators will result in a complete loss of the ability to supply MFW flow to the steam generators. In this situation, all three MFW pumps are inoperable and the ACTION requirements of Technical Specification 3.7.1.2. are applicable. Immediate corrective action is required.However, a plant shutdown is not appropriate until a discharge flow path from the common discharge header to one steam generator is restored.MILLSTONE -UNIT 2 B 3/4 7-2a Amendment No. , Acknowledged by NRC letter dated 6/28/05 November 10, 2005 LBDCR 04-MP2-013 3/4.7 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued) If the turbine-driven auxiliary feedwater train is inoperable due to an inoperable steam supply in MODES 1, 2, and 3, or if the turbine-driven auxiliary feedwater pump is inoperable while in MODE 3 immediately following REFUIEL1INJQ action must be taken to restore the inoperable equipment to an OPERABLE status within 7 days. The 7 day allowed outage time is reasonable, based on the following:

a. For the inoperability of the turbine-driven auxiliary feedwater pump due an inoperable steam supply, the 7 day allowed outage time is reasonable since the auxiliary feedwater system design affords adequate redundancy for the steam supply line for the turbine-driven pump.b. For the inoperability of a turbine-driven auxiliary feedwater pump while in MODE 3 immediately subsequent to a refueling, the 7 day allowed outage time is reasonable due to the minimal decay heat levels in this situation.

c. For both the inoperability of the turbine-driven pump due to an inoperable steam supply and an inoperable turbine-driven auxiliary feedwater pump while in MODE 3 immediately following a refueling outage, the 7 day allowed outage time is reasonable due to the availability of redundant OPERABLE motor driven auxiliary feedwater pumps, and due to the low probability of an event requiring the use of the turbine-driven auxiliary feedwater pump.When one steam supply to the turbine-driven auxiliary feedwater pump is inoperable, the turbine-driven auxiliary feedwater pump is inoperable.

In this case, although the turbine-driven auxiliary feedwater pump with a single oper~able steam supply is capable of perfonning its safety function in the absence of a single failure, the turbine-driven auxiliary feedwater pump is considered inoperable due to the lack of redundancy with respect to steam supplies.The required ACTION dictates that if the 7 day allowed outage time is reached the unit must be in at least HOT STAND)BY within the next 6 hours and in HOT SHUTDOWN within the following 12 hours.The allowed time is reasonable, based on operating experience, to reach the required conditions from full power conditions in an orderly manner and without challenging plant systems.MILLSTONE -UNIT 2 B 3/4 7-2b Amendment No. g2, 6-1-, 63-, 2-l44,-2-36, 2g3-2, LB3DCR 14-MIP2-016 September 4, 2014 3/4.7 PLANT SYSTEMS BASES 0 3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued') A Note limits the applicability of the inoperable equipment condition

b. to when the unit has not entered MODE 2 following a REFUELING..Required ACTION b. allows one auxiliary feedwater pump to be inoperable for 7 days vice the 72 hour allowed outage time in required ACTION c. This longer allowed outage time is based on the reduced decay heat following REFUELING and prior to the reactor being critical.With one of the auxiliary feedwater PUmps inoperable in MODE 1, 2, or 3 for reasons other than ACTION a. or b., ACTION must be taken to restore the inoperable equipment to OPERABLE status within 72 hours. This includes the loss of both steam supply lines to the turbine-driven auxiliary feedwater pump. The 72 hour allowed outage time is reasonable, based on redundant capabilities afforded by the auxiliary feedwater system, time needed for repairs, and the low probability of a DBA occurring during this time period. Two auxiliary feedwater pumps and flow paths remain to supply feedwater to the steam generators.

If all three AFW pumps are inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with non-safety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW pump to OPERABLE status. Required ACTION e. is modified by a Note indicating that all required MODE changes or power reductions are suspended until one MFW pump is restored to OPERABLE status. Ina this case, LCO 3.0,3 is not applicable because it could force the unit into a less safe condition. During periodic surveillance testing. of the turbine driven AFW pump, valve 2-CN-27A is closed and valve 2-CN-28 is opened to prevent overheating the water being circulated. In this configuration, the suction of the turbine driven AFW pump is aligned to the Condensate Storage Tank via the motor driven AFW pump suction flow path, and the pump minimum flow is directed to the Condensate Storage Tank by the turbine driven AFW pump suction path upstream of 2-CN-27A in the reverse direction. During this surveillance, the suction path to the motor driven AFW pump suction path remains OPERABLE, and the turbine driven AFW suction path is inoperable. In this situation, the ACTION requirements of Technical Specification 3.7.1.2 for one MFW pump are applicable. The surveillance frequency is controlled under the Surveillance Frequency Control Program.I MILLSTONE -UNIT 2 B3472 mnmn o 8-B 3/4 7-2c Amendment No. -2gg, LBDCR 14-MP2-016 September 4, 2014 3/4.7 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued) Surveillance Requirement 4.7.1I.2.a verifies the correct alignment for manual, power operated, and automatic valves in the Auxiliary Feedwater (AFW) System flow paths (water and steam) to provide assurance that the proper flow paths will exist for AFW operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The surveillance frequency is controlled under the Surveillance Frequency Control Progr'am.Surveillance Requirement 4.7.1.2.b, which addresses periodic surveillance testing of the AFW pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems, is required by the ASMIE Code for Operations and Maintenance of Nuclear Power Plants (ASME GM Code). This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the perfonnance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program. The ASME GM Code provides the activities and frequencies necessary to satisfy the requirements. This surveillance is modified to indicate that the test can be deferred for the steam driven AFW pump until suitable plant conditions are established. This deferral is required because steam pressure is not sufficient to perform the test until after MODE 3 is entered. Once the unit reaches 800 psig, 24 hours would be allowed for completing the surveillance. However, the test, if required, must be performed prior to entering MODE 2.Surveillance Requirements 4.7.1.2.c and 4.7.1 .2.d demonstrate that each automatic AFW valve actuates to the required position on an actual or simulated actuation signal (AF WAS) and that each AFW pump starts on receipt of an actual or simulated actuation signal (AF WAS). This surveillance is not required for valves that are locked, sealed, or Otherwise secured in the required position under administrative controls. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program. These surveillances do not apply to the steam driven AFW pump and associated valves which are not automatically actuated.MILLSTONE -UNIT 2 B3472 mnmn o B 3/4 7-2d Amendment No. November 10, 2005 LBDCR 04-MP2-013 3/.7PLNS SSTM 0 BASES 3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued) Surveillance Requirement 4.7.1 .2.e demonstrates the AIEW System is properly aligned by verifyiing the flow path to each steam generator prior to entering MODE 2, after 30 cumulative days in MODE 5, MODE 6, or a defueled condition. OPERABILITY of the AFW flow paths must be verified before sufficient core heat is generated that would require operation of the AFW System during a subsequent shutdown. To further ensure AEW System alignment, the OPERABILITY of the flow paths is verified following extended outages to determine that no misalignmaent of valves has occurred. The frequency is reasonable, based on engineering judgment, and other administrative controls to ensure the flow paths are OPERABLE.3/4.7.1.3 CONDENSATE STORAGE TANK The OPERABILITY of the condensate storage tank with the minimum water volume ensures that sufficient water is available for cooldown of the Reactor Coolant System to less than 300°F in the event of a total loss of off-site power. The minimum water volume is sufficient to maintain the RCS at HOT STANDBY conditions for 10 hours with steam discharge to atmosphere. The contained water volume limit includes an allowance for water not usable due to discharge nozzle pipe elevation above tank bottom, plus an allowance for vortex formation. ib 3/4.7.1.4 ACTIVTY The limitations on secondary system specific activity ensure that the resultant off-site radiation dose will be limited to a small fraction MILLSTONE -UNIT 2 B 3/4 7-2e Amendment No. . LBDCR 04-MP2-016 February 24, 2005 PLANT SYSTEMS BASES..3/4.7.1i.4 ACTIVITY (Continued) of 10 CFR Part 100 limits in the event of a steam line rupture. The dose calculations for an assumed steam line rupture include the effects of a coincident 1.0 GPM primary to Secondary tube -.leak in the steam generator of the affected steam line and a concurrent loss of offsite electrical power. These values are consistent with theassumptions used in the accident analyses.3/4.7.1.5 MAIN STEAM. LINE IsoLATIoN VALVES The OPERABILITY of the main steam line isolation valves ensures, that no *more than one steam generator will blowdown in the event of a steam line rupture. This restriction is *required to 1I) minimize te p~ositi.ve Teactivity ffe tfth'e Ractor, Coklant;,Siystem-.o-ol[down i.sso~5iated. with the blowdown, and:2) -limiti-the!pr~es~sure-rise:w~ithin-coigtginmehtiin:he-eve-nt--th, steoan l~ine rupture occurs within conitainment. fTheOP'ERABILITY of the maini steam valves within the closure times of the surveillance requiremenats are consistent with the assumptions used in the accident analyses.The ability of the main steam line isolation valves (MSIVs) to close is verified after the plant has been heated up. Since it is necessary to establish a high Reactor Coolant System temperature before the surveillance test can be performed, on exception to Technical Specification 4.0.4 has been added to SR 4.7.1.5 to allow entry into MODE 3. This is necessary to allow plant startup to proceed with equipment that is believed to be OPERABLE; but that Cannot be verified by performance of the surveillance test until the appropriate plant conditions have been established. After entering MODE 3 and establishing the necessary plant conditions (Tavg > 51 5 0 F), the MSIVs will be declared inoperable if SR 4.7.1.5 has not been performed within the required frequency, plus 25%, in accordance with Technical Specifications 4.0:2 and 4.0.3. The ACTION statement for MODES 2 and 3 Would thenbe entered. However, the required ACTIONS can be deferred for up to 24 hours (Technical Specification 4.0.3) to allow performance of SR 4.7.1.5. If the surveillance test is not performed within this 24 hour time period, the requirements of the ACTION statement for MODES 2 and 3 apply, and the MSIV(s) [must be either restored to OPERABLE status or closed. Closing the MSIV(s) put the valve(s) in the required accident condition. However, the MSIV(s) may be opened to perform SR 4.7.1.5. If the MSIV(s) carmnot be closed, the plant must be shut down to MODE 4.3/4.7.1.6 MAMN FEEDWATER ISOLATION COMIPONENTS (MFICS)Feedwater isolation response time ensures a rapid isolation of feed flow to the steam.generators via the feedwater regulating valves, feedwater bypass Valves, and: as backup, feed pump discharge valves. :The response time includes signal generation time and valve stroke. Feed line block valves also receive MILLSTONE -UNIT 2 'B 3/4 7-3 Amendment No. 4-88, 24-9, Acknowledged by NRC letter dated 6/28/05 LBDCR 07-MP2-03 1 August 8, 2007 PLANT SYSTEMS BASES a feedwater isolation signal Since the steam line break accident analysis credits them in prevention of feed line volume flashing in some cases. Feedwater pumps are assumed to trip immediately with an MSI signal.3/4.7.1.7 ATMOSPHERIC DUMP VALVES The atmospheric dump valve (ADV) lines provide a method to maintain the unit* in HoT STANDBY, and to replace or supplement the condenser steam dump valves to cool the unit to Shutdown Cooling (SDC) entry conditions. Each ADV line contains an air operated.ADV, and an uipstream manual isolation Vcalve. The manual isolation valves are normally open; anid the ADVS closed. The ADVs, which are normally operated from the main control* room, can be operated*locally using a manual handwheel. An ADV is, ..if the manual iso~latin val~ve-,iS,,pen and .if~tocal:-mranual.. of theADN.c~an bed u ;9:4 t: eroxc~nrolole4;0r~easeofgstamn .t t~he *atospere. If:the manual isolation valve is closed the ADV line is inoperable The considerable: time and effort required to open the valve Wvould challenge the timing of critical operator act~ions and established operator dose limits. This is consistent with the LOCA analysis and Steam Generator Tube Rupture analysis which credits local manual operation of the ADV lines for accident mitigation. 3/4.7.1.8 STEAM GENERATOR BLOWDOWN ISOLATION VALVES The steam generator blowdown isolation valves will isolate steam generator blowdown on*low steam generator water level; An auxiliary feedwater actuation signal will also be generated at*this steam generator water level. Isolation of steam generator: blowdown will conserve steam generator water inventory following, a loss of main feedwater. The steam generator blowdown isolation valves will also*close automatically upon receipt of a containment isolation signal or a high radiation signal (steam generator blowdown or condenser air ejector discharge). 3/4.7.2 DELETED... 3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER sYSTEM The OPERABILITY of the Reactor Building Closed Cooling Water*(RBCCw) System ensures that sufficient cooling capacity is available for continued operation of vital components and Engineered Safety Feature equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the ass used in the accident analyses... The RBcCW loops areredundant of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a'design basis accident,: one RBCCW ioop is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to. which it supplies cooling water. To enSure this requirement is met, two RBCCW loops must be OPERABLE, and independent to the extent" necessary to ensure that a single failure will not result in the unavailability MILLSTONE -UNIT 2 B 3/4 7-3a Amendment No. 2N-l9, &224, 226,24m6,-~2-8,-2-7-2, January 10, 2002 PTSCR 2-18-01 May 1, 2002 PLANT SYSTEMS BASES of both RBCCW loops. At least one RBCCW ioop will operate assuming the worst single active failure occurs following a design basis accident coincident with a loss of offsite power, or the worst single passive failure occurs during post-loss of coolant accident long tenn cooling. System design is assumed to mitigate the single active failure. System design or operator action is assumed to mitigate the passive failure.The RBCCW System has numerous cross connection points between the redundant loops, with manual valve isolation capability. When these valves are opened, the two system ioops are no longer independent. The loss of independence will result in one large RBCCW loop. This may adversely impact the ability of the RBCCW System to mitigate the design basis events if a single failure, active or passive, occurs. Opening the manual cross-connection valves during normal operation should be evaluated to ensure system stability, minimum component cooling flow requirements, and the ability to mitigate the design basis events coincident with a single failure are maintained. Continuous operation with cross-connection valves open is acceptable if the configuration has been evaluated and protection against a single failure can be demonstrated.(Several system configurations that have been evaluated and determined acceptable for continuous plant operation are identified below). If opening a cross-connection valve will result in a plant configuration that does not provide adequate protection against a single failure, the following guidance app lies. If only the manual cross-connect valves have been opened, and the R.BCCW System is in a normal configuration otherwise, with all system equipment OPERABLE, one RBCCW loop should be considered inoperable and the ACTION requirements of Technical Specification 3.7.3.1 applied. If the RBCCW System is not in a normal configuration otherwise and/or not all equipment is OPERABLE, both RBCCW loops should be considered inoperable and the ACTION requirements of Technical Specification 3.0.3 applied.The loss of loop independence is equivalent to the situation w!here one loop is inoperable. If one loop is inoperable, the remaining OPERABLE loop will be able to meet all design basis accident functions, assuming an additional single failure does not occur. If the loops are not independent, the remaining single large OPERABLE loop will be able to meet all design basis accident functions, assuming a single failure does not occur. Operation in a plant configuration where protection against a single failure can not be shown is acceptable provided the time period in that configuration is limited to less than the Technical Specification specified allowed outage trine. It is acceptable to operate in the off normal plant configurations identified in the ACTION requirements for the time periods specified due to the low probability of occurrence of a designl basis event concurrent with a single failure during this limited trime period. The allowed outage time for one inoperable RBCCW loop provides an appropriate lrimit for continued operation with only one OPERABLE RBCCW loop, and can be applied to a plant configuration where only loop independence has been compromised. The loop determined to be inoperable should be the loop that results in the most adverse plant configuration with respect to the availability of accident mitigation equipment. Restoration of loop independence within the trime constraints of the allowed outage time is required, or a plant shutdown is necessary. MILLSTONE -UNIT 2 B 3/4 7-3b Revised by NRC Letter A 15689 Amendment No. LIBDCR 14-MIP2-016 September 4, 2014 PLANT SYSTEMS BASES 3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER SYSTEM (Continued) It is acceptable to operate with the RBCCW pump minimum flow valves (2-RB-107A, 2-RB-l07B, 2-RiB-107C), RBCCW pump sample valves (2-RB-56A, 2-RiB-56B, and 2-RB-56C), and the RBCCW pump radiation monitor stop valves (2-RIB-39, 2-RB-4t,and 2-RB-43) open. An active single failure will not adversely impact both RBCCW loops with these valves open. In addition, protection against a passive single failure after the initiation of post-loss of coolant accident long term cooling is achieved by manually closing these accessible valves, as directed by the emergency operating procedures. In addition, operation with RBCCW chemical addition valves (2-RB-50A and 2-RB-50B) open during chemical addition evolutions is acceptable since these normally closed valves are opened to add chemicals to the RBCCW and then closed as directed by nonnal operating procedures. Therefore, operation with these valves open does not affect OPERABILITY of the RBCCW loops.Surveillance Requirement 4.7.3.1 .a verifies the correct alignment for manual, power operated, and automatic valves in the RBCCW System flow paths to provide assurance that the proper flow paths exist for RBCCW operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since thlese valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position.The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.7.3.1 .b and 4.7.3.1 .c demonstrate that each automatic RBCCW valve actuates to the required position on an actual or simulated actuation signal and that each RBCCW pump starts on receipt of an actual or simulated actuation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. These surveillance frequencies are controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing; and equipment performance is monitored as part of the Inservice Testing Program.3/4.7.4 SERVICE WATER SYSTEM The OPERABILITY of the Service Water (SW) System ensures that sufficient cooling capacity is available for continued operation of vital components and Engineered Safety Feature equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the accident analyses.MILLSTONE -UNIT 2 B 3/4 7-3c Amendment No. -249, g22, 36, 2-3&, 2a7-3 February 13, 2003 PLANT SYSTEMS BASES 3/4.7.4 SERVICE WATER SYSTEM (continued) The SW loops are redundant of each other to the degree that each has separate controls and power supplies and the operation Of one does not depend on the other. In the event of a design basis accident, one SW loop is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two SW loops must be OPERABLE, and independent to the extent necessary to ensure that a single failure will not result in the unavailability of both SW loops. At least one SW loop will operate assuming the worst single active failure occurs following a design basis accident coincident with a loss of offsite power, or the worst single passive failure occurs post-loss of coolant accident long term cooling. System design is assumed to mitigate the single active failure. System design or operator action is assumed to mitigate paissive failure.The SW System has numerous cross connection points between the redundant loops, with manual valve isolation capability. When these valves are opened, the two system loops are no longer independent. The loss of independence will result in one large SW loop. This may adversely impact the ability of the SW System to mitigate the design basis events if a single failure, active or passive, occurs. Opening the manual cross-connection valves during normal operation should be evaluated to ensure system stability, minimum component cooling flow requirements, and the ability to mitigate the design basis event coicident with a single failure are maintained. Continuous operation with cross-connection valves open is acceptable if the configuration has been evaluated and protection against a single failure can be demonstrated. (SeVeral system configurations that have been evaluated and determined acceptable for continuous plant operation are identified below). If opening a cross-connection valve will result in a plant configuration that does not provide adequate protection against a single failure, the following guidance applies: If only the manual cross-connect valves have been opened, and the SW System is in a normal configuration otherwise, with all system equipment OPERABLE, one SW loop should be considered inoperable and the ACTION requirements of Technical Specification 3.7.4.1 applied. If the SW System is not in a normal configuration otherwise and/or not all equipment is OPERABLE, both SW loops should be considered inoperable and the ACTION requirements of Technical Specification 3.0.3 applied.The loss of loop independence is equivalent to the situation where one loop is inoperable. If one loop is inoperable, the remaining OPERABLE loop will be able to meet all design basis accident functions, assuming an additional single failure does not occur. If the loops are not independent, the remaining single large OPERABLE loop will be able to meet all design basis accident functions, assuming a single failure does not occur. Operation in a plant configuration where protection against a single failure can not be shown is acceptable provided the time period in that configuration is limited to less then the Technical Specification specified allowed outage time. It is acceptable to operate in the off normal plant configurations identified in the ACTION requirements for the time periods specified due to the low probability of occurrence of a design basis event concurrent with a single failure during this limited time period. The allowed outage time for one inoperable SW loop provides an appropriate limit for continued operation with only one OPERABLE SW loop, and can be applied to a plant configuration where only loop independence has been compromised. The loop MILLSTONE -UNIT 2B3473AmnetNo23 B3/4 7-3d Amendment No. 273 REVERSE OF PAGE B314 7-3d INTENTIONALLY LEFT BLANK LBDCR I4-MiP2-016 September 4, 2014 PLANT SYSTEMS BASES 3/4.7.4 SERVICE WATER SYSTEM (Continued) determined to be inoperable should be the ioop that results in the most adverse plant configuration with respect to the availability of accident mitigation equipment. Restoration of ioop independence within the time constraints of the allowed outage time is required, or a plant shutdown is necessary.-Branch lines are supplied to isolation valves in the intake for lubrication to the circulating water pump bearings (2-S W-298 and 2-S W-299), and alternate supply connections (2-S W-84A, and 2-S W-84B). The flow restricting orifices in these lines ensure that safety related loads continue to receive minimum required flow during a LOCA (in which the lines remain intact), or during a seismic event (when the lines break) even with the valves open. Therefore, operation with these valves open does not affect OPERABILITY of the SW loops.Surveillance Requirement 4.7.4.1 .a verifies the correct alignment for manual, power operated, and automatic valves in the Service Water (SW) System flow paths to provide assurance that the proper flow paths exist for SW operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position.The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.7.4.1l.b and 4.7.4.l.c demonstrate that each automatic SW valve actuates to the required position on an actual or simulated actuation signal and that each SW pump starts on receipt of an actual or simulated actuation signal. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. These surveillance frequencies are controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program..3/4.7.5 DELETED MILLSTONE -UNIT 2 B 3/4 7-4 MILLTON -NIT2 B3/47-4Amendment No. 2g-36, June 25, 2007 LBDCR 07-MP2-013 PLANT SYSTEMS BASES 0 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM The OPERABILITY of the Control Room Emergency Ventilation System ensures that 1) the ambient air temperature does not exceed the allowable temperature for continuous duty rating for the equipment and instrumentation cooled by this system and 2) the control room will remain habitable for operations personnel during and following all credible accident conditions. The OPERABILITY of thiis system in conjunction with control room design provisions is based on limiting the radiation exposure to personnel occupying the control room. For all postulated design basis accidents, the radiation exposure to personnel occupying the control room shall be 5 rem TEDE or less consistent with the requirements of 10 CFR 50.67 The Control Room Envelope (CRIB) is the area within the confines of the GRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and other non-critical areas including adjacent support offices, and utility rooms. The GRE is protected during normal operation, natural events, and accident conditions. The GRE boundary is the combination of walls, floor, ceiling, ducting, valves, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the GRE will not exceed the inleakage assumed in the licensing basisa analysis of design basis accident (DBA) consequences to GRE occupants. The GRE and boundary are defined in the Control Room Envelope Habitability Program.In order for the control room emergency ventilation systems to be considered OPERABLE, the GRE boundary must be maintained such that the GRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that GRE occupants are protected from hazardous chemicals and smoke.TS LCO 3.7.6.1 is modified by a footnote allowing the GRE boundary to be opened intermittently under administrative controls. This footnote only applies to openings in the GRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening Who is in continuous communication with the operators in the GRE. This individual will have a method to rapidly close the opening and to restore the GRE boundary to a condition equivalent to the design condition when a need for GRE isolation is indicated. MILLSTONE -UNIT 2 B 3/4 7.-4a Amendment No. 22S, 2-36, 7-3, 4ng4, LBDCR 14-MIP2-001 May 20, 2014 PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) ACTIONS a. 1, b. 1, b.2, b.3, c. 1, c.2 and c.3 of this specification are applicable at all times during plant operation in MODES 1, 2, 3, and 4. ACTIONS d.1, d.2, and e.1 are applicable in MODES 5 and 6, or when recently irradiated fuel assemblies are being moved. The control room emergency ventilation system is required to be OPERABLE during fuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 300 hours).With one Control Room Emergency Ventilation (CREV) train inoperable except due to an inoperable CREV boundary, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CREV subsystem is adequate to perform control room radiation protection function. However, the overall reliability is reduced because a single failure in the OPERABLE CREV train could result in loss of CREV function. The 7 day allowed outage time is based on the low probability of a DBA occunring during this time period, and the ability of the remaining train to provide the required capability. If both CREV trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable control room boundary (i.e., Condition c), at least one CREV train must be returned to OPERABLE status within 24 hours. The Condition is modified by a Note stating it is not applicable if the second CREV train is intentionally declared inoperable. The Condition does not apply to voluntary removal of redundant systems or components from service. The Condition is only applicable if one train is inoperable for any reason and the second train is discovered to be inoperable, or if both trains are discovered to be inoperable at the same time. During the period that the CREV trains are inoperable, action must be initiated to implement mitigating actions to lessen the effect on control room (CR) occupants from potential hazai'ds while both trains of.CREV are inoperable. In the event of a DBA, the mitigating actions will reduce the consequences of radiological exposures to the CR occupants. Specification 3.4.8, "Reactor Coolant System Specific Activity," allows limited operation with the reactor coolant system (RCS) activity significantly greater than the LCO limit. This presents a risk to the plant operator during an accident when all CREV trains are inoperable. Therefore, it must be verified within 1 hour that LCO 3.4.8 is met. This Required Action does not require additional RCS sampling beyond that normnally required by LCO 3.4.8.At least one CREV train must be returned to OPERABLE status within 24 hours. The allowed outage time is based on Reference 1 whtich demonstrated that the 24 hour allowed outage time is acceptable based on the infrequent use of the Required Actions and tlhe small incremental effect on plant risk.MILLSTONE -UNIT 2 B 3/4 7-4b Amendment No. 2-g, 2-36, 5, -24, -54, 2g4, LBDCR 14-Mv~P2-001 May 20, 2014 PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) If the control room boundary is in~operable in MODES 1, 2, 3, and 4, the CREV trains cannot perfonn their intended functions. Actions must be taken to restore an OPERABLE control room boundary within 90 days. During the period that the control room boundary is inoperable, appropriate compensatory measures (consistent with the intent of GDC 19) should be utilized to protect contr~ol room operators from potential hazards such as radioactive contamination, toxic chemicals, smoke, temperature and relative humidity, and physical security. Preplarned measures should be available to address these concerns for intentional and unintentional entry into the condition. The 90 days allowed outage time is reasonable based on the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 90 days allowed outage time is a typically reasonable time to diagnose, plan and possibly repair, and test most problems with the control room boundary.In MODE 5 or 6, or during movement of recently irradiated fuel assemblies, if Required Action d. 1 cannot be completed within the required allowed outage time, the OPERABLE CREV train must be immediately placed in the recirculation mode of operation. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure will be readily detected. i An alternative to Required Action d. 1 s to immediately suspend activities that could result in-a release of radioactiv;ity that might require isolation of the control room. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel assemblies to a safe position.When in MODES 5 and 6, or during movement of recently irr-adiated, fuel assemblies, with two CREV trains inoperable, action muist be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the control roomJ This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.The control room radiological dose calculations use the conservative minimum acceptable flow of 2250 cfm based on the flowrate surveillance requirement of 2500 cfm 4+ 10%.MILLSTONE -UNIT 2 B 3/4 7-4c Amendment No. 2-, 2--6, -2A-5, 2a4g,-2-54, 84, LBDCR 14-MP2-001 May 20, 2014 PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) Currently there are some situations where the CREV System may not automatically start on an accident signal, without operator action. Under most situations, the emergency filtration fans will start and the CREV System will be in the accident lineup. However, a failure of a supply fan (F21A or B) or an exhaust fan (F31lA or B), will require operator action to return to a full train lineup. Also, if a single emergency bus does not power up for one train of the CREV System, the opposite train filter fan will automatically start, but the required supply and exhaust fans will not automatically start. Therefore, operator action is required to establish the whole train lineup. This action is specified in the Emergency Operating Procedures. The radiological dose calculations do not take credit for CREV System cleanup action until 1 hour into the accident to allow for operator action.When the CREV System is checked to shift to the recirculation mode of operation, this will be performed from the nonnal mode of operation, and from the smoke purge mode of operation. If the unfiltered inleakage of potentially contaminated air past the CRE boundaiy and into the CR3 can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour allowed outage time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day allowed outage time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day allowed outage time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CR3 boundary.MILLSTON~E -UNIT 2 B3474 mnmn o B 3/4 7-4d Amendment No. LBDCR 14-MIP2-016 September 4, 2014 PLANT SYSTEMS BASES I1 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) Irmrediate action(s), in accordance with the LCO Action Statements, means that the required action should be pursued without delay and in a controlled manner.Surveillance Requirement 4.7.6.1 .c. 1 dictates the test frequency, methods and acceptance criteria for the Control Room Emergency Ventilation System trains (cleanup trains). These criteria all originate in the Regulatory Position sections of Regulatory Guide 1.52, Rev. 2, March 1978 as discussed below.Section C.5 .a requires a visual inspection of the cleanup system be made before the following tests, in accordance with the provisions of section 5 of ANSI N510-1975:

• in-place air flow distribution test o DOP test o activated carbon adsorber section leak test Section C.5 .c requires the in-place Dioctyl phthalate (DOP) test for IT]EPA filters to conform to section 10 of ANSI N510-1975.

The HEPA filters should be tested in place (1) initially, (2) at the frequency specified in the Surveillance Frequency Control Program, and (3) following painting, fire, or chemical release in any ventilation zone communicating with the system. The testing is to confirm a penetration of less than or equal to 1%* at rated flow.Section C.5 .d requires the charcoal adsorber section to be leak testedwvith a gaseous halogenated hydrocarbon refrigerant, in accordance with. section 12 of ANSI N5 10-1975 to ensure that bypass leakage through the adsorber section is less than or equal to 1%. ** Adsorber leak testing should be conducted (1) initially, (2) at the frequency specified in the Surveillance Frequency Control Program, (3) following removal of an adsorber sample for laboratoiy testing if the integrity of the adsorber section is affected, and (4) following painting, fire, or chemical release in any ventilation zone communicating with the system.* Means that the HIEPA filter will allow passage of less than or equal to 1% of the test concentration injection at the filter inlet from a standard DOP concentration injection.

• Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of the injected test concentration around the charcoal adsorber section.MILLSTONE

-UNIT 2 B 3/4 7-4e Amendment No. LBDCR 14-MP2-001 May 20, 2014 PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) The ACTION requirements to immediately suspend various activities (CORE ALTERATIONS, irradiated fuel movement, etc.) do not preclude completion of the movement of a component to a safe position.Technical Specification 3.7.6.1 provides the OPERABILITY requirements for the Control Room Emergency Ventilation Trains. If a Control Room Emergency Ventilation Train emergency power source or normal power source becomes inoperable in MODES 1, 2, 3, or 4 the requirements of Technical Specification

3.0.5 apply

in determining the OPERABILITY of the affected Control Room Emergency Ventilation Train. If a Control Room Emergency Ventilation Train emergency power source or normal power source becomes inoperable in MODES 5 or 6 the guidance provided by Note "**~" of this specification applies in determining the OPERABILITY of the affected Control Room Emergency Ventilation Train. If a Control Room Emergency Ventilation Train emergency power source or normal power source becomes inoperable while not in MODES 1, 2, 3, 4, 5, or 6 the requirements of Technical Specification

3.0.5 apply

in determining the OPERABILITY of the affected Control Room Emergency Ventilation Train.Surveillance Requirement 4.7.6.1.h verifies the OPERABILITY of the CRE boundary by testing for -unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.*Means that the HF-EPA filter will allow passage of less than or equal to 1% of the test concentration injection at the filter inlet from a standard DOP concentration injection.

• • Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of the injected test concentration around the charcoal adsorber section.MILLSTONE

-UNIT 2 B3474 mnmn o B 3/4 7-4f Amendment No. ] LBDCR 14-MIP2-001 ~May 20, 2014 PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) The GRE is considered habitable when the radiological dose to GRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 remn TEDE and the GRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the GRE is no greater than the flow rate assumed in the licensing basis analyses of DB3A consequences. When unfiltered air inleakage is greater than the assumed flow rate, ACTION c. must be entered. ACTION c. allows time to restore the GRE boundary to OPERABLE status provided mitigating actions can ensure that the GRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, which endorses, with exceptions, NEI 99-03.These compensatory measures may also be used as mitigating actions as required by ACTION c.Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY. Options for restoring the GRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the GRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the GRE boundary has been restored to OPERABLE status.REFERENCE !1. WCAP- 16 125-NP-A, "Justification for Risk-Informed Modifications to Selected Teclmical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B 3/4 7-4g 10O LBDCR 11-MP2-010 August 23, 2011 PLANT SYSTEMS BASES 3/4.7.7 DELETED 3/4.7.8 SNUBBERS All snubbers are required OPERABLE to ensure that the structural integrity of the reactor coolant system and all other safety related systems is maintained during and following a seismic or other event initiating dynamic loads. Snubbers excluded from this inspection program are those installed on nonsafety-related systems and then only if their failure or failure of the system on xWhich they are installed would have no adverse effect on any safety-related system.MILLSTONE -UNIT 2 B 3/4 7-5 Amendment No. 141, 3-5, 96, 4-1-6, LW2: LBDCR 11-MP2-010 August 23, 2011 PLANTSYSTM 0 BASES 3/4.7.9 DELETED MILLSTONE -UNIT 2 B 3/4 7-6 Amendment No.. 1-t, 2_,-, %, -t-l-, 49-1-,-244 LBDCR 13-MP2.-004 May 2, 2013 PLANT SYSTEMS BASES 3/4.7.10 DELETED 3/4.7.11 ULTIMATE HEAT SINK BACKGROUND The ultimate heat sink (UI-{S) for Millstone Unit No. 2 is Long Island Sound. The Long Island Sound is connected to the Atlantic Ocean and provides the required 30 day supply of water.It serves as a heat sink for both safety and non-safety-related cooling systems. Sensible heat is discharged to the UtIIS via the service water (SW) and circulating water (CW) systems.The basic performance requirement is that a 30 day supply of water be available, and that the design basis temperatures of safety related equipment not be exceeded.Additional information on the design and operation of the system, along with a list of components served, can be found in References 1, 2, and 3.APPLICABLE SAFETY ANALYSES The U-FIS is the sink for heat removed from the reactor core following all accidents and anticipated operational occurrences in which the unit is cooled down and placed on shutdown cooling system (SDC) operation. With UHIS as the normal heat sink for condenser cooling via the CW System, unit operation at full power is its maximum heat load. Its maximum post accident heat load occurs < 1 hour after a design basis loss of coolant accident (LOCA). Near this time, the unit switches from injection to recirculation and the containment cooling system is required to remove the core decay heat ...The operating limits are based on conservative heat transfer analyses for the worst case LOCA. References 1, 2, and 3 provide the details of the assumptions used in the analysis, which include worst expected meteorological conditions, conservative uncertainties when calculat~ing decay heat, and worst case single active failure (e.g., single failure of a man-made structure). The limitations on the temperature of the UHIS ensure that the assumption for temperature used in the analyses for cooling of safety related components by the SW system are satisfied. These analyses ensure that under normal operation, plant cooldown, or accident conditions, all components cooled directly or indirectly by SW will receive adequate cooling to perform their design basis functions. The UJIS satisfies Criterion 3 of 10 CFR 50.3 6(c)(2)(ii). M'VILLSTON\E -UNIT 2 B 3/4 7-7 Amendment No. 4-t4-, 1I94I-, 1-, 24-7-, 2 5~7 , 2 1 4 I~A gx...... 1 byI,- l./t-r dat+cd-12,'l9/'0 LBDCR 14-MP2-016 September 4, 2014 PLAINT SYSTEMS BASES 3/4.7.11 ULTIMATE HEAT SINK (Continued) LCO The UIHS is required to be OPERABLE and is considered OPERABLE if it contains a sufficient volume of water at or below the maximum temperature that would allow the SW System to operate for at least 30 days following the design basis LOCA without the loss of net positive suction head (NPSHJ), and without exceeding the maximum design temperature of the equipment served by the SW System. To meet this condition, the UJIS temperature should not exceed 80 0 F during normal unit operation. While the use of any supply side SW temperature indication is adequate to ensure compliance with the analysis assumptions, precision instruments installed at the inlet to the reactor building closed cooling water (RBCCW) heat exchangers will normally be used.Therefore, instrument uncertainty need not be factored into the surveillance acceptance criteria.All in-service instruments must be within the limit. If all of the precision instruments are out of service, alternative instruments that measure SW supply side temperature will be used. In this case, an appropriate instrument uncertainty will be subtracted from the acceptance criteria.Since Long Island Sound temperature changes relatively slowly and in a predictable fashion according to the tides, it is acceptable to monitor this temperature at the frequency0 specified in the Surveillance Frequency Control Program when there is ample (>5°F) margin to the limit. When within 5°F of the limit, the temperature shall be monitored every 6 hours to ensure that tidal variations are appropriately captured.APPLICABILITY In MODES 1, 2, 3, and 4, the UIIS is required to support the OPERABILITY of the equipment serviced by the UIH-S and required to be.OPERABLE in these MODES.In MODE 5 or 6, the OPERABILITY requirements of the UIIS are determined by the systems it supports.ACTION If the U911 is inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours and in COLD SHUTDOWN within the following 30 hours.The allowed outage times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.MILLSTONE -UNIT 2B3/7-B 3/4 7-8 LBDCR 13-MP2-004 May 2, 2013 PLANT SYSTEMS BASES 3/4.7.11 ULTIMATE HEAT SINK (Continued) SURVEILLANCE REQUIREMENTS This surveillance requirement verifies that the UTIS is capable of providing a 30 day cooling water supply to safety related equipment without exceeding its design basis temperature. This surveillance requirement verifies that the water temperature of the UHIS is < 80°F.REFERENCES

1. FSAR, Sections 6.3, 6.4, 6.5, and 6.6 addressing Containment Systems.2. FSAR, Sections 9.3, 9.4, and 9.5 addressing Water Systems.3. FSAR, Section 14.6, Decrease in Reactor Coolant Inventory.

MILLSTONE -UNIT 2B3/79 B 3/4 7-9 REVERSE OF PAGE B 3/4 7-9 INTENTIONALLY LEFT BLANK : LBDCR 11-MP2-012 December 21, 2011 3/4.8 ELECTRICAL POWER SYSTEMS BASES The OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety related equipment required for 1) the safe shutdown of the facility and 2) the mitigation and control of accident conditions within the facility. The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criteria 17 of Appendix "A" to 10 CFR 50.The required circuits between the offsite transmission network and the onsite Class 1E distribution system (Station Busses 24C, 24D, and 24E) that satisfy Technical Specification 3.8.1.1 .a (MODES 1, 2, 3, and 4) consist of the following circuits from the switchyard to the onsite electrical distribution system: a. Station safeguards busses 24C and 24D via the Unit 2 Reserve Station Service Transformer; and b. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer (energized with breaker 1 5G-13T-2 (13T) and associated disconnect switches open) and bus 34A or 34B.When taking credit for the Unit 3 Normal Station Service Transformer as a second offsite circuit, breaker 13T and its associated disconnect switches are required to be open. This removes the potential for a single failure (that of breaker 13T) to cause a simultaneous loss of both offsite circuits. Should the other offsite circuit (i.e., the Unit 2 Reserve Station Service Transformer) already be inoperable, the requirement for maintaining breaker 1 3T and its associated disconnect switches open is no longer applicable. If the plant configuration will not allow Unit 3 to supply power to Unit 2 from the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer within 3 hours, Unit 2 must consider the second offsite source inoperable and enter the appropriate ACTION statement of Technical Specification 3.8.1.1 for an inoperable offsite circuit.This is consistent with the GDC 17 requirement for two offsite sources. Each offsite circuit is required to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded.The first source is required to be available within a few seconds to supply power to safety related equipment following a loss of coolant accident. The second source is not required to be available* immediately and no accident is assumed to occur concurrently with the need to use the second source. However, the second source is required to be available in sufficient time to assure the reactor remains in a safe condition The 3 hour time period is based on the Millstone Unit No. 2 Appendix R analysis. This analysis has demonstrated that the reactor will remain in a safe condition (i.e., the pressurizer will not empty) if charging is restored within 3 hours.MILLSTONE -UNIT 2 B 3/4 8-1 MILSTOE UNT 2B /4 -1Amendment No. 4-l-, 4-92, 3-1-, LBDCR 11-MP2-012 December 21, 2011 3/4.8 ELECTRICAL POWER !BASES In MODES 1 through 4 (Technical Specification 3.8.1 .1), the Unit 2 Normal Station Service Transformer can be used as the second offsite source after the main generator disconnect links have been removed and the backfeed lineup established. The required circuit between the offsite transmission network and the onsite Class lE distribution system (Station Busses 24C, 24D, and 24E) that satisfies Technical Specification 3.8.1 .2.a (MODES 5 and 6) consists of the following circuit from the switchyard to the onsite electrical distribution system: a. Station safeguards bus 24C or 24D via the Unit 2 Reserve Station Service Transformer; or b. Station safeguards bus 24C or 24D via the Unit 2 Normal Station Service Transformer and bus 24A or 24B after the main generator disconnect links have been removed and the back~feed lineup established; or c. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer and bus 34A or 34B.When the plant is operating with the main generator connected to the grid, the output of the main generator will normally be used to supply the onsite Class lE distribution sYstem.During this time the required offsite circuits will be in standby, ready to supply power to the onsite Class lE distribution system if the main generator is not available. When shut down, only one of the offsite circuits will normally be used to supply the onsite Class lE distribution system.The other offsite circuit, if required, will be in standby. Verification of the required offsite circuits consists of checking control power to the breakers (breaker indicating lights), proper breaker position for the current plant configuration, and voltage indication as appropriate for the current plant configuration. The ACTION requirements specified for the levels of degradation of the power sources provide restriction upon continued facility operation commensurate with the level of degradation. The OPERABILITY of the power sources are consistent with the initial condition assumptions of the accident analyses and are based upon maintaining at least one of each of the onsite A.C. and D.C. power sources and associated distribution systems OPERABLE during accident conditions coincident with an assumed loss of offsite power and single failure of the other onsite A.C.source............ MILLSTONE-UNIT 2 " B 3/4 8:-2 ......--MILSTOE -UNI 2 3/4~2.... Amendment No:4-148; 4-9W2g34-, LBDCR 07-MP2-009" March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES Technical Specification 3.8.1.1 ACTION Statements b and c provide an allowance to avoid unnecessary testing of the other OPERABLE diesel generator. If it can be determined thatcause of the inoperable diesel generator does not exist on the OPERABLE diesel generator, Surveillance Requirement 4.8.1.1 .2.a.2 does not have to be performed. If the cause of inoperability exists on the other OPERABLE diesel generator, the other OPERABLE diesel generator would be declared inoperable upon discovery, ACTION Statement e would be entered, and appropriate ACTIONS will be taken. Once the failure is corrected, the common cause failure no longer exists, and the required ACTION Statements (b, c, and e) will be Satisfied. If it cannot be determined that the cause of the inoperable diesel generator does not exist on the remaining diesel generator, performance of Surveillance Requirement 4.8.1i.1 .2.a.2, within the allowed time period, suffices to provide assurance of continued OPERABILITY of the diesel generator. If the inoperable diesel generator is restored to OPERABLE status prior to the determination of the impact on the other diesel generator, evaluation will continue of the possible common cause failure. This continued evaluation is no longer under the time constraint imposed while in ACTION Statement b or c.The determination of the existence of a common cause failure that would affect the remaining diesel generator will require an evaluation of the current failure and the applicability to the remaining diesel generator. Examples that would not be a common cause failure include, but are not limited to: 1. Preplanned preventive maintenance or testing, or 2. An inoperable support system with no potential common mode failure for the remaining diesel generator, or 3. An independently testable component with no potential common mode failure for the remaining diesel generator. If one Millstone Unit No. 2 diesel generator is inoperable in MODES 1 though 4, ACTION Statements b.3 and c.3 require verification that the steam-driven auxiliary feedwater pump is OPERABLE (MODES I; 2, and 3 only). If the steam-driven auxiliary feedwater pump is inoperable, restoration within 2 hours is required or a plant shutdown to MODE 4 will be necessary. This requirement is intended to provide assurance that a loss of offsite power event will not result in degradation of the auxiliary feedwater safety function to below accident mitigation requirements during the period one of the diesel generators is inoperable. The term verify, as used in this context, means to administratively check by examining logs or other information to determine if the steam-driven auxiliary feedwater pump is out of service for mainten~ance or other reasons. It does not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITY of the steam-driven auxiliary feedwater pump.MILLSTONE -UNIT 2 B 3/4 8-3 Amendment No. 4-8, +/-9-2,, 23-1-, 248,-2-6, LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS 9 BASES If one Millstone Unit No. 2 diesel generator is inoperable in MODES 1 through 4, a 72 hour allowed outage time is provided by ACTION Statement b.5 to allow restoration of the diesel generator, provided the requirements of ACTION Statements

b. I, b.2, and b.3 are met. This allowed outage time can be extended to 14 days if the additional requirements contained in ACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that the Millstone Unit No. 3 diesel generators are OPERABLE as required by the applicable Millstone Unit No. 3 Technical Specification (2 diesel generators in MODES 1 through 4, and 1 diesel generator in MODES 5 and 6) and the Millstone Unit No. 3 SBO0 diesel generator is available.

The term verify, as used in this context, means to administratively check by examining logs or other information to determine if the required Millstone Unit No. 3 diesel generators and the Millstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. It does not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITY of the required Millstone Unit No. 3 diesel generators or availability of the Millstone Unit No. 3 SBO diesel generator. When using the 14 day allowed outage time provision and the Millstone Unit No. 3 diesel generator and/or the Millstone Unit No. 3 SBO diesel generator requirements are not met, 72 hours is allowed for restoration of the required Millstone Unit No. 3 diesel generators and the Millstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 3 diesel : generators and/or the Millstone Unit No. 3 SBO diesel generator are not restored within 72. hours,l i, , and one Millstone Unit No. 2 diesel generator is still inoperable, Millstone Unit No. 2 is required..... to shut down.The 14 day allowed outage time for one inoperable Millstone Unit No. 2 diesel generator will allow performance of extended diesel generator maintenance and repair activities (e.g., diesel inspections) while the plant is operating. To minimize plant risk when using this extended allowed outage time the following additional requirements must be met: 1. The extended diesel generator maintenance outage shall not be scheduled when adverse or inclement weather conditions and/or unstable grid conditions are predicted or present.2. The availability of the Millstone Unit No. 3 SBO DG shall be verified by test performance within the previous 30 days prior to allowing a Millstone Unit No. 2 diesel generator to be inoperable for greater than 72 hours.3. All activity in the switchyard shall be closely monitored and controlled. No elective maintenance within the switchyard that could challenge offsite power availability shall be scheduled. MILLSTONE -UNIT 2 B 3/4 8-4 Amendment No. 4-8, 40-2-, ;3-i-, 948, I ".j ,6-1-, 77, LBDCR 07-MvP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES In addition, the plant configuration shall be controlled during the diesel generator-maintenance and repair activities to minimize plant risk consistent with a Conafiguration Risk Management Program, as required by 10 CFR 50.65(a) (4).Diesel Generator Testing An engine prelube period is allowed prior to engine start for all diesel generator testing.This 'will minimize wear on moving parts that do not get lubricated when the engine is not running.When specified in the surveillance tests, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations. SR 4.8.1.l.2.a.2 This surveillance helps to ensure the availability of the standby electrical power supply to mitigate design basis accidents and transients and to maintain the unit in a safe shutdown condition. It verifies the ability of the diesel generator to start from a standby condition and achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify' degradation of governor or voltage regulator performance when testing in accordance with the requirements of the surveillance. This surveillance is modified by two notes. Note 1 allows the use of a modified start based on recommnendations of the manufacturer to reduce stress and wear on diesel engines.When using a modified start, the starting speed of the diesel generators is limited, wanmup is limited to this lower speed, and the diesel generators are gradually accelerated to synchronous speed prior to loading. If a modified start is not used, the 15 second start requirement of SR 4.8.l.I.2.d applies. Note 2 states that SR 4.8.1.1.2;d, ainore rigorous test, may be perfornned in lieu of 4.8.1.l.2.a. During performance of SR 4.8.1.1.2.a.2, the diesel generator shall be started by using one of the following signals: 1. Manual;2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;3. Simulated safety injection actuation signal alone; or 4. simulated loss of power alone.MILLSTONE -UNIT 2 B3485AedetN.m B 3/4 8-5 Amendment No. g7-7, [ LBDCR 14.-MIP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES The surveillance frequency is controlled under the Surveillance Frequency Control Program.SR 4.8.1.1 .2.a.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation. This surveillance is modified by five Notes. Note 1 indicates that diesel engine runs for this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance. Note 5 states that SR 4.8.1.1 .2.d, a more rigorous test, may be performed in lieu of 4.8.1.1.2.a. The surveillance frequency is controlled under the Surveillance Frequency Control Program.SR 4.8.l.1.2.b.1 Microbiological fouling is a major cause of fuel' oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the three fuel storage tanks at the frequency specified in the Surveillance Frequency Control Program eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. This surveillance is for preventative maintenance. The presence of water does not necessarily represent failure of this surveillance provided the accumulated water is removed during performance of the surveillance. MILLSTONE -UNMT 2 B3486Aed~n o -7 B 3/4 8-6 Amendment No. ggg, LBDCR April 3, 2012 3/4.8 ELECTRICAL POWER SYSTEMS BASES SR 4.8.1.1.2.b.2 This surveillance requires testing of the new and stored fuel oil in accordance with the Diesel Fuel Oil Testing Program, as defined in Section 6 of the Technical Specifications. The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows (more restrictive State of Connecticut and/or equipment limits may apply): a. Sample the new fuel oil in accordance with ASTM D4057, b. Verify in accordance with the tests specified in ASTM D975-81 that the sample has an absolute specific gravity at 60/60°F of 0.83 and < 0.89, or an API gravity at 60°F of> 270 and < 390, a kinematic viscosity at 40°C of> 1.9 centistokes and <4.1 centistokes (alternatively, Saybolt viscosity, STJS at 100°F of> 32.6 bit< 40.1)and a flash point _> 125°F, and c. Verify that the new fuel oil has a clear and bright appearance with proper color when tested in accordance with ASTM D4176 or a water and sediment content within limits when tested in accordance with ASTM D2709 or D1796.Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-8:1 are met for new fuel oil when tested in accordance with ASTM D975-81, except that the analysis for sulfur may be performed in accordance with ASTM D 1552 or ASTM D2622. The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an imnmediate effect on DG operation. This surveillance ensures the availability of high quality fuel oil for the diesel generators. Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure. Particulate concentrations should be determined in accordance with ASTM D2276-78, Method A, every 92 days. This method involves a gravimetric MILLSTONE -UNIT 2B3/8-AmnetNo 7, B 3/4 8-7 Amendment No. 7--7, LBDCR 14-MP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES deternination of total particulate concentration in the fuel oil and has a limit of 10 rag/I. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of fied testing.The frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between surveillance intervals. SR 4.8.1.1.2.c.2 Under accident and loss of offsite power conditions, loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the diesel generators due to high motor starting currents. The load sequence time interval tolerances ensure that sufficient time exists for the diesel generator to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding Engineered Safety Features (ESE) equipment time delays are not violated.The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally perforning the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomPlete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment detertnines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed surveillance, a successful surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when the surveillance is performed in MODE 1, 2, 3, or 4. Risk insights or deterninistic methods may be used for this assessment. MILLSTONE -UNIT 2 B3488AedetN.2-- B 3/4 8-8 Amendment No. LBDCR 14-MiP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES SR 4.8.1 .3.2.c.3 Each diesel generator is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This surveillance demonstrates the diesel generator load response characteristics and capability to reject the largest single load without exceeding a predetermined frequency limit. The single largest load for each diesel generator is identified in the FSAR (Tables 8.3-2 and 8.3-3).This surveillance may be accomplished by either: a. Tripping the diesel generator output breaker with the diesel generator carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power or while solely supplying the bus; or b. Tripping the equivalent of the single largest post-accident load with the diesel generator solely supplying the bus.The time, voltage, and frequency tolerances specified in this surveillance are based on the repneduring load sequence intervals. The 2.2 seconds seiidi qa o4%o h .second load sequence interval associated with sequencing of the largest load (Safety Guide 9).The voltage and frequency spe~cified are consistent with the design range of the equipment powered by the diesel generator. SR 4.8.1.1.2.c.3.a corresponds to the maximum frequency excursion, while SR 4.8.1.1.2.c.3.b and SR 4.8.1.1.2.c.3.c are steady state voltage and frequency values to which the system must recover following load rejection. The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as practical. When synchronized with offsite power, testing should be performed at a power factor of_< 0.9 lagging. This power factor is representative of the inductive loading a diesel generator would see based on the motor rating of the single largest load. It is within the adjustment capability of the Control Room Operator based on the use of reactive load indication to establish the desired power factor. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than_<0.9. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to _ 0.9 results in voltages on the emergency buses that are too MILLSTON'E -UNIT 2 B3489AedetN.2~ B 3/4 8-9 Amendment No. 7-7, LBDCR 14-MIP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES high. Under these conditions, the power factor should be maintained as close as practicable to 0.9 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.9 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel generator. In such cases, the power factor shall be maintained as close as practicable to 0.9 lagging without exceeding the diesel generator excitation limits.SR 4.8.1.1.2.c.4 This surveillance demonstrates the diesel generator capability to reject a rated load without overspeed tripping. A diesel generator rated load rejection may occur because of a system fault or inadvertent breaker tripping. This surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the diesel generator experiences following a rated load rejection and verifies that the diesel generator will not trip upon loss of the load. While the diesel generator is not expected to experience this transient during an event, this response ensures that the diesel generator is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.This surveillance is performed by tripping the diesel generator output breaker with the diesel generator carrying the required load while paralleled to offsite power.The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as practical. When synchronized with offsite power, testing should be performed at a power factor of < 0.83 lagging. This power factor is representative of the inductive loading a diesel generator would see under design basis accident conditions. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than < 0.83. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to < 0.83 results in voltages on the emergency buses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.83 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.83 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel MILLSTON"E -UNIT 2B3/8-0AedntN.27 B 3/4 8-10 Amendment No. LBDCR 14-MiP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES generator. In such cases, the power factor shall be maintained as close as practicable to 0.83 lagging without exceeding the diesel generator excitation limits.SR 4.8.1 .1 1.2 .c.5 In the event of a design basis accident coincident with a loss of offsite power, the diesel generators are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded. This surveillance demonstrates the diesel generator operation during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection of pernanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.The surveillance frequency is controlled under the Surveillance Frequency Control Program. *..For the purpose of this testing, .the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recormmendations. This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and MILLSTOYNE -UNIT 2B318-1AedntN.27 B 3/4 8-11 Amendment No. LBDCR 14-MP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES other unanticipated OPERABILITY concerns) provided an assessment detennines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment. SR 4.8.l. 1.2.c.6 This surveillance demonstrates that diesel generator noncritical protective functions (e.g., high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESF actuation test signal. During this time, the critical protective functions (engine overspeed, generator differential current, low lube oil pressure [2 out of 3 logic], and voltage restraint overcurrent) remain available to trip the diesel generator andlor output breaker to avert substantial damage to the diesel generator unit. An EDG Emergency Start Signal (Loss of Power signal or SIAS) bypasses the EDG mechanical trips in the EDG control circuit, except engine overspeed, and switches the low lube oil trip to a 2 of 3 coincidence. The loss of power to the emergency bus, based on supply breaker position (A302, A304, and A505 for Bus 24C; A410, A4tl, and A505 for Bus 24D), bypasses the EDG electrical trips in the breaker control circuit except generator differential current and voltage restraint over current. The noncritical trips are bypassed during design basis accidents and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The diesel generator availability to mitigate the design basis accident is more critical than protecting the engine against minor problems that are not inrmediately detrimental to emergency operation of the diesel generator. The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by a Note. The reason for the Note is that perfonning the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment detennines plant safety is MILLSTONE -UNIT 2B3/812AedntN.7, B 3/4 8-I2 Amendment No. -7-7-, LBDCR September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment. SR 4.8.1.1 .2.c.7 This surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by two Notes. The reason for Note 1 is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally perfonning the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete SUlrveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is MILLSTONE -UNIT 2 B3481 mnmn o 7-B 3/4 8-13 Amendment No. LBDCR 14-MP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when portions Of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or detenninistic methods may be used for the assessment. Surveillance Note 2 specifies that the start of the diesel generator from a standby condition is not required if this surveillance is performed in conjunction with SR 4.8.l.l.2.c.5. Since this test is normally performed in conjunction with SR 4.8.1.1.2.c.5, the proposed note will exclude the requirement to start fr'om a standby condition to minimize the time to perfonn this test. This will reduce shutdown risk since plant restoration, and subsequent equipment availability will occur sooner. In addition, it is not necessary to test the ability of the EDG to auto start from a standby condition for this test since that ability will have already been verified by SR 4.8.1.1.2.c.5, which will have just been performed if the note's exclusion is to be utilized. If this test is to be performed by itself, the EDG is required to start from a standby condition. SR 4.8.1.1.2.c.8 This surveillance demonstrates that the diesel generator automatically starts and achieves the required voltage and speed (frequency) within the specified tine (15 seconds) fr~om the design basis actuation signal (Safety Injection Actuation Signal) and operates for >5 minutes. The 5 minute period provides sufficient time to demonstrate stability. Since the specified actuation signal (ESF signal without loss of offsite power) will not cause the emergency bus loads to be shed, and will not cause the diesel generator" to load, the surveillance ensures that permanently connected loads and autoconnected loads remain energized from the offsite electrical power system (Unit 2 RSST or NSST, or Unit 3 RSST or NSST). In certain circumstances, many of these loads cannot actually be connected without undue hardship or potential for undesired operation. It is not necessary to verify all autoconnected loads remain connected. A representative sample is acceptable. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 2B3/8-4AedntN.2, B 3/4 8-14 Amendment No. 7-7-, LBD CR 14-MP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations. SR 4.8.1.1.2.c.9 This surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from a normal surveillance, and achieve the required voltage and speed within 15 seconds. The 15 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by a Note. The Note ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the diesel generator. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain diesel generator OPERABILITY. The requirement that the diesel has operated for at least 1 hour at rated load conditions prior to performance of this surveillance is based on manufacturer recotmmendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test.SRs 4.8.1.l.2.d.1 and 4.8.l.1.2.d.2 SR 4.8.1.1 .2.d. 1 verifies that, at the frequency specified in the-Surveillan~ce Frequency Control Program, the diesel generator starts from standby conditions and achieves required voltage and speed (frequency) within 15 seconds. The 15 second start requirement supports the assumptions of the design basis LOCA analysis in the FSAR. Diesel generator voltage and speed will continue to increase to rated values, and thern should stabilize. SR 4.8.l.1.2.d.2 verifies the ability of the diesel generator to achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify degradation of governor or voltage regulator performance when besting in accordance with the requirements of this surveillance. These surveillance frequencies are controlled under the Surveillance Frequency Control Program. In addition, SR 4.8.1.1.2.d may be performed in lieu of 4.8.1.1.2.a. MILLSTONE -UNIT 2B3/815AedntN.27 B 3/4 8-15 Amendment No. LBDCR 14-MP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations. During performance of SR 4.8.1.1,2.d. 1, the diesel generators shall be started by using one of the following signals: 1. Manual;2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;3. Simulated safety injection actuation sign~al alone; or 4. Simulated loss of power alone.SR 4.8.1.1.2.d.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation. The surveillance frequency is controlled under the Surveillance Frequency Control [ProgramI This SR is modified by four Notes. Note 1 indicates that diesel engine runs for this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance. MILLSTONE -UNIT 2 B 3/4 8-16 Amendment No. 4g, 92, 2-3-1-, 248, 2641-, 2-T, , February 19, 2009 LBDCR 09-MP2-002 3/4.8 ELECTRICAL POWER SYSTEMS BASES The OPERABILITY of the minimum specified A.C. and D.C. power sources and associated distribution systems during shutdown and refueling ensures that 1) the facility can be maintained in the shutdown or REFUELING condition for extended time periods and 2) sufficient instrumentation and control capability is available for monitoring and maintaining the facility status. If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6, operations involving CORE ALTERATIONS, positive reactivity additions, or movement of recently irradiated fuel assemblies are required to be suspended. Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. The.movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 300 hours), is also required to be suspended. Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power source or distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.Each 125-volt D.C. bus train consists of its associated 125-volt D.C. bus, a 125-volt D.C.battery bank, and a battery charger with at least 400 ampere charging capacity. To demonstrate OPERABILITY of a 125-volt D.C. bus train, these components must be energized and capable of performing their required safety functions. Additionally;in~MODES 1 through 4 at least one tie breaker between the 125-volt D.C. bus trains must be open for a 125-volt D.C. bus train to be considered OPERABLE.For MODES 5 and 6, each battery is sized to supply the total connected vital loads (one battery connected to both buses) for one hour without charger support. Therefore, in MODES 5 and 6 with at least one. 125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied, the 125-volt D.C: support system operability requirements for both buses-are satisfied. Footnote (a) to Technical Specification Tables 4.8-i and 4.8-2 permits the electrolyte level to be above the specified maximum level for the Category A limits during equalizing charge, provided it is not overflowing. Because of the internal gas generation during the performance of an equalizing charge, specific gravity gradients and artificially elevated electrolyte levels are produced which may exist for several days following completion of the equalizing charge. These limits ensure that the plates suffer no physical damage, and that adequate electron transfer capability is maintained in the event of transient conditions. In accordance with the recommendations of IEEE 450-1980, electrolyte level readings should be taken only after the battery has been at float charge for at least 72 hours.MILLSTONE -UNIT 2 B 3/4 8-17 Amendment No. 4-88, 4-9-2, 2-34-, 248~,-264-, mg, 27-9, 3, March 29, 2007 LBDCR 07-MP2-009 3/4.8 ELECTRICAL POWER SYSTEMS BASES1 Based on vendor recommendations and past operating experience, seven (7) days has been determined a reasonable time frame for the 1 25-volt D.C. batteries electrolyte level to stabilize and to provide sufficient time to verify battery electrolyte levels are with in the Category A limits.Footnote (b) to Technical Specification Tables 4.8-1 and 4.8-2 requires that level correction is not required when battery charging current is < 5 amps on float charge. This current provides, in general, an indication of overall battery condition. Footnote (c) to Technical Specification Tables 4.8-1 and 4.8-2 states that level correction is not required when battery charging current is < 5 amps on float charge. This currentprovides, in general, an indication of overall battery condition. Because of specific gravity gradients that are produced during the recharging process, delays of several days may occur while waiting for the specific gravity measurement for determining the state of charge. This footnote allows the float charge current to be used as an alternative to specific gravity to show OPERABILITY of a battery for up to seven (7) days following the completion of a battery equalizing charge. Each connected cells specific gravity must be measured prior to expiration of the 7 day allowance. Surveillance Requirements 4.8.2.3.2.c. 1 and 4.8.2.5.2.c.1 provide for visual inspection of the battery cells, cell plates, and battery racks to detect any indication of physical damage or abnormal deterioration that could potentially degrade battery performance. The non-safety grade 125V D.C. Turbine Battery is required for accident mitigation for a main steam line break within containment with a coincident loss of a vital D.C. bus. The Turbine Battery provides the alternate source of power for Inverters 1 & 2 respectively via non-safety grade Inverters 5 & 6. For the loss of a D.C. eveit[ wiiltaicbincident steam line break within containment, the feedwater regulating valves are required to close to ensure containment design pressure is not exceeded.The Turbine Battery D.C. electrical power subsystem consists of 125-volt D.C. bus 201D and 125-volt D.C. battery bank 201D. To demonstrate OPERABILITY of this subsystem, these components must be energized and capable of performing their required safety functions.

• The feedwater regulating valves require power to close. On loss of a vital D.C. bus, the alternate source of power to the vital A.C. bus via the Turbine Battery ensures power is available to the affected feedwater regulating valve such that the valve will isolate feed flow into the faulted generator.

The Turbine Battery is considered inoperable when bus voltage is less than 125 volts D.C., thereby ensuring adequate capacity for isolation functions via the feedwater regulating. valves during the onset of a steam line break.The Turbine Battery Charger is not required to be included in Technical Specifications even though the Turbine Battery is needed to power backup Inverters 5 & 6 for a main steam line break inside containment coincident with a loss of a Class 1 E D.C. bus. This is due to the fact that feedwater isolation occurs within seconds from the onset of the event.MILLSTONE -UNIT 2 B 3/4 8-18 Amendment No. 4-18, 4-9, -24%, j 9 June 28, 2006.3/4.9 REFUELING OPERATIONS BASES 3/4.9 REFUELING OPERATIONS The ACTION requirements to immediately suspend various activities (CORE ALTERATIONS, fuel movement, CEA movement, etc.) do not preclude completion of the movement of a component to a safe position.3/4.9.1 BORON CONCENTRATION The limitations on reactivity conditions during REFUELING ensure that: 1) the reactor will remain subcritical during CORE ALTERATIONS, and 2) sufficient boron concentration is maintained forlreactivity control in the water volume having direct access to the reactor vessel.These limitations are consistent with the initial conditions assumed for the boron dilution incident in the accident-analyses. Reactivity control in the water volume having direct access to the reactor vessel is achieved by determining boron concentration in the refueling canal. The refueling canal is defined as the entire length of pool stretching from refuel pool through transfer canal to spent fuel pool.The applicability is modified by a Note. The Note states that the limits on boron concentration are only applicable to the refueling canal when this volume is connected to the Reactor Coolant System (RCS). When the refueling canal is isolated from the RCS, no potential.~ *path for boron dilution exists. Prior to reconnecting portions of the refueling canal to the RCS, S Surveillance 4.9.1 .2 must be met. If aydilution activity has occurred while the refueling canal: was disconnected from the RCS, this ansurveillance ensures the correct boron concentration prior to communication with the RCS.Concerning the ACTION statement, operations that individually add limited positive reactivity (e.g., temperature fluctuations from inventory addition or temperature control fluctuations), but when combined with all other operations affecting core reactivity (e.g., intentional boration)result in overall net negative reactiv'ity addition, are not precluded by this ACTION.314.9.2 INSTRUMENTATION The OPERABILITY of the source range neutron flux monitors ensures that redundant monitoring capability is available to detect changes in the reactivity condition of the core.Concerning ACTION a., with only one SRM OPERABLE, redundancy has been lost. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that which would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Performance of ACTION a. shall not preclude completion of movement of a component to a safe position..MILLSTONE -UNIT 2 B 3/4 9-1 Amendment No. 72, 14, 4-50, 1-, 24-5, 26-3, 293 LBDCR 1 0-MP2-007 June 22,.2010 REFUELING OPERATIONS BASES (continued) 3/4.9.3 DECAY TIME The minimum requirement for reactor subcriticality prior to movement of irradiated fuel ensures that sufficient time has elapsed to allow the radioactive decay of the-short-lived fission products so that the calculated radiological dose consequences of the fu~el handling accident are bounding.3/4.9.4 CONTAINMENT PENETRATIONS The requirements on containment penetration closure and OPERABILITY ensure that a release of radioactive material within containment to the environment will be minimized. The OPERABILITY, closure restrictions, and administrative controls are sufficient to minimize the release of radioactive material from a fuel element rupture based upon the lack of containment pressurization potential durirng the movement of in'adiated fu~el assemblies within containment. The containment purge valves are containment penetrations and must satisfy all requirements specified for a containment penetration. Containment penetrations, including the personnel airlock doors and equipment door, can be open during the movement of irradiated fuel provided that sufficient administrative controls are in place such that any of these containment penetrations can be closed within 30 minutes.Following a Fuel Handling Accident, each penetration, including the equipment door, is closed such that a containment atmosphere boundary can be established. However, if it is that closure of all containment penetrations would represent a significant radiological hazard to the personnel involved, the decision may be made to forgo the closure of the affected penetration(s). The containment atmosphere boundary is established when any penetration which provides direct access to the outside atmosphere is closed such that at least one barrier between the containment atmosphere and the outside atmosphere is established. Additional actions beyond establishing the containment atmosphere boundary, such as installing flange bolts for the equipment door or a containment penetration, are not necessary. Administrative controls for opening a containment penetration require that one or more designated persons, as needed, be available for isolation of containment from the outside atmosphere. Procedural controls are also in place to ensure cables or hoses which pass through a containment opening can be quickly removed. The location of each cable and hoses isolation device for those cables and hoses which pass through a containment opening is recorded to ensure timely closure of the containment boundary. Additionally, a closure plan is developed for each containment opening which includes an estimated time to close the containment opening. A log of personnel designated for containment closure is maintained, including identification of which containment openings each person has responsibility for closing. As necessary,equipment will be pre-staged to support timely closure of a containment penetration. MILLSTONE -UNIT 2 B 3/4 9-l a Amendment No. 7-2-, -144, 1-N0, 20-1,, 240, 24#5, 24, September 20, 2004 REFUELING OPERATIONS BASES (continued) 3/4.9.4 CONTAINMENT PENETRATIONS (Continued') Prior to opening a containment penetration, a review of containment penetrations currently open is performed to verify that sufficient personnel are designated such that all containment penetrations can be closed within 30 minutes. Designated personnel may have other duties, however, they must be available such that their assigned containment openings can be closed within 30 minutes. Additionally, each new work activity inside containment is reviewed to consider its effect on the closuire of the equipment dooi, personnel air lock, and/or other open containmaent penetrations. The required number of designated personnel are continuously available to perform closure of their assigned containment openings whenever irradiated fuel is being moved within the containmaent. Administrative controls are also in place to ensure that the containment atmosphere boundary is established if adverse weather conditions which could present a potential missile hazard threaten the plant. Weather conditions are monitored during irradiated fuel movement whenever a containment penetration, including the equipment door and personnel air lock, is open and a storm center is within the plant monitoring radius of 150 miles.The administrative controls ensure that the containment atmosphere boundary can be quickly established (i.e., within 30 minutes) upon determining that adverse weather conditions exist which pose a significant threat to the Millstone Site. A significant threat exists when a hurricane warning or tornado warning is issued which applies to the Millstone Site, or if an average wind speed of 60 miles an hour or greater is recorded by plant meteorological edluipment at the meteorological tower. If the meteorological equipment is inoperable, information from the National Weather Service can be used as a backup in determining plan~t wind speeds. Closure of contaimnent penetrations, including the equipment door and personnel air lock door, begin immediately upon determination that a significant threat exists.When severe weather conditions which could generate a missile are within the plant monitoring radius, containment and spent fuel pool penetrations are closed to establish the containment atmosphere boundary.314.9.5 DELETED MILLSTONE -UNIT 2 B349l mnmn o 8 B 3/4 9-1b Amendment No. 284 LIBDCR 15-MP2-003 March 26, 2015 REFUELING OPERATIONS E BASES 3/4.9.6 DELETED 3/4.9.7 DELETED 3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION In MODE 6 the shutdown cooling trains are the primary means of heat removal. One SDC train provides sufficient heat removal capability. However, to provide redundant paths for heat removal either two SDC trains are required to be OPERABLE and one SDC train must be in operation, or" one SDC train is required to be OPERABLE and in operation with the refueling cavity water level 23 feet above the reactor vessel flange. This volume of water in the refueling cavity will provide a large heat sink in the event of a failure of the operating SDC train. Any exception to these requirements are contained in the LCO Notes.An OPERABLE SDC train, for plant operation in MODE 6, includes a pump, heat exchangei; valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine RCS temperature. In addition, sufficient portions of the Reactor Building Closed Cooling Water (RBCCW) and Service Water (SW) Systems are available to provide cooling to the SDC heat exchanger. The flow path starts at the RCS hot leg and is retum-ed to the RCS cold legs.An OPERABLE SDC train consists of the following equipment:

1. An OPERABLE SDC pump (low pressure safety injection pump);2. The associated SDC heat exchanger from the same facility as the SDC pump;3. An RBCCW pump, powered from the same facility as the SDC pump, and RBCCW heat exchanger capable of cooling the associated SDC heat exchanger;

4. A SW pump, powered from the same facility as the SDC pump, capable of supplying cooling water to the associated RBCCW heat exchanger; and 5. All valves required to support SDC System operation are in the required position or are capable of being placed in the required position.In MODE 6, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchanger-s, 2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headers are required to provide cooling to the SDC heat exchangers, but only 1 SW header is required to support the SDC trains. The equipment specified is sufficient to address a single active failure of the SDC System and associated support systems.MILLSTONE

-UNIT 2 B 3/4 9-2 Amendment No. 6-9, p-l-, 4-7, 4-8g, 24G, 244, -240., September 14, 2006 LBDCR 06-MP2-030 REFUELING OPERATIONS BASES 3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued) In addition, two SDC trains can be considered OPERABLE, with only one 125-volt D.C.bus train OPERABLE, in accordance with Limiting Condition for Operation (LCO) 3.8.2.4.2-SI-306 and 2-SI-657 are both powered from the same 125-volt D.C. bus, on Facility 1. Should these valves reposition due to a loss of power, SDC would no longer be aligned to cool the RCS.However, a designated operator is assigned to reposition these valves as necessary in the event 125-volt D.C. power is lost. Consistent with the bases for LCO 3.8.2.4, the 125-volt D.C. support system operability requirements for both trains of SDC are satisfied in MODE 6 with at least one 125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied. Either SDC pump may be aligned to the refueling water storage tank (RWST) to support filling the fueling cavity or for performance of required testing. A SDC pump may also be used to transfer water from the refueling cavity to the RWST. In addition, either SDC pump may be aligned to draw a suction on the spent fuel pool (SFP) through 2-RW- 11 and 2-SI-442 instead of the normal SDC suction flow path, provided the SFP transfer canal gate valve 2-RW-280 is open under administrative control (e.g., caution tagged). When using this alternate SDC flow path, it will be necessary to secure the SFP cooling pumps, and limit SDC flow as specified in the appropriate procedure, to prevent vortexing in the suction piping. The evaluation of this alternate SDC flow path assumed that this flow path will not be used during a refueling outage until after the completion of the fuel shuffle such that approximately one third of the reactor core will contain new fuel. By waiting until the completion of the fuel shuffle, sufficient time (at least 14 days from reactor shutdown) will have elapsed to-.ensure-the limited SDC flow rate specified for this alternate lineup will be adequate for decay heat removal from the reactor core and the spent fuel pool. In addition, CORE ALTERATIONS shall be suspended when using this alternate flow path, and this flow path should only be used for short time periods, approximately 12 hours. If the alternate flow path is expected to be used for greater than 24 hours, or the decay heat load will not be bounded as previously discussed, further evaluation is required to ensure that this alternate flow path is acceptable. These alternate lineups do not affect the OPERABILITY of the SDC train. In addition, these alternate lineups will satisfy the requirement for a SDC train to be in operation if the minimum required SDC flow through the reactor core is maintained. In MODE 6, with the refueling cavity filled to >_ 23 feet above the reactor vessel flange, both SDC trains may not be in operation for up to 1 hour in each 8 hour period, provided no operations are permitted that would dilute the RCS boron concentration by introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1. Boron concentration reduction with coolant at boron concentrations less than required to assure the RCS boron concentration is maintained is prohibited because MILLSTONE -UJNIT 2 B 3/4 9-2a Amendment No. 69, 7-l-, 4-1-7-, -l-8-5, 24O, 24-5, 2.49,-2-g4,-29)3, Acknowledged By NRC July 5, 2007 January 27, 2009 LBDCR 08-MP2-030. REFUELING OPERATIONS BASES 314.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued) uni~form concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles, and RCS to SDC isolation valve testing. During this 1 hour period, decay heat is removed by natural convection to the large mass o fwater in the refueling pool.In MODE 6, with the refueling cavity filled to >_ 23 feet above the reactor vessel flange, both SDC trains may also not be in operation for local leak rate testing of the SDC cooling suction line (containment penetration number 10) or to permit maintenance on valves located in the common SDC suction line. This will allow the performance of required maintenance and testing that otherwise may require a full core offload. an adition to the requirement prohibiting operations that would dilute the RCS boron concentration by introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1, CORE ALTERATIONS are suspended and all containment penetrations providing direct access from the containment atmosphere to outside atmos phere must be closed. The containment purge valves are containment penetrations and must satisf all requirements specified for a containment penetration. No time limit is specified to operate in this configuration. However, factors such as scope of the work, decay heat load/heatup rate, and RCS temperature should be considered to determine if it is feasible to perform the work. Prior to using thisprovision, a review and approval of the evolution by the Facility Safety Review Committee (FSRC is required. This review will evaluate currentplant conditions and the proposed work to determine if this provision should be used, and to establi~sh the termination criteria and appropriate contingency plans. ~During this period, decay heat is removed by natural convection to the large mass of water in the0 In Mode 6, with the refueling cavity filled to > 23 feet above the reactor vessel flange and the required shutdown cooling train inoperable or not-in operation (with the exceptions provided in the note. following LCO 3.9.8.1I), there will be no forced circulation to provide mixing to ensure uniform boron concentration distribution. Suspending posi~tive reactivity additions that could result in failure to meet the boron concentration-i-riihit in aiccordance with LCO 3.9.1 is required to assure continued safe .operation. Also, actions shall be taken immediately to suspend loading irradiated fuel assemblies in the core. With no forced circulation cooling, decay neat removal from the core occurs by natural convection to the heat sink provided by the water above the core.A minimum refueling water level of 23 feet above the reactor vessel fange provides an adequate available heat sink. Suspending any operation that would increase the decay heat load, such as loading an irradiated fuel assembly, is a prudent action under this condition. However, suspension of loading irradiated fuel assemblies shall not preclude completion of movement of an irradiated fuel assembly to a safe position outsidte the core." The requirement that at least one shutdown cooling loop be in operation at >_ 1000 g pm ensures that (1) sufficient cooling capacity is available to remove decay heat and maintain the water in the reactor pressure vessel below 1 40 0 F as required during the REFUELING MODE, (2)sufficient coolant circulation is maintained through the reactor core to minimize the effects of a boron dilution incident and prevent boron stratification, and (3) is consistent with boron dilution analysis assumptions. The 1000 gpm shutdown cooling flow limit is the minimum analytical limit. Plant operating procedures maintain the minimum shutdown cooling flow at a higher value to accommodate flow measurement uncertainties. Average Coolant Temperature (Tavg) values are derived under shutdown cooling conditions, using the designated formula for use in Unit 2 operating procedures.

• SDC flow greater than 1000 gpm: (SDCoutiet

+ SDCiniet) / 2 = Tav 0 MILLSTONE -UNIT 2 B 3/4 9-2b Amendment No. 69, 7-l-, 44-7-, 4-84, 240,-24-5, 249, 29-LBDCR 06-MP2-030 September 14, 2006 REFUELING OPERATIONS BASES 3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued) During SDC only operation, there is no significant flow past the loop RTDs. Core inlet and outlet temperatures are accurately measured during those conditions by using T3 51 Y, SDC return to RCS temperature indication, and T351IX, RCS to SDC temperature indication. The.average of these two indicators provides a temperature that is equivalent to the average RCS temperature in the core.T35 IX will not be available when using the alternate SDC suction flow path from the SFP.Substitute temperature monitoring capability shall be established to provide indication of reactor core o~utlet temp~erature. ..A portable temp~erature device can be used.to -indicate reactor, core outlet. to ,thle cottrl .rod'tu petr'oi~tel.: A~r~nmfte {teevisioti cdti-neia dr- an a~sgigifi~d individual are acceptable alternative methods to provide this indication to control room personnel. 3/4.9.9 AND_3/4.9.10 DELETED 3/4.9.11 AND 3/4.9.12 WATER LEVEL-REACTOR VESSEL AND STORAGE POOL WATER LEVEL The restrictions on minimum water level ensure that sufficient water depth is available to remove 99% of the assumed 10% iodine gap activity released from the rupture of an irradiated fuel assembly. The minimum water depth is consistent with the assumptions of the accident.analysis.MILLSTONE -UNIT 2 B 3/4 9-2c Amendment No.Acknowledged By NRC July 5, 2007 .REVERSiE OF PAGE B 3/4 INTENTIONALLY LEFT BLANK... September 20, 2004 F" REFUELING OPERATIONS BASES 3/4.9.13 DELETED 3/4,9.14 DELETED 3/4.9.15 DELETED MILLSTONE -UNIT 2 B 3/4 9-3 Amendment No. gO, 4-09, 44-7, 4-5n, 4-1-5, 4~-7, g08, 24g, 284 September 20, 2004 THIS PAGE TNTENTIONALLY LEFT BLANK OMILLSTONE -UNIT 2 B 3/4 9-3a Amendment No. 3%, 4-09, 4-4-, 4-5-4, 4-5-7, 4-7-2, Q, 245-, 284 LBDCR 14-MP2-016 September 4, 2014 REFUELING OPERATIONS BASES (Continued) 314.9.16 SHIELDED CASK The limitations of this specification ensure that in the event of a shielded cask drop accident the doses from ruptured fuel assemblies will be within the assumptions of the safety analyses.3/4.9.17 SPENT FUEL PO OL B ORON CONCENTRATION The limitations of this specification ensures that sufficient boron is present to maintain spent fuel pool Keff_< 0.95 under accident conditions. Postulated accident conditions which could cause an increase in spent fuel pool reactivity are: a single dropped or mis-loaded fuel assembly, a single dropped or mis-loaded Consolidated Fuel Storage Box, or a shielded cask drop onto the storage racks. A spent fuel pool soluble boron concentration of 1400 ppm is sufficient to ensure Keff _ 0.95 under these postulated accident conditions. The required spent fuel pool soluble boron concentration of___ 1720 ppm conservatively bounds the required 1400 ppm. The ACTION statement ensure that if the soluble boron concentration falls below the required amount, that fuel movement or shielded cask movement is stopped, until the boron concentration is restored to within limits.An additional basis of this LCO is to establish 1720 ppm as the minimum spent fuel pooi soluble boron concentration which is sufficient to ensure that the design basis value of 600 ppm soluble boron is not reached due to a postulated spent fuel pool boron dilution event. As part of the spent fuel pool criticality design, a spent fuel soluble boron concentration of 600 ppm is sufficient to ensure Keff < 0.95, provided all fuel is stored consistent with LCO requirements. By maintaining the spent fuel pool soluble boron concentration > 1720 ppm, sufficient time is provided to allow the operators to detect a b~oron dilution event, and terminate the event, prior to the spent fuel pool being diluted below 600 ppm. In the unlikely event that the spent fuel pool soluble boron concentration is decreased to 0 ppm,. Keff will be maintained <1.00, provided all fuel is stored consistent with LCO requirements. The ACTION statement ensures that if the soluble boron concentration falls below the required amount, that immediate action is taken to restore the soluble boron concentration to within limits, and that fuel movement or shielded cask movement is stopped. Fuel movement and shielded cask movement is stopped to prevent the possibility of creating an accident condition at the same time that the minimum soluble boron is below limits for a potential boron dilution event.The surveillance of the spent fuel pool boron concentration within 24 hours of fuel movement, consolidated fuel movement, or cask movement over the cask layout area, verifies that the boron concentration is within limits just prior to the movement. The periodic surveillance interval is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 2 B 3/4 9-3b Amnendment No. g-Q, 1409,1447, 4--57, 1-7-2, 208, 2Ag, 2-74,2,84,...n.....g.. N,. C .. uly. 5, 2007 April 1, 2003 R.EFUELING OPERATIONS BASES 3/4.9.18 SPENT FUEL POOL -STORAGE The limitations described by Figures 3.9-la, 3.9-Ib, and 3.9-3 ensure that the reactivity of fuel assemblies and consolidated fuel storage boxes, introduced into the Region C spent fuel racks, are conservatively within the assumptions of the safety analysis.The limitations described by Figure 3.9-4 ensure that the reactivity of the fuel assemblies, introduced into the Region A spent fuel racks, are conservatively within the assumptions of the safety analysis.3/4.9.19 SPENT FUEL POOL -STORAGE PATTERN The limitations of this specification ensure that the reactivity condition of the Region B storage racks and spent fuel pool Keffwill remain less than or equal to 0.95.The Cell Blocking Devices in the 4th location of the Region B storage racks are designed to prevent inadvertent placement andlor storage in the blocked locations. The blocked location remains empty, or a Batch B fuel assembly may be stored in the blocked location, to maintain reactivity control for fuel assembly storage in any adjacent locations. Region B (non-cell blocker locations) is designed for the storage of new assemblies in the spent fuel pool, and for fuel assemblies which have not sustained sufficient burnup to be stored in Region A or Region C.This LCO is not applicable during the initial installation of Batch B fuel assemblies in the cell blocker locations of Region B. This is acceptable because only Batch B fuel assemblies will be moved during the initial installation of Batch B fuel assemblies, under the Region B cell blockers. Batch B fuel assemblies are qualified for storage in any spent fuel pool storage rack location, hence a fuel misloading event which causes a reactivity consequence is not credible.This exception is valid only during the initial installation of Batch B fuel assemblies in the cell blocker locations. 3/4.9.20 SPENT FUEL POOL -CONSOLIDATION The limitations of these specifications ensure that the decay heat rates and radioactive inventory of the candidate fuel assemblies for consolidation are conservatively within the assumptions of the safety analysis.MILLSTONE -UNIT 2 B 3/4 9-4 Amendment No. -447, 4-1-5, 4-58, 4-7-2, 274 September 25, 2003 P 3.4.10 SpECIAL TEST EXCEPTIONS BASES 3/4.10.1 SHUTDOWN MARGIN This special test exception provides that a minimum amount of CEA worth is immediately available for reactivity control or that the reactor is sufficiently subcritical so as to provide safe operating conditions when tests are performed for CEA worth measurement. This special test exception is required to permit the periodic verification of the actual versus predicted core reactivity condition oecuring as a result of fuel bumup or fuel cycling operations. 3/4.10.2 GROUP HEIGHT ANTD INSERTION LIMITS This special test exception permits individual CEAs to be positioned ouside of their normal group heights and insertion limits during the performance of such PHYSICS TESTS as those required .to 1) measure CEA worth and 2) determine the reactor stability index and damping factor under xenon oscillation conditions. S MiLLSTONE -UNIT 2 3401AedetN.,28 B 3/4 10-1 Amendment No. 280 October 27, 1977 DELETED I27 MILLSTONE -UNIT 2 B341-B 3/4 10-2 November 28, 2000 3/4.11 DELETED BASES 3/4.11.1 -DELETED 3/4.11.2 -DELETED 3/4.11.3 -DELETED MILLSTONE -UNIT 2 B 3/4 11-1 MILLTONE-UNT 2 3/411-1Amendmient No. 250 November 28, 2000 This page intentionally left blank Nillstone Unit 2 B 3/4 11-2 MilltoneUnit2 B /4 1-2 /Aendment No. J79, 250 November 28, 2000 This page intentionally left blank MILLSTONE -UNIT 2 B 3/4 11-3 MILLTON -NIT B /4 1-3Amendment No. 250 November 28, 2000 This page intentionally left blank MILLSTONE -UNIT 2 B 3/4 11-4 MILLTONE-UNT 2 3/411-4Amendment No. JX9, 250 Serial No. 16-078 Docket No. 50-423 ATTACHMENT 2 BASES PAGES FOR MILLSTONE POWER STATION UNIT 3 DOMINION NUCLEAR CONNECTICUT, INC.MILLSTONE POWER STATION UNIT 3 BASES FOR SECTION 2.0 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS NOTE The BASES contained in succeeding pages summarize the reasons for the Specifications in Section 2.0, but in accordance with 10 CFR 50.36 are not part of these Technical Specifications. LBDCR No. 06-MP3-014 June 22, 2006 D.' BASES*:, 2.1.1 REACTOR CORE BACKGROUND 10 CER 50, Appendix A, General Design Criterion 10, requires that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs). This is accomplished by having a departure from nucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95%confidence level (the 95/95 DNB criterion) that DNB will not occur and by requiring that fuel centerline temperature stays below the melting temperature. The restrictions of this Safety Limit (SL) prevent overheating of the fuel and cladding, as well as possible cladding perforation, that would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate (LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature. Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the fuel centerline temperature to reach the melting point of the fuel.Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the>: point of failure, allowing an uncontrolled release of activity to the reactor coolant.Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of DNB and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. Thisweaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.The proper functioning of the Reactor Protection System (RPS) and steam generator safety valves prevents violation of the reactor core SLs.APPLICABLE SAFETY ANALYSES The fuel cladding must not sustain damage as a result of nonnal operation and AOOs. The reactor core SLs are established to preclude violation of the following fuel design criteria: a. There must be at least 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB, and b. The hot fuel pellet in the core must not experience centerline fuel melting.MILLSTONE -UNIT 3 B-B2-1 Amendment No. 60, 2--t4, LBDCR No. 06-MP3-014 June 22, 2006 2.1 SAFETY LIMITS BASES (Continued) The Reactor Trip System setpoints, in combination with all the LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System (RCS) temperature, pressure, RCS Flow, ALI, and THERMAL POWER level that would result in a departure from nucleate boiling ratio (DNBR) of less than the DNBR limit and preclude the existence of flow instabilities. Automatic enforcement of these reactor core SLs is provided by the appropriate operation of the RPS and the steam generator safety valves.SAFETY LIMITS The figure provided in the CORE OPERATING LIMITS REPORT (COLR) shows the loci of points of THERMAL POWER, RCS pressure, and average temperature for which the minimum DNBR is not less than the safety analyses limit, that fuel centerline temperature remains below melting, that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturated liquid, or that the exit quality is within the limits defined by the DNBR correlation. The reactor core SLs are established to preclude violation of the following fuel design criteria: a. There must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB, and b. There must be at least a 95% probability at a 95% confidence level that the hot fuel pellet in the core does not experience centerline fuel melting.The reactor core SLs are used to define the various RPS .functions such that the above criteria are satisfied during steady state operation, normal operational transients, and AOOs. To ensure that the RPS precludes the violation of the above criteria, additional criteria are applied to the Overtemperature and Overpower AT reactor trip functions. That is, it must be demonstrated that the average enthalpy in the hot leg is less than or equal to the saturation enthalpy and that the core exit quality is within the limits defined by the DNBR correlation. Appropriate functioning of the RPS ensures that for variations in the THERMAL POWER, RCS Pressure, RCS average temperature, RCS flow rate, and AI that the reactor core SLs will be satisfied during steady state operation, normal operational transients, and AOOs.APPLICABILITY SL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactor is critical. Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The steam generator safety valves or automatic protection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate a reactor trip function, which forces the unit into MODE 3. In MODES 3, 4, 5, and 6, applicability is not required since the reactor is not generating significant THERMAL POWER.MILLSTONE -UNIT 3 B2l mnmn o B2-1a Amendment No. LBDCR No. 06-MP3-014 June 22, 2006 2.1 SAFETY LIMITS BASES (Continued) SAFETY LIMIT VIOLATIONS If SL 2.1.1 is violated, the requireme~nt to go to HOT STANDBY places the unit in a MODE in which this SL is not applicable. The allowed completion time of 1 hour recognizes the importance of bringing the unit to a MODE of operation where this SL is not a~ppicable, and reduces the probability of fuel damage.Amendment No.MILLSTONE -UNIT 3 B2l B2-1b January 31, 1986 SAFETY LIMITS BASES 2.1.2 REACTOR COOLANT SYSTEM PRESSURE The restriction of this Safety Limit protects the integrity of the Reactor Coolant Systemn (RCS) fromn overpressurization and thereby prevents the release of radionuclides contained in the-reactor coolant from reaching the containment atmosphere. The reactor vessel, pressurizer, and the RCS piping, valves and fittings are designed to Section III of the ASME Code for Nuclear Power Plants which permits a. maximum transient pressure of 110% (2750 psia) of design pressure.. The Safety Limit of 2750 psia is therefore consistent with the design criteria and associated Code requirements. The entire RCS is hydrotested at 125% (3125 psia) of design pressure, to demonstrate integrity prior to initial operation. MILLSTONE -UNIT 3B22 B 2-2 LBDCR Noj)4-MP3-01 5 February 24, 2005 2.2 LIMITING SAFETY SYSTEM SETTINGS BASES 2.2.1 REACTOR TRIP SYSTEM INSTRUMENTATION SETPOINTS The Nominal Trip Setpoints specified in Table 2.2-1 are the nominal values at which the reactor trips are set for each functional unit. The Allowable Values (Nominal Trip Setpoints +/-k the calibration tolerance) are considered the Limiting Safety System Settings as identified in 10OCFR50.36 and have been selected to ensure that the core and Reactor Coolant System are .prevented from exceeding their safety limits during normal operation and design basis anticipated operational occurrences and to assist the Engineered SafetyFeatures Actuation System in mitigating the consequences of accidents. The Setpoint for a Reactor Trip System or interlock function is considered to be consistent with the nominal value when the measured "as left" Setpoint is within the administratively controlled (+) calibration tolerance identified in plant procedures (which specifies the difference between the Allowable Value and Nominal Trip Setpoint). Additionally, the Nominal Trip Setpoints may be adjusted in the conservative direction provided the calibration tolerance remains unchanged. Measurement and Test Equipment accuracy is administratively controlled by plant procedures and is included in the plant uncertainty calculations as defined in WCAP-10991. OPERABILITY determinations are based on the use of Measurement and Test Equipment that conforms with the accuracy used in the plant uncertainty calculation. The Allowable Value specified in Table 2.2-1 defines the limit beyond which a channel is inoperable. If the process rack bistable setting is measured within the "as left" calibration tolerance, which specifies the difference between-the A-iiowable Value and Nominal Trip Setpoint, then the channel is considered to be OPERABLE.The methodology, as defined in WCAP- 10991 to derive the Nominal Trip Setpoints, is based upon combining all of the uncertainties .in the channels. Inherent in the determination of the Nominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and other instrumentation utilized in these channels should be capable of operating within the allowances of these uncertainty magnitudes. Occasional drift in excess of the allowance may be determined to be acceptable based on the other device performance characteristics. Device drift in excess of the allowance that is more than occasional, may be indicative of more serious problems and would warrant further investigation. The various reactor trip circuits automatically open the reactor trip breakers whenever a condition monitored by the Reactor Trip System reaches a preset or calculated level. In addition to the redundant channels and trains, the design approach provides Reactor Trip System functional diversity. The MILLSTONE -UNIT 3 B 2-3 Amendment No. 59, Acknowledged by NRC letter dated 08/25/05 LBDCR 07-MP3-037-July 12, 2007 2.2 LIMITING SAFETY SYSTEM SETTINGS BASES REACTOR TRIP SYSTEM INSTRUMENTATION SETPOINTS (Continued) functional capability at the specified trip setting is required for those anticipatory or diverse reactor trips for which no direct credit was assumed in the safety analysis to enhance the overall reliability of the Reactor Trip System. The Reactor Trip System initiates a turbine trip signal whenever reactor trip is initiated. This prevents the reactivity insertion that would otherwise result from excessive Reactor Coolant System cooldown and thus avoids unnecessary actuation of: the Engineered Safety Features Actuation System.Manual Reactor Trip The Reactor Trip System includes manual Reactor trip capability. Power Range. Neutron Flux In each of the Power Range Neutron Flux channels there are two independent bistables, each with its own trip setting used for a High and Low Range trip setting. The Low Setpoint trip provides protection during subcritical and low power operations to mitigate the consequences of a power excursion beginning from low power, and the High Setpoint trip provides protection during power operations to mitigate the consequences of a reactivity excursion from all power levels. l The Low Setpoint trip may be manually blocked above P-i 10 (a power level of approximately 10% of RATED THERMAL PO.WER)._and is automatically reinstated below the P-10 Setpoint.Power Range. Neutron Flux. High Positive Rate The Power Range Positive Rate trip provides protection against rapid flux increases which are characteristic of positive reactivity insertion events. Specifically, this trip complements the Power Range Neutron Flux High and Low trips to ensure that the criteria are met for all rod ejection accidents. This trip also complements the Pressurizer Pressure-High trip, along with the Overtemperature AT and the Power Range Neutron Flux High Positive Rate trips, to ensure that the criteria are met for the rod withdrawal at power accidents. MILLSTONE -UNIT 3 B 2-4 Amendment No. 4-46, 4-59, 24-l-, LBDCR No. 07-MP3-017 April 12, 2007 LIMITING SAFETY SYSTEM SETTINGS BASES Intermediate and Source Range. Neutron Flux The Intermediate and Source Range, Neutron Flux trips provide core protection during reactor startupto mitigate the consequences of an uncontrolled rod cluster control assembly bank withdrawal from a. subcritical condition. These trips provide redundant protection to the Low Setpoint trip of the Power Range, Neutron Flux channels. The Source Range channels will initiate a Reactor trip at about 105 counts per second unless manually blocked when P-6 becomes active. The Intermediate Range channels will initiate a Reactor trip at a current level equivalent to approximately 25% of RATED THERMAL POWER unless manually blocked when P-10 becomes active. No credit was taken for operation of the trips associated with either the Intermediate .or Source Range Channels in the accident analyses; however, their functional capability at the specified trip settings is required by this specification to enhance the overall reliability of the Reactor Trip System.Overtemperature AT The Overtemperature AT trip provides core protection to prevent DNB for all combinations of pressure, power, coolant temperature, and axial power distribution, provided that the transient is slow with respect to piping transit delays from the core to the temperature detectors, and pressure is within the range between the Pressurizer High and Low Pressure trips.The Setpoint is automatically varied with: (1) coolant temperature to correct for temperature induced changes in density and heat capacity of water and ~includes dynamic compensation for .piping delays from the core to the loop temperature detectors, (2) pressurizer pressure, and (3) axial power distribution. With normal axial power distribution, this Reactor trip limit is always below the core Safety Limit as shown by the Reactor Core Safety Limit curves in the COLR. If axial peaks are greater than design, as indicated by the difference between top and bottom power range nuclear detectors, the Reactor trip is automatically reduced according to the notations in Table 2.2-1. Although a direction of conservatism is identified for the Overtemperature AT reactor trip function K 2 and K 3 gains, the gains should be set as close as possible to the values contained in Note 1 to ensure that the Overtemperature AT setpoint is consistent with the assumptions of the safety analyses.Overpower AT The Overpower AT trip provides assurance of fuel integrity (e.g., no fuel pellet melting and less than 1% cladding strain) under all possible overpower conditions, limits the required range for Overtemperature AT MILLSTONE -UNIT 3 B 2-5 MILLTON -NIT3 B2-5Amendment No. 2, 60, 4-52, 2-l--7-, LBDCR No.;08-MP3-014 October 21, 2008 LIMITING SAFETY SYSTEM SETTINGS BASES trip, and provides a backup to the High Neutron Flux trip. The Setpoint is automatically varied with: (1) coolant temperature to correct for temperature induced changes in density and heat capacity of water, and (2) rate of change of temperature for dynamic compensation for piping delays from the core to the loop temperature detectors, to ensure that the allowable heat generation rate (kW/ft) is not exceeded. The Overpower AT trip provides protection to mitigate the consequences of various size steam breaks as reported in WCAP-9226, "Reactor Core Responseto Excessive Secondary Steam Releases." Pressurizer Pressure In each of the pressurizer pressure channels, there are two independent bistables, each with its own trip setting to provide for a High and Low Pressure trip thus limiting the pressure range in which reactor operation is permitted. The Low Setpoint trip protects against low pressure which could lead to DNB by tripping the reactor in the event of a loss of reactor coolant pressure.On decreasing power the Low Setpoint trip is automatically blocked by P-7 (a power level of approximately 10% of RATED THERMAL POWER with turbine impulse chamber pressure at approximately 10% of full power equivalent); and on increasing power, automatically reinstated by P-7.The High Setpoint trip functions in conjunction with the pressurizer relief and safety valves to protect the Reactor Coolant System against system overpressure. Pressurizer Water Level The Pressurizer Water Level High trip is provided~-.to pre-vent water relief through the pressurizer safety valves. On decreasing power the Pressurizer High Water Level trip is automatically blocked by P-7 (a power level of approximately 10% of RATED THERMAL POWER with a turbine impulse chamber pressure at approximately 10% of full power equivalent); and on increasing power, automatically reinstated by P-7.Reactor Coolant Flow The Reactor Coolant Flow Low trip provides core protection to prevent DNB by mitigating the consequences of a loss of flow resulting from the loss of one or more reactor coolant pumps.The nominal RCS flow is the actual measured RCS flow during POWER OPERATION. The low RCS flow RPS trip is set to be greater than or equal to 90% of the actual measured flow.Technical Specification 3.2.3, RCS Flow Rate and Nuclear Enthalpy Rise Hot Channel Factor, assures that the nominal (actual measured) RCS flow will exceed the RCS design Hlow rate used for design basis accidents and the Minimum Measured Flow used in the DNBR analysis as specified in the COLR and consequently the trip setpoint based upon the nominal (actual measured) RCS will be conservative with respect to the safety analysis. A trip setpoint based upon 90% of nominal (actual measured) RCS flow assures that the design basis analyses and the DNBR analyses are conservative and bounding.MILLSTONE -UNIT 3 B- mnmn o B 2-6 Amendment No. LBDCR No. 08-MP3-036 October 30, 2008 LIMITING SAFETY SYSTEM SETTINGS BASES On increasing power above P-7 (a power level of approximately 10%. of RATED THERMAL POWER or a turbine impulse chamber pressure at approximately 10% of full power equivalent), an automatic Reactor trip will occur if the flow in more than one loop drops below 90% of nominal full loop flow. Above P-8 (a power level of approximately 50% of RATED THERMAL POWER) an automatic Reactor trip will occur if the flow in any single loop drops below 90% of nominal full loop flow. Conversely, on decreasing power between P-8 and the P-7 an automatic Reactor trip will occur on low reactor coolant flow in more than one loop and below P-7 the trip function is automatically blocked.'Steam Generator Water Level The Steam Generator Water Level Low-Low trip protects the reactor from loss of heat sink in the event of a sustained steamn/feedwater flow mismatch resulting from loss of normal feedwater. The specified Setp~oint provides allowances for starting delays of the Auxiliary Feedwater System.Low Shaft Speed -Reactor Coolant Pumps The Low Shaft Speed -Reactor Coolant Pumps trip provides core protection to prevent DNB in the event of a sudden significant decrease in reactor coolant pump speed (with resulting decrease in flow) on two reactor coolant pumps in any two operating reactor coolant loops. The trip setpoint ensures that a reactor trip will be generated, considering instrument errors and response times, in sufficient time to allow the DNBR to be maintained greater than the design above limit following a four-pump loss of flow event.Turbine Trip A Turbine trip initiates a Reactor trip. On decreasing power the Reactor trip from the Turbine trip is automatically blocked by P-9 (a power level of approximately 50% of RATED THERMAL POWER); and on increasing power, reinstated automatically by P-9. The P-9 setpoint is acceptable with up to two steam dump valves out of service.Safe.ty Injection Input from ESF If a Reactor trip has not already been generated by the Reactor Trip System instrumentation, the ESF automatic actuation logic channels will initiate Reactor trip upon any signal which initiates a Safety Injection. The ESF instrumentation channels which initiate a Safety Injection signal are shown in Table 3.3-3.Reactor Trip System Interlocks The Reactor Trip System interlocks perform the following functions: P-6 On increasing power, P-6 becomes active above the Interlock Allowable Value specified on Table 2.2-1 to allow the manual block of the Source Range trip (i.e., prevents premature block of the Source Range trip during reactor startup) and deenergizes the high voltage to the detectors. On decreasing power during a MILLSTONE -UNIT 3B27AmnetNo B 2-7 Amendment No. LBDCR No,-08-MP3-014

• October 21, 2008 LIMITING SAFETY SYSTEM SETTINGS BASES Reactor Trip System Interlocks (Continued) reactor shutdown, Source Range Level trips are automatically reactivated and high voltage restored when P-6 deactivates.

The P-6 deactivation will occur at a value below its activation value and may be calibrated to occur below the P-6 Interlock Allowable Value specified on Table 2.2-1 to prevent overlap and chatter based upon.: the expected bistable drift.P-7 On increasing power P-7 automatically enables Reactor trips on low flow in more than one reactor coolant loop, reactor coolant pump low shaft speed, pressurizer low pressure and pressurizer high level. On decreasing power, the above listed trips are automatically blocked.P-8 On increasing power, P-8 automatically enables Reactor trips on low flow in one or more reactor coolant loops. On decreasing power, the P-8 automatically blocks the above listed trips.P-9 On increasing power, P-9 automatically enables Reactor trip on Turbine trip. On decreasing power, P-9 automatically blocks Reactor trip on Turbine trip.P-i10 On increasing power, P- 10 provides input to P-7 to ensure that Reactor Trips on low flow in more than one reactor coolant loop, reactor coolant pump low shaft speed, pressurizer low pressure and pressurizer high level are active when powver reaches 11%. It also allows the manual block of the Intermediate Range trip and the Low Setpoint Power Range trip; and automatically blocks the Source Range trip and deenergizes the Source Range high voltage power.On decreasing power, P-10 resets to automatically reactivate the Intermediate Range trip and the Low Setpoinit Power Range trip before power drops below 9%. It also provides input to reset P-7.P-13 On increasing power, P-13 provides input to P-7 to ensure that Reactor trips on low flow in more than one reactor coolant loop, reactor coolant pump low shaft speed, pressurizer low pressure and pressurizer high level are active when power reaches 10%.On decreasing power, P-13 resets when power drops below 10% and provides input, along with P-10, to reset P-7.MILLSTONE -UNIT 3 B 2-8 MILSTOE UNT B -8Amendment No. -5 2--l-g, :2---, BASES FOR SECTIONS 3.0 AND 4.0 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS NOTE The BASES contained in succeeding pages summarize the reasons for the Specifications in Sections 3.0 and 4.0, but in accordance with 10 CFR 50.36 are not part of these Technical Specifications. october 25, 1990.3/4.0 APPLICABILITY '! BASES 3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS 3/4.0 APPLICABILITY Specification

3.0.1 throuah

3.0.4 establish the general requirements applicable to Limiting Conditions for Operation. These requirements are based on the requirements for Limiting Conditions for Operation stated in the Code of Federal Regulations, 10 CFR 50.36(c)(2): "Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility.When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specification until the condition can be met." Specification

3.0.1 establishes

the Applicability statement within each individual specification as the requirement for when (i.e., in which OPERATIONAL MODES or other specif'ied conditions) conformance to the Limiting Conditions for Operation is required for safe operation of the facility. The SACTION requirements establish those remedial measures that must be taken within specified time limits when the requirements of a Limiting Condition for*Operation are not met.S There are two basic types of ACTION requirements. The first specifies the S remedial measures that permit continued operation of the facility which is not further restricted by the time limits of the ACTION requirements. In this case, conformance to the ACTION requirements provides an acceptable level of safety for unlimited continued operation as long as the ACTION requirements continue to be met. The second type of ACTION requirement specifies a time limit in which conformance to the conditions of the Limiting Condition for Operation must be met. This time limit is the allowable outage time to restore an inoperable sYstem or component to OPERABLE status of for restoring parameters within specified limits. If these actions are not completed within the allowable outage time limits, a shutdown is required to place the facility in a MODE or condition in which the specification no longer applies. It is not intended that the shutdown ACTION requirements be used as an operational convenience which permits (routine) voluntary removal of a system(s) or component(s) from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. The specified time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. The time limits of the ACTION requirements are also applicable when a system or component is removed from service for surveillance testing or investigation of operational problems. Individual specifications may include a specified time limit for the completion of a Surveillance Requirement when equipment is removed from service. In this case, the allowable outage time rn limits of the ACTION requirements are applicable when this limit expires if~the surveillance has not been completed. When a shutdown is required to MILLSTONE -UNIT 3 B3401 AEDETN.5 B 3/4 0-I AMENDMENT NO. 57 October 25, 3/4.0 APPLICABILITY W BASES comply with ACTION requirements, the plant may have entered a MODE in which a new specification becomes applicable. In this case, the time limits of the ACTION requirements would apply from the point in time that the new specification becomes applicable if the requirements of the Limiting Condition for Operationfare not met.Specification

3.0.2 establishes

that noncompliance with a specificationexists when the requirements of the Limiting Condition for Operation are not met and the associated ACTION requirements have not been implemented within the specified time interval. The purpose of this specification is to clarify that (I) implementation of the ACTION requirements within the specified time interval constitutes compliance with a specification and (2) completion of the remedial measures of the ACTION requirements is not required when compliance with a Limiting Condition of Operation is restored within the time interval specified in the associated ACTION requirements. Specification

3.0.3 establishes

the shutdown ACTION requirements that must be implemented when a Limiting Condition for Operation is not met and the condition is not specifically addresFzA by the associated ACTION requirements. The purpose of this specification is 'o delineate the time limits for placing the unit in a safe shutdown MODE when plant operation cannot be maintained within the limits for safe operation defined by the Limiting Conditions for i.Operation and its ACTION requirements. It is not intended to be used as an operational convenience which permits (routine) voluntary .removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. This time permits the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and Within the cooldown capabilities of the facility assuming only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the primary coolant system and the potential for a plant upset that could challenge safety systems under conditions for which this specification applies.If remedial measures permitting limited continued operation of the facility under the provisions of the ACTION requirements are completed, the shutdown may be terminated. The time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. Therefore, the shutdown may be terminated if the ACTION requirements have been met or the time limits of the ACTION requirements have not expired, thus providing an allowance for the completion of the required actions. The time limits of Specification

3.0.3 allow

37 hours for the plant to be in COLD SHUTDOWN MODE when a shutdown is required during the POWER MODE of operation. If the plant is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE of operation applies. However, if a lower MODE of operation is reached in less time than allowed, the total allowable time to reach COLD SHUTDOWN, or other applicable MILLSTONE -UNIT 3 MILTN NT3B 3/4 0-2 AMENDMENT NO. 57 3/4.0 APPLICABILITY Apr11 17, 2000 BASES MODE, is not reduced. For example, if HOT STANDBY is reached in 2 hours, the time allowed to reach HOT SHUTDOWN is the next 11 hours because the total time to reach HOT SHUTDOWN is not reduced from the allowable limit of 13 hours.Therefore, if remedial measures are completed that would permit a return to POWER operation, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.The same principle applies with regard to the allowable outage time limits of the ACTION requirements, if compliance with the ACTION requirements for one*specification results in entry. into a MODE or condition of operation for another specification in which the requirements of the Limiting Condition for Operation are not met. If the new specification becomes applicable in less time than specified, the difference may be added to the allowable outage time limits of the second specification. However, the allowable outage.time limits of ACTION requirements for a higher MODE of operation may not be used to extend the allowable outage time that is applicable when a Limiting Condition for Operation is not met in a lower MODE of operation. The Shutdown requirements of Specification 3.0.3 do not apply in MODES 5 and 6, because the ACTION requirements of individual specifications define the remedial measures to be taken.Specification

3.0.4 establishes

limitations on MODEchanges when a Limiting Condition for Operation is not met. It precludes placing the facility in a high MODE of operation when the requirements for a Limiting Condition for Operation are not met and continued noncompliance to these conditions would result in a shutdown to comply with the ACTION requirements if a change in MODES were permitted. The purpose of this specification is to ensure that facility operation is not initiated or that higher MODES of operation are not entered when corrective action is being taken to obtain compliance with a specification by restoring equipment to OPERABLE status or parameters to specified limits. Compliance with ACTION requirements that permit continued operation of the facility for an unlimited period of time provides *an acceptable level of safety for continued operation without regard to the status of the plant before or after a MODE change. Therefore, in this case, entry into an OPERATIONAL MODE or other specified condition may be made in accordance with the provisions of the ACTION requirements. The provisions of this specification should not, however, *be interpreted as endorsing the failure to exercise good practice in restoring systems or components to OPERABLE status before plant startup.When a shutdown is required to comply with ACTION requirements, the provision of Specification 3.0.4 do not apply because they would delay placing the facility in a lower MODE of operation. Specification

3.0.5 establishes

the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to Specifications 3.0.1 and 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate either: a. The OPERABILITY of the equipment being returned to. service; or b. The OPERABILITY of other equipment. MILLSTONE -UNIT 3 B 3/4 0-3 MILLTONE-UNT 3 3 40-3Amendment No. F7, 179 3/4.0 APPLICABILITY Arl1,20 April 17, 2000 BASES The administrative controls ensure the time the equipment is returned to , service in conflict with the requirements of the ACTIONS is limited to the time absolutely neCessary to perform the required testing to demonstrate, OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance. An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the required testing.An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of required testing on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.Specifications

4.0.1 through

4.0.5 establish the general requirements applicable to Surveillance Requirements. These requirements are based on the Surveillance Requirements stated in the Code of Federal Regulations, 10 CFR 50.36(c) (3) : 0i MILLSTONE UNIT 3 B 3/40-3a MILLTONEUNI 3 B3/4 -3aAmendment No. 179 November 15, 2002 3/4.0 APPLICABILITY BASES"Surveillance requirements are requirements relating to test, calibration, or inspection to ensure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met." Specification

4.0.1 establishes

the requirement that surveillances must be met during the OPERATIONAL MODES or other conditions for which the requirements of the Limiting Conditions for Operation apply unless otherwise stated in an individual Surveillance Requirement. The purpose of this specification is to ensure that surveillances are performed to verify the OPERABILITY of systems and components and that parameters are within specified limits to ensure safe operation of the facility when the plant is in a MODE or other specified condition for which the associated Limiting Conditions for Operation are applicable. Failure to meet a Surveillance within the specified surveillance interval, in accordance with Specification 4.0.2, constitutes a failure to meet a Limiting Condition for Operation. Systems and components are assumed to be OPERABLE when the associated Surveillance Requirements have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are when either: a. The systems or components are known to be inoperable, although still meeting the Surveillance Requirements or b. The requirements of the Surveillance(s) are known to be not met between required Surveillance performances. Surveillance requirements do not have to be performed when the facility is in an OPERATIONAL MODE or other specified conditions for which the requirements of the associated Limiting Condition for Operation do not apply unless otherwise specified. The Surveillance Requirements associated with a Special Test Exception are only applicable when the Special Test Exception is used as an allowable exception to the requirements of a specification. Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given Surveillance Requirement. In this case; the unplanned event may be credited as fulfilling the performance. of the Surveillance Requirement. This allowance includes those Surveillance Requirement(s) whose performance is normally precluded in a given MODE or other specified condition. Surveillance Requirements, including Surveillances invoked by ACTION requirements, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with Specification 4.0.2, prior to returning equipment to OPERABLE status.Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with Specification 4.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed. MILLSTONE -UNIT 3 B 3/4 0-4 MILL TON -NIT3 B3/40-4Amendment No. =5-7, -l-2-, 213 LBDCR No. 074-MP3-015 February 24, 2005 3/4.0 APPLICABILITY 'BASES Some examples of this process are: a. Auxiliary feedwater (AFW) pump turbine maintenance during refueling that requires testing at steam pressure > 800 psi. However, if other appropriate testing is satisfactorily completed, the AFW System can be considered OPERABLE. This allows startup and other necessary testing to proceed until the plant reaches the steam pressure required to perform the testing.b. High pressure safety in~jection (I-PSI) maintenance during shutdown that requires*system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPSI considered OPERABLE. This allows operation to reach the specified pressure to complete the necessary post maintenance testing.Specification 4.0.2 This specification establishes the limit for which the specified time interval for surveillance requirements may be extended. It permi~ts an allowable extension of the normal surveillance interval to facilitate surveillance scheduling and consideration of plant operating conditions that may not be suitable for conducting the surveillance; e.g., transient conditions or other ongoing surveillance or maintenance activities. It also provides flexibility to accommodate the length of a fuel cycle for surveillances that are performed at each refueling outage and are specified typically with an 18-month surveillance interval. It is not intended that this provision be used repeatedly as a convenience to extend surveillance intervals beyond that specified for surveillances that are not performed during refueling outage. The limitation of 4.0.2 is based on" engineering judgment and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the surveillance requirements. This provision is sufficient to ensure that the reliability ensured through surveillance activities is not significantly degraded beyond that obtained from the specified surveillance interval.*Specification

4.0.3. establishes

the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified surveillance interval. A delay period of up to 24 hours or up to the limit of the specified surveillance interval, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with Specification 4.0.2, and not at the time that the specified surveillance interval was not met.This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with ACTION requirements or other remedial measures that might preclude completion of the Surveillance. The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of'the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements. MILLSTONE -UNIT 3 B 3/4 0-5 Amendment No. , 22, 06, t-3,0 Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015 February 24, 2005 3/4.0 APPLICABILITY BASES When a Surveillance with a surveillance interval based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations, (e.g., prior to entering MODE I after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not havje been performed when specified, Specification

4.0.3 allows

for the full delay period of up to the specified surveillance interval to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity. Specification

4.0.3 provides

a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by ACTION requirements.[ Failure to comply with specified surveillance intervals for the Surveillance Requirements is expected to be an infrequent occurrence. Use of the delay period established by Specification 4.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours or the limit of the specified surveillance interval is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to.perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should~be managed, through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determinethe safest course of action. All missed Surveillances will be placed in the licensee's Corrective Action Program.If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable* is considered outside the specified limits and the entry into the ACTION requirements for the applicable Limiting Condition for Operation begins immediately upon, expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and entry into the ACTION requirements for the applicable Limiting Conditions for Operation begins immediately upon the failure of the Surveillance. Completion of the Surveillance within the delay period allowed by this Specification, or within the Allowed Outage Time of the applicable ACTIONS, restores compliance with Specification 4.0.1.MILLSTONE -UNIT 3 B 3/4 0-5a Amendment No. 2-4-3, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 07-MP3-009 June 19, 2007 3/4.0 APPLICABILITY BASES Specification

4.0.4 establishes

the requirement that all applicable surveillances must be met before entry into an OPERATIONAL MODE or other condition of operation specified in the Applicability statement. The purpose of this specification is to ensure that system and component OPERABILITY requirements or parameter limits are met before entry into a MODE or condition for which these systems and components ensure safe operation of the facility. This provision applies to changes in OPERATIONAL MODES or other specified conditions associated with plant shutdown as well as startup.Under the provisions of this specification, the applicable Surveillance Requirements must be performed within the specified surveillance interval to ensure that the Limiting Conditions for Operation are met during initial plant startup or following a plant outage.When a shutdown is required to comply with ACTION requirements, the provisions of Specification 4.0.4 do not apply because this would delay placing the facility in a lower MODE of operation. Specification

4.0.5 establishes

the requirement that inservice testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with a periodically updated version of the ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OMN Code) and applicable Addenda as required by l0CFR5O.55a(f). These requirements apply except when relief has been provided in writing by the Commission. This specification includes a clarification of the frequencies for performing the inservice testing activities required by the ASME. OM Code and applicable Addenda. This clarification is provided to ensure consistency in surveillance intervals throughout the Technical Specifications and to remove any ambiguities relative to the frequencies for performing the required inservice testing activities.. Under the terms of this specification, the more restrictive requirements of the Technical Specifications take precedence over the ASME OM Code and applicable Addenda. The requirements of Specification 4.0.4 to perform surveillance activities before entry into an OPERATIONAL MODE or other specified condition takes-precedence over the ASME OM Code" provision which allows pumps and valves to be tested up to one week after return to normal operation. MILLSTONE -UNIT 3 B 3/4 0-6 MILLTONE-UNT 3 3/40-6Amendment No. 2--3, LBDCR 06-MP3-013 April 5, 2006 3/4.1 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1 BORATION CONTROL 3/4.1.1.1i and 3/4.1.1.2 SHUTDOWN MARGIN A sufficient SHUTDOWN MARGIN ensures that: (1) the reactor can be made subcritical from all operating. conditions, (2) the reactivity transients associated with postulated accident conditions are controllable within acceptable limnits, and (3) the reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition. sHUTDOWN MARGIN requirements vary throughout core life as a function of fuel depletion, RCS boron concentration, and RCS Tavg. In MODES I and 2, the mnost restrictive condition occurs at EOL with Tav at n1o load operating temperature, and is associated with a postulated steam line break accident and resulting uncontrolled RCS cooldown. In the analysis of this accident, a minimum SHUTDOWN MARGIN as defined in Specification 3/4.1.1.1.1 is required to: control the reactivity transient. Accordingly, the SHUTDOWN MARGIN requirement is based upon this limiting condition and is consistent with FSAR safety analysis assumptions. In MODES 3, 4 and 5, the mnost restrictive condition occurs at BOL, associated with a boron dilution accident. In the analysis of this accident, a minimum SHUTDOWN MARGIN as defined in Specification 3/4.1.1 .1 .2 is required to allow the operator 15 minutes from the initiation of the Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. Accordingly, the SHUTDOWN MARGIN requirement is based upon this limiting requirement and is consistent with the accident analysis assumption. The locking closed of the required valves in MODE 5 (with the loops not filled) will preclude the possibility of uncontrolled boron dilution of the Reactor Coolant System by preventing flow of unborated water to the RCS.3/4.1.1.3 MODERATOR TEMPERATURE COEFFICIENT The limitations on moderator temperature coefficient (MTC) are provided to ensure that the value of this coefficient remains within the limniting condition assumned in the FSAR accident and transient analyses.The MTC values of this specification are applicable to a specific set of plant conditions; accordingly, verification of MTC values at conditions other than those explicitly stated will require extrapolation to those conditions in order to permit an accurate comparison. The most negative MTC, value equivalent to the nmost positive moderator density coefficient (MDC), was obtained by incrementally correcting the MDC used in the ESAR analyses to nominal operating conditions. MILLSTONE -UNIT 3 B 3/4 1-1 Amendment No. 9,-6O, 9~9, 4-1-, Acknowledged by NRC Letter dated 12/19/06 August 27, 2001 REACTIVITY CONTROL SYSTEMS BASES MODERATOR TEMPERATURE COEFFICIENT (Continued) These corrections involved: (1) a conversion of the MDC used in the FSAR safety analyses to its equivalent MTC, based on the rate of change of moderator density with temperature at RATED THERMAL POWER conditions, and (2) subtracting from this value the largest differences in MTC observed between EOL, all rods withdrawn, RATED TIHERMAL POWER conditions, and those most adverse conditions of moderator temperature and pressure, rod insertion, axial power skewing, and xenon concentration that can occur in normal operation and lead to a significantly more negative EOL MTC at RATED THERMAL POWER. These corrections transformed the MDC value used in the FSAR safety analyses into the limiting End of Cycle Life (EOL) MTC value. The 300 ppm surveillance limit MTC value represents a conservative MTC value at a core condition of 300 ppm equilibr/ium boron concentration, and is obtained by making corrections for burnup and soluble boron to the limiting EOL MTC value.The Surveillance Requirements for measurement of the MTC at the beginning and near the end of the fuel cycle are adequate to confirm that the MTC remains within its limits since this coefficient changes slowly due principally to the reduction in RCS boron concentration associated with fuel burnup.3/4.1.1.4 MINIMUM TEMPERATURE FOR CRITICALITY This specification ensures that the reactor will not be made critical with the Reactor Coolant System average temperature less than 551. This limitation is required to ensure: (1) the moderator temperature coefficient is within it analyzed temperature range, (2) the trip instrumentation is within its normal operating range, (3) the P-12 interlock is above its setpoint, (4) the pressurizer is capable of being in an OPERABLE status with a steam bubble, and (5) the reactor vessel is above its minimum RTNDT temperature. 3/4.1.2 DELETED MILLSTONE -UNIT 3 B 3/4 1-2 MILLTON -NIT3 B3/41-2Amendment No. 2-9, 5-0, 4457-, 197 LBDCR 07-MP3-037 Jtily 12, 2007 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.3 MOVABLE CONTROL ASSEMBLIES The specifications of this section ensure that: (1) acceptable power distribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effects of rod misalignment on associated accident analyses are limited. OPERABILITY of the control rod position indicators is required to detennine control rod positions and thereby ensure compliance with the control rod aligmnent and insertion limits. Verification that the Digital Rod Position Indicator agrees with the demanded position within +/--12 steps at 24, 48, 120, and fully withdrawn position for the Control Banks and 18, 210, and fully withdrawn position for the Shutdown Banks provides assurances that the Digital Rod Position Indicator is operating correctly over the full range of indication. Since the Digital Rod Position Indication System does not indicate the actual shutdown rod position between 18 steps and 210 steps, only points in the indicated ranges are picked for verification of agreement with demanded position.The ACTION statements which permit limited variations from the basic requirements are accompanied by additional restrictions which ensure that the original design criteria are met.Misalignment of a rod requires measurement of peaking factors and a restriction in TI-ERMAL POWER. These restrictions provide assurance of fuel rod integrity during continued operation. In addition, those safety analyses affected by a misaligned rod are reevaluated to confirm that the results remain valid during future operation. The maximaum rod drop time restriction is consistent with the assumed rod drop time used in the safety analyses. Measurement with Tavg greater than or equal to 500°F and with all reactor coolant pumps operating ensures that the measured drop times will be representative of insertion times experienced during a Reactor trip at operating conditions. The required rod drop time of< 2.7 seconds specified in Technical Specification 3.1.3A4 is used in the FSAR accident analysis. A rod drop time was calculated to validate the Technical Specification limit. This calculation accounted for all uncertainties, including a plant specific seismic allowance of 0.50 seconds. Since the seismic allowance should be removed when verifying the actual rod drop time, the acceptance criteria for surveillance testing is 2.20 seconds (Reference 4).Measuring rod drop times prior to reactor criticality, after reactor vessel head removal and installation, ensures that the reactor internals and rod drive mechanism will not interfere with rod.motion or rod drop time, and that no degradation in these systems has occurred that would adversely affect rod motion or drop time. Any time the OPERABILITY of the control rods has been affected by a repair, maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. MILLSTONE -UNIT 3 B 3/4 1-3 Amendment No..-!-2., 60, .83, 4-4-, 4-5-7, 164, 4-9-7, LBDCR l2-MP3-010 September 20, 2012 REACTVTSCNRLSYTM BASES MOVABLE CONTROL ASSEMIBLIIES (Continued') Control rod positions and OPERABILITY of the rod position indicators are required to be verified at the frequency specified in the Surveillance Frequency Control Program with more frequent verifications required if an automatic monitoring channel is inoperable. These verification frequencies are adequate for assuring that the applicable LCOs are satisfied. The Digital Rod Position Indication (DRPI) System is defined as follows:* Rod position indication as displayed on DRPI display panel (MB4), or* Rod position indication as displayed by the Plant Process Computer System.With the above definition, LCO 3.1.3.2, "ACTION a." is no applicable with either DRPI display panel or the plant process computer points OPERABLE.The plant process computer may be utilized to satisfy DRIPI System requirements which meets LCO 3.1.3.2, in requiring diversity for determining digital rod position indication. Technical Specification SR 4.1.3.2.1 determines each digital rod position indicator to be OPERABLE by verifying the Demand Positioni Indication System and the DRPI System agree within 12 steps at the frequency specified in the Surveillance Frequency Control Program, except during the time when the rod position deviation monitor is inoperable, then compare the Demand Position Indication System and the DRIPI System at least once each 4 hours.The Rod Deviation Monitor is generated only from the DRIPI panel at M4I34. Therefore, when rod position indication as displayed by the plant process computer is the only available indication, then perform SURVEILLANCE REQUIREMENTS every 4 hours.MILLSTONE -UNIT 3 B 3/4 1-4 Amendment No. 6Q0 : LBDCR 12-MP3-010 September 20, 2012 REACTIVTY CONTROL SYSTEMS D BASES MOVABLE CONTROL ASSEMBLIES (Continued) Additional surveillance is required to ensure the plant process computer indications are in agreement with those displayed on the DRPI. This additional SURVEILLANCE REQUIREMENT is as follows: Each rod position indication as displayed by the plant process computer shall be determined to be OPERABLE by verifying the rod position indication as displayed on the DRPI display panel agrees with the rod position indication as displayed by the plant process computer at the frequency specified in the Surveillance Frequency Control Program.The rod position indication, as displayed by DRPI display panel (@AB4), is a non-QA system, calibrated on a refueling interval, and used to implement T/S 3.1.3.2. Because the plant process computer receives field data from the same source as the DRPI System (MB4), and is also calibrated on a refueling interval, it fully meets all requirements specified in T/S 3.1.3.2 for rod position. Additionally, the plant process computer provides the same type and level of accuracy as the DRPI System (MB4). The plant process computer does not provide any alarm or rod position i deviation monitoring as does DRPI display panel (MB4).For Specification 3.1.3.1 ACTIONS b. and c., it is incumbent upon the plant to verify the trippability of the inoperable control rod(s). Tripp ability is defined in Attachment C to a letter dated December 21, 1984, from E. P. Rahe (Westinghouse) to C. 0. Thomas (NRC). This may be by verification of a control system failure, usually electrical in nature, or that the failure is....as.sociated with the control rod stepping mechanism. In the event the plant is unable to verify the rod(s) trippability, it must be assumed to be untrippable andi-thus f~alls undr therequirements of-ACTION a. Assuming a controlled shutdoWn from 100% RATED THERMAL POWER, this allows approximately 4 hours for this verification. For LCO 3.1.3.6 the control bank insertion limits are specified in the CORE OPERATING LIMITS REPORT (COLR). These insertion limits are the initial assumptions in safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions, assumptions of available SHUTDOWN MARGIN, and initial reactivity insertion rate.The applicable I&C calibration procedure (Reference 1.) being current indicates the associated circuitry is OPERABLE.There are conditions when the Lo-Lo and Lo alarms of the RIu Monitor are limited below the RIL specified in the COLR. The RIL Monitor remains OPERABLE because the lead control rod bank still has the Lo and Lo-Lo alarms greater than or equal to the RIL.MILLSTONE -UNIT 3 B3415AedetN.6 B 3/4 1-5 Amendment No. 60 LBDCR 14-MP3-005 May 8, 2014 REACTIVITY CONTROL SYSTEMS BASES MOVABLE CONTROL ASSEMBLIES (Continued) When rods are at the top of the core, the Lo-Lo alarm is limited below the RIL to prevent spurious alarms. The RIL is equal to the Lo-Lo alarm until the adjustable upper limit setpoint on the RIL Monitor is reached, then the alarm remains at the adjustable upper limit setpoint. When the RIL is in the region above the adjustable upper limit setpoint, the Lo-Lo alarm is below the RIL.

References:

1. SP 3451N23, Rod Insertion Limits Calibration.

2. Letter NS-OPLS-OPL-1-91-226, (Westinghouse Letter NEU-91-563), dated April 24, 1991.3. Millstone Unit 3 Technical Requirements Manual, Appendix 8.1, "CORE OPERATING LIMITS REPORT".4. Westinghouse Letter NEU-07-62, "MPS3 -SPUP RCCA Drop Time," dated June 4, 2007.5. Westinghouse Letter 98NEU-G-0060, "Millstone Unit 3. -Robust Fuel Assembly (Design Report) and Generic SECL," dated October 2, 1998.MILLSTONE

-UNIT 3 B3416Amnmn o B 3/4 1-6 Amendment No. LBDCR No. 04~-MP3-0l5 February 24, 2005 3/4.2 POWER DISTRIBUTION LIMITS BASES The specifications of this section provide assurance of fuel integrity during Condition I (Normal Operation) and II (Incidents of Moderate Frequency) events by: (1) maintaining the minimum DNBR in the core greater than or equal to the design limit during normal operation and*in short-tenn transients, and (2) limiting the fission gas release, fuel pellet temperature, and cladding mechanical properties to within assumed design criteria. In addition, limiting the peak linear power density during Condition I events provides assurance that the initial conditions assumed for the LOCA analyses are met and the ECCS acceptance criteria limit of 2200°F is not exceeded.The definitions of certain hot channel and peaking factors as used in these specifications-are as follows: FQ(Z) Heat Flux Hot Channel Factor, is defined as the maximum local heat flux on thle surface of a fuel rod at core elevation Z divided by the average fuel rod heat flux, allowing for manufacturing tolerances on fuel pellets and rods;, and F NNuclear Enthalpy Rise. Hot Channel Factor, is defined as the ratio of the integral of AH linear power along the rod with the highest integrated power to the average rod power.3/4.2.1 AXIAL FLUX DIFFERENCE The limits on AXIAL FLUX DIFFERENCE (AFD) assure that the FQ(Z) up~per bound envelope of the FQ limit specified in. the CORE OPERATING LIMITS REPORT (COLR) times.the normalized axial peaking factor is not exceeded during either normal operation or in the event of xenon redistribution following power changes.Target flUX difference is determined at equilibrium xenon conditions. The full-length rods may be positioned within the core in accordance with their respective insertion limits and should be inserted near their normal position for steady-state operation at high power levels.' The val~ue of the target flux difference Obtained under these conditions divided by the fraction of RATED THERMAL POWER is the target flux difference at RATED THERMAL POWER for the.associated core burnup conditions. Target flux differences for other THERMAL POWER levels are obtained by multiplying the RATED THERMAL POWER value by the appropriate fractional THERMAL POWER level. The periodic updating of the target flux difference value is necessary to reflect core burnup considerations. MILLSTONE -UNIT 3 B 3/4 2-1 Amendment No. g0, 60, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015 Februaiy 24, 2005 POWER DISTRIBUTION LIMITS BASES AXIAL FLUX DIFFERENCE (Continued) At power lev'els below APLND, the limits on AFD are defined in the COLR consistent with thae Relaxed Axial Offset Control (RAOC) operating procedure and limits. These limits were calculated in a manner such that expected operational transients, e.g., load follow operations, would not result in the AFD deviating outside of those limits. However, in the event such a deviation occurs, the short period of time allowed outside of the limits at reduced power levels will not result in significant xenon redistribution such that the envelope of peaking factors would change sufficiently to prevent operation in the vicinity of the APLND power level.At power levels greater than APLNO, two modes of operation are permissible: (1) RAOC, the AFD limit of which are defined in the COLR, and (2) base load operation, which is defined as the maintenance of the AFD within COLR specifications band about a target value. The RAOC operating procedure above APLNO is the same as that defined for operation, below APLND.However, it is possible when following extended load following maneuvers that the AFD limits may result in restrictions in the maximum allowed power or AFD in order to guarantee operation with FQ(Z) less than its limiting value. To allow operation at. the maximum permissible power level, the base load operating procedure restricts the indicated AFD to relatively small target band (as specified in the COLR) and power swings (APLND < power < APLBL or 100% RATED THERMAL POWER, whichever is lower). For base load operation, it is expected that the plant will .operate within the target band. Operation outside of the target band for the short time period allowed will not result in significant xenon redistribution such that the envelope of peaking factors wotuld change sufficiently to prohibit cohatint~e&d operation iti the power tegiori defined above.. To assure there is no residual xenon redistribution impact from .past operation on the base load operation, a 24-hour waiting period at a power level above APLND and allowed by RAOC is necessary. During this time period load changes and rod motion are restricted to that allowed by the base load procedure. After the waiting period, extended base load operation is permissible. The computer determines the 1-minute average of each of the oPERABLE excore detector outputs and provides an alarm message immediately if the AFD for at least 2 of 4 or 2 of 3 OPERABLE excore channels are: (1) outside the allowed delta-I power operating space (for RAOC operation), or (2) outside the allowed delta-I target band (for base load operation). These.alarms are active when power is greater than (1) 50% of RATED THERMAL POWER (for RAOC operation), or MILLSTONE -UNIT 3 B 3/4 2-2 Amendment No. NO, 60, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 06-MP3-014 June 22, 2006 POWER DISTRIBUTION LIMITS BASES AXIAL FLUX DIFFERENCE (Continued) (2) APN (for base load operation). Penalty deviation minutes for base load operation are not accumulated based on the short period of time during which operation outside of the target band is allowed.3/4.2.2 AND 3/4.2.3 HEAT FLUX HOT CHANNrEL FACTOR AND RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR The limits on heat flux hot channel factor, RCS flow rate, and nuclear enthalpy rise hot channel factor ensure that: (1) the design limits on peak local power density and minimum.DNBR are not exceeded and (2) in the event of a LOCA the peak fuel clad temperature will not exceed the 2200°F ECCS acceptance criteria limit.Each of these is mieasurable but will normally only be determined periodically as specified in Specifications 4.2.2 and 4.2.3. This periodic sutrveillance is sufficienat to ensure that the limits are maintained provided: a. Control rods in a single group move together with no individual rod insertion differing by more than +/-12 steps, indicated, from the group demand position;b. Control rod groups are sequenced with overlapping groups as described in Specification 3.1.3.6;c. The control rod insertion limits of Specifications 3.1.3.5 and 3.1.3.6 are maintained; and d. The axial power distribution, expressed in terms of AXIAL FLUX DIFFERENCE, is maintained within the lhinits.FNAH will be maintained within its limits provided Conditions

a. through d. above are maintained.

The relaxation of FNAH as a function of THERMAL POWER allows changes in the radial power shape for all permissible rod insertion limits.The FNaH as calculated in Specification 3.2.3.1 is used in the various accident analyses where FNN_ influences parameters other than DNBR, e.g., peak clad temperature, and thus is the maximum "as measured" value allowed.The RCS total flow rate and FNAHt are specified in the CORE OPERATING LIMITS REPORT (COLR) to provide operating and analysis flexibility from cycle to cycle. However, the minimum RCS flow rate, that is based on 10% steam generator tube plugging, is retained in the Technical Specifications. MILLSTONE -UNIT 3 B 3/4 2-3 MILSTOE -UNI 3 3/2-3Amendment No. .5-, 60, _9-1--7-, LBDCR 12-MP3-010 September 20, 2012 POWER DISTRIBUTION LIMITS BASES 3/4.2.2 and 3/4.2.3 HEAT FLUX HOT CHANNEL FACTOR and RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR (Continued) Margin is maintained between the safety analysis limit DNBR and the design limit DNBR. This margin is more than sufficient to offset the effect of rod bow and any other DNB penalties that may occur. The remaining margin is available for plant design flexibility. When an FQ measurement is taken, an allowance for both experimental error and manufacturing tolerance mnust be made. An allowance of 5% is appropriate for a full core map taken with the incore detector flux mapping system and a 3% allowance is appropriate for manufacturing tolerance. The heat flux hot channel factor, FQ(Z), is measured periodically in accordance with the Surveillance Frequency Control Program using the incore detector system. These measurements are generally taken with the core at or near steady state conditions. Using the measured three dimensional power distributions, it is possible to derive F.QM~z),.a computed value Of FQ..(Z).However, because this value represents a steady state condition, it does not include the variations in the value Of FQ(Z) that are present during nonequilibrium situations. To account for these possible variations, the steady state limit of FQ(Z) is adjusted by an elevation dependent factor appropriate to either RAOC or base load operatio~n, W(~Z) or W(Z)BL, that accounts for the calculated worst case transient conditions. The W(Z) and W(Z)BL, factors described above for normal operation are specified in the COLR per Specification 6.9.1.6. Core monitoring and control under nonsteady state conditions are accomplished by operating the core within the limits of the appropriate LCOs, including the limits on AFD, QPTR, and control rod insertion. Evaluation of the steady state FQ(Z) limit is performed in Specification 4.2.2.1 .2.b and 4.2.2.1.4.b while evaluation nonequilibriumn limits are performed in Specification 4.2.2.1.2.c and 4.2.2.1 .4.c.When RCS flow rate and FNAH_ are measured, no additional allowances are necessary prior to comparison with the limits of the Limiting Condition for Operation. Measurement errors for RCS total flow rate and for have been taken into account in determination of the design DNBR value.The measurement error for RCS total flow rate is based upon performing a precision heat balance and using the result to calibrate the RCS flow rate indicators. To perform the precision heat balance, the instrumentation used for determination of steam pressure, feedwater pressure, feedwater temperature, and feedwater venturi AP in the calorimetric calculations shall be calibrated in accordance with the Surveillance Frequency Control Program. Potential fouling of.the feedwater venturi which might not be detected could bias the result fl'om the precision heat balance in a non-conservative manner. Any fouling which might bias the RCS flow rate measurement can be detected by monitoring and trending various plant perfonmance parameters. If detected, action shall be taken before performing subsequent precision heat balance measurements, i.e., either the effect of the fouling shall be quantified and compensated for in the RCS flow rate measurement or the venturi shall be cleaned to eliminate the fouling.MILLSTONE -UNIT 3 B 3/4 2-4 MILLTONE-UNT 3 3/42-4Amendment No. 2, 61), -!-7@,2-7 LBD CR 12-MP3-010 September 20, 2012 POWER DISTRIBUTION LIMITS BASES HEAT FLUX HOT CHANNhEL FACTOR and RCS FLOW RATE AND1T NUCLEAR ENTHAIPY RISE HOT CHAINNEL FACTOR (Continued) The periodic surveillance of indicated RCS flow in accordance with the Surveillance Frequency Control Program is sufficient to detect only flow degradation which could lead to operation outside the acceptable region of operation defined in Specifications 3.2.3.1.3/4.2.4 QUADRANT POWER TILT RATIO The QUADRANT POWER TILT RATIO limit assures that the radial power distribution satisfies the design values used in the power capability analysis. Radial power distribution measurements are made during STARTUP testing and periodically during POWER OPERATION. The limit of 1.02, at which corrective action is required, provides DNB and linear heat generation rate protection with x-y plane power tilts. A limiting tilt of 1.025 can be tolerated before the margin for uncertainty in FQ is depleted. A limit of 1.02 was selected to provide an allowance for the uncertainty associated with the indicated power tilt.The 2-hour" time allowance for operation with a tilt condition greater than 1.02 but less than 1.09 is provided to allow identification and correction of a dropped or misaligned control rod. In the event such action does riot conrect the tilt, the margin for uncertainty on FQ is reinstated by reducing the maximum allowed power by 3% for each percent of tilt in excess of 1.For purposes of monitoring QUADRANT POWER TILT RATIO when one excore detector is inoperable, the moveable incore detectors are used to confirm that the normalized symmetric power distribution is consistent with the QUADRANT POWER TILT RATIO. The incore detector monitoring is done with a full incore flux map or two sets of four symmetric thimbles. The two sets of four symmetric thimbles is a unique set of eight detector locations. These locations are C-8, E-5, E-11, H-3, H-13, L-5, L-11, N-8.3/4.2.5 DNB The limits on the DNB-related parameters assure that each of the parameters are mnaintained within the normal steady-state envelope of operatioii assumed in the transient and accident analyses. The limits are consistent with the initial FSAR assumptions and have been analytically demonstrated adequate to maintain a minimum DNBR greater than the design limit throughout each analyzed transient. The indicated Tavg values MILLS TON~E -UNIT 3 B 3/4 2-5 Amnendment No. 7-, .50, 60,1),!7-LBDCR 12-MP3-010 September 20, 2012 POWER DISTRIBUTION LIMITS BASES DNB PARAMETERS (Continued) and the indicated pressurizer pressure values are specified in the CORE OPERATING LIMITS REPORT. The calculated values of the DN-B related parameters will be an average of the indicated values for the OPERABLE channels.The periodic surveillance of these parameters through instrument readout in accordance with the Surveillance Frequency Control Program is sufficient to ensure that the parameters are restored within their limits following load changes and other expected transient operation. Measurement uncertainties have been accounted for in detennining the parameter linuits.MILLSTONE -UNIT 3 B 3/4 2-6 MILLSONE -UNIT3 B 342-6Amendment No. 4-!, 60, -- LBDCR 12-MIP3-010 September 20, 2012 3/4.3 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION The OPERABILITY of the Reactor Trip System and the Engineered Safety Features Actuation System instrumentation and interlocks ensures that: (1) the associated action and/or Reactor trip will be initiated when the parameter monitored by each channel or combination thereof reaches its setpoint, (2) the specified coincidence logic is maintained, (3) sufficient redundancy is maintained to permit a channel to be out of service for testing or maintenance, and (4) sufficient system functional capability is available from diverse parameters. The OPERABILITY of these systems is required to provide the overall reliability, redundancy, and diversity assumed available in the facility design1 for the protection and mitigation of accident and transient conditions. The integrated operation of each of these systems is consistent with the assumptions used in the safety analyses. The Surveillance Requirements specified for these systems ensure that the overall system fimlctional capability is maintained comparable to the original design standards. The periodic surveillance tests performed are sufficient to demonstrate this capability. The surveillance frequency is controlled under the Surveillance Frequency Contr'ol Program.The Engineered Safety Features Actuation System Nominal Trip Setpoints specified in Table 3.3-4 are the nominal values of which the bistables are set for each functional unit. The Allowable Values (Nominal Trip Setpoints +/-- the calibration tolerance) are considered the Limiting Safety System Settings as identified in lOCFR5O.36 and have been selected to mitigate the consequences of accidents. A Setpoint is considered to be consistent with the nominal value when the measured "as left" Setpoint is within the administratively controlled (#) calibration tolerance identified in plant procedures (which specifies the difference between the Allowable Value and Nominal Trip Setpoint). Additionally, the Nominal Trip Setpoints may be adjusted in the conservative direction provided the calibration tolerance remains unchanged. Measurement and Test Equipment accuracy is administratively controlled by plant procedures and is included in the plant uncertainty calculations as defined in WCAP- 10991.OPERABILITY determinations are based on the use of Measurement and Test Equipment that confonns with the accuracy used in the plant uncertainty calculation. The Allowable Value specified in Table 3.3-4 defines the limit beyond which a channel is.inoperable. If the process rack bistable setting is measured within the "as left" calibration tolerance, which specifies the difference between the Allowable Value and Nominal Trip Setpoint, then the channel is considered to be OPERABLE.MILLSTONE -UNMT 3B3/31AmnetNo -9 B 3/43-1 Amendment No. 4-5-9 LBDCR 12-MP3-010 September 20, 2012 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINJEERED SAFETY FEATUIRES ACTUATION SYSTEM 1NSTRUMIENTATION (Continued). The methodology, as defined in WCAP-10991 ito derive the Nomhinal Trip Setpoints, is based upon combining all of the uncertainties in the channels. Inherent in the detennination of the Nominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and other instrumentation utilized in these channes should be capable of operating within the allowances of these uncertainty magnitudes. Occasional drift in excess of the allowance may be determined to be acceptable based on the other device perfonnance characteristics. Device drift in excess of the allowance that is more than occasional, may be indicative of more serious problems and would warrant further investigation. The above Bases does not apply to the Control Building Inlet Ventilation radiation monitors ESF Table (Item 7E). For these radiation monitors the allowable values are essentially nominal values.Due to the uncertainties involved in radiological parameters, the methodologies of WCAP- 10991 were not applied. Actual trip setpoints will be reestablished below the allowable value based on calibration accuracies and good practices. The OPERABILITY requirements for Table 3.3-3, Functional Units 7.a, "Control Building Isolation, Manual Actuation," and 7.e, "Control Building Isolation, Control Building Inlet Ventilation Radiation," are defined by table notation "*". These functional units are required to be OPERABLE at all times during plant operation in MODES 1, 2, 3, and 4. These functional units are also required to be OPERABLE during movement of recently irradiated fuel assemblies, as -specified by table notation "*i". The Control Building Isolation Manual Actuation and Control Building.Inlet Ventilation Radiation are required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 350 hours*). Table notation "*" of Table 4.3-2 has the same applicability. The verification of response time provides assurance that the reactor iri and the engineered safety features actuation associated with each channel is completed within the tim~e limit assumed in the safety analysis. No credit is taken in the analysis for those channels with response times indicated as not applicable (i.e., N.A.). The surveillance frequency is controlled under the Surveillance Frequency Control Program.Required ACTION 4. of Table 3.3-1 is modified by a Note to indicate that nonnal plant control operations that individually add limited positive reactivity (e.g., temperature or b~oron fluctuations associated with RCS inventory management or temperature control) are not precluded by this ACTION provided they are accounted for in the calculated SDM. The proposed change pennits operations introducing positive reactivity additions but prohibits the temperature change or overall boron concentration from decreasing below that required to maintain the specified SDM or required boron concentration.

• During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.MILLSTONE

-UNIT 3 B 3/4 3:2 Amendment No. 3,-9-1, 4-!-9,14-7-, 4-7, 2-!9, -230 O March 17, 2004 INSTRUMENTATION BASES I': 3/4.3-1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION andl ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) Response time may be verified. by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic responsetimes with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g. vendor) test measurements, or (3) utilizing vendor engineering specifications. WCAP-13 632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor~response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test. Detector response times may be measured by the in-situ online noise analysis-response time degradation method described in the Westinghouse Topical Report, "The Use of Process Noise Measurements to Determine Response Characteristics of Protection Sensors in U.S. Plants," dated August 1983.WCAP- 14036, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification .of the protection system channel response time.O I The allocations for sensor, signal conditioning and actuation logic response times must be verified i! prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response._ time provided the parts used for repair are of the same. type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter. The Engineered Safety Features Actuation System senses selected plant parameters and determines whether or not predetermined limits are being exceeded. If they are, the signals are combined into logic matrices sensitive to. combinations indicative of various accidents, events, and transients. Once the required logic combination is completed, the system sends actuation signals to those Engineered Safety Features components whose aggregate function best serves the.requirements of the condition. As an example, the following actions may be initiated by the Engineered Safety Features Actuation System to mitigate the consequences of a steam line break or loss-of-coolant accident: (1) Safety Injection pumps start and automatic valves position, (2)Reactor trip, (3) feed-water isolation, (4) startup of the-emergency diesel generators, (5) quench spray pumps start and automatic valves .position, (6) containment isolation, (7) steam line isolation, (8) Turbine trip, (9) auxiliary feedwater pumps start, (10) Service water pumps start and automatic valves position, and (1 1) Control Room isolates.O MILLSTONE -UNIT 3 B 3/4 3-2a Amendment No. 3, 9-3-, 4-98, 219 LBDCR No. 0J4-MP3-015 February 24, 2005 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) For slave relays, or any auxiliary relays in: ESFAS circuits that are of the type Potter & Brumfield MVDR series relays, the SLAVE RELAY TEST is performed at an "R" frequency (at least once every 18 months) provided the relays meet the reliability assessment criteria presented in WCAP- 13 878, of Potter and Brumfield MDR series relays," and WCAP-13 900, "Extensiin of Slave Relay Surveillance Test Intervals." The reliability assessments performed as part of the aforementioned WCAPs are relay specific and apply only to Potter and B~rumfield MDR series relays. Note that for normally energized applications, the relays may have to be replaced periodically in accordance with the guidance given in WCAP-13 878 for MDR relays.REACTOR TRIP BREAKER This trip function applies to the reactor trip breakers (RTBs) exclusive of individual trip mechanisms. The LCO requires two OPERABLE trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single RTS logic train that are racked in, closed, and capable of supplying power to the control rod drive (CRD) system. Thus, the train may consist of the main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the system configuration. Two OPERABLE trains ensure no single random failure can disable the RTS trip capability. These trip f-unctions must be.OPE.R.AB3LE in MODE 1 .or 2 when the reactor is critical.. In MODE 3, 4, or 5, these RTS trip functions must be OPERABLE when the RTBs or associated bypass breakers are closed, and the CRD system is capable of rod withdrawal. BYPASSED CHANNEL* -. Technical Specifications 3.3.1 and 3.3.2 often allow the bypassing of instrument channels in the case of an inoperable instrument or for surveillance testing.A BYPASSED CHARNEL shall be a channel which is:* Required to be .in its accident or tripped condition, but is not presently in its accident or tripped condition using a method described below; or* Prevented from tripping.MILLSTONE -UNIT 3 B 3/4 3-2b Amendment No. 24-9, Acknowledged by NRC letter dated 08/25/05 March 17, 2004 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) A channel may be bypassed by:* Insertion of a simulated signal to the bistable; or* Failing the transmitter or input device to the bypassed condition; or* Returning a channel to service in a untripped condition; or* An equivalent method, as determined by Engineering and I&C*Bypass switches exist only for NIS source range, NIS intermediate range, and containment pressure Hi-3.TRIPPED CHANN'EL -Technical Specifications 3.3.1 and 3.3.2 often require the tripping.of instrument channels in the case of an inoperable instrument or for surveillance testing.A TRIPPED CHANNEL shall be a channel which is in its required accident or tripped condition. A channel may be placed in trip by:-The Bistable Trip Switches; or.. ....o Insertion of a simulated signal to the bistable; or* Failing the transmitter or input device to the tripped condition; or* An equivalent method, as determined by Engineering and I&C The Engineered Safety Features Actuation System interlocks perform the following functions: P-4 Reactor tripped -Actuates Turbine trip, closes main feedwater valves on Tav below Setpoint, prevents the opening of the main feedwater valves which were closed by a Safety Injection or High Steam Generator Water Level signal, allows Safety Injection block so that components can be reset or tripped.Reactor not tripped .- prevents manual block of Safety Injection. MILLSTONE -UNIT 3 B 3/4 3-3 MILLTONE-UNT 3 3/43-3Amendment No. 4-, 4-64, 219 LBDCR ¶ 0-MP3-003 February 23, 2010 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) P-Il On increasing pressurizer pressure, P-1l automatically reinstates Safety Injection actuation on low pressurizer pressure and low steam line pressure. On decreasing pressure, P-l1 allows the manual block of Safety Injection actuation on low pressurizer pressure and low steam line pressure.P-12 On increasing reactor coolant ioop temperature, P-12 automatically provides an arming signal to the Steam Dump System. On decreasing reactor coolant loop temperature, P-12 automatically removes the arming signal from the Steam Dump System.P-14 On increasing steam generator water level, P-14 automatically trips all feedwater isolation valves, main feed pumps and main turbine, and inhibits feedwater control valve modulation. P-19 Upon decreasing Reactor Coolant System pressure, permits the cold leg injection valves to automatically open upon receipt of a Safety Injection signal.314.3.3 MONITORING INSTRUMENTATION 3/4.3.3.1 RADIATION MONITORING FOR PLANT OPERATIONS The OPERABILITY of the radiation monitoring instrumentation for plant operations ensures.that: (1) the associated action will be initiated when the radiation level monitored by each channel or combination thereof reaches its Setpoint, (2) the specified coincidence logic is maintained, and (3) sufficient redundancy is maintained to permit a channel to be out-of-service for testing or maintenance. The radiation monitors for plant operations .senses radiation levels in selected plant systems and locations and determines whether or not predetermined limits are being exceeded. If they are, the signals are combined into logic matrices sensitive to combinations indicative of various accidents and abnormal conditions. Once the required logic combination is completed, the system sends actuation signals to initiate alarms.The Fuel Storage Pool Area Monitor is required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 350 hours*).*During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.MILLSTONE -UNIT 3 B 3/4 3-4 MILLTONE-UIT 3B 3/3-4Amendment No. 49-3, 2-1-9 LBDCR October 21, 2008 INSTRUMENTATION BASES 3/4.3.3.2 DELETED 3/4.3.3.3 DELETED 3/4.3.3.4 DELETED 3/4.3.3.5 REMOTE SHUTDOWN INSTRUMENTATION The OPERABILITY of the Remote Shutdown Instrumentation ensures that sufficient capability is available to permit safe shutdown of the facility from locations outside of the control room. This capability is required in the event control room habitability is lost and is consistent with General Design Criterion 19 of 10 CFR Part 50.Calibration of the Intermediate Range Neutron Amps channel from Table 4.3-6 applies to the signal that originates from the output of the isolation amplifier within the intermediate range neutron flux processor drawers in the control room and terminates at the displays within the Auxiliary Shutdown Panel.The OPERABILITY of the Remote Shutdown Instrumentation ensures that a fire will not.preclude achieving safe shutdown. The remote shutdown monitoring instrumentation, control, and power circuits and transfer switches necess.a~ryto eliminate effects of the fire and allow operation of instrumentation, control and power circuits required to achieve and maintain a safe-shutdown condition are independent of areas where a fire could damage systems normally used to shut down the reactor. This capability is consistent with General Design Criterion 3 and Appendix R to 10 CFR Part 50.3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION The OPERABILITY of the accident monitoring instrumentation ensures that sufficient information is available on selected plant parameters to monitor and assess these variables following an accident. The instrumentation included in this specification are those instruments provided to monitor key variables, designated as Category 1 instruments following the guidance for classification contained in Regulatory Guide 1.97, Revision 2, "Instrumentation for Light-Water-Cooled Nuclear Power Plants To Assess Plant and Environs Conditions During and Following an Accident." MILLSTONE -UNIT 3 B 3/4 3-5 MILLTON -JNIT3 B3/43-5Amendment No. 3, :76, g4, 2, 2-1-9, LBDCR No;.04.-MP3-015 February 24, 2005 INSTRUMENTATION BASES 3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued) ACTION Statement "a": The use of one main control board indicator and one computer point, total of two indicators per steam generator, meets the requirements for the total number of channels for Auxiliary Feedwater flow rate. The two channels used to satisfy this Technical Specification for each steam generator are as follows: Steam Instrument (M5 Instrument .(Computer),enerator S/G 1 FWA*FI51A1 (Orange) FWA -F33A3 (Purple)S/G 2 FWA*FI33B 1 (Purple) FWA -F51 B3 (Orange)I/G 3 FWA*FI33C1 (Purple) FWA -F51 C3 (Orange)S/0 4 FWA*FI51D1 (Orange) FWA -F33D3 (Purple)The SPDS computer point for auxiliary feedwater flow will be lost 30 minutes following an LOP when the power supply for the plant computer is lost. However, this design configuration -one continuous main control board indicator and one indication via the SPDS/plant computer, total of two per steam generator -was submitted[-o~ the-N!C via "Response to question 420.6" dated January 13, 1984, B 11002. NRC review and approval was obtained with the acceptance of MP3, SSER 4 Appendix L, "Conformance to Regulatory Guide 1.97," Revision 2. (dated November 1985).LCO 3.3.3.6, Table 3.3-10, Item (17), requires 2 OPERABLE reactor vessel water level (heated junction thermocouples -IHJTC) channels. An OPERABLE reactor vessel water level channel shall be defined as: 1. Four or more total sensors operating.

2. At least one of two operating sensors in the upper head.3. At least three of six operating sensors in the upper plenum.MILLSTONE

-UNIT 3 B 3/4 3-5a Amendment No. :3, :-6, 84, 4-42, 2-1-9, Acknowledged by NRC letter dated 08/25/05 LBDCR 05-MP3-028 November 30, 2005 INSTRUMENTATION BASES 3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued) A channel is OPERABLE if four or more sensors, half or more in the upper head region and half or more in the upper plenum region, are OPERABLE.In the event more than four sensors in a Reactor Vessel Level channel are inoperable, repairs may only be possible during the next refueling outage. This is because the sensors are accessible only after the missile shield and reactor vessel head are removed. It is not feasible to repair a channel except during a refueling outage when the missile shield and reactor vessel head are removed to refuel the core. If only one channel is inoperable, it should be restored to OPERABLE status in a refueling outage as soon as reasonably possible. If both channels are inoperable, at least one channel shall be restored to OPERABLE status in the nearest refueling outage..... The Reactor Coolant System Subcooling Margin Monitor, Core Exit The.rmocouples, and Reactor Vessel Water Level instruments are processed by two separate trains of ICC (Inadequate Core Cooling) and HJTC (Heated Junction ThennoCouple) processors. The preferred indication for these parameters is the Safety Parameter Display System (SPDS) via the non-qualified PPC (Plant Process Computer) but qualified indication is provided in the instrument rack room. When.the PPC data links cease to transmit data, the processors must be reset in order to restore the flow of data to the PPC. During reset, the qualified indication in the instrument rack room is lost.These instruments are OPERABLE during this reset since the indication is only briefly interrupted while the processors reset and the indication is promptly restored. The sensors are not removed from service during this reset. The train should be considered inoperable only if the qualified indication fails to be restored following reset. Except for the non-qualified PPC display, the instruments operate as required.3/4.3.3.7 DELETED 3/4.3.3.8 DELETED 3/4.3.3.9 DELETED 3/4.3.3.10 DELETED 3/4.3.4 DELETED MILLSTONE -UN4IT 3 B 3/4 3-6 Amendment No. 4-8%, 9-3,-24-9, Acknowledged by NRC Letter dated 04/12/06 REVERSE OF PAGE B 3/4 3-6 INTENTIONALLY LEFT BLANK 0 LBDCR No. 04-MP3-015 February 24, 2005 INSTRUMENTATION .. BASES 3/4.3.5 SHUJTDOWN MARGIN MONITOR The Shutdown Margin Monitors provide an alarm that a Boron Dilution Event may be in progress. The minimum count rate of Specification 3/4.3.5 and the SHUTDOWN MARGIN requirements specified in the CORE OPERATING LIMITS REPORT for MODE 3, MODE 4 and MODE 5 ensure that at least 15 minutes are available for operator action from the time of the " Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. By borating an additional 1:50 ppm above the SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT for MODE 3 or 350 ppm above the SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT for MODE 4, MODE 5 With RCS loops filled, or MODE 5 with RCS loops not filled, lower values of minimum count rate are accepted.Shutdown Margin Monitors

Background:

The purpose of the Shutdown Margin Monitors (SMM) is-to annunciate an increase in core subcritical multiplication allowing the operator at least 15 minutes response time to mitigate the consequences of the inadvertent addition of unborated primary grade water (boron dilution event)into the Reactor Coolant System (RCS) when the reactor is shut down (MODES 3, 4, and 5).* The SMMs utilizes two channels of source range instrumentation (GM detectors). Each channel.provides a signal to its applicable train of SMM. The SMM channel uses the last 600 or more counts to calculate the count rate and updates the measurement after 30 new counts or 1* Second, whichever is longer. Each channel has 20 registers that hold the counts (20 registers X 30 count=600 counts) for averaging the rate. As the .cduiit rate decreasges, the ldiigei- it takes t6 fIl the registers (fill the 30 count minimum). As the instrume~n.t's measured count rate decreases, the delay time in thie instrument's response increases. This delay time leads to the requirement of a minimum count rate for OPERABILITY. During the dilution event, count rate will increase to. a level above the normal steady state count rate. When this new count rate level increases above, the. instrument's setpoint, .the channel will alarm alerting the operator of the event.Applicable Safety Analysis The SMM senses abnormal increases in the source range count per second and alarms the operator of an inadvertent dilution event. This alarm will occur at least 15 minutes prior to the reactor achieving criticality. This 15 minute window allows adequate operator response time to terminate the dilution, FSAR Section 15.4.6.LCO LCO 3.3.5 providesthe requirements for OPERABILITY -of the instrumentation of the SMMs that are used to mitigate the boron dilution event. Two trains are required to be OPERABLE to provide protection against single failure.* MILLSTONE -UN4IT 3 B 3/4 3-7 Amendment No. 64, 217T-, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015 February 24, 2005 BASES (continued) Applicability 9 The SMM must be OPERABLE in MODES 3, 4, and 5 because the safety analysis identifies this system as the primary means to alert the operator and mitigate the event. The SMMs are allowed*to be blocked during start up activities in MODE 3 in accordance with approved plant procedures. The alarm is blocked to allow the SMM channels to be used to monitor the 1/M approach to criticality. The SMM are not required to be OPERABLE in MODES 1 and 2 as other RPS is credited with accident mitigation, over temperature delta temperature and power range neutron flux high (low setpoint of 25 percent RTP) respectively. The SMMs are not required to be OPERABLE in MODE 6 as the dilution event is precluded by administrative controls over all dilution flow paths (Technical Specification 4.1.1.2.2). ACTIONS*Channel inoperability of the SMMs can be caused by failure of the channel's electronics, failure of the channel to pass its calibration procedure, or by the channel's count rate falling below the minimum count rate for OPERABILITY. This can occur when the count rate is so low that the ]channel's delay time is in excess of that assumed in the safety analysis. In any of the above conditions, the channel must be declared inoperable and the appropriate ACTION statement entered. If the SMMs are declared inoperable due to low count rates, an RCS heatup will cause the SMM channel count rate to increase to above the minimum count rate for OPERCABILITY. I Allowing the plant to increase modes will actually return the SMMs to OPERABLE status. Once the SMM channels are above the minimum count rate for OPERABILITY, the channels can~be declared OPERABLE and the LCO ACTION statements can be exited-.LCO 3.3.5, ACTION a. -With one train of SMM inoperable, ACTION a. requires the inoperable train to be returned to OPERABLE status within 48 hours. In this condition, the remaining SMM train is adequate to provide protection. If the above required ACTION cannot be met, alternate compensatory actions must be performed to provide adequate protection from the boron dilution.event. All operations involving positive reactivity changes associated with RCS dilutions and rod~withdrawal must be suspended, and all dilution flowpaths must be closed and secured in position (locked closed per Technical Specification 4.1.1.2.2) within the following 4 hours.LCO 3.3.5, ACTION b. -With both trains of SMM inoperable, alternate protection must be provided: 1. Positive reactivity operations via dilutions and rod withdrawal are suspended. The intent of this ACTION is to stop any planned dilutions of the RCS. The SMMs are not intended to monitor core reactivity during RCS temperature changes. The alarm setpoint is routinely reset during the plant heatup due to the increasing count rate. During cooldowns as the count rate, decreases, baseline count rates are continually lowered automatically by the SMMs. The Millstone Unit No. 3 boron dilution. analysis assumes.steady state RCS temperature conditions. MILLSTONE -UNIT 3 B 3/4 3-8 Amendment No. 4-164, Acknowledged by NRC letter dated 08/25/05 LBDCR 12-MP3-010 September 20, 2012 INSTRUMENTATION 3/4.3.5 SHUTDOWN MARGIN MONITOR BASES (continued) Required ACTION b. is modified by a Note which permits plant temperature changes provided the temperature change is accounted for in the calculated SDM. Introduction of temperature changes, including temperature increases when a positive MTC exists, must be evaluated to ensure they do not result in a loss of required SDM.2. All dilution flowpaths are isolated and placed under admninistrativye control (locked closed). This action provides redundant protection and defense in depth (safety overlap) to the SMMs. In1 this configuration, a boron dilution event (BDE) cannot occur. This is the basis for not having to analyze for BDE in MODE 6. Since the BDE cannot occur with the dilution flow paths isolated, the SMMs are not required to be OPERABLE as the event cannot occur and OPERABLE SMMs provide no benefit.3. Increase the SIIUTDOWN MARGIN surveillance frequency fi-om the frequency specified in the Surveillance Frequency Control Program to every 12 hours. This action in combination with the above, provide defense in depth and overlap to the loss of the SMMs.Surveillance Requirements The SMMs are subject to an ANALOG CHANNEL OPERATIONAL TEST to ensure each train of SMM is fully operational. This test shall include verification that the SMvfls are set per the CORE OPERATING LIMITS REPORT. The surveillance fr'equency is controlled under the Surveillance Frequency Control Program.MILLSTONE-UNIT3 B 3/4 3-9 MILLSONE -UMT B 31 3-9Amendmnent No. 4-64, 2. REVERSE OF PAGE B 314 3-9 INTENTIONALLY LEFT BLANK LBDCR No. 06-MP3-005 May 25, 2006 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 REACTOR COOLANT LOOPS AND COOLANT CIRCULATION The purpose of Specification 3.4.1.1 is to require adequate forced flow rate for core heat removal in MODES 1 and 2 during all normal operations and anticipated transients. Flow is represented by the number of reactor coolant pumps in operation for removal of heat by the steam generators. To meet safety analysis acceptance criteria for DNB, four reactor coolant pumps are required at rated power. An OPERABLE reactor coolant ioop consists of an OPERABLE reactor coolant pump in operation providing forced flow for heat transport and an OPERABLE steam generator. With less than the required reactor coolant loops in operation this specification requires that the plant be in at least HOT STANDBY within 6 hours.In MODE 3, three reactor coolant loops, and in MODE 4, two reactor coolant loops provide sufficient heat removal capability for removing core decay heat even in the event of a bank withdrawal accident; however, in MODE 3 a single reactor coolant loop provides sufficient heat removal capacity~if a bank withdrawal accident can be prevented, i.e., the Control Rod Drive System is not capable of rod withdrawal. In MODE 4, if a bank withdrawal accident can be prevented, a single reactor coolant loop or RHR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations require that at least two loops (any combination of RI-R or RCS) be OPERABLE.In MODE 5, with reactor coolant loops filled, a single RUR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations require that at least two RIIR loops or at least one RIHR loop and two steam generators be OPERABLE.In MODE 5 with reactor coolant loops not filled, a single RHR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations, and the unavailability of the steam generators as a heat removing component, require that at least two RHR loops be OPERABLE.In MODE 5, during a planned heatup to MODE 4 with all RAIR loops removed from operation, an RCS loop, OPERABLE and in operation, meets the requirements of an OPERABLE and operating RI-R loop to circulate reactor coolant. During the heatup there is no requirement for heat removal capability so the OPERABLE and operating RCS loop meets all of the required functions for the heatup condition. Since failure of the RCS loop, which is OPERABLE and operating, could also cause the associated steam generator to be inoperable, the associated steam generator cannot be used as one of the steam generators used to meet the requirement of LCO 3.4.1l.4.1.b. MILLSTONE -UNIT 3 B 3/4 4-1 MILLTONE-UNT 3 3/44-1 Amendment No. 60, gO, 99, 4-5--5, -7, 2-t--7, LBDCR No. 04-MP3-015 February 24, 2005 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued) The operation of one reactor coolant pump (RCP) or one RH-R pump provides adequate flow to ensure mixing, prevent stratification and produce gradual reactivity changes during boron concentration reductions in the Reactor Coolant System. The reactivity change rate associated with boron reduction will, therefore, be within the capability of operator recognition and control.The restrictions on starting the first RCP in MODE 4 below the cold overpressure protection enable temperature (226°F), and in MODE 5 are provided to prevent RCS pressure transients. These transients, energy additions due to the differential temperature between the steam generator secondary side and the RCS, can result in pressure excursions which could challenge the PIT limits. The RCS will be protected against overpressure transients and will not exceed the reactor vessel isothermal beitline PIT limit by restricting RCP starts based on the differential water temperature between the secondary side of each steam generator and the RCS cold legs. The restrictions on starting the first RCP only apply to RCPs in RCS loops that are not isolated. The restoration of isolated RCS loops is normally accomplished with all RCPs secured.If an isolated RCS loop is to be restored when an RCP is operating,. the appropriate temperature differential limit between the secondary side of the isolated loop steam generator and the in service RCS cold legs is applicable, and shall be met prior to opening the loop isolation valves.The temperature differential limit between the secondary side of the steam generators and the RCS cold legs is based on the equipment providing cold overpressure protection as required by Technical Specification 3.4.9.3. If the pressurizer PORVs are providing cold overpressure protection, the steam generator secondary to RCS cold leg water temperature differential is limited to a maximum of 50°F. If any P1-R relief valve is providing cold overpressure protection and RCS cold leg temperature is above 150OT, the steam generator secondary water temperature must be at or below RCS cold leg water temperature. If any RHJR relief valve is providing cold overpressure protection and RCS cold leg temperature is at or below 150 0'F, the steam generator secondary to RCS cold leg water temperature differential is limited to a maximum of 50°F.Specification 3.4.1.5 The reactor coolant loops are equipped with loop stop valves that permit any loop to be isolated from the reactor vessel. One valve is installed on each hot leg and one on each cold leg.The loop stop valves are used to perform maintenance on an isolated loop. Operation in MODES 1-4 with a RCS loop stop valve closed is not permitted except for the mitigation of emergency or abnormal events. If a loop stop valve is closed for any reason, the required ACTIONS of this specification must be completed. To ensure that inadvertent closure of a loop stop valve does not occur, the valves must be open with power to the valve operators removed in MODES 1, 2, 3 and 4.MILLSTONE -UNIT 3 B 3/4 4-la Amendment No. 60, :7O, 9-9, .447, 4-9-7, 20-2,,2--7, j Acknowledged by NRC letter dated 08/25/05 W LBDCR 12-MP3-0i0 September 20, 2012 3/4.4 REACTOR COOLANT SYSTEM BASES The safety analyses performed for the reactor at power assume that all reactor coolant loops are initially in operation and the loop stop valves are open. This LCO places controls on the loop stop valves to ensure that the valves are not inadvertently closed in MODES 1, 2, 3 and 4.The inadvertent closure of a loop stop valve when the Reactor Coolant Pumps (RCPs) are operating will result in a partial loss of forced reactor coolant flow. If the reactor is at rated power at the time of the event, the effect of the partial loss of forced coolant flow is a rapid increase in the coolant temperature which could result in DNB with subsequent fuel damage if the reactor is not tripped by the Low Flow reactor trip. If the reactor is shutdown and a RCS loop is in operation removing decay heat, closure of the loop stop valve associated with the operating ioop could also result in increasing coolant temperature and the possibility of fuel damage.The loop stop valves have motor operators. If power is inadvertently restored to one or more loop stop valve operators, the potential exists for accidental closure of the affected loop stop valve(s) and the partial loss of forced reactor coolant flow. With power applied to a valve operator, only the interlocks prevent the valve from being operated. Although operating procedures and interlocks make the occurrence of this event unlikely, the prudent action is to remove power from the loop stop valve operators. The time period of 30 mninutes to remove power from the loop stop valve operators is sufficient considering the complexity of the task.Should a loop stop valve be closed in MODES 1 through 4, the affected valve must be maintained closed and the plant placed in MODE 5. Once in MODE 5, the isolated loop may be started in a controlled manner in accordance with LCO 3.4.1.6, "Reactor Coolant System Isolated Loop Star'tup." Opening the closed loop stop valve in MODES 1 tin'ough 4 could result in colder water or water at a loweriboron concentration being mixed with the operating RCS loops resulting in positive reactivity insertion. The time period provided in ACTION 3.4.1.5 .b allows time for borating the operating loops to a shutdown boration level such that the plant can be brought to MODE 3 within 6 hours and MODE 5 within 30 hours. The allowed ACTION times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.Surveillance Requirement 4.4.1.5 is perforned to ensure that the RCS loop stop valves are open, with power removed from the loop stop valve operators. The primamyr function of this Surveillance is to ensure that power is removed from the valve operators, since Surveillance Requirement 4.4.1.1 requires verification that all loops are operating and circulating reactor coolant, thereby ensuring that the loop stop valves are open. The frequency specified in the Surveillance Frequency Control Program ensures that the required flow is available. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 MILSTOE -UNI 3B 3/4 4-lb Amnendlnent No. 60, 7-0, 9-, 1-7,4-9-7-,-202,2-1 LBDCR No. 05-MVP3-026 October 19, 2005 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued) Specification 3.4.1.6 The requirement to maintain the isolated loop stop valves shut with power removed ensures that no reactivity addition to the core could occur due to the startup of an isolated loop.Verification of the boron concentration in an isolated loop prior to opening the first stop valve provides a reassurance of the adequacy of the boron concentration in the isolated loop.RCS Loops FilledINot Filled: In MODE 5, any RHR train with only one cold leg injection path is sufficient to provide adequate core cooling and prevent stratification of boron in the Reactor Coolant System.The definition of OPERABILITY states that the system or subsystem must be capable of performing its specified function(s). The reason for the operation of one reactor coolant pump (RCP) or .one RHR pump is to:* Provide sufficient decay heat removal capability

• Provide adequate flow to ensure mnixing to:* Prevent stratification
• Produce gradual reactivity changes due to boron concentration changes in the RCS The definition of "Reactor coolant loops filled" includes a ioop that is filled, swept, and vented, and capable of supporting natural circulation heat transfer.

This allows the non-operating RHR loop to be removed from service while filling and unisolating loops as long as steam generators on the OPERABLE reactor coolant loops are available to support decay heat removal.Any loop being unisolated is not OPERABLE until the ioop has been swept and vented. The process of sweep and vent will make the previously OPERABLE loops finoperable and the requirements of LCO 3.4.1.4.2, "Reactor Coolant System,.COLD SI{UTDOWN -Loops Not Filled," are applicable. When the RCS has been filled, swept and vented using an approved procedure, all unisolated loops may be declared OPERABLE.The definition of "Reactor coolant loops filled" also includes a ioop that has been vacuum [filled and capable of supporting natural circulation heat transfer. Any isolated loop that has been I vacuum filled is OPERABLE as soon as the loop is unisolated. One cold leg injection isolation valve on an RI-R train may be closed without considering the train to be inoperable, as long as the following conditions exist:* CCP temperature is at or below 95 0 F* Initial RUR temperature is below 1 84°F MILLSTONE -UNIT 3 B 3/4 4-ic Amendmnent No. ;2-4-7, Acknowledged by NRC Letter dated 04/12/06 LBDCR No._08-MP3-014 October 21, 2008 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued)

• The single RI-R cold leg injection flow path is no_! utilized until a minimum of 48 hours after reactor shutdown* CCP flow is at least 6,600 gpm* RHR flow is at least 2,000 gpm In the above system lineup, total flow to the core is decreased compared to the flow when two cold legs are in service. This is acceptable due to the substantial margin between the flow required for cooling and the flow available, even through a slightly restricted R.HR train.The review concerning boron stratification with the utilization of the single injection point line, indicates there will not be a significant change in the flow rate or distribution through the core, so there is not an increased concern due to stratification.

Flow velocity, which is high, is not a concern from a flow erosion or pipe loading standpoint. There are no loads imposed on the piping system which would exceed those experienced in a seismic event. The temperature of the fluid is low and is not significant from a flow erosion standpoint. The boron dilution accident analysis, for Millstone Unit 3 in MODE 5, assumes a full RHR System flow of approximately 4,000 gpm. Westinghouse analysis, Reference (1), for RHR flows down to 1,000 gpm, determined adequate mixing results. As the configuration will result in a R}IR flow rate only slightly less then 4,000 gpm:-here-is no concern in regards to a boron dilution accident.The basis for the requirement of two RCS loops OPERABLE is~to provide natural circulation heat sink in the event the operating RHR loop is lost. If the RI-R loop were lost, with two loops filled and two loops air bound, natural circulation would be established in the two filled loops.Natural circulation would not be established in the air bound loops. Since there would be no circulation in the air bound loops, there would be no mechanism for the air in those loops to be carried to the vessel, and subsequently into the filled loops rendering them inoperable for heat sink requirements. The LCO is met as long as at least two reactor coolant loops are OPERABLE and the following conditions are satisfied:

• One RI-R loop is OPERABLE and in operation, with exceptions as allowed in Technical Specifications; and MILLSTONE

-UNIT 3B3/4-dAemntN.2, B 3/4 4-1d Amendment No. g-t-7-, LBDCR. 04-MP3-001 December 10, 2003 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued) Either of the following: o An additional RHR loop OPERABLE, with exceptions as allowed in Technical Specifications; or* The secondary side water level of at least two steam generators shall be greater than .17% (These are assumed to be on OPERABLE reactor coolant loops)When the reactor coolant loops are swept, the mechanism exists for air to be carried into previously OPERABLE loops. All previously OPERABLE loops are declared inoperable and an additional RIIR loop is required OPERABLE as specified by LCO 3.4.1.4.2 for loops not filled.When the RCS has been filled, swept, and vented using an approved procedure, all unisolated loops may be declared OPERABLE.ISOLATED LOOP STARTUP The below requirements are for unisolating a loop with all four loops isolated while decay heat is being removed by RIIR and to clarify, prerequisites to meet T/S requirements for unisolating a loop at any time.With no RCS loops operating, the two RHR loops referenced in Specification 3.4.1.4.2 are the operating loops. Starting in MODE 4 as referenced in Specification 3.4.1.3, the RHR loops are allowed to be used in place of an operating R CS loop:. Specification 3.4.1.4.2 requires two RH{R loops OPERABLE and at least one in operation. Ensuring the isolated cold leg temperature is within 20°F of the highest RHR outlet temperature for the operating RHR loops within 30 minutes prior to opening the cold leg stop valve is a conservative approach since the major concern is a positive reactivity addition.SR 4.4.1.6.1

When in MODE 5 with all RCS loops isolated, the two RH-R loops referenced in LCO 3.4.1.4.2 shall be considered the OPERABLE RCS loops. The isolated loop cold leg temperature shall be determined to be within 20°F of the highest RHR outlet temperature for the operating RHR loops within 30 minutes prior to opening the cold leg stop valve.Surveillance requirement 4.4.1.6.2 is met when the following actions occur within 2 hours prior to opening the cold leg or hot leg stop valve:* An RCS boron sample has been taken and analyzed to determine current boron concentration

• The SHUTDOWN MARGIN has been determined using OP 3209B, "Shutdown Margin" using the current boron concentration determined above MILLSTONE

-UNIT 3 B 3/4 4-1le Amendment No. 2-1-7, Acknowledged by NRC Letter dated 04/12/06 LBDCR 12-MiP3-010 September 20, 2012 3/4.4 REACTOR COOLANT SYSTEM BASES (continued)

• For the isolated loop being restored, the power to both loop stop valves has been restored Surveillance 4.4.1.6.2 indicates that the reactor shall be determined subcritical by at least the amount required by Specifications 3.1.1.1.2 or 3.1.1.2 for MODE 5 or Specification 3.9.1.1 for MODE 6 within 2 hours of opening the cold leg or hot leg stop valve.The SHUTDOWN MvARGIN requirement in Specification 3.1.1.1.2 is specified in the CORE OPERATING LIMITS REPORT for MODE 5 with RCS loops filled. Specification 3.1.1.1.2 cannot be used to determine the required SHUTDOWN MARGIN for MODE 5 loops isolated condition.

Specification 3.1.1.2 requires the SHUTDOWN MARGIN to be greater than or equal to the limits specified in the CORE OPERATING LIMITS REPORT for MODE 5 with RCS loops not filled provided CVCS is aligned to preclude boron dilution. This specification is for loops not filled and therefore is applicable to an all loops isolated condition. Specification 3.9.1.1 requires Keff of 0.95 or less, or a boron concentration of greater than or equal to the limit specified in the COLR in MODE 6.Specification 3.1.1.1.2 or 3.1.1.2 for MODE 5, both require boron concentration to be detennined at the frequency specified in the Surveillance Frequency Control Program.SR 4.1.1.1.2.1 .b.2 and 4.1.1 .2.1.b.1 satisfy the requirements of Specifications 3.1.1.1.2 and 3.1.1.2 respectfully. Specification 3.9.1.1 for MODE 6 requires boron concentration to be determined at the frequency specified in the Surveillance Frequency Control Program. S.R. 4.9..1.1.2 satisfy the requirements of Specification 3.9.1.1.Per Specifications 3.4.1.2, ACTION c.; 3.4.1.3, ACTION c.; 3.4.1.4.1, ACTION b.; and 3.4.1.4.2, ACTION b., suspending the introductiorn of coolant into the RCS of coolant with boron concentr~iion less than required to meet the minimum SDM of LCO 3.1.1.1.2 is required to assure continued safe operation. With coolant added without forced circulation, unmrixed coolant could be introduced to the core, however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.

References:

1. Letter NEU-94-623, dated July 13, 1994; Mixing Evaluation for Boron Dilution Accident in Modes 4 and 5, Westinghouse HR-5 9782.2. Memo No. MP3-E-93-821, dated October 7, 1993.MILLSTONE

-UNIT 3 B 3/4 4-1f MILSTOE -UNT 3B 34 4ifAmendment No. 2-3g. REVERSE OF PAGE B 3/4 4-if INTENTIONALLY LEFT BLANK LBDCR No. 07-MP3-009 June 19, 2007 REACTOR COOLANT SYSTEM BASES 314.4.2 SAFETY VALVES The pressurizer Code safety valves operate to prevent the RCS from being pressurized above its Safety Limit of 2750 psia. Each safety valve is designed to relieve 420,000 lbs per hour of saturated steam at the valve Setpoint. The relief capacity of a single safety valve is adequate to relieve any overpressure condition which could occur during shutdown. If any pressurizer Code safety valve is inoperable, and cannot be restored to OPERABLE status, the ACTION statement requires the plant to be shut down and cooled down such that Technical Specification 3.4.9.3 will become applicable and require cold overpressure protection to be placed in service.During operation, all pressurizer Code safety valves must be OPERABLE to prevent the RCS firom being pressurized above its Safety Limit of 2750 psia. The combined relief capacity of all of these valves is greater than the maximaum surge rate resulting from a complete loss-of-load assuming no Reactor trip until the first Reactor Trip System Trip Setpoint is reached (i.e., no credit is taken for a direct Reactor trip on the loss-of-load) and also assuming no operation of the power-operated relief valves or steam dump valves.Demonstration of the safety valves' lift settings will occur only during shutdown and will be performed in accordance with the provisions of the ASME Code for Operation and Maintenance of Nuclear Power Plants.3/4.4.3 PRESSURIZER Th~e pressurizer provides a point in the RCS when liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primatyr system pressure during steady state operation and limiting the pressure changes caused by reactor. coolant thermal expansion and contraction during load transients. MODES 1 AND 2 The requirement for the pressurizer to be OPERABLE, with pressurizer level maintained at pro granmmed level within 4- 6% of full scale is consistent with the accident analysis in Chapter 15 of the FSAR. The accident analysis assumes that pressurizer level is being maintained at the programmed level by the automatic control system, and when in manual control, similar limits are established. The progralmmed level ensures the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpres sure and pressurizer overfill transients. A pressurizer level control error based upon automatic level control has been taken into account for those transients where pressurizer overfill is a concern (e.g., loss of feedwater, feedwater line break, and inadvertent ECCS actuation at power). When in manual control, the goal is to maintain pressurizer level at the program level value. The +/-- 6% of full scale acceptance criterion in the Technical Specification establishes a band for operation to accommnodate variations between level measurements. This value is bounded by the margin applied to the pressurizer overfill events.MILLSTONE -UNIT 3 B 3/4 4-2 MILLTON -NIT3 B3/44-2Amendment No. -!-60, 4-9-7-, LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.3 PRESSURIZER ('continued) The periodic surveillances require that pressurizer level be maintained at programmed level within =k 6% of full scale. The surveillance is performed by observing the indicated level.The surveillance frequency is controlled under the Surveillance Frequency Control Program.During transitory conditions, i.e., power changes, the operators will maintain progralmmed level, and deviations greater than 6% will be corrected within 2 hours. Two hours has been selected for pressurizer level restoration after a transient to avoid an unnecessary downpower with pressurizer level outside the operating brand. Nonnally, alarms are also available for early detection of abnormal level indications. Electrical itmmersion heaters, located in the lower section of the pressurizer vessel, keep the water in the pressurizer at saturation temperature and maintain a constant operating pressure.A minimumn required available capacity of pressurizer heaters ensures that the RCS pressure can be maintained. The capability to maintain and control system pressure is important for maintaining subcooled conditions in the RCS and ensuring the capability to remove core decay heat by either forced or natural circulation of the reactor coolant. Unless adequate heater capacity is available, the hot high-pressure condition cannot be maintained indefinitely and still provide the required subcooling margin in the primary system. Inability to control the system pressure and maintain subcooling under conditions of natural circulation flow in the primary system could lead to a loss of single-phase natural circulation and decreased capability to remove core decay heat.The LCO requires 'two groups of OPERABLE pressurizer heaters, each with a capacity of at least 175 kW. The heaters are capable of being powered from either the offsite power source or the emergency power supply. The minimum heater capacity required is sufficient to maintain the RCS near normal operating pressure when accounting for heat losses thraough the pressurizer insulation. By maintaining the pressure near" the operating conditions, a wide margin to subcooling can be obtained in the loops. The requirement for two groups of pressurizer heaters, each having a capacity of 175 kW, is met by verifying the capacity of the pressurizer heater groups A and B. Since the pressurizer heater groups A and B are supplied from the emergency 480V electrical buses, there is reasonable assurance that these heaters can be energized during a loss of offsite power to maintain natural circulation at HOT STANhDBY. Providing an emergency (Class 1EB) power source for the required pressurizer heaters meets the requirement of NUREG-0737, "A Clarification of TMI Action Plan Requirements," II.E.3.1, "Emergency Power Requirements for Pressurizer Heaters." If one required group of pressurizer heaters is inoperable, restoration is required within 72 hours. The Completion Time of 72 hours is reasonable considering that a demand caused by loss of offsite power would be unlikely in this time period. Pressure control may be maintained during this time using normal station powered heaters.MODE 3 The requirement for the pressurizer to be OPERABLE, with a level less than or equal to 89%, ensures that a steam bubble exists. The 89% level preserves the steam space for pressure control. The 89% level has been established to ensure the capability to establish and maintain pressure control for MODE 3 and to ensure a bubble is present in the pressurizer. Initial pressurizer level is not significant for those events analyzed for MODE 3 in Chapter 15 of the FSAR.MILLSTONE -UNIT 3 B 3/4 4-2a MILLTON -NIT B /4 -2aAmendment No. 60, !-0 LBDCR 12-MP3-010 September 20, 2012.REACTOR COOLANT SYSTEM O BASES 3/4.4.3 PRESSURIZER (cont'd.)The periodic surveillance requires that during MODE 3 operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The surveillance is performed by observing the indicated level. The surveillance frequency is controlled under the Surveillance Frequency Control Program. Alarms are also available for early detection of abnormal level indications. The basis for the pressurizer heater requirements is identical to MODES 1 and 2.3/4.4.4 RELIEF VALVES The power-operated relief valves (PORVs) and steam bubble function to relieve RCS pressure during all design transients up to and including the design step load decrease with steam dump. Operation of the PORVs minimizes the undesirable opening of the spring-loaded pressurizer Code safety valves. Each PORV has a remotely operated block valve to provide a positive shutoff capability should a relief valve become inoperable. Requiring the PORVs to be OPERABLE ensures that the capability for depressurization during safety grade cold shutdown is met.ACTION statements a, b, and c distinguishes the inoperability of the power operated relief valves! (ORV). Specifically, a PORV mybe designated inoperable but it mybe able to automatically

• and manually open and close and therefore, able to perform its function.

PORV inoperability may be due to seat leakage which does not prevent automatic or manual use and does not create the possibility for a small-break LOCA. For these reasons, the block valve may be closed but the action requires power to be maintained to the valve. This allows quick access to the PORV for pressure control. On the other hand if a PORV is inoperable and not capable of being automatically and manually cycled, it must be either restored or isolated by closing the associated block valve and removing power.Note: PORV position indication does not affect the ability of the PORV to perform any of its safety functions. Therefore, the failure of PORV position indication does not cause the PORV to be inoperable. However, failed position indication of these valves must be restored "as soon as practicable" as required by Technical Specification 6.8.4.e.3. Automatic operation of the PORVs is created to allow more time for operators to terminate an Inadvertent ECCS Actuation at Power. The PORVs and associated piping have been demonstrated to be qualified for water relief. Operation of the PORVs will prevent water relief fr'om the pressurizer safety valves for which qualification for water relief has not been demonstrated. If the PORVs are capable of automatic operation but have been declared inoperable, closure of the PORV block valve is acceptable since the Emergency Operating Procedures provide guidance to assure that the PORVs would be available to mitigate the event. OPERABILITY and setpoint controls for the safety grade PORV opening logic are maintained in the Technical Requirements Manual..MILLSTONE -UNIT 3 B 3/4 4-2b Amendment No. 4-10, 4-4-1 LBDCR No. 14-MP3-014 September 18, 2014 REACTRCOLNESSE 0 BASES RELIEF VALVES (Continued) The prime importan~ce for the capability to close the block valve is to isolate a stuck-open FORM.Therefore, if the block valve(s) cannot be restored to OPERABLE status within 1 hour, the remedial action is to place the PORV in manual control (i.e., the control switch in the "CLOSE" position) to preclude its automatic opening for an overpressure event and to avoid the potential of a stuck-open PORV at a time that the block valve is inoperable. The time allowed to restore the block valve(s) to OPERABLE status is based upon. the remedial action time limits for inoperable PORV per ACTION requirements

b. and c. ACTION statement

d. does not specify closure of the block valves because such action would not likely be possible when the block valve is inoperable.

For the same reasons, reference is not made to ACTION statements

b. and c. for the required remedial actions.SURVEILLANCE REQUIREMENT 4.4.4.2 verifies that a block valve(s) can be opened or closed if necessary.

This SURVEILLANCE REQUIREMENT is not required to be perform~ed with the block valve(s) closed in accordance with the ACTIONS of TS 3.4.4. Opening the block valve(s) in this condition increases the risk of an unisolable leak from the RCS since the PORV(s)is already inoperable. MILLSTONE -UNIT 3 B 3/4 4-2c Amendment No. gg, 4-10, 61-, Acknowledged by NRC letter dated 08/28/15 LBDCR No. 12-MP3-007 June 26, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY LCO The LCO requires that steam generator (SG) tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the plugging criteria be plugged in accordance with the Steam Generator Program.During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging. If a tube was determined to satisfy the plugging criteria but was not plugged, the tube may still have tube integrity. In the context of this Specification, a SG tube is defined as the entire length of the tube, including the tube wall between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 6.8.4.g, "Steam Generator Program," and describe acceptable SG tube performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Ttibe burst is defined as, "The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis. The division between primary and secondary classifications will be based on detailed analysis and/or testing.MILLSTONE -UNIT 3B3/4-AmnetNo B 3/4 4-3 Amendment No. LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES.° 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)

• Structural integrity requires that the primary membrane stress intensity in a tube not exceed the* yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included in the design specification.

This includes safety factors and applicable design basis loads based on ASMIE Code, Section III,* Subsection NB (Ref. 4).and Draft Regulatory Guide 1.121 (Reference 5).The accident induced leakage performance criterion ensures that the primary to secondary.....LE-AKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The accident analysis assumes that accident induced leakage does not exceed 1* gallon per minute or is assumed to increase to 1 gallon per minute for all steam generators. The: accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the ,.-. accident in addition to primary to secondary LEAKAGE induced during the accident..The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in RCS LCO 3.4.6.2, "Operational Leakage," and limits primary to secondary LEAKAGE through any one SG* .to 150 gallons per day. This limit is based on the assumption that a single crack leaking this* amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, r .. and the above assumption is conservative.

• APPLICABILITY Steam generator tube integrity is challenged when the pressure differential across the tubes is* large. Large differential pressures across SG tubes can only be experienced during MODES 1, 2, 3, and 4.* .. RCS conditions are far less challenging during MODES 5 and 6 than during MODES 1, 2, 3, and" 4. During MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.ACTIONS The ACTIONS are modified by a NOTE clarifying that the Conditions may be entered* ...independently for each SG tube. This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube. Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.MILLSTONE -UNIT 3 B3443 mnmno B 3/4 4-3a Amendment No.

LBDCR No. 12-MiP3-007 June 26, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued') a.1 and a.2 ACTION a. applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube plugging criteria but were not plugged in accordance with the Steam Generator Program as required by SR 4.4.5.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG plugging criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, ACTION b. applies.A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity. If the evaluation determines that the affected tube(s) have tube integrity, Required ACTION a.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tube(s). However, the affected tube(s) must be plugged prior to entering MODE 4 following the next refueling outage or SG inspection. This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.

b. I and b.2 If the ACTIONS and associated Completion Times of ACTION a. are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.MILLSTONE

-UNIT 3 B3443 mnmn o B 3/4 4-3b Amendment No. LBDCR No. 12-MiP3-007 Iune 26, 2012 REACTOR COOLANT SYSTEM 'BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued~) SURVEILLANCE REQUIREMENTS TS 4.4.5.1 During shutdown periods the SGs are inspected as required by this SR and the Steam Generator" Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices. During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring assessment determines the "as found" condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube plugging criteria. Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation. Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations. The Steam Generator Program defines the Frequency of TS 4.4.5.1. The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Reference 6).The Steam Generator Program uses information on existing degradations and gr'owth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 6.8.4.g contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections. If crack indications are found in any SG tube, the maximum inspection interval for all affected and potentially affected SGs is restricted by Specification 6.8.4.g until subsequent inspections support extending the inspection interval.TS 4.4.5.2 During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging. The tube plugging criteria delineated in Specification 6.8.4.g are intended to ensure that tubes accepted for continued service satisfy the S G performance criteria with allowance for error~ in the flaw size measurement and for future flaw growth. In addition, the tube plugging criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational MILLSTONE -UNIT 3 B/43 mnmn o B 3/4 4-3c Amendment No. LBDCR No. 12-MIP3-007 June 26, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued~) assessments to verify, that the tubes remaining in service will continue to meet the SG performance criteria.The Frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the plugging criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential. BACKGROUND SG tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers. The SG tubes have a number of important safety functions. Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary system s pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.1.1, "STARTUP and POWER OPERATION," LCO 3.4.1.2, "HOT STANDBY," LCO 3.4.1.3, "HOT SI{UTDOWN," and LCO 3.4.1.4.1, "COLD SI{UTDOWN -Loops Filled." SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements. SG tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively. The SG performance criteria are used to manage SG tube degradation. Specification 6.8.4.g., "Steam Generator (SG) Program," requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 6.8.4.g., tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 6.8.4.g. Meeting the SO performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions. The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Reference 1).MILLSTONE -UNIT 3 B3443 mnmno B 3/4 4-3d Amendment No. LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) APPLICABLE SAFETY ANALYSES The steam generator tube rupture (SGTR) accident is the limiting design basis event for SG tubes and avoiding an SGTR is the basis for this Specification. The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate greater than the operational LEAKAGE rate limits in RCS LCO 3.4.6.2, "Operational LEAKAGE," plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumes the contaminated secondary fluid is released to the atmosphere via safety valves or atmospheric dump valves.The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture.) In these analyses, the steam discharge to the atmosphere is based on the total primary to secondary LEAKAGE from all S~s of 1 gallon per minute or is assumed to increase to 1 gallon per minute as a result of accident induced conditions. For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUIVALENT 1-131 is assumed to be equal to the RCS LCO 3.4.8, "Specific Activity" limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Reference 2), 10 CER 50.67 (Reference

3) or the N-RC approved licensing basis (e.g., a small fraction of these limits).Steam Generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

REFERENCES

1. NEJ 97-06, "Steam Generator Program Guidelines." 2. 10 CFR 50 Appendix A, GDC 19.3. 10OCFR 50.67.4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.*5. Draft Regulatory Guide 1.12 1, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines." MILLSTONE

-UNIT 3B3/43eAenmtNo B 3/4 4-3e Amendment No. LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BAsEs 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS The RCS Leakage Detection Systems required by this specification are provided to monitor and detect leakage from the reactor coolant pressure boundary. These Detection Systems are consistent with the recommendations of Regulatory Guide 1.45, "Reactor Coolant Pressure Boundary Leakage Detection Systems," May 1973.ACTION c-provides a 72 hour allowed outage time (AOT) when both the containment atmosphere particulate radioactivity monitor and the containment drain sump monitoring system, are inoperable. The 72 hour AOT is appropriate since additional actions will be taken during this limited time period to ensure RCS leakage, in excess of the UNIDENTIFIED LEAKAGE TS limit of 1 gpm (TS 3.4.6.2), will be readily detectable. This will provide reasonable assurance that any significant reactor coolant pressure boundary degradation is detected soon after occurrence to minimize the potential for propagation to a gross failure. This is consistent with the requirements of General Design Criteria (GDC) 30 and also Criterion 1 of 10 CFR 50.3 6(d)(2)(ii) which requires installed instrumentation to detect, and indicate in the control roo~m, a significant abnormal degradation of the. reactor coolant pressure boundary. The RCS water inventory balance calculation determines the magnitude of RCS UNIDENTIFIED LEAKAGE by use of instrumentation readily available to the control room operators. However, the proposed additional actions will not restore the continuous monitoring capability normally provided by the inoperable equipment. The RCS water inventory balance is capable of identifying a one gpm RCS leak rate. The containment grab samples will also indicate an increase in RCS leak rate which would then be quantified by the RCS water inventory balance. Since these additional actions are sufficient to ensure RCS LEAKAGE is withi~n TS limits, it is appropriate to provide a limited time period to.restore at least one of the TS-required LEAKAGE monitoring systems.LCO 3.4.6.1 .b. Containment Sump Drain Monitoring System The intent of LCO 3.4.6.1.b is to have a system able to monitor and detect leakage from the reactor coolant pressure boundary (RCPB). Any of the following three methods may be used to meet LCO 3.4.6.l.b: A. 3DAS-P1O, Unidentified Leakage Sump Pump, and associated local and main board annunciation. B. 3DAS-P 10, Unidentified Leakage Sump Pump, and computer point 3DAS-L39 and CVLKR2.C. 3DAS-P2A or 3DAS-P2B, Containment Drains Sump Pump, and computer points.3DAS-L22 and CVLKR2 or CVLKjR3I.To meet Regulatory Guide 1.45 recommendations, the Containment Drain Sump Monitoring System must meet the following five criteria: 1. Must monitor changes in sump water level, changes in flow rate or changes in the operating frequency of pumps.2. Be able to detect an UNIDENTIFIED LEAKAGE rate of 1 gpm in less than one hour.MILLSTONE -UNIT 3B3/44AmnetNo B 3/4 4-4 Amendment No. LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued)

3. Remain OPERABLE following an Operating Basis Earthquake (OBE).4. Provide indication and alarm in the Control Room.5. Procedures for converting various indications to a common leakage equivalent must be available to the Operators.

The three Containment Drain Sump Monitoring Systems identified above meet these five requirements as follows: A. 3DAS-PiO. Unidentified Leakage Sump Pump. and associated main board annunciation.

1. Sump level is monitored at two locations by the starting-and stopping of 3DAS-P 10, Unidentified Leakage Sump Pump. Flow is measured as a function of time between pump starts/stops and the known sunap levels at which these Occur.2. Two timer relays in the control circuitry of 3DAS-P 1O are set to identify a 1 .gpm leak rate within 1 hour.3. This monitoring, system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will. be taken. This position has been reviewed by the NRC and documented as acceptable in the Safety Evaluation Report.4. If the control circuitry of 3DAS-P10 identifies a 1 gpm leak rate within 1 hour, Liquid Radwaste Panel Annunciator LWS :4-5, CTMT UJNIDENT LEAKAGE TROUBLE, and Main Board Annunciator MB1 B 4-3, RAD LIQUID WASTE SYS TROUBLE, will alarm. These control circuits and alarms operate independently from the plant process computer.If the computer is inoperable, these control circuits and alarms meet the Technical Specification requirements for the Containment Drain Sump Monitoring System.5. To convert the unidentified leakage sump pump run times to a leakage rate, use the following formula: (3DAS-P1O run times in minutes -[number of 3DAS-P10 starts x.5 minutes])

x 20 gpm' Elapsed monitored Time in minutes B. 3DAS-P 10. Unidentified Leakage Sump Pump. and computer points 3DAS-L39 and CVLKR2.1. Sump level is monitored by 3DAS-LI39, the Unidentified Leakage Sump Level indicator. This level indicator provides an input to computer point 3DAS-L39.MILLSTONE -UNIT 3 B/44 mnmn o B 3/4 4-4a Amendment No. LBDCR No. 1 1-MP3-004 March 22, 2011 REACTOR COOLANT SYSTEM BASES 3/4.4.6.1I LEAKAGE DETECTION SYSTEMS (Continued)

2. The plant process computer calculates a leakage rate every 30 seconds when 3DASP1O indicates stop. This leakage rate is displayed via computer point CVLKR2. When pump Pl10 does run, the leakage rate calculation is stopped and resumes 10 minutes after pump PlO stops. If it cannot provide a value of the leakage rate within any 54 minute interval, CVDASPIONC (UNDNT LKG RT NOT CALC) alarms which alerts the Operator that UNIDENTIFIED LEAKAGE cannot be determined.

3. This monitoring system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will be taken.4. A priority computer alarm (CVLKR2) is generated if the calculated leakage rate is greater than a value specified on the Priority Alarm Point Log. This alarm value should be set to alert the Operators to a possible RCS leak rate in excess of the Technical Specification maximum allowed UNIDENTIFIED LEAKAGE. The alarm value may be set at one gallon per minute or less above the rate of IDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems, into the unidentified leakage sump. The rate of IDENTIFIED LEAKAGE may be determined by either measurement or analysis.

If the Priority Alarm Point Log is adjusted,.the high leakage rate alarm will be bounded by the IDENTIFIED LEAKAGE rate and the low leakage rate alarm will be set to notify the operator that a decrease in leakage may require the high leakage rate alarm to be reset. The priority alarm setpoint shall be no greater than 2 gallons per minute. This ensures that the IDENTIFIED LEAKAGE will not mask a small increase in UNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit is also within the identified leakage sump level monitoring system alarm operating range which has a maximumn setpoint of 2.3 gallons per minute.To convert unidentified leakage sump level changes to leakage rate, use the following formula: Note: Wait 10 minutes after 3DAS-Pl10 stops before taking level readings.1.083 15 gallons X % change in level from 3DAS-L39 1% time between level readings in minutes C. 3DAS-P2A or 3DAS-P2B. Containment Drains Sump Pump, and computer points 3DAS-L22 and CVLKR2 or CVLKR3I.1. Sump level is monitored by 3DAS-L122, the Containment Drains Sump Level Indicator. This level indicator provides an input to computer point 3DAS-L22.This method can be used to monitor UNIDENTIFIED LEAKAGE when Pump Pl10 and its associated equipment is inoperable provided Pump Pl10 is out of service and 3DAS-L1 39 indicates that the unidentified leakage sump is overflowing to the containment drains sump (approximately 40% level on 3DAS-LI39). MILLSTONE -UNIT 3 B 3/4 4-4b Amendment No. LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued) In this case, CVLKR2 and CVLKR3I monitor flow rate by comparing level indications on the containment drains sump when Pumps Pl10, P2A, P2B and P 1 are not running.2. The plant process computer calculates a leakage rate every 30 seconds when 3DAS-P 10, 3DAS-Pl1, 3DAS-P2A and 3DAS-P2B indicate stop. This leakage rate is displayed via computer points CVLKR3I and CVLKR2 when 3DAS-PI10 is off and when the unidentified leakage sump is overflowing to the containment drains sump. When one of these pumps does run, the leakage rate calculation is stopped and resumes 10 minutes after all pumps stop. If it cannot provide value of the leakage rate within any 54 minute interval, two computer point alarms (CVDASP2NC, UNDNT LKG RT NOT CALC and CVDASP2NC, SMP 3 LKG RT NT CALC) are generated which alerts the Operator that UNIDENTIFIED LEAKAGE cannot be determined.

3. This monitoring system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will be taken.4. Two priority computer alarms (CVLKR2 and CVLKR3I) are generated if the calculated leakage rate is greater than a value specified on the Priority Alarm Point Log. This alarm value should be set to alert the Operators to a possible RCS leak rate in excess of the Technical Specification maximum allowed UNIDENTIFIED LEAKAGE. The alarm value may be set at one gallon per minute or less above the Wi :P rate of IDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems, into the containment drains sump. The rate of IDENTIFLED LEAKAGE may be determined by either, measurement or by analysis.

If the Priority Alarm Point Log is adjusted, the high leakage rate alarm will be bounded by the IDENTIFIED LEAKAGE rate and the low leakage rate alarm will be set to notify the operator that a decrease in leakage may require the high leakage, rate alarm to be reset. The priority alarm set-point shall be no greater than 2 gallons per minute. This ensures that the IDENTIFIED LEAKAGE will not mask a small increase in UNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit is also within the contaimnent drains sump level monitoring system alann operating range which has a maximum setpoint of 2.5 gallons per minute.5. To convert containment drains sump run times to a leakage rate, refer to procedure SP3 670.1 for guidance on the conversion method.3/4.4.6.2 OPERATIONAL LEAKAGE LCO RCS operational LEAKAGE shall be limited to: a. PRESSURE BOUNDARY LEAKAGE No PRESSURE BOUNDARY LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further MILLSTONE -UNIT 3 B3444 mnmn o B 3/4 4-4c Amendment No. LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE.b. UNIDENTIFIED LEAKAGE One gallon per minute (gpm) of UNIDENTIFIED LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.*c. Primary_ to Secondary. LEAKAGE through Any One Steam Generator (SG)The limit of 150 gallons per day per SG is based on the operational LEAKAGE performance criterion in NEl 97-06, Steam Generator Program Guidelines (Reference 4).The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, "The RCS operational primaryr to secondary LEAKAGE through any one SG shall be limited to 150 gallons per day." The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational LEAKAGE rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.d. IDENTIFIED LEAKAGE Up to 10 gpm of IDENTIFIED LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of UNIDENTIFIED LEAKAGE and is well within the capability of the RCS makeup system. IDENTIFIED LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include PRESSURE BOUNDARY LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (CONTROLLED LEAKAGE). Violation of this LCO could result in continued degradation of a component or system.e. CONTROLLED LEAKAGE The CONTROLLED LEAKAGE limitation restricts operation when the total flow supplied to the reactor coolant pump seals exceeds 40 gpm with the modulating valve in the supply line fully open at a nominal RCS pressure of 2250 psia. This limitation ensures that in the event ofa LOCA, the safety injection flow will not be less than assumed in the safety analyses.A limit of 40 gpm is placed on CONTROLLED LEAKAGE.f. RCS Pressure Isolation Valve LEAKAGE The specified allowable leakage from any RCS pressure isolation valve is sufficiently low to ensure early detection of possible in-series valve failure. It is apparent that when pressure isolation is provided by two in-series valves and when failure of one valve in the p~air can go undetected for a substantial length of time, verification of valve integrity is required. Since these valves are important in preventing overpressurization and rupture of the ECCS low pressure piping which could result in a LOCA, these valves should be tested periodically to ensure low probability of gross failure.MILLSTONE -UNIT 3B3/44dAemntN.2, B 3/4 4-4d Amendment No. g09, LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized. In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.LCO 3.4.6.2.f~, RCS Pressure Isolation Valve (PIV) Leakage, measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the. other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.ACTIONS b.,c.UNIDENTIFIED LEAKAGE, IDENTIFIED LEAKAGE or RCS pressure isolation valve LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify' UNIDENTIFIED LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.a. b. c.If any PRESSURE BOUNDARY LEAKAGE exists, or primary to secondary LEAKCAGE is not within limits, or if UNIDENTIFIED LEAKAGE, IDENTIFIED LEAKAGE, or RCS pressure isolation valve LEAKAGE cannot be reduced to within limits within 4 hours, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE. The reactor must be brought to HOT STANDBY within 6 hours and COLD SHUTDOWN within the following 30 hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In COLD SHUTDOWN, the pressure stresses acting on the reactor coolant pressure boundary are much lower, and further deterioration is much less likely.MILLSTONE -UNIT 3B3444eA ndntN.O, B 3/4 4-4e Amendment No. -2419, LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) SURVEILLANCE REOUIREMENTS 4.4.6.2.1 .c CONTROLLED LEAKAGE is determined under; a set of reference conditions, listed below: a. One Charging Pump in operation.

b. RCS pressure at 2250 +/- 20 psia.By limiting CONTROLLED LEAKAGE to 40 gpm during normal operation, it can be assured that during an SI with only one charging pump injecting, RCP seal injection flow will continue to remain less than 80 gpin as assumed in the accident analysis.

When the seal injection throttle valves are set with a normal charging lineup, the throttle valve position bounds conditions where higher charging header pressures could exist. Therefore, conditions which create higher charging header pressures such as an isolated charging line, or two pumps in service are bounded by the single puinp-nonnal system lineup surveillance configuration. Basic accident analysis assumptions are that 80 gpin flow is provided to the seals by a single pump in a runout condition. 4.4.6.2.1 .d Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the reactor coolant pressure is maintained. PRESSURE BOUNDARY LEAKAGE would at first appear as UNIDENTIFIED LEAKAGE and can only be positively identified by inspection. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE.UNIDENTIFIED LEAKAGE and IDENTIFIED LEAKAGE are determined by performance of an RCS water inventory balance.The RCS water inventory balance must be performed with the reactor at steady state operating conditions (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows). The Surveillance is modified by two Notes.Note 1 states that this SR is not required to be performed until 12 hours after establishing steady state operation. The 12 hour allowance provides sufficient thne to collect and process all necessary data after stable plant conditions are established. Steady state operation is required to perform a proper water inventory balance since calculations during maneuvering are not useful. For RCS operational LEAKAGE detennination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flOWS.MILLSTONE -UNIT 3B /4fAenetNo B 3/4 4-4f Amen&nent No. [ LBDCR 12-MP3-010 September 20, 2012 REACTOR. COOLANT SYSTEM l BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) An early warning of PRES SURE BOUNDARY LEAKAGE or UNIDENTIFIED LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE. These leakage detection systems are specified in RCS LCO 3.4.6.1, "Leakage Detection Systems." Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 150 gallons per day caimot be measured accurately by an RCS water inventory balance.The surveillance frequency is controlled under the Surveillance Frequency Control Program.4.4.6.2.1 .e This SR verifies that primary to secondary¢ LEAKAGE is less than or equal to 150 gallons per day through any one SG. Satisfying the primary to secondary LEAKAGE limait ensures that the operational LEAKAGE performance criterion in the Steam Generator Progr'am is met. If this SR is not met, compliance with LCO 3.4.5, "Steam Generator Tube Integrity," should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference

5. The , operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.The Surveillance is modified by a Note which states that the surveillance is not required to be performed until 12 hours after establishment of steady state operation.

For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.The surveillance frequency is controlled under the Surveillance Frequency Control Program. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Reference 5).4.4.6.2.2 The Surveillance Requirements for RCS pressure isolation valves provide assurance of valve integrity thereby reducing the probability of gross valve failure and consequent intersystem LOCA.Leakage from the RCS pressure isolation valve is IDENTIFIED LEAKAGE and will be considered as a portion of the allowed limit.MILLSTONE -UNIT 3B3/4gAenetNo B 3/4 4-4g Amendment No. LBDCR No. 06-MP3--005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stable conditions for performance of Surveillance Requirement 4 .4 .6.2 .2 (including Surveillance Requirement 4.4.6.2.2.d) for RCS pressure isolation valves which can only be leak-tested at elevated RCS pressures. The requirements of Surveillance Requirement 4.4.6.2.2.d to verify that a pressure isolation valve is OPERABLE shall be performed within 24 hours after the required RCS pressures has been met.In MODES 1 and 2, the plant is at normal operating pressure and Surveillance Requirement 4.4.6.2.2.d shall be performed within 24 hours of valve actuation due to automatic or manual action or flow through the valve. In MODES 3 and 4, Surveillance Requirement 4.4.6.2.2.d shall*be performed within 24 hours of valve actuation due to automatic or manual actuation of flow through the valve if and when RCS pressure is sufficiently high for performance of this surveillance. BACKGROUND Components that contain or transport the coolant to or from the reactor core make up the reactor coolant system (RCS). Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCS "Operational LEAKAGE" LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.10 CFR 50, Appendix A, GDC 30 (Reference 1), requires means for detecting and, to the extent.practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Reference

2) describes acceptable methods for selecting leakage detection systems.The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration.

Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIDENTIFIED LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur detrimental to the safety of the facility and the public.A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS LEAKAGE detection. This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analysis radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).MILLSTONE -UNIT 3 B3444 mnmn o B 3/4 4-4h Amendment No. [ LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) APPLICABLE SAFETY ANALYSES -OPERATIONAL LEAKAGE Except for primary to secondary LEAKAGE, the safety analyses do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA;the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGE from all steam generators (SGs) is 1 gallon per minute or increases to 1 gallon per minute as a result of accident induced conditions. The LCO requirement to limit primary to secondary LEAKAGE through any one SG to less than or equal to 150 gallons per day is significantly less than the conditions assumed in the safety analysis.Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a main steam line break (MSLB). To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR)accident. The leakage contaminates the secondary fluid.The ESAR (Reference

3) analysis for SGTR assumes the contaminated secondary fluid is released via atmospheric dump valves. The 1 gpm primary to secondary LEAKAGE safety analysis assumption is relatively inconsequential.

The safety analysis for the MSLB accident assumes 500 gpd primary to secondary LEAKAGE is through the affected steam generator and the remainder of the 1 gpm is through the intact SGs as an initial condition. The dose consequences resulting from the MSLB accident are within the guidelines based on 10 CFR 50.67 or other staff approved licensing basis.The RCS operational LEAKAGE satisfies Criterion 2 of 10 CER 50.36(c)(2)(ii). REFERENCES

1. 10 CFR 50, Appendix A, GDC 30.2. Regulatory Guide 1.45, May 1973.3. FSAR, Section 15.4. NEI 97-06, "Steam Generator Program Guidelines." 5. EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."* 6. Letter FSD/SS-NEU-37 13, dated March 25, 1985.7. Letter NEU-89-639, dated December 4, 1989.MILLSTONE

-UNIT 3 B3444 mnmn o B3/4 4-4i Amendment No. LBDCR No. 08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES 3/4.4.7 DELETED 3/4.4.8 SPECIFIC ACTIVITY BACKGROUND The maximum dose that an individual at the exclusion area boundary can receive for 2 hours following an accident, or at the low population zone outer boundary for the radiological release duration, is specified in 10 CFR 50.67 (Reference 1). Doses to control room occupants must be limited per GDC 19. The limits on specific activity ensure that the offsite and Control Room Envelope (CRE) doses are appropriately limited during analyzed transients and accidents. The RCS specific activity LCO limits the allowable concentration of radionuclides in the reactor coolant. The LCO limits are established to minimize the dose consequences in the event of a steam line break (SLB) or steam generator tube rupture (SGTR) accident.The LCO contains specific activity limits for both DOSE EQUIVALENT I-i131 and DOSE EQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and CRE doses meet the appropriate acceptance criteria in the Standard Review Plan (Reference 2).APPLICABLE SAFETY ANALYSES The LCO limits on the specific activity of the reactor coolant ensure the resulting offsite and CRE doses meet the appropriate SRP acceptance criteria following a SLB or SGTR accident. The safety analyses (References 3 and 4) assume the specific activity of the reactor coolant is at the LCO limits, and an existing reactor coolant (SG) tube leakage rate of"l gpm exists. The safety analyses assume the specific activity of the secondary coolant is at its limit of 0.1 jgCi/gm DOSE EQUIVALENT 1-131 from LCO 3.7.1.4, "Specific Activity." The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specific activity. Reference to these analyses is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.The safety analyses consider two cases of reactor coolant iodine specific activity. One case assumes specific activity at 1.0 .ixCi/gm DOSE EQUIVALENT 1-131 with a concurrent large iodine spike that increases the rate of release of iodine from the fuel rods containing cladding defects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factor of 335) respectively. The second case assumes the initial reactor coolant iodine activity at 60.0 gICi/gm DOSE EQUIVALENT 1-131 due to an iodine spike caused by a reactor or an RCS transient prior to the accident. In both cases, the noble gas specific activity is assumed to be 81 .2 gaCi/gm DOSE EQUIVALENT XE- 133.The SGTR analysis also assumes a loss of offsite power at the same time as the reactor trip. The SGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from a low pressurizer pressure signal or an RCS overtemperature AT signal.MILLSTONE -UNIT 3B3/45AmnetNo24 B 3/4 4-5 Amendment No. 2-04 LBDCR No:08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued) The loss of offsite power causes the steam dump valves to close to protect the condenser. The rise in pressure in the ruptured SG discharges radioactively contaminated steam to the atmosphere through the SG power operated relief valves and/or the main steam safety valves. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends and the Residual Heat Removal (RHIR) system is put in service." The SLB radiological analysis assumes offsite power is lost at the same time as the pipe break occurs outside containment. Reactor trip occurs after the generation of an SI signal on low steam line pressure. The affected SG blows down completely and steam is vented directly to the atmosphere. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends and the RUR system is placed in service.Operation with iodine specific activity levels greater than I /tCi/gm but less than or equal to 60.0 jixCi/gm is permissible for up to 48 hours while efforts are made to restore DOSE EQUIVALENT 1-131 to within the 1 pCi/gm LCO limit. Operation with iodine specific activity levels greater than 60 jgCi/gm is not permissible. The RCS specific activity limits are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices. RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). LCO The iodine specific activity in the reactor coolant is limited to 1.0 paCi/gm DOSE EQUIVALENT I-131, and the noble gas specific activity in the reactor coolant is limited to 81.2 pCi/gm DOSE EQUIVALENT XE-133. The limits on specific activity ensure that offsite and CRE doses will meet the appropriate SRP acceptance criteria (Reference 2).The SLB and SGTR accident analyses (References 3 and 4) show that the calculated doses are within acceptable limits. Operation with activities in excess of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SLB or SGTR, lead to doses that exceed the SRP acceptance criteria (Reference 2).APPLICABILITY In MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT 1-131 and DOSE EQUIVALENT XE-133 is necessary to limit the potential consequences of a SLB or SGTR to within the SRP acceptance criteria (Reference 2).In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS and steam generators are depressurized, and primary to secondary LEAKAGE is minimal. Therefore, the monitoring of RCS specific activity is not required.MILLSTONE -UNIT 3B3/46AmnetNo B 3/4 4-6 Amendment No. LBDCR No. 08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued) ACTIONS a. and b.With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at intervals of four hours must be taken to demonstrate that the specific activity is < 60 pCi/gim. Four hours is required to obtain and analyze a sample. Sampling is continued every four hours to provide a trend.The DOSE EQUIVALENT 1-131 must be restored to within limit within 48 hours. The completion time of 48 hours is acceptable since it is expected that, if there were an iodine spike, the nonnal coolant iodine concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.A statement in ACTION b. indicates the provisions of LCO 3.0.4 are not applicable. This exception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTIONS a. and b. while the DOSE EQUIVALENT 1-13 1 LCO is not met. This exception is acceptable due to the significant conservatism incor~porated into the RCS specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, POWER OPERATION. c.If the required action and completion time of ACTION b. is not met, or if the DOSE EQUIVALENT 1-131 is > 60 jFCi/gm, the reactor must be brought to HOT STANDBY (MODE 3)within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completion times are reasonable, based on operating experience, to reach the reqfiired plant conditions from full power conditions in an orderly maimer and without challenging plant systems.d_.With the RCS DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENT XE-133 must be restored to within limit within 48 hourns. The allowed completion time of 48 hours is acceptable since it is expected that, if there were a noble gas spike, the normaal coolant noble gas concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.A statement in ACTION d. indicates the provisions of LCO 3.0.4 are not applicable. This exception to LCO 3.0.4 permnits entry into the applicable MODE(S), relying on ACTION d. while the DOSE EQUIVALENT XE-133 LCO is not met. This exception is acceptable due to the significant conservatism incorporated into the RCS specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remnains at, or proceeds to, POWER OPERATION. MILLSTONE -UNIT 3 B3446 mnmn o* B 3/4 4-6a Amendment No. LBDCR 12-MPll3-010 September 20, 2012 REACTOR. COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued) ACTIONS (Continued) e.If the required action and completion time of ACTION d. is not met, the reactor must be brought to HOT STANDBY (MODE 3) within 6 hours and COLD SIIUTDOWN (MODE 5) within 3 6 hours. The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner mad without challenging plant systems.SURVEILLANCE REQUIREMENTS 4.4.8.1 Surveillance Requirement 4.4.8.1 requires performing a gamma isotopic analysis as a measure of the noble gas specific activity of the reactor coolant at the frequency specified in the Surveillance Frequency Control Program. This measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance Requirement provides an indication of any increase in the noble gas specific activity.Trending the results of this Surveillance Requirement allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The surveillance frequency is controlled under the Survweillance Frequency Control Progr-am.Due to the inaherent difficulty in detecting Kr'-85 in a reactor coolant sample due to masking from radioisotopes with similar decay energies, such as F-18 and 1-134, it is acceptable to include the minimum detectable activity for Kr-85 in the Surveillance Requirement 4.4.8.1 calculation. If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE-133 is not detected, it should be assumed to be present at the minimum detectable activity.A Note modifies the Su'veillance Requirement to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows the Surveillance Requirement to be performned in those MODES, prior to entering MODE 1.4.4.8.2 This Surveillance Requirement is performed to ensure iodine specific activity remains within the.LCO limit during normal operation and following fast power changes when iodine spiking is more apt to occur The surveillance fr'equency is controlled under the Surveillance Frequency Control Program. The frequency of between 2 and 6 hours after a power change _> 15% RTP within a 1 hour period is established because the iodine levels peak during this time following iodine spike initiation; samples at other times would provide inaccurate results.MILLSTONE -UNIT 3 B3446 mnmn o B 3/4 4-6b Amendment No. LBDCR No. 08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued) SURVEILLANCE REQUIREMENTS (Continued) The Note modifies this Surveillance Requirement to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows the Surveillance Requirement to be performed in those MODES, prior to entering MODE 1.REFERENCES

1. 10CFR5O.67.

2. Standard Review Plan (SRP) Section 15.0.1, "Radiological Consequence Analyses Using Alternate Source Terms." 3. FSAR, Section 15.1.5.4. FSAR, Section 15.6.3.3/4.4.9 PRESSURE/TEMPERATURE LIMITS REACTOR COOLANT SYSTEM (EXCEPT THE PRESSURIZER)

BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation. Figures 3.4-2 and 3.4-3 contain P/T limit curves for heatup, cooldown, inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature. Each PIT limit curve defines an acceptable region for normal operation. The usual use of the curves is operational requirements during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region. A heatup or cooldown is defined as a temperature increase or decrease of greater than or equal to 1 0°F in any one hour period. This definition of heatup and cooldown is based upon the ASME definition of isothermal conditions described in ASME, Section XI, Appendix E.MILLSTONE -UNIT 3 B 3/4 4-7 MILLTONE-UNT 3 3/44-7Amendment No. 5, 4-9-7, LBDCR 3-4-03 May 20, 2004 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued) Steady state thermal conditions exist when temperature increases or decreases are <1 0°F in any one hour period and when the plant is not performing a planned heatup or cooldown in accordance with a procedure. The LCO establishes operating limits that provide a margin to brittle failure, applicable to the fenritic material of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the Pressurizer. The P/T limits have been established for the ferritic materials of the RCS considering ASME Boiler and Pressure Vessel Code Section XI, Appendix G (Reference

1) as modified by ASME Code Case N-640 (Reference 2), and the additional requirements of 10 CFR 50 Appendix G (Reference 3). Implementation of the specific requirements provide adequate margin to brittle fracture of ferritic materials during normal operation, anticipated operational occurrences, and system leak and hydrostatic tests.The neutron embrittlement effect on the material toughness is reflected by increasing the nil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.

The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor ve~ssel material specimens, in accordance with ASTM E 185 (Ref. 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and. the recommendations of Regulatory Guide 1.99 (Ref. 6).The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations may be more restrictive, and thus, the curves are composites of the most restrictive regions.The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient-reversal alters the location of the tensile stress between the outer and inner walls.The P/T limits include uncertainty margins to ensure that the calculated limits are not inadvertently exceeded. These margins include gauge and system loop uncertainties, elevation differences, containment pressure conditions and system pressure drops between the beltline region of the vessel and the pressure gauge or relief valve location.MILLSTONE -UNIT 3 B 3/4 4-8 Amendment No. 48, -l-5-, 19-7, Acknowledged by NRC letter dated 08/25/05 August 27, 2001 REACTOR COOLANT SYSTEM BASES.PRESSURE/TEMPERATURE LIMITS (continued) The criticality limit curve includes the Reference 1lrequirement that it be >_ 40°F above the heatup curve or the cooldown curve, and not less than 1 60°F above the minimum permissible

temperature for ISLH testing. This limit provides the required margin relative to brittle fracture.However, the criticality curve is not operationally limiting; a more restrictive limit exists in LCO 3.1.1.4, "Minimurn Temperature for Criticality." The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the ferritic RCPB materials, possibly leading to a nonisolable leak or loss of coolant accident.

In the event these limits are exceeded, an evaluation must be performed to determine, the effect on the structural integrity of the RCPB components. The ASME Code, Section XI, Appendix F (Ref. 7) provides a recommended methodology for-evaluating an operating event that causes an excursion outside the limits.APPLICABLE SAFETY ANALYSIS The P/T limits are not derived from Design Basis Accident (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to prop agate and cause nonductile

• failure of the RCPB, an unanalyZed condition.

Reference 1, as modified by Reference 2, il!: combined with the additional requirements of Reference 3 provide the methodology for determining the P/T limits. Although the PiT limits are not derived from any DBA, the P/T limits are acceptance limits since they preclude operation in an 'unanalyzed condition. RCS P/T limits satisfy Criterion 2 of.l0CFR,50.36(e)(2)(ii-). LCO The LCO limits apply to ferritic components of the RCS, except the Pressurizer. These limits define allowable operating regions while providing margin against nonductile failure for the" controlling ferritic components. The limitations imposed on the rate of change of temperature have been established to ensure consistency with the resultant heatup, cooldown, and ISLH testing P/T'limit curves. These limits control the thermal gradients (stresses) within .the reactor vessel belt line (the limiting component). Note that while these limits are to provide protection to ferritic components within the reactor coolant pressure boundary, a limit of 1 00 0 F/hr applies to the reactor, coolant pressuire boundary (except the pressurizer) to ensure that operation is maintained within the ASME Section III design loadings, stresses, and fatigue analyses for heatup and cooldown.MILLSTONE -UNIT 3 B 3/4 4-9 MILLTON -NIT3 B3/44-9Amendment No. 4--57-, 197 LBDCR 04-MP3-001 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued) Violating the LCO limits places the reactor vessel outside of the bounds of the analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follows: a. The severity of the departure from the allowable operating P/T regime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced);

and c. The existences, sizes, and orientations of flaws in the vessel material.APPLICABILITY The RCS P/T limits LCO provides a definition of acceptable operation for prevention of nonductile failure of ferritic RCS components using ASME Section XI Appendix G, as modified by Code Case N-640 and the additional requirements of l0CFR50, Appendix G (Ref. 1). The P/T limits were developed to provide requirements for operation during heatup or cooldown (MODES 3, 4, and 5) or ISLH testing, in keeping with the concern for nonductile failure. The limits do not apply to the Pressurizer. During MODES 1 and 2, other Technical Specifications priovide limits for operation that can be more restrictive than or can supplement these P/T limits. LCO 3.2.5, "DNB Parameters"; LCO 3.2.3. 1, "RCS Flow Rate and Nuclear En~thaltpy H'ot Channel Facto',;.LCO 3,1.1.4,"Minimum Temperature for Criticality"; and Safety Limit 2.1, "Safety Limits," also provide operational restrictions for pressure and temperature and maximum pressure. Furthermore, MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed. for normal maneuvering profiles, such as power ascension or descent.ACTIONS Operation outside the P/T limits must be corrected so that the RCPB is returned to a. condition that has been verified by stress analyses. The Allowed Outage Times (AOTs) reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the*activity can be accomplished in this time in a controlled manner.Besides restoring operation within limits, an evaluation is required to. determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components. MILLSTONE -UNIT 3 B 3/4 4-10 Amendment No. 5-7, 1-9-, 2--l--, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP'3-015

• February 24, 2005 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued)

ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.The 72 hour AOT when operating in MODES 1 through 4 is reasonable to accomplish the evaluation. The evaluation for a mild violation ispossible within this time, but more severe violations may require special; event specific* stress analyses or inspections. A favorable evaluation must be completed before continuing to operate.This evaluation must be completed whenever a limit is exceeded. Restoration within the AOT alone is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity. If the required remedial actions are not *completed within the allowed times, the plant must be placed in a lower MODE or not allowed to enter MODE 4 because either the RCS remained in an unacceptable P/T region for an extended period of increased stress or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased. If the required evaluation for continued operation in MODES 1 through 4 cannot be accomplished within 72 hours or the results are indeterminate or unfavorable, action must proceed to reduce preSur~e and te~fnperathire as sp~cifr~d~ii the ACT]ION stiatement. A evaluation must be completed and documented before r-etrnirng to operating pressure and temperature conditions. Pressure and temperature are reduced by bringing the plan~t to MODE 3 within 6 hours and to MODE 5 with RCS pressure < 500 psia within the next 30 hours.Completion of the required evaluation following limit violation in other than MODES 1 through 4 is required before plant startup to MODE 4 can* proceed..The AOTs are reasonable, based on operating experience to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE REQUIREMENTS Verification that operation is within the LCO limits as well as the :limits of Figures 3.4-2 and -3.4-3 is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This frequency is considered reasonable in view of the control room indication available to monitor RCS status.MILLSTONE -UNIT 3 B 3/4 4-11 Amendment No. 4&, 89, 4-5#, 4)-97, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES : PRES SURE/TEMPERATURE LIMITS (continued) Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied. This Surveillance Requirement is only required to be performed during system heatup, cooldown, and ISLJ- testing. No Surveillance Requirement is given for criticality operations because LCO 3.1.1.4 contains a more restrictive requirement. It is rnot necessary to perform Surveillance Requirement 4.4.9.1.1 to verify' compliance with Figures 3.4-2 and 3.4-3 when the reactor vessel is fully detension'ed. During REFUELING; with the head fully detensioned or off the reactor vessel, the RCS is not capable of being pressuriz~ed to any significant value. The limiting thermal stresses which could be encountered during this time would be limited to flood-up using RWST water as low as 40°F. It is not possible to cause crack growth of postulated flaws in the reactor vessel at normal REFUELING temperatures even injecting 40°F Water.REFERENCES

1. ASME Boiler and Pressure Vessel Code, Section XI, Appendix GQ "Fracture

I Toughness for Protection Against Failure," 1995 Edition.2. ASME Section XI, Code Case N-640, "Alternative R~eference Fracture Toughness for Development of P-T Limit Curves," dated F~ebruary 26, 1999.3. 10 CFR 50 Appendix G, "Fracture Toughness Requirements." 4. ASTM E 185-82, "Standard Practice for Conducting Surveillance Tests for Light-Water Cooled Nuclear Power Reactor. Vessels, E 706." 5. 10 CFR 50 Appendix IH, "Reactor Vessel Material Surveillance Program Requirements." 6. Regulatory Guide 1.99 Revision 2, "Radiation Embrittlement of Reactor Vessel Materials," dated May 1988.7. ASME Boiler and Pressure Vessel Code, Section XI, Appendix E, "Evaluation of Unanticipated Operating Events," 1995 Edition.MILLSTONE

-UNIT 3 B 3/4 4-12 Amendment No. 48,14-7, 9-,-2-04,-2-t-4, Acknowledged by NRC letter dated 08/25/05 May 8, 2002 This page intentionally left blank MILLSTONE -UNIT 3 B 3/4 4-13 MILLTON -NIT B /4 -13Amendment No. #$, Z7'7 204 May 8, 2002 This page intentionally left blank MILLSTONE -UNIT 3 B 3/4 4-14 MILLTON -NIT B /4 -14 Amendment No. JF7, 204 REACTRCOLNESSE May 8, 2002 BASES I OVERPRESSURE PROTECTION SYSTEMS BACKGROUND The Cold Overpressure Protection System limits RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the isothermal beltline. pressure and temperature (P/I)limits developed using the guidance of ASME Section XI, Appendix G (Reference 1)as modified by ASME Code Case N-640 (Reference 2). The reactor vessel is the limiting RCPB component for demonstrating such protection. Cold Overpressure Protection consists of two PORVs with nominal lift setting as specified in Figures 3.4-4a and 3.4-4b, or two residual heat removal (RHR)suction relief valves, or one PORV and one RHR suction relief valve, or a depressurized RCS and an RCS vent of sufficient size. Two relief valves are required for redundancy. One relief valve has adequate relieving capability to prevent overpressurization of the RCS for the required mass input capability. MILLSTONE -UNIT 3 B 3/4 4-15 Amendment No. J7, J 7, 204 REVERSE OF PAGE B 3/4 4-15 INTENTIONALLY LEFT BLANK-LBDCR Nb. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued) The use of a PORV for Cold Overpressure Protection is limited to those conditions when no more than one RCS loop is isolated from the reactor vessel. When two or more ioops are isolated, Cold Overpressure Protection must be provided by either the two RHR suction relief valves or a depressurized and vented RCS, The reactor vessel material is less tough at low temperatures than at normal operating temperature. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to stress at low temperatures (Ref. 3). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased. The potential for vessel overpressurization is most acute when the RCS is water solid, occurring while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the RCS P/T limits by a significant amount could cause nonductile cracking of the reactor vessel. LCO 3.4.9.1, "Pressure/Temperature Limits -Reactor Coolant System,'"requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the limits providedin Figures 3.4-2 and 3.4-3.This LCO provides RCS overpressure protection by limiting mass input capability and requiring adequate pressure relief: capacity. Limiting mass input capability requires all Safety Injection O ~ (illI) pumps and all but one centrifugal charging pump to be incapable of injection into the RCS.W The pressure relief capacity requires either two redundant relief valves or .a depressurized RCS and an RCS vent of sufficient size. One relief valve or the open RCS vent is the overpressure protection device that acts to terminate an increas~ing presswr~e event..With minimum mass input capability, the ability to p rovi'de core coolant addition is restricted. The LCO does not require the makeup control system deactivated or the safety injection (SI)actuation circuits blocked. Due to the lower pressures in the Cold Overpressure Protection modes and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve.If a loss of RCS inventory or reduction in SHUTDOWN MARGIN event occurs, the appropriate response will be to correctthe situation by starting RCS makeup pumps. If the loss of inventory or-SHUTDOWN MARGIN is significant, this may necessitate the use of additional RCS makeup pumps that are being maintained not capable of injecting into the RCS in accordance with Technical Specification 3.4.9.3. The use of these additional pumps to restore RCS inventory or SHUTDOWN MARGIN will require entry into the associated ACTION statement. The ACTION* I statement requires immediate action to comply with the specification. The restoration of RCS inventory or SHUTDOWN MARGIN canbe considered to be part of the immediate action to-restore the additional RCS makeup pumps to a not capable of injecting status. While recovering RCS inventory or SHUTDOWN MARGIN, RCS pressure will be maintained below the P/T limits. After RCS inventory or SHUTDOWN MARGIN has been restored, the additional pumps should be immediately made not capable of injecting and the ACTION statement exited.O MILLSTONE -UNIT 3 B 3/4 4-16 Amendment No. 4-&, 88 3-8, 4-5-7, Acknowledged by NRC letter dated 08/25/05 August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRES SURE PROTECTION SYSTEMS (continued) PORV Requirements As designed, the PORV Cold Overpressure Protection (COPPS) is *signaled to open if the RCS pressure approaches a limit determined by the COPPS actuation logic..The COPPS actuation logic monitors both RCS temperature and RCS pressure and determines when the nominal setpoint of Figure 3.4-4a or Figure 3.4-4b is approached. The wide range RCS temperature indications are auctioneered to select the lowest temperature signal.The lowest temperature signal is processed through a function generator that calculates a pressure setpoint for that temperature. The calculated pressure setpoint is then compared with RCS pressure measured by a wide range pressure channel. If the measured pressure meets or exceeds the calculated value, a PORV is Signaled to open.The use of the PORVs is restricted to three and four RCS loops unisolated: for a loop to be considered isolated, both RCS loop stop valves must be closed. If more than one loop is isolated, then the PORVs must have their block valves closed or COPPS must be blocked. For these cases, Cold Overpressure Protection must be provided by either the two RHR suction relief valves or a depressurized RCS and an RCS vent. This is necessary because the PORV mass and heat injection transients have only been analyzed for a maximum of one loop isolated, the use of the PORVs is i restricted to three and four RCS loops unisolated. W The RHR suction relief valves have been qualified for all mass. injection transients for. any combination of isolated loops. In addition, the heat injection transients not..prohibited by the Technical"Sp~ecificationis have also b~een' the alilifi~ationi of the RHR s~Ictibr relief valves.Figure 3.4-4a and Figure 3.4-4b present the PORY setpoints for COPPS. The setpoints are.staggered so only one valve opens during a low temperature overpressure transient. Setting both valves to the values of Figure 3.4-4a and Figure 3.4-4b within the tolerance allowed for the calibration accuracy, ensures that the isothermal P/T limits will not be exceeded for the analyzed [isothermal events.When a PORV is opened, the release of coolant will cause the pressure increase to slow and reverse; As the PORV releases coolant, the RCS press~ure decreases until a reset pressure is reached and the valve is signaled to close. Thie pressure continues to decrease below the reset pressure as the valve closes.MILLSTONE -UNIT 3 B 3/4 4-16a MILLTON -UIT B 34 416aAmendment No. 48, 88, 4-57, 197 August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRES SURE PROTECTION SYSTEMS RIIR Suction Relief Valve Requirements The isolation valves between the RCS and the RIIR suction relief valves must be open to make*the RIIR.suction relief valves OPERABLE for RCS overpressure mitigation. The RHRsuctionvalves are spring loaded, bellows type water relief valves with setpoint tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (AS ME) Code (Ref. 4) for Class 2 relief valves.When the RHR system is operated for decay heat removal or low pressure letdown control, the.isolation valves between the RCS and the RHR suction relief valves are open, and the RHR_suct~ion relief valves are exposed to the RCS and are able to relieve pressure transients in the RCS.RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the'RCS at acceptable pressure levels in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. *Thus, the vent path must be capable Qf relieving the flow resulting from the limiting mass or heat input transient, and maintaining .pressure below the P/T limits for the analyzed isothermal events.For an RCS vent to meet the flow capacity requirement, it requires removing a Pressurizer safety valve, removing a Pressurizer manway, or similarly establishing a vent by opening* an RCS vent valve provided that the opening meets the relieving capacity requirements. The vent path must be above the level of reactor coolant, so as not to drain t/he RCS wheri open.MILLSTONE -UNIT 3 B 3/4 4-17 MILLTONE-UNT 3 3/4-17Amendment No. 1-5-7, 197 LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES i OVERPRES SURE PROTECTION SYSTEMS (continued) APPLICABLE SAFETY ANALYSIS Safety analyses (Ref. 5) demonstrate that the reactor yessel is adequately protected against exceeding the PIT limits for the analyzed isothermal events. In MODES 1, 2, AND3, and in MODE 4, with RCS cold leg temperature exceeding 226 0 F, the pressurizer safety valves will provide RCS overpressure protection in the ductile region. At.226 0 F and below, overpressure prevention is provided by two means: (1) two OPERABLE relief valves, or (2) a depressurized RCS with a sufficiently sized RCS vent, consistent with ASMIE Section XI, Appendix G for temperatures less than RTNDT +/- 50OF. Each oftlhese means has a limuited overpressure relief capability. The required RCS temperature for a given pressure increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the Technical. Specification curves are revised, the cold overpressure protection must be re-evaluated to ensure its functional requirements continue to be met using the RCS relief valve method or the depressurized and vented RCS condition. Transients capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow: Mass Input Transients

a. Inadvertent safety injection; or b. Charging/letdown flow mismatch Heat Input Transients

a. Inadvertent actuation of Pressurizer heaters;b. Loss of RHIR cooling; or c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.

The Technical Specifications ensure that mass input transients beyond the OPERABILITY of the cold overpressure protection means do not occur by rendering all Safety Injection Pumps and all*but one centrifugal charging pump incapable of injecting into the RCS whenever an RCS cold leg is _226 0 F.The Technical Specifications ensure that energy addition transients beyond the OPERABILITY of the cold overpressure protection means do not occur by limiting reactor coolant pump starts.LCO 3.4.1.4.1, "Reactor Coolant Loops and Coolant Circulation -COLD SHUTDOWN -Loops Filled," LCO 3.4.1.4.2, "Reactor Coolant MILLSTONE -UNIT 3 B 3/4 4-18 Amendment No. 1-5-7, I-9-7, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BA.SES OVERPRESSURE PROTECTION SYSTEMS (continued) Loops and Coolant Circulatio~n -COLD SHUTDOWN -Loops Not Filled," and LCO 3.4.1.3,""'Reactor Coolant Loops and Coolant Circulation -HOT SHUTDOWN" limit starting the first reactor coolant pump such that it shall not be started when any RCS loop wide range cold leg temperature is 226°F unless the secondary side water temperature of each steam generator is< 50°F above each RCS cold leg temperature. The restrictions ensure the potential energy addition to the RCS from the secondary side of the steam generators will not result in an RCS overpressurization event beyond the capability of the COPPS to mitigate. The COPPS utilizes the pressurizer PORVs and the RHR relief valves to. mitigate th~e limiting mass .and en~ergy addition events, thereby protecting the isothermal reactor vessel b.eltline P/T limits. The restrictions w~ill ensure the reactor vessel. wili~be protected from a. cold .oyerpress~ure event whenlstartinag the first RCP. If at least, one RCP is operating, no restrictions are necessary to start additional RCPs for'reactor vessel protection. In addition, this restriction only applies to RCS loops and associated components that are. not isolated from the reactor vessel.The RCP starting criteria are based on the equipment used to provide cold overpressure protection. A maximum temperature differential of 50°F between the steam generator secondary sides and RCS cold legs will limit the potential energy addition to within the capability of the*pressurizer PORVs to mitigate the transient. The RHR relief valve are also adequate to mitigate energy addition transients constrained by this temperature differential limit, provided all RCS cold leg temperature are at or below 150°F. The ability of the RUR relief valves to mitigate.energ~y cold leg ,temperature is .above,.,50 0 F has not analyzed.As a result, the temperature of the steam-generator secondary sides must 'be at or below the RCS cold leg temperature if the RHR relief valves are providing cold overpressure protection and the RCS cold leg temperature is above 150OT.! MILLSTONE -UNIT 3 B 3/4 4-19 Amendment No. t4-7, -l-9-?, Acknowledged by NRC letter dated 08/25/05 August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued) The cold overpres sure transient analyses demonstrate that either one relief valve or the depressurized RCS and RCS vent can maintain RCS pressure below limits when RCS letdown is isolated and only one centrifugal charging pump is operating. Thus, the LCO allows only one centrifugal charging pump capable of injecting when cold overpressure protection is required: The cold overpressure protection enabling temperature is conservatively established at a value.< 226°F based on the *criteria provided by ASME Section XI, Appendix G.PORV Performance The analyses show that the vessel is protected against non-ductile failure When the PORVs are set to open at the values shown in Figures 3.4-4a and 3.4-4b within the tolerance allowed for the calibration accuracy. The curves are derived by analyses for both three and four RCS loops unisolated that model the performance of the PORV cold overpressure protection system (COPPS), assuming the limiting mass and heat transients of one centrifugal charging pump injecting into the RCS, or the energy addition as a result of starting an RCP with temperature asymmetry between the RCS and the steam generators. These analyses consider pressure overshoot beyond the PORV opening setpoint resulting from signal processing and valve stroke*times.The PORV setpoints in Figures 3.4-4a and 3.4-4b will be updated when the P/T limits conflict*with the cold overpressure analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement. Revised limits are determined using neutron fluence projections and the results of testing of the reactor vessel material irradiation-survei~ltancee-speeimens. The .Baseso~for ,LCO -3.49-l,. "P..ressure/Temperature Limits -Reactor Coolant System (Except the Pressurizer)," dismiss these, e-valuations. The PORVs are considered active components. Thus, the failure of one PORV is assumed to represent the worst case, single active failure.RHR Suction Relief Valve Performance The RIIR suction relief valves do not have variable pressure and temperature lift s etpoints as do the PORVs. Analyses show that one RHIR suction relief valve with a setpoint at or between 426.8 psig and 453.2 psig will pass flow greater than that required for the limiting cold overpressure transient while maintaining RCS pressure less than the isothermal P/T limit curve.Assuming maximum relief flow requirements during the limiting cold overpressure. event, an RHR suction relief valve will maintain RCS pressure to _< 110% of the nominal lift setpoint.Although each RHR suction relief valve is a passive spring loaded device, which meets single failure criteria, its location within the RHR System precludes meeting single failure criteria when spurious RHR suction isolation valve or RIIR suction valve closure is postulated. Thus the los~s of an RHR suction relief MILLSTONE -UNIT 3 B 3/4 4-20 MILLTON -NIT3 B3/4-20Amendment No. I1-5g, 197 REACTOR COOLANT SYSTEM AUgust 27, 2001 BASES OVFRPRESSURE PROTECTION SYSTEMS (conti~nued) valve is the worst case single failure. Also, as the RCS P/T limits are revised to reflect change in toughness in the reactor vessel materials, the RHR suction.rel~ief valve's analyses must be re-evaluated to ensure continued accommodation of-:the design bases cold overpressure transients. RCS vent Performance With the RCS depressurized, analyses show a vent size of > 2.0 square inches is capable of mitigating the limiting cold overpressure transient. The capacitfof this vent size is greater .than the flow of the limiting transient, while maintaining RCS pressure less than the maximum pressure on the isothermal P/T limit curve.The RCS vent size will be re-evaluated for compliance each time the isothermal P/I limit curves are revised.The RCS vent is a passive device and is not subject to active failure.The RCS vent satisfies Criterion 2 of 1OCFR50.36(c)(2)(ii). MILLSTONE-UNIT 3: B 3/4 4-21 MILL TON -UIT .B /4 -21Amendment No. 197 REACTOR COOLANT SYSTEM August 27, 2001 BASES OVERPRESSURE PROTECTION SYSTEMS (continued) LCO This LCO requires that cold overpressure protection be OPERABLE and the maximum mass input be limited to one charging pump. Failure to meet this LCO could lead to the loss of low temperature overpressure mitigation and violation of the reactor vessel isothermal P/T limits as a result of an operational transient. To limit the mass input capability, the LCO requires a maximum of one centrifugal charging pump capable of injecting into the RCS.The elements of the LCO that provides low temperature overpressure mitigation through pressure relief are: I. Two OPERABLE PORVs; or A PORV is OPERABLE for cold overpressure protection when its block valve is*open, its lift setpoint is set to the nominal- setpoints provided for both three and four loops unisolated by Figure 3.4-4a or 3.4-4b and when the surveillance requirements are met.2. Two OPERABLE RHR suction relief valves; or An RH-R suction relief valve is OPERABLE for cold overpressure protection when its isolation valves from the RCS are open and when its setpoint is at or between 426.8 psig and 453.2 psig, as verified by required testing.3. One OPERABLE PORV and one OPERABLE RHR suction relief valve; or 4. A depressurized RCS and an RCS vent.An RCS vent is OPERABLE when open with an area of > 2.0 square inches.Each of these methods of ovepressure prevention is Capable of mitigating the limiting cold overpressure transient. MILLSTONE -UNIT 3 B 3/4 4-Z2 MILLTON -NIT B /4 -22Amendment No. 197 LBD CR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued) APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is < 226°F, in MODE 5, and in MODE 6 when the head is on the reactor vessel. The Pressurizer safety valves provide RCS ovelrpressure protection in the ductile region (i.e. > 226°F). When the reactor head is off, overpressurization cannot occur.LCO 3.4.9.1 "Pressure/Temperature Limits" provides the operational P/T limits for all MODES.LCO 3.4.2, "Safety Valves," requires the OPERABILITY of the Pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and 4 when all RCS cold leg temperatures are > 226°F.Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a rapid increase in RCS pressure when little or no time exists for operator action to mitigate the event.ACTIONS a. and b.With two or more centrifugal charging pumps capable of injecting into the RCS, or with any SIH pump capable of injecting into the RCS, RCS over~pressurization is possible.To immediately initiate action to restore restricted massinput capability to the Rcs reflects the urgency of removing the RCS from this condition. Required ACTION a. is modified by a Note that permits two centrifugal charging pumps capable of RCS injection for < 1 hour to allow for pump swaps. This is a controlled evolution of short duration and the procedure prevents having two charging pumps simultaneously out of pull-to-lock while both charging pumps are capable of injecting into the RCS.c.In MODE 4 when any RCS cold leg temperature is < 226°F, with one required relief valve inoperable, the RCS relief valve must be restored to OPERABLE status within an allowed outage time (AOT) of 7 days. Two relief valves in any combination of the PORVs and the RHR suction relief valves are requi'ed to provide low temperature overpressure mitigation while withstanding a single failure of an active component. MILLSTONE -UNIT 3 B 3/4 4-23 Amendmen~t No. 9-7, Acknowledged by NRC letter dated 0 8/25/05 LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES OVERPRES SURE PROTECTION SYSTEMS (continued') The AOT in MODE 4 considers the facts that only one of the relief valves is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low. The RCS must be depressurized and a vent must be established within the following 12 hours if the required relief valve is not restored to OPERABLE within the required AOT of 7 days.d.The consequences of operational events that will overpressure the RCS are more severe at lower temperatures (Ref. 8). Thus, with one of the two required relief valves inoperable in MODE 5 or in MODE 6 with the head on, the AOT to restore two valves to OPERABLE status is 24 hours.The AOT represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE relief valve to protect against events. The RCS must be depressurized and a vent must be established within the following 12 hours if the required relief valve is not restored to OPERABLE within the required AOT of 24 hours.e.The RCS must be depressurized and a vent must be established within 12 hours when both required Cold Overpressure Protection relief valves are inoperable. The vent must be sized >_ 2.0 square inches to ensure that the flow capacity is greater than that required for the worst case cold overpressure transient reasonable during the applicable MODES.This action is needed to protect the RCPB from a low temperature overpressureevent and a possible non-ductile failure of the reactor vessel.The time required to place the plant in this Condition is based on the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements. SURVEILLANCE REQUIREMENTS 4.4.9.3.1 Performance of an ANALOG CHANNEL OPERATIONAL TEST is required within 31 days prior to entering a condition in which the P0KV is required to be OPERABLE and at the[frequency specified in the Surveillance Frequency Control Program thereafter on each required PORV to verify and, as necessary, adjust its lift setpoint. The ANALOG CHANNEL OPERATIONAL TEST will verify the setpoint in accordance with the nominal values given in Figures 3.4-4a and 3.4-4b. P0RV actuation could depressurize the RCS; therefore, valve operation is not required.MILLSTONE -UNIT 3 B 3/4 4-24 MILLTONE-UNT 3 3/44-24Amendment No. 4-l-57-,4-97 LBDCR 12-MiP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES OVERPRES SURE PROTECTION SYSTEMS (continued) Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required periodically to adjust the channel so that it responds and the valve opens within the required range and accuracy to a known input. The surveillance frequency is controlled under the Surveillance Frequency Control Program.The PORV block valve must be verified open and COPPS must be verified anned periodically to provide a flow path and a cold overpressure protection actuation circuit for each required PORV to perform its function when required. The valve is remotely verified open in the main control room. This Surveillance is perfonned if credit is being taken for the PORV to satisfy the LCO.The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required to be removed, and the manual operator is not required to be locked in the open position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure transient. The surveillance frequency is controlled under the Surveillance Frequency Control Program.4.4.9.3.2 Each required RH-R suction relief valve shall be demonstrated OPERABLE by verifying the .RHR suction valves, 3R1IS*MV8701A and 3 RHS*M8701 C, are open when suction r.elief valve 3PJHS*RV8708A is being used to meet the LCO and by verify"ing theRiHR suction valves, 3RHS*MVT8702B and 3RHIS*MV\8702C, are open when suction relief valve 3RHS*RV8708B is being used to meet the LCO. Each required RHIR suction relief valve shall also be demonstrated OPERABLE by testing it in accordance with 4.0.5. This Surveillance is only required to be performed if the RUR suction relief valve is being used to meet this LCO.The RHR suction valves are periodically verified to be open. The surveillance frequency is controlled under the Surveillance Frequency Control Program.The ASME Code for Operation and Maintenance of Nuclear Power Plants, (Reference 9), test per 4.0.5 verifies OPERABILITY by proving proper relief valve mechanical motion and by measuring and, if re~quired, adjusting the lift setpoint.MILLSTONE -UNIT 3 B 3/4 4-25 MILLSONE -UNIT B 3/4-25Amendment No. 5, -I-97-, 2. LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEMd BASES OVERPRESSUJRE PROTECTION SYSTEMS (continued) 4.4.9.3.3 The RCS vent of> 2.0 square inches is proven OPERABLE periodically by verifying its open condition. A removed Pressurizer safety valve fits this category.This passive vent arrangement must only be open to be OPERABLE. This Surveillance is required to be performed if the. vent is being used to satisfy the pressure relief requirements of the LCO. The surveillance frequency is controlled under the Suareillance Frequency Control Program.4.4.9.3.4 and 4.4.9.3.5 To minimize the potential for a low temperature overpressure event by limiting the mass input capability, all SIHl pumps and all but one centrifugal charging pump are verified incapable of injecting into the RCS.The SIll pumps and charging pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control.Alternate methods of control may be employed using at least two independent means to prevent an injection into the RCS. This may be accomplished thr'ough any of the following methods: 1) placing the pump in pull to lock (PTL) and pulling its UJC fuses, 2) placing the pump in pull to lock (PTL) and closing the pump discharge valve(s) to the injection line, 3) closing the discharge valve(s) to the injection line and either removing power from the valve operator(s) or locking manual valves closed, and 4) closing the valve(s) from th~e injection source and either removing power fr'om the valve operator(s) or locking manual valves closed.An SIN- pump may be energized for testing or for filling* teAcmulators provided it is incapable of injecting inato the RCS.The surveillance frequency is controlled under the Surveillance Frequency Control Program.REFERENCES

1. ASME Boiler and Pressure Vessel Code, Section XI, Appendix G-, "Fracture Toughness for Protection Against Failure," 1995 Edition.2. ASME Section XI, Code Case N-640, "Alternative Reference Fracture Toughness for Development of P-T Lim~it Curves," dated February 26, 1999.3. Generic Letter 88-11 4. ASMiE, Boiler and Pressure Vessel Code, Section III 5. FSAR, Chapter 15 6. lOCFR50, Section 50.46 7. 10CFR50, Appendix K 8. Generic Letter 90-06 9. ASME Code for Operation and Maintenance of Nuclear Power Plants MILLSTONE

-UNIT 3 B 3/4 4-26 Amendmnent No. 1-5-7-, 4- 0 , May 8, 2002 This page intentionally left blank MILLSTONE -UNIT 3 B 3/4 4-27 Amendment No. X7204 REVERSE OF PAGE B 3/4-4-27 INTENTIONALLY LEFT BLANK LBDCR 05-MP3-025 March 7, 2006 3/4.5 EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.1 ACCUMULATORS The OPERABILITY of each Reactor Coolant System (RCS) accumulator ensures that a sufficient volume of borated water will be immnediately forced into the reactor core through each of the cold legs in the event the RCS pressure falls below the pressure of the accumulators. This initial surge of water into the core provides the initial cooling mechanism during large RCS pipe ruptures.The limits on accumulator volume, boron concentration and pressure ensure that the assumptions used for accumulator injection in the safety analysis are met.The accumulator power operated isolation valves are required to meet the guidance of "operating bypasses" in the context of IEEE Std. 279-1971, which requires that bypasses of a protective function be removed automatically whenever permissive conditions are not met. The "operating bypass" designed for the isolation valves is applicable to MODES 1, 2, and 3 with Pressurizer pressure above P-Il1 setpoint. In addition, as these accumulator isolation valves fail to meet single failure criteria, removal of power to the valves is required.The limits for operation with an accumulator inoperable for any reason except an isolation valve closed minimizes the time exposure of the plant to a LOCA event occurring concurrent with failure of an additional accumulator which may result in unacceptable peak cladding temperatures. If a closed isolation valve cannot be immediately opened, the full capability of one accumulator is not available and prompt action is required to place the reactor in a mode where this capability is not required.3/4.5.2 AND 3/4.5.3 ECCS SUBSYSTEMS The OPERABILITY of two independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure consideration. Either subsystem operating in conjunction with the accumulators is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double ended break of the largest RCS cold leg pipe downward. In addition, each ECCS subsystem provides long-term core cooling capability in the re-circulation mode during the accident recovery period.With the RCS temperature below 350°F, one OPERABLE ECCS subsystem is acceptable without single failure consideration and with some valves out of normal injection lineup, on the basis of the stable reactivity condition of the reactor and the limited core cooling requirements. The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System is required to be available to support charging pump operation. The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System consists of two redundant trains, each capable of providing 100% of the required flow. Each train has a two position, "Off" and "Auto," remote control switch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the operating train. The associated fans do not receive any safety related automatic start signals (e.g., Safety Injection Signal).MILLSTONE -UNIT 3B3/5-AmnetNo -, B 3/4 5-1 Amendment No. :t-5-7, LBDCR No. 05-MP3-025 March 7, 2006 EMERGENCY CORE COOLING SYSTEMS BASES "O ECCS SUBSYSTEMS (Continued) Placing the remote control switch for a Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train in the "Off' position to start the redundant train or" to per~form post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensure the remote control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use of an approved procedure and a designated individual at the control switch for the respective Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respond to instructions from procedures, or control room personnel, based on plant conditions. The Surveillance Requirements provided to ensure OPERABILITY of each component ensures that at a minimum, the assumptions used in the safety analyses are met and that subsystem OPERABILITY is maintained. Surveillance Requirements for throttle valve position stops provide assurance that proper ECCS flows will be maintained in the event of a LOCA.Maintenance of proper flow resistance and pressure drop in the piping system to each injection point is necessary to: (1) prevent total pump flow from exceeding runout conditions when the system is in its minimum resistance configuration, (2) provide the proper flow split between injection points in accordance with the assumptions used in the ECCS-LOCA analyses, and :B.(3) provide an acceptable level of total ECCS flow to all injection points equal to or above that.assumed in the ECCS-LOCA analyses.Any time the OPERABILITY of an ECCS throttle valve or an ECCS Subsystem has been affected by repair, maintenance, modification, or replacement activity that alter flow characteristics, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. Surveillance Requirement 4.5.2.b.l1 requires verifying that the ECCS piping is full of water. The ECCS pumps are normally in a standby, nonoperating mode, with the exception of the operating centrifugal charging pump(s). As such, the ECCS flow path piping has the potential to develop voids and pockets of entrained gases. Maintaining the piping from the ECCS pumps to the RCS full of water ensures that the system will perform properly when required to inject into the RCS.This will also prevent water hammer, degraded performance, cavitation, and gas binding of ECCS pumps, and reduce to the greatest extent practical the pumping of non-condensible gases (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling.This Surveillance Requirement is met by:*VENTING the ECCS pump casings and VENTING or Ultrasonic Test (UT) of the accessible suction and discharge piping high points including the ECCS pump suction crossover piping (i.e., downstream of valves 3RSS*MV8837A/B and 3RSS*MV8838A/B to safety injection and charging pump suction). VENTING of the , MILLSTONE -UNIT 3 B 3/4 5-2 MILSTOE -UNI 3 3/5-2Amendment No. 4-00, 4-4-7, -l--5-7, LBDCR No. 05-MP3-004 April 21, 2005 EMERGENCY COPE COOLING SYSTEMS.BASES ECCS SUBSYSTEMS (Continued) accessible suction and discharge piping high points including the ECCS pump suction crossover piping is required when gas accumulations exceed the gas accumulation limits. NOTE: Certain maintenance (e.g. ECCS pump overhaul) or other evolutions

• can cause gas or air to enter the EGGS. VENTING of the affected portion of the ECCS is necessary for these evolutions.
• VENTING of the nonoperating centrifugal charging pumps at the suction line test connection.

The nonoperating centrifugal charging pumps do not have casing vent connections and VENTING the suction pipe will assure that the pump casing does not voids and pockets of entrained gases.*using ant external water level detection method for the water filled portions of the RSS piping upstream of valves 3RSS*MV8837AJB and 3RSS*MV8838AJB. When deemed necessary by an external water level detection method, filling and venting to reestablish the acceptable water levels may be performed after entering LCO.ACTION statement 3.6.2.2 since VENTING without isolation of the affected train would result in a breach of the containment pressure boundary.The following ECCS subsections are exempt from this Surveillance:

• the operating centrifugal charging pump(s) and associated piping -as an operating pump is self VENTING and cannot develop voids and pockets of entrained gases.* the RSS pumps, since this equipment is partially dewatered during plant operation.

Each RS S pump is equipped with a pump casing vent line that allows automatic VENTING of the pump casing prior to pump operation following an accident.I

• the RSS heat exchangers, since this equipment is laid-up dry during plant operation.

Gas is flushed out of the heat exchangers during the initial operation of the RS S pumps following an accident.* the RSS piping that is not maintained filled with water during plant operation. The configuration of this piping is such that it is self VENTING upon initial operation of the RSS pumps.*the ECCS discharge piping within containment. These piping sections are inaccessible during reactor operations due to accessibility (containment entry), safety, and radiological concerns. They are static sections of piping relatively insensitive to* gas accumulations since these lines are stagnant during normal power operation. The ECCS discharge piping inside containment is filled and vented upon system return to service.* the Residual Heat Removal (RI-R) heat exchangers. These are dual pass, vertical u-tube heat exchangers that do not allow direct measurement of gas voids. System MILLSTONE -UNIT 3 B 3/4 5-2a Amendment No. 4-1-@, 5-7, Acknowledged by NRC Letter dated 04/12/06 LBDCR 12-MIP3-O00 September 20, 2012 EMERGENCY CORE COOLING SYSTEMS ,l 0 BASES ECCS SUB SYSTEMS (Continued) flush upon heat exchanger return to service and procedural compliance is relied upon to ensure that gas is not present within the heat exchanger u-tubes.Surveillance Requirement 4.5 .2.C.2 requires that the visual inspection of the containment he performed at least once daily iffthe contaimnent has been entered that day and when the final containment entry is made. This will reduce the number of unnecessary inspections and also reduce personnel exposure.Surveillance Requirement 4.5.2.d.2 addresses periodic inspection of the containment sump to ensure that it is unrestricted and stays in proper operating condition. The surveillance fr'equency is controlled under the Surveillance Frequency Control Program.The Emergency Core Cooling System (ECCS) has several piping cross connection points for use during the post-LOCA recirculation phase of operation. These cross-connection points allow the Recirculation Spray System (RSS) to supply water from the containment sump to the safety injection and charging pumps. The RSS has the capability to supply both Train A and B safety injection pumps and both Train A and B charging pumps. Operator action is required to position valves to establish flow fr'om the containment sump through the RSS subsystems to the safety injection and charging pumps since the valves are not automatically repositioned. The quarterly stroke testing (Technical Specification 4.0.5) of the ECC/RSS recirculation flowpath valves discussed below will not result in subsystem inoperability (except due to other equipment manipulations to support valve testing) since these valves are manually aligned in accordance with the Emnergency Operating Procedures (EOPs) to establish the recirculation flowpaths. It is expected the valves will be returned to the normal pre-test position following termination of the surveillance testing in response to the 9 accident. Failure to restore any valve to the normal pre-test position will be indicated to the Control Room Operators when the ESF status panels are checked, as directed by the EOPs. The EOPs direct the Control Room Operators to check the ESF status panels early in the event to ensure proper equipment alignment. Sufficient time before the recirculation flowpath is required is expected to be available for operator action to position any valves that have not been restored to the pretest position, including local manual valve operation. Even if the valves are not restored to the pre-test position, sufficient capability will remain to meet ECCS post-LOCA recirculationi requirements. As a result, stroke testing of the ECCS recirculation valves discussed below will not result in a loss of system independence or redundancy, and both ECCS subsystems will remain OPERABLE.When performing the quarterly stroke test of 3 SIH*MV8923A, the control switch for safety injection pump 3SIH*PIA is placed in the pull-to-lock position to prevent an automatic pump stait with the suction valve closed. With the control switch for 3 SIH*PIA in pull-to-lock, the Train A ECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a., applies. This ACTION statement is sufficient to administratively contr'ol the plant configuration with the automatic start of 3S1H*P1A defeated to allow stroke testing of 3SIH*MV8923A. In addition, the EOPs and the ESF status panels will identify this abnormal plant configuration, if not corrected following the termination of the surveillance testing, to the plant operators to allow restoration of the normal post-LOCA recirculation flowpath. Even if system restoration is not accomplished, sufficient equipment will be available to perfonn all ECCS and RSS injection and recirculation functions, provided no additional ECCS or RSS equipment is inoperable, and an additional single failure does not occur (an acceptable assumption since the Technical Specification ACTION statement limits the plant configuration time such that no additional equipment failure need be postulated). During the injection phase the redundant subsystem (Train B) is fully functional, as is a significant portion of the Train A subsystem. During the recirculation phase, the Train A RSS subsystem can supply water from the containment sumnp to the Train A MILLSTONE -UNIT 3 B 3/4 5-2b MILLTON -NIT B 14 -2bAmendment No. -!00, 4-!4-, 4-5 LBDCR No. 05-MP3-004 April 21, 2005 EMERGENCY CORE COOLING SYSTEMvS BASES and B charging pumps, and the Train B RSS subsystem can supply water from the containmaent sump to the B safety injection pump.When performing the quarterly stroke test of 3 SIH*MV8923B, the control switch for safety injection pump 3SIH*'PlB is placed in the pull-to-lock position to prevent an automatic pump start with the suction valve closed. With the control switch for 3SIW*P1B in pull-to-lock, the Train B ECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a., applies. This ACTION statement is sufficient to administratively control the plant configuration with the automatic start of 3SIH*PlB defeated to allow stroke testing of 3 SIH*VMV8923B. In addition, the EOPs and the ESE status panels will identify this abnormal plant configuration, if not corrected following the termination of the surveillance testing, to the plant operators to allow restoration of the normal po st-LOCA recirculation flowpath. Even if system restoration is not accomplished, sufficient equipment will be available to perform all ECCS and RSS injection and recirculation functions, provided no additional ECCS or RSS equipment is inoperable, and an additional single failure does not occur (an acceptable assumption since the Technical Specification ACTION statement limits the plant configuration time such that no additional equipment failure need be postulated). During the injection phase the redundant subsystem (Train-A) is fully functional, as is a significant portion of the Train B subsystem. During the recirculation phase, the Train A RSS subsystem can supply water from the containment sump to the Train A and B charging pumps and the Train A safety injection pump. The Train B RSS subsystem cannot supply water from the containment sump to any of the remaining pumps.When performing the quarterly stroke test of 3SIH*MV8807A or 3SIH*MV8807B, 3 SIH*IMV8924 is closed first to prevent the potential injection of RWST water into the RCS through the operating charging pump. When 3S1H*MV8924 is closed, it is not necessary to declare either ECCS subsystem inoperable..Although expected to be open for post-LOCA recirculation, sufficient time is expected to be available post-LOCA to identify and open 31H*IV1-V8924 either from thle Control Room or locally at valve. The EOPs and the ESF status panels will identify this abnormal planlt configuration, if not corrected following the termination of thle surveillance testing, to the plant operators to allow restoration of the normal po st-LOCA recirculation flowpath. Even if system restoration is not accoimplished, sufficient equipment will be available to perform all ECCS and RSS binjection and recirculation functions, provided no additional ECCS or RSS equipment is inoperable, eyen if a single failure is postulated. The failure to open 3SIH*'MV8924 due to mechanical binding or the loss of power to ECCS Train A could be the single failure. If a different single failure is postulated, restoration of 3SIH'*MV8924 can be accomplished. The closure of 3SIH*MV8924 has no affect on the injection phase. During the recirculation phase, assuming 3SIH*MI\V8924 remains closed (i.e., the single failure), the Train A RSS subsystem can supply water from the containmaent sump to the Train A and B charging pumps, and the Train B RSS subsystem can supply water from the containment sump to the Train A and B safety injection pumps. If power is lost to ECCS Train A and 3SIH*MV8924 is not opened locally (i.e., the single failure), cold leg recirculation can be accomplished by using RSS Train B to supply containment sump water via 3SIW*PIB to the RCS cold legs and 3S1L*MV8809B can be opened to supply containment sump water via RSS Train B to the RCS cold legs. Hot leg recirculation can be accomplished by using RSS Train B to supply containment sump water via 3SIH*PlB to the RCS hot legs and maintaining 3SIL*~MV8809B open to supply contaimnent sump water via RSS Train B to the RCS cold legs.MILLSTONE -UNIT 3 B 3/4 5-2c Amendment No. 4-08, 7,, Ackn~owledged by NRC Letter dated 04/12/06 LBDCR No. 13-MP3-011 October 30, 2013 CORE COOLING SYSTEMS BASES ECCS Subsystems: Auxiliary Building RPCCW Ventilation Area Temperature Maintenance: In MODES 1, 2, 3 and 4, two trains of 4 heaters each, powered from class 1E power supplies, are required to support charging pump OPERABILITY during cold weather conditions. These heaters are required whenever outside temperature is less than or equal to 17°F.When outside air temperature is below 17°F, if both trains of heaters in the RPCCW Ventilation Area are available to maintain at least 65°F in the Charging Pump and Reactor Comporhent Cooling Water Pump areas of the Auxiliary Building, both charging pumps are OPERABLE for MODES 1, 2 and 3.When outside air temperature is below 17°F, if one train of heaters in the RPCCW Ventilation Area is available to maintain at least 32°F in the Charging Pump and Reactor Component Cooling Water Pump areas of the Auxiliary Building, the operating charging pump is OPERABLE, for MODE 4.With less than 4 OPERABLE heaters in either train, the corresponding train of charging is inoperable. This condition will require entry into the applicable ACTION statement for LCOs 3.5.2 and 3.5.3.LCO 3.5.2 ACTION statement "b", and LCO 3.5.3 ACTION statemnent "c" address special reporting requirements in response to ECCS actuation with water injection to the RCS.The special report completion is not a requirement for logging out of the ACTION statements that require the reports.3/4.5.4 REFUELING WATER STORAGE TANK The OPERABILITY of the refueling water storage tank (RWST) as part of the ECCS ensures that a sufficient supply of borated water is available for injection by theECCS in the evzent of a LOCA. The limits on RWST minimum volume and boron concentration ensure that: (1)sufficient water is available within containmient to permit recirculation cooling flow to the core, and (2) the reactor will remain subcritical in the cold condition following a large break (LB)LOOA, assuming mixing of the RWST, RCS, EGGS water, and other sources of water that may eventually reside in the sump, with all control rods assumed to be out. These assumptions are consistent with the LOCA analyses.The contained water volume limit includes an allowance for water not usable because of tank discharge line location or other physical characteristics. The limits on contained water vo lumne and boron concentration of the RWST also ensure a pH value of between 7.0 and 7.5 for the solution recirculated within containment after a LOCA. This pH band minimizes the effect of chloride and caustic stress corrosion on mechanical systems and components. MILLSTONE -UNIT 3 B 3/4 5-2d Amendment No. 4-I0, ,-i4, ,-4-57, LBDCR No. 13-MP3-011 October 30, 2013 EMERGENCY CORE COOLING SYSTEMS BASES The minimum and maxinmum solution temperatures for the RV\ST in MODES 1, 2, 3 and 4 are based on the following: The 42°F minimum and 73 °F maximum solution temperature values identified within the Technical Specifications include an operational margin of 2°F (e.g., measurement uncertainties, analytical uncertainties, and design uncertainties) from values used in accident analysis/piping stress analysis. Accident analysis/piping stress analysis used 40°F and 75°F for the minimum and maximum RWST solution temperature. MILLSTONE -UNIT 3 B3452 B 3/4 5-2e 0 REVERSE OP PAGE B 3/4 5-2e INTENTIONALLY LEFT BLANK 0 May 26, 1995 EMERGENCY CORE COOLING SYSTEMS 3/4.5.5 TRISODIUM pHOSpHATE STORAGEBASKETS BASES BACKGROUND Trisodlum phosphate (TSP) dodecahydrate is stored in porous wire mesh baskets on the floor or in the sump of the containment building to ensure that iodine, which may be dissolved in the recirculated reactor cooling water following a loss of coolant accident (LOCA), remains In solution, TSP also helps inhibit stress corrosion cracking (SCC) of austenitic stainless steel components in containment during the recirculatlon phase following an accident.Fuel that is damaged during a LOCA will release iodine in several chemical forms to the reactor coolant and to the containment, atmosphere. A portion of the iodine in the containment atmosphere is washed to the sump by containment sprays (i.e.., Quench Spray and/or Containment Recirculation Spray). The emergency core cooling water is borated for reactivity control.This borated water causes the sump solution to be acidic. In a low pH (acidic) solution, dissolved iodine will be converted to a volatile form. The volatile iodine will evolve out of solution Into the containment atmosphere, significantly increasing the levels of airborne iodine. The increased levels of airborne iodine in containment contribute to the radiological releases and increase the consequences from the accident due to containment atmosphere leakage.After a LOCA, the components of the core cooling and containment spray systems will be exposed to high temperature borated water. Prolonged exposure to the core cooling water combined with stresses imposed on the components can cause SCC. The SCC is a function of stress, oxygen and chloride concentrations, pH, temperature, and alloy composition Of the components. High temperatures and low pH,.which would be present after a LOCA, tend to promote SCC. This can lead to the failure of necessary safety systems or components. Adjusting the pH of the recirculation solution to levels above 7.0 prevents a significant fraction of the dissolved iodine from converting to a volatile form. The higher pH thus decreases the level of airborne Iodine in containment and reduces the radiological consequences from containment atmosphere leakage following a LOCA. Maintaining the solution pH Z 7.0 also reduces the occurrence of SCC of austenltic stainless steel components in containment. Reducing SCC reduces the probability of failure of components. Granular TSP dodecahydrate Is employed as a passive form of pH control for post LOCA containment spray and core cooling water. Baskets of TSP are placed on the floor or In the sump of the containment building to dissolve MILLSTONE UNIT NO. 3 B 3/4 5-3 Amendment No.1 1 5 May 26, 1995 CORE COOLING SYSTEMS BASES (continued) BACKGROUND (continued) from released reactor coolant water and containment sprays after a LOCA.Recirculation of the water for core cooling and containment sprays then provides mixing to achieve a uniform solution pH. The dodecahydrate form of TSP is used because of the high humidity in the containment building during normal operation. Since the TSP is hydrated, it is less likely to abso~rb large amounts of water from the humid atmosphere and will undergo less physical and chemical change than the anhydrous form of TSP.APPLICABLE SAFETY ANALYSES The LOCA radiological consequences analysis takes credit for "iodine retention in the sump solution based on the recirculation water pH being S7.0. The radionuclide releases from the containment atmosphere and the consequences of a LOCA would be increased if the pH of the recirculation water were not adjusted to 7.0 or above.LIMITING CONDITION FOR OPERATION The TSP is required to adjust the pH of the recirculation water to Z 7.0 after a LOCA. A pH 7.0 after a LOCA is necessary to prevent significant amounts of iodine released from fuel failures and dissolved in the recirculation water from converting to a volatile form and evolving into the containment atmosphere. Higher levels of airborne iodine in containment may increase the release of radionuclides and the consequences of the accident. A pH 7.0 is also necessary to prevent SCC of austenitic stainless steel components in containment. SCC increases the probability of failure of components. The required amount of TSP is based upon the extreme cases of water volume and pH possible in the containment sump after a large break LOCA. The minimum required volume is the volume of TSP that will achieve a sump solution pH of 7.0 when taking into consideration the maximum possible sump water volume and the minimum possible pH. The amount of TSP needed in the containment building is based on the mass of TSP required to achieve the desired pH. However, a required volume Is specified, rather than mass, since it Is not feasible to weigh the entire amount of TSP In containment. The minimum required volume is based on the manufactured density of TSP dodecahydrate. Since TSP can have a tendency to agglomerate from high humidity In the containment building, the density may increase and the volume decrease during normal plant operation. Due to possible agglomeration and increase in density, estimating the minimum volume of TSP in containment is conservative with respect to achieving a minimum required pH.MILLSTONE UNIT NO. 3 B 3/4 5-4 Amendment No. 115 0303 LBDCR 12-MP3-010 September 20, 2012 EMERGENCY CORE COOLING SYSTEMS BASES (Continued) APPLICABILITY In MODES 1, 2, 3, and 4, a design basis accident (DBA) could lead to a fission product release to containment, that leaks to the secondary containment boundary. The large break LOCA, on which this system's design is based, is a full-power event. Less severe LOCAs and leakage still require the system to be OPERABLE thraoughout these MODES. The probability and severity of a LOCA decrease as core power and reactor coolant system pressure decrease. With the reactor shut down, the probability of release of radioactivity resulting from such an accident is low.In MODES 5 and 6, the probability and consequence of a DBA are low due to the pressure and temperature limitations in these MODES. Under these conditions, the SLCRS is not required to be OPERABLE.ACTIONS If it is discovered that the TSP in the containment building sump is not within limits, action must be taken to restore the TSP to within limits. During plant operation, the containment suinp is not accessible and corrections may not be possible.The 7-day Completion Time is based on the low probability of a DBA occurring during this period. The Completion Time is adequate to restore the volume of TSP to within the technical specification limits.If the TSP cannot be restored within limits within the 7-day Completion Time, the plant must be brought to a MODE in which the LCO does not apply. The specified Completion Times for reaching MODES 3 and 4 are those used throughout the technical specifications; they were chosen to allow reaching the specified conditions from full power in an orderly manner and without challenging plant systems.SURVEILLANCE REQUIREMENTS Surveillance Requirement

4.5.5 Periodic

determination of the volume of TSP in containment must be perfonned due to the possibility of leaking valves and components in the containment building that could cause dissolution of the TSP during nonmal operation. This requirement ensures that there is an adequate volume of TSP to adjust the pH of the post LOCA sump solution to a value > 7.0. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B 3/4 5-5 MILLTON -NIT3 B3/45-5Amendment No. 14-5-, 204

• 0 REVERSE OF PAGE B 3/4 5-5 i TNTENTIONALLY LEFT BLANK 0 LBDCR No. 06-MP3-026 October* 15,. 2006 3/4.6 CONTAINMENT sYSTEMS BASES 3/4.6.1 PRIMARY CONTAINMENT 3/4.6.1.1

'CONTAINMENT INTEGRITY Primary CONTAINMENT INTEGRITY ensures that the release of radioactive materials from the containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the safety analyses. This restriction, in conjunction with the leakage rate limitation, will. limit the SITE BOUNDARY radiation doses to within the dose guidelines of 10 CFR 50.67 during accident conditions and the control room operators dose to withinthe guidelines of GDC 19.* Prim~ary .CONTAINM. ENT INTEGR.TY is-req~ui.red i:.n .MODE...!.h_.ugl;;:, 4 i .......press~ure, low pressufizer pressure and low steam~line pressure. In MODE 4 the automatic containment isolation* signals generated by high containment pressure, low pressurizer pressure and 1 0ow steamline pressure .ar~e not required to be OPERABLE. Automatic actuation of the containment i solation system in-MODE 4 is not required because adequate time is available for plant operators to evaluate plant Conditions and respond by manually operating engineered safety features components. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. Since the manual actuation pushbuttons porti~on.;of the containment isolation system is required to be OPERABLE in MODE 4, the plant operators can. use the manual pushbuttons to rapidly position all automatic containment isolation valves to the required accident positioni. Therefore, the containment isolation actuation pushbuttons satisfy the requirementfor an OPERABLE containment automatic isolation valve system in MODE 4." 3/4.6.1.2 CONTAINMENT LEAKAGE The limitations on containment leakage rates, as specified in the Containment Leakage Rate Testing Program,. ensure that the total containment~leakage volume will not exceed the value assumed in the safety analyses at the peak accident pressure, P a- As an added conservatism, the measured overall integra~ted leakage rate is flurther limited to less than 0.75 La during performnance of the periodic test to account for possible degradation of the containment leakage barriers between leakage tests..*The Limiting Conditioh for Operation defines the limitations on containment leakage.The leakage rates are verified by surveillance testing as specified in the Containment Leakage Rate Testing Program, in accordance with therequirements of Appendix J. Although the LCO specifies the leakage rates at accident pressure, Pa, it is not feasible to perform a test at such an exact vahue for~pressiire. Consequently, the surveillance testing is performed at a pressure greater than or equal to Pa to. account for test instrument uncertainties and stabilization changes. This conservative test pressure en'sures that the measured leakage rates MILLSTONE -UNIT 3 B 3/4 *6-1 Amendment No. 5gg, 89, 1-, 54, 4-1-6, 2-1-6 NRC Verbal Acknowledgement: 07/05/07 May 15, 2002 3/4.6 CONTAINMENT SYSTEMS BASES 3/4.6.1.2 CONTAINMENT LEAKAGE (continued) are representative of those which would occur at accident pressure while meeting the intent of the LCO. This test methodology is in accordance with the Containment Leakage Rate Testing Program.The surveillance testing. for~measuring leakage rates' are in accordance with the Containment Leakage Rate Testing Program.The enclosure building bypass leakage paths are listed in the "Technical Requirements Manual." The addition or deletion of the enclosure buiilding bypass leakage paths shall be made in accordance with Section 50.59 of 10CFR50.and approved by the Plant Operations Review Committee. Th& requireiiii:

t~ ar6 "ri:di~fi~d

!by a -1f46tg That allow6 'nfy it:id exift (6efon.repairs on the affected air lock components. .This means there, m~ay be a short time during which the containment boundary .is not intact (e.g., duri~ng access through the OPERABLE door). The -ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an evenit that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After.each entry and exit, the OPERABLE door must be immediately closed.ACTION a.. is only applicable when one air lock door is inoperable.. With only one air lock door inoperable, the remaining OPERABLE air lock door murst be verified closed within 1 hour. This ensures a leak tight containment barrier is maintained by use of the remaining* OPERABLE air lock door. The 1lhour requirement is consistent with the requirements of.Technical Specification 3.6.i. 1 to restore CONTAINMENT INTEGRITY. In addition, the remaining OPERABLE air lock door must be locked closed within 24 hours and then verified periodically to ensure an acceptable containment leakage bounda~ry is maintained. Otherwise, a plant shutdown is required.ACTION b. is only applicable when the air lock door intdrlock mechanism is inoperable. With only the air lock interlock mechanism inoperable, an. OPERABLE air lock door must be verified closed within 1 hour. This ensures a leak tight containment barrier is maintained by use of an OPERABLE air lock door. The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore.CONTAJNMENT INTEGRITY. In addition, an OPERABLE air" lock door must be locked closed within 24 hours and then verified periodically to ensure an acceptable containment leakage boundary is maintained. Otherwise, a. plant shutdown is required. In addition, entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i. e., the individual perfoimas the function of the in~terlock) is permitted. ACTION c. is applicable when both air lock doors, are inoperable, or the air lock is inoperable for any other reason excluding the door interlock mechanism. With both air lock doors inoperable or the air lock otherwise inoperable, an evaluation of the overall containmaent leakage rate per Specification 3.6.1.2" MILLSTONE -UNIT 3 B 3/4 6-1la Amendment No. 59189, 4-4,4--7-7,4-1-6, 205 3/4.6 .CONTAINMENT SYSTEMS.-May 15, 2002 BASES 3/4.6.1.3. CONTAINMENT.AIR.LOCKS (continued). shall be initiated immediately, and an air lock door must be verified closed within 1.hour. .An evaluation..is acceptable since it is overly .conservative to.i y decl.are .the. cont ai nment .i noper.ab~le eif both doors in the. air .lock. have.failed, a seal-test or if overall a~ir.lockileakage

• is not within limi~ts. In many.instances (e.g.,i .only..one.

seal iper doQor has fai~led), containment: remains OPERABLE, yet only 1 hour (.per'..S'pecificati~on"3.6.1.1). woul'd'.be provided to.restore the air .lock to OPERABLE status pri~or to requiri~ng ap1lant s~hutdown.. In addition,, even with both.'dOors .fail inlg the seal test., .the. ove~rall, leakage rate can still be within limits. The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In'addit~ion, the air.lock, and/or at least one air lock door' must be.restored to .OPERABLE. status within .24 hours or a-plant *shutdown is..required... SurveilIlance Requi rement 4 .*6.1..3. a .veri fi es leakage through the .cont ainment air l ock..i~s within' the requirements specified in' the. Containment .Leakage, Rate.Testing Program. T!he containment air *lock leakage results are account'ed for in the combined: Type Band C containment, leakage, rate. Failure of an a'ir lock door does not invalidate the previous satisfactory overall air lock leakage test because either air lock door is capable of providing a fission product barrier in the event of a design basis accident.The .limitations on. closure rate for .the containment air locks are required to meet the restrictions on CONTAINMENT INTEGRITY and containment leak rate. Surveillance.testing of the air lock seals is performed in accordance with the Containment Leakage Rate Testing Program, which ensures that the overall air lock leakage will not become excessive due .to seal damage during the intervals between air lock leakage tests. While the leakage rate limitation is specified at accident pressure, Pa the actual surveillance testing is performed by applying a pressure greater than or equal to Pa. This higher pressure accounts for test instrument uncertainties and test volume stabilization changes which occurs under actual test conditions. 3/4.6.1.4 and 3/4.6.1.5 AIR PRESSURE and AIR TEMPERATURE The limitations on containment pressure and average air 'temperature ensure that: (1) the containment structure is prevented from exceeding its design negative pressure 'of 8 psia, and (2) the containment peak pressure does not exceed the design pressure of 60 psia during LOCA conditions. Measure-ments .shall be made at all listed locations, whether by fixed or portable instruments, prior to determining the average air temperature. The limits on the pressure and average air temperat~ure are consistent with the assumptions of the safety analysis. The minimum total containment pressure of 10.6 psia is determined by summing the minimum 'permissible. air partial pressure of.8.9 psia and the maximum expected vapor pressure of .l.7 psia (occurring at the maximum permissible containment initial temperature of 120 0 F).MILLSTONE -UNIT 3 B3 3/4 6-lb Amendment No. ;I#082 77, 7 zo25 REVERSE OF PAGE B 3/4 6-lb INTENTIONALLY LEFT BLANK June 3, 2002 CONTAINMENT SYSTEMS BASES 3/4.6.1.6 CONTAINMENT STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the containment will be manahtained comparable to the original design standards for the life of the facility. Structural integrity is required to ensure that the containment will withstand the maximum pressure of 60 psia in the event of a LOCA. A visual inspection, in accordance with the Containment Leakage Rate Testing Program, is sufficient to demonstrate this capability. 3/4.6.1.7 CONTAINMENT VENTILATION SYSTEM The 42-inch containment purge supply and exhaust isolation valves are required to be locked closed during plant operation since these valves have not been demonstrated capable of closing during a LOCA or steam. line break accident. Maintaining these valves closed during plant operations ensures that excessive quantities of radioactive materials will not be released via the Containment Purge System. To provide assurance that these containment valves cannot be inadvertently opened, the valves are locked closed in accordance with Standard Review Plan 6.2.4 which incudes mechanical devices to seal or lock the valve closed, or prevents power from being supplied to the valve operator.The Type C testing frequency required by 4.6.1.2 is acceptable, provided that the resilient seats of these valves are replaced every other refueling outage.3/4.6.2 DEPRESSURIZATION AND COOLING SYSTEMS 3/4.6.2.1 and 3/4.6.2.2 CONTAINMENT OUENCH SPRAY SYSTEM and RECIRCULATION SPRAY SYSTEM The OPERABILITY of the Containment Spray Systems ensures that containmeflt depressurization and iodine removal will occur in the event of a LOCA. The pressure reduction, iodine removal capabilities and resultant containment leakage are consistent with the assumptions used in the safety analyses.LCO 3.6.2.2 One Recirculation Spray System consists of:* Two OPERABLE contaimnent recirculation heat exchangers

• Two OPERABLE contaiznment recirculation pumps The Contaimnent Recirculation Spray System. (RSS) consists of two paralle redundant subsystems which feed two parallel 360 degree spray headers. Each subsystem consists of two pumps and two heat exchangers.

Train A consists of 3RSS*P1A and 3R5S*P1C. Tamn B consists of 3RSS*PIB and 3RSS*PID.MILLSTONE -UNIT 3 B 3/4 6-2 Amendment No. 145,4-4,"Revised by NRC Letter A15710" LIBDCR 12-MP3-010 September

20. 2012 CONTAINMENT SYSTEMS BASES The design of the Containment RSS is sufficiently independent so that an active failure in the recirculation spray mode, cold leg recirculation mode, or hot leg recirculation mode of the ECCS has no effect on its ability to perform its engineered safety function.

In other words, the failure in one subsystem does not affect the capability of the other subsystem to perfonn its designated safety function of assuring adequate core cooling in the event of a design basis LOCA. As long as one subsystem is OPERABLE, with one pump capable of assuring core cooling and the other*pump capable of removing heat from containment, the RSS system meets its design requirements. The LCO 3.6.2.2. ACTION applies when any of the RSS pumps, heat exchangers, or associated components are declared inoperable. All four RSS pumps are required to be OPERABLE to meet the requirements of this LCO 3.6.2.2. During the injection phase of a Loss Of Coolant Accident all four RSS pumps would inject into containment to perform their contaimnent heat removal function. The minimum requirement for the RSS to adequately perform this function is to have at least one subsystem available. Meeting the requirements of LCO 3.6.2.2. ensures the minimum RSS requirements are satisfied. Surveillance Requirement 4.6.2.2.c requires that verification is made that on a CDA test signal, each RSS pump starts automatically after receipt of an RWST Low-Low level signal. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.6.2.1.d and 4.6.2.2.e require verification that each spray nozzle is unobstructed following maintenance that could cause nozzle blockage. Nonnal plant operation and maintenance activities are not expected to trigger performance of these surveillance requirements. However, activities, such as an inadvertent spray actuation that causes fluid flow through the nozzles, a major configuration change, or a loss of for~eign material control when working within the respective system boundary may require surveillance performance. An evaluation, based on the specific situation, Will detennine the appropriate test method (e.g., visual inspection, air or smoke flow test) to verify no nozzle obstruction. MILLSTONE -UNIT 3 B3462 mnmn o B 3/4 6-2a Amendment No. LBDCR 12-MIP3-010 September 20, 2012 CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMEvffNT ISOLATION VALVES The OPERABILITY of the contairnment isolation valves ensures that the containment atmosphere will be isolated from the outside environment in the event of a release of radioactive material to the containment atmosphere or pressurization of the containment and is consistent with the requirements of General Design Criteria 54 through 57 of Appendix A to 10 CFR Part 50. Containment isolation within, the time limits specified for these isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a LOCA. FSAR Table 6.2-65 lists all containment isolation valves. The addition or deletion of any contaimnent isolation valve shall be made in accordance with Section 50.59 of 10OCFR50 and approved by the committee(s) as described in the QALP Topical Report.For the purposes of meeting this LCO, the safety function of the containment isolation valves is to shut within the time limits assumed in the accident analyses. As long as the valves can shut within the time limits assurned in the accidefit analyses, the valves are OPERABLE. Where the valve position indication does not affect the operation of the valve, the indication is not required for valve OPERABILITY under this LCO. Position indication for contaimnent isolation valves is covered by Technical Specification 6.8.4.e., Accident Monitoring Inastrumentation. Failed position ...indication on these valves must be restored "as soon as practicable" .as re quired by Technical Specification 6.8.4.e.3. Maintaining the valves OPERABLE, when position indication fails, facilitates troubleshooting and correction of the failure, allowing the indication to be restored "as soon as practicable.".. With one or more penetration flow paths with one containanent isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and deactivated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. If the containment isolation valve on a closed system becomes inoper'able, the remaining barrier is a closed system since a closed system is an acceptable alternative to an automatic valve.However, actions must still be taken to meet Technical Specification ACTION 3.6.3 .d and the valve, not nonnally considered as a containment isolation valve, and closest to the containment wall should be put into the closed position. No leak testing of the alternate valve is necessary to satisfy the ACTION statement. Placing the manual valve in the closed position sufficiently deactivates the penetration for Technical Specification compliance." Closed system isolation valves applicable to Technical Specification ACTION 3.6.3.d are included in FSAR Table 6.2-65, and are the isolation valves for those penetrations credited as General Design Criteria 57. The specified time (i.e., 72 hours) of Technical Specification ACTION 3.6.3.d is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3 and 4. In the event the affected penetration is isolated in accordance with 3.6.3.d, the affected penetration flow path must be verified to be isolated on a periodic basis, (Surveillance Requirement 4.6.1.1 .a). This is necessary to assure leak tightness of contaimnent and that containment penetrations requiring isolation following an accident are isolated. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B 3/4 6-3 MILLTONE-UNT 3 3/46-3Ameihdment No. 2-8, 62:-, 4-4-2_,2-- LBDCR 05-MiP3-028 November 30, 2005 CONTAINMENT SYSTEMS O BASES For the purposes of meeting this LCO, neither the containmaent isolation valve, nor any alternate valve on a closed system have a leakage limit associated with valve OPERABILITY. The opening of contafinment isolation valves on an fintermittent basis under administrative controls includes the following considerations: (1) stationing an operator, who is in constant communication with the control room, at the valve controls, (2) instructing this operator to close these valves in an accident situation, and (3) assuring that environmnental conditions will not preclude access to close the valves and that this action will prevent the release of radioactivity outside the containment. The appropriate administrative controls, based on the above considerations, to allow containment isolation valves to be opened are contained in the procedures that will be used to operate the valves. Entries should be placed in the Shift Manager Log when these valves are opened or closed. However, it is not necessary to log into any Technical Specification ACTION Statement for these valves, provided the appropriate administrative controls have been established. Opening a closed containmaent isolation valve bypasses a plant design feature that prevents the release of radioactivity outside the contafi~nment. Therefore, this should not be done frequently, and the time the valve is opened should be minimized. The determination of the appropriate administrative controls for containment isolation valves requires an evaluation of the 'expected environmnental conditions. This evaluation must conclude environmental conditions will not preclude access to close the valve, and this action will prevent the release of radioactivity outside of contafinment through the respective penetration. When the Residual Heat Removal (RHR) System is placed in. service finthe plant cooldown mode of operation, the RIIR suction isolation remotely operated valves 3RHS*MV8701A and 3RHS*MV8701B, and/or 3RTIS*MV8702A and 3RP-IS*MV8702B are opened. These valves are nonnally operated fr~om the control room. They do not receive an automatic containment isolation closure signal, but are interlocked to prevent their opening if Reactor Coolant System (RCS) pressure is greater than approximately 412.5 psia. When any of these valves are opened, either one of the two required licensed (Reactor Operator) control room operators can be credited as the operator required for administrative control. It is not necessary to use a separate dedicated operator.3/4.6.4 DELETED MILLSTONE -UNIT 3 B 3/4 6-3a Amendment No. 2--, 6-3, -42_ ---,0 Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028 November 30, 2005 THIS PAGE INTENTIONALLY LEFT BLANK 9 YILLSTONE -UNIT. 3 B 3/4 6-3b Amendment No. , 6-3,. 4-4, 24l-6,.Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028 November 30, 2005 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE -uNIT3 B 3/46-3c Amendment No. 6-3-, 442, 6 Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028 November 30, 2005 CONTAINMENT SYSTEMS BASES 3/4.6.5 SUJBATMOSPHERIC PRESSURE CONTROL SYSTEM 3/4.6.5.1 STEAM JET AIR EJECTOR The closure of the isolation valves in the suction of the steam jet air ejector ensures that: (1) the containment internal pressure may be maintained within its operation limits by the mechanical vacuum pumps, and (2) the containment atmosphere is isolated from the outside environment in the event of a LOCA. These valves are required to be closed for containment isolation. MILLSTONE -UNIT 3 B 3/4 6-3d... Amendment No. 3-3, 4-42, 216, Acknowledged by NRC Letter dated 04/12/06 REVERSE OF PAGE B 314 6-3d INTENTIONALLY LEFT BLANK June 3, 2002 CONTAINMENT SYSTEMS BASES 3/4.6.6 SECONDARY CONTAINMENT 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM B ack ground.The OPERABILITY of the Supplementary Leak Collection and Release System (SLCRS)ensures thatradioactive materials that leak from the primary containment into the Secondary Containment following a Design Basis Accident (DBA) are filtered out and adsorbed prior to any.release to the environment. SLCRS Ductwork Integrity: The Supplementary Leak Collection and Release System (SLCRS) remains OPERABLE with the following bolting*configuration:

a. For 311VR*DMPF44:

• Eight bolts properly installed on the ductwork access panels.* At least one bolt must be installed in each corner area.*The remaining bolts should be installed in the center area of each side.b. For 3HVR*DMPF29:
• 12 bolts properly installed on the ductwork access panel.* At least one bolt must be installed in each corner area.* The remaining bolts should be approximately equally spaced along each side with two bolts per side.With the above bolting specified for- 3HVR*DMPF44 and 3HVR*DMPF29, reference* (l)concluded the foillowing:..
• Any leakage around the plates is minimal and causes negligible effect on the performance of the SLCRS system.* Assures the gasket will not be extruded from between the plate and duct flange when the. SLCRS fans are started.* The remaining bolts may be installed with the fans running.* Provides adequate structural integrity in the seismic event based on engineering analysis.Applicable Safety Analyses The SLCRS design basis is established by the consequences of the limiting DBA, which is a LOCA. The accident analysis assumes that only one train of the SLCRS and one train of the.auxiliary building filter system is functional due to a single failure that disables the other train.The accident analysis accounts for the reduction of the airborne radioactive material provided by the remaining one train of this filtration system. The amount of fission products available for release from the containment is determined for a LOCA.The SLCRS is not normally in operation.

The SLCRS starts on a SIS signal. The modeled SLCRS actuation in the safety analysis (the Millstone 3 MILLSTONE -UNIT 3 B 3/4 6-4 Amendment No. 87 4-2-6,"Revised by NRC Letter A15710". LBDCR No. 04-MP3-015 February 24, 2005 CONTATNMENT SYSTEMS BASES O 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued) FSAR Chapter 15, Section 15.6) is based upon a worst-case response time following an SI initiated at the limiting setpoint. One train of the SLCRS in conjunction with the Auxiliary Building Filter (ABF) system is capable of drawing a negative pressure (0.4 inches water gauge at.the auxiliary building 24'6" elevation) within 120 seconds after a LOCA. This time includes diesel generator startup and sequencing time, system startup time, and time for the system to attain the required negative pressure after starting.LCO In the event of a DBA, one SLCRS is required to provide the minimum postulated iodine removal assumed in the safety analysis. Two trains of the SLCRS must be OPERABLE to ensure that at least one train will operate, assuming that the other train is disabled by a single-active failure. The SLCRS works in conjunction with the ABF system. Inoperability of one train of the ABF system also results in inoperability of the corresponding train of the SLCRS. Therefore, whenever LCO 3.7.9 is entered due to the ABF train A (B) being inoperable, LCO 3.6.6.1 must be entered due to the SLCRS train A (B3) being inoperable. When a SLCRS LCO is not met, it is not necessary to declare the secondary containment inoperable. However, in this event, it is necessary to determine that a loss of safety function does not exist. A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed. Applicability In MODES 1, 2, 3, and 4, a DBA could lead to a fission product release to containment that leaks to the seco~idar contaipnment. Th~e !rge b~reak LOCA, o~n whic. sys!ter's d~e sign is based, is a full- power event. Less severe LOCAs and leakage still require the syst.em to be OPERABLE throughout these MODES. The probability and severity of a LOCA decrease as*core power and reactor coolant system pressure decrease. With the reactor shut down, the probability of release of radioactivity resulting from such, an accident is low.In MODES 5 and 6, the probability and consequences of a DBA are low due to the pressure and temperature limitations in these MODES. Under these conditions, the SLCRS is not required to be OPERABLE.ACTIONS With one SLCRS train inoperable, the inoperable train must be restored to OPERABLE status within 7 days. The OPERABLE train is capable of providing 100 percent of the iodine removal needs for a DBA. The 7-day Completion Time is based on consideration of such factors* as the reliability of the OPERABLE redundant SLCRS train and the low probability of a DBA occurring during this period. The Completion Time is adequate to make most repairs. If the SLCRS cannot be restored to OPERABLE status :within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and MODE 5 within the following 30 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full-power conditions in an orderly manner and without challenging plant systems.MILLSTONE -UNIT 3 B 3/4 6-5 Amendment No. g-7, -I-2-6, Acknowledged by NRC letter dated 08/25/05 LBDCR 12-MTP3-010 September 20, 2012 CONTAINMENT SYSTEMS BASES 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued) Surveillance Requirements Cumulative operation of the SLCRS with heaters operating for at least 10 continuous hours is sufficient to reduce the buildup of moisture on the adsorbers and HEPA filters. The surveillance frequency is controlled under the Surveillance Frequency Control Program.b, c, e, and f These surveillances verify that the required SLCRS filter testing is performed in accordance with Regulatory Guide 1.52, Revision 2. ANSI N510-1980 shall be used in place of ANSI N510-1975 referenced in Regulatory Guide 1.52, Revision 2. Laboratory testing of methyl iodide penetration shall be performed in accordance with ASTM D3803-89 and Millstone Unit 3 specific parameters. The surveillances include testing HEPA filter perfonnance,. charcoal adsorber efficiency, system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). The heater kW measured must be corrected to its nameplate rating.Variations in system voltage can lead to measurements of kW which cannot be compared to the nameplate rating because the output kW is proportional to the square of the voltage.Any time the OPERABILITY of a HEPA filter or charcoal adsorber housing has been affected by repair, maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. The 720 hours of operation requirement originates from Regulatory Guide 1.52, Revision 2, March 1978, Table 2, Note "c", which states that "Testing should be performed (1) initially, (2) at least once per 18 months thereafter for systems maintained in a standby status or after 720 hours of system operations, and (3) following painting, fire, or chemical release in any ventilation zone colmmunicating with the system." This testing ensures that the charcoal adsorbency capacity has not degraded below acceptable limits, as well as providing trend data. The 720 hour figure is an arbitrary number which is equivalent to a 30 day period.. This criteria is directed to filter systems that are normally in operation and also provide emergency air cleaning functions in the event of a Design Basis Accident. The applicable filter units are not normally in operation and the sample canisters are typically removed due to the 18 month criteria.d The periodic automatic startup ensures that each SLCRS train responds properly. The surveillance frequency is controlled under the Surveillance Frequency Contr'ol Program. The surveillance verifies that the SLCRS starts on a SIS test signal. It also includes the automatic functions to isolate the other ventilation systems that are not part of the safety-related postaccident operating configuration and to start up and to align the ventilation systems that flow thr'ough the secondary contaimunent to the accident condition. MILLSTONE -UNIT 3 B 3/4 6-6 MILSTOE UNT 3B /4 -6Amendment No. 8-- 23-, 84-,--2-06 LBDCR 05-MIP3-025 March 7, 2006 CONTAINMENT SYSTEMS BASES 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)

• The main steam valve building ventilation system isolates.* Auxiliary building ventilation (normaal) system isolates.* Charging pump/reactor plant component cooling water pump area cooling subsystem aligns and discharges to the auxiliary building filters and a filter fan starts.* Hydlrogen recombiner ventilation system aligns to the postaccident configuration.
• The engineered safety features building ventilation system aligns to the postaccident configuration.

References:

1. Engineering analysis, Memo MP3-DE-94-539, "Bolting Requirements for Access Panels on Dampers 3HVR*DMPF29

& 44," dated June 16, 1994.MILLTON -NIT B /4 -6aAmendment No. 8-7-, 23-, 84, MILLSTONE -UNIT 3 B 3/4 6-6a LBDCR No. 06-MIP3-026 October 15, 2006 CONTAINMENT SYSTEMS BASES 3/4.6.6.2 SECONDARY CONTAINMENT The Secondary Containment is comprised of the containment enclosure building and all contiguous buildings (main steam valve building [partially]; engineering safety features building[partially], hydrogen recombiner building [partially], and auxiliary building). The Secondary Containment shall exist when: a. Each door in each access opening is closed except when the access opening is being used for normal transit entry and exit, b. The sealing mechanism associated with each penetration (e.g., Welds, bellows, or 0-rings) is OPERABLE.Secondary Containment ensures that the release of radioactive materials from the primary containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the safety analyses. This restriction, in conjunction with operation of the Supplemnentary Leak Collection and Release System, and Auxiliary Building Filter System will limit the SITE BOUNDARY radiation doses to within the dose guideline values of 10 CFR 50.67 during accident conditions. The SLCRS and the ABF fans and filtration units are located in the auxiliary building. The SLCRS is described in the Millstone Unit No. 3 FSAR, Section 6.2.3.order to ensure a negative pressure in all areas within the Secondary Containment under most meteorological conditions, the negative pressure acceptance criterion at the measured location (i.e., 24' 6" elevation in the auxiliary building) is 0.4 inches water gauge.LCO The Secondary Containment OPERABILITY must be maintained to ensure proper operation of the SLCRS and the auxiliary building filter system and to limit radioactive leakage fr'om the containment to those paths and leakage rates assumed in the accident analyses.Applicability Maintaining Secondary Contaimnent OPERABILITY prevents leakage of radioactive material fr'om the Secondary Containment. Radioactive material may enter the Secondary Containment from the containment following a LOCA. Therefore, Secondary Containment is required in MODES 1, 2, 3, and 4 when a design basis accident such as a LOCA could release radioactive material to the containment atmnosphere. MILLSTONE -UNIT 3 B 3/4 6-7 Amendment No. 8-7-, 4--26 NRC Verbal Acknowledgement: 97/05/07 LBDCR 12-MP3-010 September 20, 2012 CONTAINMENT SYSTEMS 1 BASES 3/4.6.6.2 SECONDARY CONTAINMENT (continued) In MODES 5 and 6, the probability and consequences of a DBA are low due to the RCS temperature and pressure limitation in these MODES. Therefore, Secondary Containmrent is not required in MODES 5 and 6.ACTIONS In th~e event Secondary Containment OPERABILITY is not maintained, Secondary Containment OPERABILITY must be restored within 24 hours. Twenty-four hours is a reasonable Completion Time considering the limited leakage. design of contaimnent and the !ow probability of a DBA occurring during this time period.Inoperability of the Secondary Contahunent does not make the SLCRS fans and filters inoperable. Therefore, while in this ACTION Statement solely due to inoperability of the Secondary Containment, the conditions and required ACTIONS associated with Specification 3.6.6.1 (i.e., Supplementary Leak Collection and Release System) are not required to be entered.If the Secondary Containment OPERABILITY cannot be restored to OPERABLE status within the required completion time, the plant must be brought to a MODE in which the LCO does apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and toW MODE 5 within the following 30 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full-power conditions in an orderly manner and without challenging plant Systems.Surveillance Requirements 4.6.6.2.1 Maintaining Secondary Containment oPERABILITY requires maintaining each door in each access opening in a closed position except when the access opening is being used for normal entry! and exit. The normal time allowed for passage of equipment and personnel through each access opening at a time is defined as no more than 5 minutes. The access opening shall not be blocked open. During this time, it is not considered necessary to enter the ACTION statement. A 5-minute time is considered acceptable since the access opening can be quickly closed without special provisions and the probability of occurrence of a DBA concurrent with equipment andlor personnel transit time of 5 minutes is low.The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B3468AedetN.~-2 B 3/4 6-8 Amendment No. 8-7-, February 5, 1998 CONTAINMENT SYSTEMS BASES 3/4.6.6.2 SECONDARY CONTAINMENT (continued) 4.6.6.2.2 The ability of a SLCRS to produce the required negative pressure during the test operation within the required time provides assurance that the Secondary Containment is adequately sealed.With the SLCRS in postaccident configuration, the required negative pressure in the Secondary Containment is achieved, in 110 seconds from the time of simulated emergency diesel generator breaker closure. Time delays of dampers and, logic delays must be accounted for in this surveillance. The time to achieve the required negative pressure is 120 seconds, with a loss-of-offsite power coincident with a SIS. The surveillance verifies that one train of-'SLCRS in conjunction with the ABF system will produce a negative pressure of-O.4 inches water gauge at the auxiliary building 24'6" elevation relative to the outside atmosphere in the Secondary Containment. For the purpose of this surveillance, pressure measurements will be made at the 24'6" elevation in the auxiliary building. This single location is considered to be adequate and representative of the entire Secondary Containment due to the large cross-section of the air passages which interconnect the various buildings within the Secondary Containment. In order to ensure a negative pressure in all areas inside the Secondary Containment under most meteorological conditions, the negative pressure acceptance criterion at the measured location is_0.4 inch water gauge. It is recognized that there will be an occasional meteorological condition under which slightly positive pressure may exist at some localized portions of the boundary (e.g., the upper elevations on the down-wind side of a building). For example, a very low outside temperature combined with a moderate wind speed could cause a slightly positive pressure at the upper elevations of the containment enclosure building on the leeward face. The probability of occurrence of meteorological conditions which could result in such a positive differential pressure condition in the upper levels of the enclosure building has been estimated to be less than 2% of the time.The probability of wind speed within the necessary moderate band, combined with the probability of extreme low temperature, combined with the small portion of the boundary affected, combined with the low probability of airborne radioactive material migrating to the upper levels ensures that the overall effect on the design basis dose calculations is insignificant. The SLCRS system and fan sizing was based on an estimated infiltration rate. The fan flow rates are verified within a minimum and maximum on a monthly basis. Initial testing verified that the drawdown criterion was met at the lowest acceptable flow rate. The new standard Technical Specification (NUREG-1431) 3.6.6.2 surveillance requirement requires that the drawdown HILLSTONE -UNIT 3 B 3/4 6-9 MILLTONE-UNT 3 3/46-9Amendment No. F7, 126 February 5, 1996 CONTAINMENT SYSTEMS BASES 3/4.6.6,2 SECONDARY CONTAINMENT (continued) criterion be met while not exceeding a maximum flow rate. It is assumed that the purpose of this flow limit is to ensure that adequate attention is given to maintain the SLCRS boundary integrity and not using excess system capacity to cover .for boundary degradation. The SLCRS system was designed with minimal marginand, therefore, does not have excess capacity that can be substituted for boundary integrity. Additionally, since SLCRS fan flow rates are verified to be acceptable on a more frequent basis than the drawdown test surveillance, and by means of previous testing the minimum flow rate is acceptable, verifying a flow rate during the drawdown test would not provide an added benefit. Historical SLCRS flow measurements show a lack of repeatability associated with the inaccura-cies of air flow measurement. As a result, the more reliable verification of system performance is the actual negative pressure generated by the drawdown test and a measured flow rate would add little.3/4.6.6.3 SECONDARY CONTAINMENT STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the Secondary Containment will be maintained comparable to the original design standards for the life of the facility. Structural integrity is required to provide a secondary boundary surrounding the primary containment that can be maintained at a negative pressure during accident conditions. A visual inspection is sufficient to demonstrate this capability. MILLSTONE -UNIT 3 B s/4 6-zo MILLTON -NIT B /4 -10Amendment No. F7, 126 LBDCR-.07-MP3 -037 July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES BACKGROUND The primary purpose of the main steam line Code safety valves (MSSVs) is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available. Five MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in the FSAR, Section 10.3.1 (Reference 1). The MSSVs must have sufficient capacity to limit the secondary system pressure to less than or equal to 110% of the steam generator design pressure in order to meet the requirements of the ASME Code, Section III (Reference 2). The design minimum total relieving capacity for all valves on all of the steam lines is 1.579 x 107 lbs/hr which is 105% of total secondary steam flow of 1.504 x 10 lbs/h at 100%RATED THERMAL POWER. The MSSV design includes staggered setpoints, according to Table 3.7-3 in the accompanying LCO, so that only the needed valves will actuate. Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine reactor trip. Table 3.7-3 allows a +/- 3% setpoint tolerance (allowable value) on the lift setting for OPERABILITY to account for drift over an operating cycle.APPLICABLE SAFETY ANALYSES The design basis for the MSSVs comes from Reference 2 and its purpose is to limit the secondary system pressure to less than or equal to 110% of design pressure for any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis.The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are those characterized as decreased heat removal events, which are presented in the FSAR, Section 15.2 (Reference 3). Of these, the full power turbine trip without steam dump is typically the limiting AOO. This event also terminates normal feedwater flow to the steam generators. The safety analysis demonstrates that the transient response for turbine trip occurring from full power without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System. One turbine trip analysis is performed assuming primary system pressure control via operation of the pressurizer relief valves and spray. This analysis demonstrates that the DNB design basis is met. Another analysis is performed assuming no primary system pressure control, but crediting reactor trip on high pressurizer pressure and operation of the pressurizer safety MILLSTONE -UNIT 3 B 3/4 7-1 MILLTON -NIT3 B3/47-1Amendment No. 4-t02,, 7-, LBDCR_.7-MP3-037 July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) valves. This analysis demonstrates that RCS integrity is maintained by showing that the maximum RCS pressure does not exceed 110% of the design pressure. All cases analyzed demonstrate that the MSSVs maintain Main Steam System integrity by limiting the maximum steam pressure to less than 110% of the steam generator design pressure.In addition to the decreased heat removal events, reactivity insertion events may also challenge the relieving capacity of the MSSVs. The uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power event is characterized by an increase in core power and steam generation rate until reactor trip occurs when either the Overtemperature AT or Power Range Neutron Flux-High setpoint is reached. Steam flow to the turbine will not increase from its initial value for this event.The increased heat transfer to the secondary side causes an increase in steam pressure and may result in opening of the MSSVs prior to reactor trip, assuming no credit for operation of the atmospheric or condenser steam dump valves. The FSAR Section 15.4 safety analysis of the RCCA bank withdrawal at power event for a range of initial core power levels demonstrates that the MSSVs are capable of preventing secondary side overpressurization for this AOO.The FSAR safety analyses discussed above assume that all of the MSSVs for each steam generator are OPERABLE. If there are inoperable Ms sv(s), it is necessary to limit the primary system power during steady-state operation and AOOs to a value that does not result in exceeding the combined steam flow capacity of the turbine (if available) and the remaining OPERABLE MSSVs. The required limitation on primary system power necessary to. prevent secondary system overpressurization may be determined by system transient analyses or conservatively arrived at by a simple heat balance calculation. In some circumstances it is necessary to limit the primary side heat generation that can be achieved during an AOO by reducing the setpoint of the Power Range Neutron Flux-High reactor trip function. For example, if more than one MSSV on a single steam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurring from a~partial power level may result in an increase in reactor power that exceeds the combined steam flow capacity of the turbine and the remaining OPERABLE MSSVs. Thus, for multiple inoperable MSSVs on the same steam generator it is necessary to prevent this power increase by lowering the Power Range Neutron Flux-High setpoint to an appropriate value. If the Moderator Temperature Coefficient (MTC) is positive, the reactor power may increase above the initial value during an RCS heatup event (e.g., turbine trip). Thus, for any number of inoperable MSSVs, it is necessary to reduce the trip setpoint if a positive MTC may exist at partial power conditions, unless it is demonstrated by analysis that a specified reactor power reduction alone is sufficient to prevent overpressurization of the steam system.MILLSTONE -UNIT 3 B347l mnmn o -2 B 3/4 7-1a Amendment No. LBDCR 07-MP3-037 July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) The MSSVs are assumed to have two active and one passive failure modes. The active failure modes are spurious opening, and failure to reclose once openfed. The passive failure mode is .failure to open upon demand.The MSSVs satisfy Criterion 3 of 10 CFR 50.3 6(c)(2)(ii). LCO The accident analysis requires that five MSSVs per steam generator be OPERABLE to provide overpressure protection for design basis transients occurring at 102% RTP. The LCO requires that five MSSVs per steam generator be OPERABLE in compliance with Reference 2, and the DBA analysis.The OPERABILITY of the MSSVs is defined as the ability to open upon demand within the setpoint tolerances, to relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the Inservice Testing Program.This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that challenge to the RCPB, or Main Steam System integrity. APPLICABILITY In MODES 1, 2, and 3, five MSSVs per steam generator are required to be OPERABLE to prevent Main Steam System overpressurization. In MODES 4 and 5, there are no credible transients requiring the MSSVs. The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.ACTIONS ACTIONS are modified by a Note indicating that separate Condition entry is allowed for each MSSV.With one or more MSSVs inoperable, action must be taken so that the available MSSV relieving capacity meets Reference 2 requirements for the applicable THERMAL POWER.MILLSTONE -UNIT 3 B347l mnmn o B 3/4 7-1b Amendment No. LBDCR 07-MP3-037-July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1 .1 SAFETY VALVES (Continued) Operation with less than all five MSSVs OPERABLE for each steam generator is permissible, if THERIMAL POWER is limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam .generator. In the case of only a single inoperable MSSV on one or more steam generators when the Moderator Temperature Coefficient is not positive, a reactor power reduction alone is sufficient to limit primary side heat generation such that overpressurization of the secondary side is precluded for any RCS heatup event. Furthermore, for this case there is sufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Therefore, ACTION a. requires an appropriate reduction in reactor power within 4 hours. If the power reduction is not completed within the required time, the unit must be placed in at least HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following 6 hours.The maximum THERMAL POWER correspondin~g to._he.heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the attachment to Reference 4 with an appropriate allowance for calorimetric power uncertainty. The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined by the governing heat transfer relationship is the equation q = mnAh, where q is the heat input from the primary side, mn is the mass flow rate of the steam, and Ah is the increase in enthalpy that occurs in converting the secondary side water to steam. If it is conservatively assumed that the secondary side water is all saturated liquid (assuming no subcooled feedwater), then the Ah is the heat of vaporization (hfg) at the steam'relief pressure.For each steam generator, at a specified pressure, the maximum allowable power level is determined as follows: 100 w Q- x shfgN Maximum Allowable Power Level < K MILLSTONE -UNIT 3 B347l mnmn o B 3/4 7-1c Amendment No. LBDCR- 07-MP3-037 July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) Where: Q =Nominal NSSS power rating of the plant (including reactor coolant pump heat), MWt K =Conversion factor, 947.8 2 (Btu/sec)MWt Ws= Minimum total steam flow rate capability of the OPERABLE MSSVs on any one steam generator at the highest OPERABLE MSSV opening pressure including tolerance and accumulation, as appropriate, lb/sec.hfg =Heat of vaporization at the highest MSSV opening pressure including tolerance and accumulation as appropriate, Btu/lbm.N =Number of loops in the plant.For use in determining the % RTP in ACTION a., the Maximum NSSS Power calculated above is reduced by 2% RTP to account for calorimetric power uncertainty. b and c In the case of multiple inoperable MSSVs on one or more steam generators, with a reactor power reduction alone there may be insufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Furthermore, for a single inoperable MSSV on one or more steam generators when the Moderator Temperature Coefficient is positive the reactor power may increase as a result of an RCS heatup event such that flow capacity of the remaining OPERABLE MSSVs is insufficient. The 4 hour completion time to reduce reactor power is consistent with ACTION a. An additional 32 hours is allowed to reduce the Power Range Neutron Flux High reactor setpoint. The total completion time of 36 hours is based on a reasonable time to correct the MSSV inoperability, the time to perform the power reduction, operating experience to reset all channels of a protection function, and on the low probability of the occurrence of a transient that could result in steam generator overpressure during this period. If the required action is not completed within the associated time, the unit must be placed in at least HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following 6 hours.MILLSTONE -UNIT 3 B347i mnmn o B 3/4 7-1d Amendment No. LBDCR 07-MP3-037 July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (.Continued) The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the.: attachment to Reference 4, with an appropriate allowance for nuclear instrumentation system trip channel uncertainties. ..To determine the Table 3.7-1 Maximum Allowable Power for Required ACTIONS b and c (%RTP), the calculated Maximum NSSS Power is reduced by 9% RTP to account for Nuclear Instrumentation System trip channel uncertainties. ACTIONS b and c are modified by a Note. The Note states that the Power Range Neutron Flux High reactor trip setpoint reduction is only required in MODE 1. in MODES 2 and 3 the reactor protection system trips specified in LCO 2.2.1, "Reactor Trip System Instrumentation Setpoints," provide sufficient protection. The allowed completion times are reasonable based on operating experience to accomplish the ACTIONS in an orderly manner without challenging unit systems.d If one or more steam generators have four or more inoperable MSSVs, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, .the unit must be placed in at least HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following 6 hours. The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE REQUIREMENTS (SR) 4.7.1.1 This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint (Table 3.7-3) in accordance with the Inservice Testing Program. During this testing, the MSSVs are OPERABLE provided the actual lift settings are within +/- 3% of the required lift setting. The ASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7-3 allows a +/- 3% setpoint tolerance for OPERABILITY; however, the valves are reset to +/- 1%during the Surveillance to allow for drift during the next operating cycle. However, if the testing is done at the end of the operating cycle when the plant is being shut down for refueling, MILLSTONE -UNIT 3 B347l mnmn o B 3/4 7-1e Amendment No. LBDCR 07-MIP3-037 July 12, 2007 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 314.7.1.1 SAFETY VALVES (Continued') restoration to +/- 1% of the specified lift setting is not required for valves that will not be used (e.g., replaced) for the next operating cycle. While the lift settings are being restored to within the +/- 1%of the required setting, the MS SVs remain OPERABLE provided the actual lift setting is within+/-t 3% of the required setting. The lift settings, according to Table 3.7-3, correspond to ambient conditions of the valve at nominal operating temperature and pressure.This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.REFERENCES

1. FSAR, Section 10.3.1.2. ASMdE, Boiler and Pressure Vessel Code, Section~ III, 1971 edition.3. FSAR, Section 15.2.4. NRC Information Notice 94-60, "Potential Overpressurization of the Main Steam System," August 22, 1994.3/4.7.1.2 AUXILIARY FEED WATER SYSTEM The OPERABILITY of the Auxiliary Feedwater (AFW) System ensures a makeup water supply to the steam generators (SGs) to support decay heat removal from the Reactor Coolant System (RCS) upon the loss of normal feedwater supply, assuming the worst case single failure. The AFW System consists of two motor driven AFW pumps and one steam turbine driven AFW pump. Each motor driven AFW pump provides at least 50% of the AEW flow capacity assumed in the accident analysis.

After reactor shutdown, decay heat eventually decreases so that one motor driven AFW pump can provide sufficient SG makeup flow. The steam driven AFW pump has a rated capacity approximately double that of a motor driven AFW pump and is thus defined*as a 100% capacity pump.Given the worst case single failure, the AFW System is designed to mitigate the consequences of numerous design basis accidents, including Feedwater Line Break, Loss of Normal Feedwater, Steam Generator Tube Rupture, Main Steam Line Break, and Small Break Loss of Coolant Accident.MILLSTONE -UNIT 3 B 3/4 7-2 MILLTON -NIT3 B3/47-2Amendment No. 0-2, 3-, 0, LBDCR 14-MIP3-006 July 8, 2014 PLANT SYSTEMS BASES AUXILIARY FEED WATER SYSTEM (Continued) In addition, given the worst case failure, the AFW is designed to supply sufficient makeup water to replace SG inventory loss as the RCS is cooled to less than 350°F at which point the Residual Heat Removal System may be placed into operation. Motor driven auxiliary feedwater pumps and associated flow paths are OPERABLE in the following alig-nment during normal operation below 10% RATED THIERMVAL POWER.*Motor operated isolation valves (3FWA*MOV35A/B/CiD) are open in MODE 1, 2 and 3,*Control valves (3FWA*HV3 1A/B/C/D) may be throffled or closed during alignment, operation and restoration of the associated motor driven AFW pump for steam generator inventoly control.The motor operated isolation valves must remain fully open due to single failure criteria (the valves and associated pump are powered from the opposite electrical trains).The Turbine Driven Auxiliary Feedwater (TDAFW) pump and associated flow paths are OPERABLE with all control and isolation valves fully open in MODE 1, 2 and 3. Due to High Energy Line Break analysis, the TDAFW pump cannot be used for steam generator inventory control during normal operation below 10% RATED THERMAL POWER.At M/IPS 3, only two of the three available steam supplies are required to establish an OPERABLE steam supply sys~tem. With one of the two required steam supplies inoperable, normally the third steam supply will be used to satisfy the requirement for two OPERABLE steam supplies. If the third steam supply is also inoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwater pump is OPERABLE), then ACTION a. is entered.If the turbine-driven auxiliary feedwater pump is inoperable due to one required steam supply being inoperable in MODES 1, 2, and 3, or ifra turbine-driven auxiliary feedwater pump is inoperable while in MODE 3 immnrediately following REFUELING, action must be taken to restore the inoperable equipment to an OPERABLE status within 7 days. The 7 day allowed outage time is reasonable, based on the following reasons: MILLSTONE -UNIT 3 B 3/4 7-2a MILLTONE-UNT 3 3/47-2aAmendment No. 03, 4-39, 4-5-0 LBDCR No. 04-MP3-011 November 10, 2005 PLANT SYSTEMS BASES AUXILIARY FEED WATER SYSTEM (Continued)

a. For the inoperability of the turbine-driven auxiliary feedwater pumrp due to one required steam supply to the turbine-driven auxiliary feedwater pump being inoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwater pump is operable), the 7 day allowed outage time is reasonable since the auxiliary* feedwater system design affords adequate redundancy for the steam supply line for the turbine-driven pump.b. For the inoperability of a turbine-driven auxiliary feedwater pump while in MODE 3 ilmmediately subsequent to a refueling, the 7 day allowed outage time is* reasonable due to the minimal decay heat levels in this situation.

c. For both the inoperability of the turbine-driven auxiliary feedwater pump due to one required steam supply to the turbine-driven auxiliary feedwater pump being inoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwater pump is operable), and an inoperable turbine-driven auxiliary feedwater pump while in MODE 3 imxmediately following a refueling outage, the 7 day allowed outage time is reasonable due to the availability of redundant OPERABLE motor driven auxiliary feedwater pumps, and due to the low probability of an event requiring the use of the turbine-driven auxiliary feedwater pump.The required ACTION dictates that if either the 7 day allowed outage time is reached the unit must be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 12 hours.The allowed time is reasonable, based on operating experience, to reachithe required conditions from full power conditions in an. orderly manner and without challenging plant systems.A Note limits the applicability of the inoperable equipment condition

b. to when the unit has not entered MODE 2 following a REFUELING.

Required ACTION b. allows one auxilia-y fee~dwater pump to be inoperable for 7 days vice the 72 hour allowed outage time in required ACTION c. This longer allowed outage thne is based on the reduced decay heat following REFUELING and prior to the reactor being critical.With one of the auxiliary feedwater pumps inoperable in MODE 1, 2, or 3 for reasons other than ACTION a. or b., ACTION must be taken to restore OPERABLE status within 72 hours. This includes the loss of three steam supply lines to the turbine-driven auxiliary feedwater pump. The 72 hour allowed outage time is reasonable, based on redundant capabilities afforded by the auxiliamy feedwater system, time needed for repairs, and the low probability of a DBA occurring during this time period. Two auxiliary feedwater pumps and flow pathls remain to supply feedwater to the steam generators. MILLSTONE -UNIT 3 B 3/4 7-2b MILLTON -NIT B /4 -2bAmendment No. -!-02-, 4-39, -0, LBDCR 12-MIP3-010 September 20, 2012 PLANT SY STEMS BASES AUXILIARY FEED WATER SYSTEM (Continued) If all thr'ee AFW pumps are inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with non safety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore oneAFW pump to OPERABLE status. Required ACTION e. is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW pump is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe conditio~n. SR 4.7.1.2.1

a. verifies the correct alignment for manual, power operated, and automatic valves in the auxiliaiy¢ feedwater water and steam supply flow paths to provide assurance that the proper flow paths exist for auxiliary feedwater operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misalign~ed, such as check valves. This Surveillance does not require any testing or valve manipulations; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. The surveillance fr'equency is controlled under the Surveillance Frequency Control Program.*The SR is modified by a Note that states one or more auxiliary feedwater pumps may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually (i.e., remotely or locally, as appropriate) realigned to the auxiliary feedwater mode of operation, provided it is not otherwise inoperable. This exception to pump OPERABILITY allows the pump(s) and associated valves to be out of their normal standby alignment and temporarily incapable of automatic initiation without declaring the pump(s)inoperable. Since auxiliary feedwater may be used during STARTUP, SI{UTDOWN, HOT STANDBY operations, and HOT SHUTDOWN operations for steam generator level control, and these mmaual operations are an accepted function of the auxiliatry feedwater system, OPERABILITY (i.e., the intended safety function) continues to be maintained. MILLSTONE -UNIT 3 B3472 mnmn o B 3/4 7-2c Amendment No. LBDCR 14-MiP3-006 July 8, 2014 AUXILIARY FEED WATER SYSTEM (Continued) Surveillance Requirement 4.7.1.2.1 .b, which addresses periodic surveillance testing of the AFW pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems, is required by the ASME GM Code. This type of testing may be accomplished by measuring the pump developed head at only one point on the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pumps baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program, which encompasses the ASME OM Code. The ASME GM Code provides the activities and frequencies necessary to satisfy the requirements. This surveillance is modified by a note to indicate that the test can be deferred for the steam driven AFW pump until suitable plant conditions are established. This deferral is required because steam pressure is not sufficient to perform the test until after MODE 3 is entered.However, the test, if required, nmst be performed prior to entering MODE 2.Surveillance Requirement 4.7.1.2.1 .c demonstrates that each AFW pump starts on receipt of an actual or simulated actuation signal. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program.Surveillance Requirement 4.7.1.2.2 demonstrates the AFW System is properly aligned by verifying the flow path to each steam generator prior to entering MODE 2 after more than 30 days in any comnbination of MODE 5 or 6 or defueled. OPERABILITY of the AFW flow paths must be verified before sufficient core heat is generated that would require operation of the AFW System during a subsequent shutdown. To further ensure AEW System alignmaent, the OPERABILITY of the flow paths is verified following extended outages to determnine that no misalignment of valves has occurred. The frequency is reasonable, based on engineering judgenment, and other administrative controls to ensure the flow paths are OPERABLE.MILLSTONE -UNIT 3 B3472 B 3/4 7-2d LBDCR 14-MP3-006 July 8, 2014 PLANT SYSTEMS BASES 3/4.7.1.3 DEM1hERALIZED WATER STORAGE TANK The OPERABILITY of the demineralized water storage tank (DWST) with a 334,000 gallon minimum measured water volume ensures that sufficient water is available to maintain the reactor coolant system at HOT STANDBY conditions for 7 hours with steam discharge to the atmosphere, concurrent with a total loss-of-offsite power, and with an additional 6-hour cooldown period to reduce reactor coolant temperature to 350°F. The 334,000 gallon required water volume contains an allowance for tank inventory not usable because of tank discharge line location, other tank physical characteristics, and surveillance measurement uncertainty considerations. The inventory requirement is conservatively based on 120°F water temperature which maximizes inventory required to remove RCS decay heat. In the event of a feedline break, this inventory requirement includes an allowance for 30 minutes of spillage before operator action is credited to isolate flow to the line break.If the combined condensate storage tank (CST) and DWST inventory is being credited, there are 50,000 gallons of unusable CST inventory due to tank discharge line location, other physical characteristics, level measurement uncertainty and potential measurement bias error due to the CST nitrogen blanket. To obtain the Surveillance Requirement 4.7.1.3.2's DWST and CST combined volume, this 50,000 gallons. of unusable CST inventory has been added to the 334,000 gallon DWST water volume specified in LCO 3.7.1.3 resulting in a 384,000 gallons 0 requirement (334,000 + 50,000 = 384,000 gallons).3/4.7.1.4 SPECIFIC ACTIVITY The limitations on Secondary Coolant System specific activity ensure that the resultant offsite radiation dose will be limited to 10 CFR 50.67 and Regulatory Guide 1.183 dose guideline values in the event of a steam line rupture. This dose also includes thae effects of a coincident 1 gpm primary-to-secondary tube leak in the steam generator of the affected steam line. These values are consistent with the assumptions used in the safety analyses.MILLSTONE -UNIT 3 B 3/4 7-2e LBDCR No. 08.-MP3-032 Octobher 28, 2008 PLANT SYSTEMS BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES BACKGROUND The main steam line isolation valves (MSIVs) isolate steam flow from the secondary side of the steam generators following a high energy line break (HELB). MSIV closure terminates flow from the unaffected (intact) steam generators. One MSIV is located in each main steam line outside, but close to, containment. The MSIVs are downstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam supply, to prevent MSSV and AFW isolation from the steam generators by MSIV closure. Closing the MSIVs isolates each steam generator from the others, and isolates the turbine, Steam Bypass System, and other auxiliary steam supplies from the steam generators. The MSIVs close on a main steam isolation signal generated by low steam generator pressure, high containment pressure, or steam line pressure negative rate (high). The MSIVs fail closed on loss of control or actuation power.Each MSIV has an MSIV bypass valve. Although these bypass valves are normally closed, they receive the same emergency closure signal as do their associated MSIVs. The MSIVs may also be actuated manually.A description of the MSIVs is found in the FSAR, Section 10.3.APPLICABLE SAFETY ANALYSIS The design basis of the MSIVs is established by the containment analysis for the large steam line break (SLB) inside containment, discussed in the FSAR, Section 6.2. It is also affected by the accident analysis of the SLB events presented .in the FSAR, Section 15.1.5. The design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one MSIV to close on demand).The limiting temperature case for the containment analysis is the SLB inside containment, at 102% power with mass and energy releases based on offsite power available following turbine trip, and failure of the MSIV on the affected steam generator to close.At hot zero power, the steam generator inventory and temperature are at their maximum, maximizing the analyzed mass and energy release to the containment. Due to reverse flow and failure of the MSIV to close, the additional mass and energy in the steam headers downstream from the other MSIV contribute to the total release. With the most reactive rod cluster control assembly assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power. The reactor is ultimately shut down by the boric acid injection delivered by the Emergency Core Cooling System.MILLSTONE -UNIT 3B3/73AmnetNo B 3/4 7-3 Amendment No. LBDCR No.-0)4-MP3-0 15 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued) The accident analysis compares several different SLB events against different acceptance criteria.The large SLB outside containment upstream of the MSIVs is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB upstream of the MSIV at hot zero power is the limiting case for a post trip return to power. The , analysis includes scenarios with offsite power available and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System cooldown. With a loss of offsite power, the response of mitigating systems is delayed. Significant single failures considered include failure of an MSIV to close.The MSIVs serve only a safety function and remain open during POWER OPERATION. These valves operate under the following situations:

a. An HELB inside containment.

In order to maximize the mass and energy release into containment, the analysis assumes that the MSIV in the affected steam generator remains open. For this accident scenario, steam is discharged into containment from all steam generators until the remaining MSIVs close. After MSIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIVs in the unaffected loops. Closure of the MSIVs isolates the break from the unaffected steam generators.

b. A break outside of containment and upstream from the MSIVs is not a containment pressurization concern. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition.

Closure of the MSIVs isolates the break and limits the blowdown to a single steam generator.

c. A break downstream of the MSIVs will be isolated by the closure of the MSIVs.d. Following a steam generator tube rupture, closure of the MSIVs isolates the ruptured steam generator from the intact steam generators.

In addition to minimizing radiological releases, this enables the operator to maintain the pressure of the steam generator with the ruptured tube below the MSSV setpoints, a necessary step toward isolating the flow through the rupture.e. The MSIVs are also utilized during other events, such as a feedwater line break. This event is less limitinig so far as MSIV OPERABILITY is concerned. MILLSTONE -UNIT 3 B 3/4 7-4 MILLTONE-UNT 3 3/47-4Amendment No. 4-1-9, 41-3-6, PLANT SYSTEMS 10/19/i00 BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued) LCO This [CO requires that four MSIVs in the steam lines be OPERABLE. The MSIVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal.This LCO provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 1OCFRIOO limits or the NRC Staff approved licensing basis.APPLICABILITY The MSIVs must be OPERABLE in MODE 1 and in MODES 2, 3, and 4 except when closed and deactivated when there is significant mass and energy in the RCS and steam generators. When the MSIVs are closed, they are already performing the safety function.In MODES 1, 2, and 3 the MSIVs are required to close within 10 seconds to ensure the accident analysis assumptions are met. In MODE 4 the MSIVs are required to close within 120 seconds to ensure the accident analysis assumptions are met.*i An engineering evaluation has determined that a Reactor Coolant System (RCS)temperature greater than or equal to 320°F is required to provide sufficient steam energy to provide the motive force to operate the MSIVs. Therefore, below an RCS temperature of 320°F the MSIVs are not OPERABLE and are required to be closed.In MODE 5 or 6, the steam generators do not contain much energy because their temperature is below the boiling point of water; therefore, the MSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.ACTIONS MODE 1 With one MSIV inoperable in MODE 1, action must be taken to restore OPERABLE status within 8 hours. Some repairs to the MSIV can be made with the unit hot.The 8 hour Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the MSIVs.The 8 hour Completion Time is greater than that normally allowed for containment isolation valves because the MSIVs are valves that isolate a closed system penetrating containment. These valves differ from other containment isolation valves in that the closed system provides a passive barrier for containment O isolation. MILLSTONE -UNIT 3 B 3/4 7-5 Amendment No. 1 85 PLANT SYSTEMS 10119100 BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued) If the MSIV cannot be restored to OPERABLE status within 8 hours, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours. The ComPletion Times are reasonable, based on operating experience, to reach MODE 2 and to close the MSIVs in an orderly manner and without challenging plant systems.MODES 2. 3. and 4 Since the MSIVs are required to be OPERABLE in MODES 2, 3, and 4, the inoperable MSIVs may either be restored to OPERABLE status or closed. When closed, the MSIVs are already in the position required by the assumptions in the safety analysis. The MSIVs may be opened to perform Surveillance Requirement 4.7.1.5.2. The 8 hour Completion Time is consistent with that allowed in MODE 1.For inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, the inoperable MSIVs must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day verification time is reasonable, based on engineering judgment, in view of MSIV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position.If the MSIVs cannot be restored to OPERABLE status or are not closed within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed at least in MODE 3 within 6 hours, and in MODE 5 within the next 30 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems. The Action Statement is modified by a note indicating that separate condition entry is allowed for each MSIV.SURVEILLANCE REQUIREMENTS 4.7.1.5.1 DELETED MILLSTONE -UNiT 3 B 3/4 7-6 Amendment No. 7$, 185 PLANT SYSTEMS 10/19100 BASES SURVEILLANCE REQUIREMENTS (continued) 4.7.1.5.2 This surveillance demonstrates that MSIV closure time is less than 10 seconds (120 seconds for MODE 4 only) on an actual or simulated actuation signal, when tested pursuant to Specification 4.0.5. A simulated signal is defined as any of the following engineering safety features actuation system instrumentation functional units per Technical Specifications Table 4.3-2: 4.a.1) manual initiation, individual, 4.a.2) manual initiation system, 4.c.containment pressure high-2, 4.d. steam line pressure low, or 4.e. steam line pressure -negative rate high. The MSIV closure time is assumed in the accident analyses. This surveillance is normally performed upon returning the plant to operation following a refueling outage. The test is normally conducted in MODES 3 or 4 with the plant at suitable (appropriate) conditions (e.g., pressure and temperature). The MSIVs should not be tested at power, since even a part stroke exercise increases the risk of valve closure when the unit is generating power.This surveillance requirement is modified by an exception that will allow entry into and operation in MODES 3 and 4 prior to performing the test to establish conditions consistent with those under which the acceptance criterion was generated. Successful performance of this test within the required frequency is necessary to operate in MODES 3 and 4 with the MSIVs open, to enter MODE 2 from MODE 3, and for plant operation in MODE 1. If this surveillance has not been successfully performed within the required frequency, the MSIVs. are inoperable and are required to be closed.In MODE 4 only, the MSIVs can be considered OPERABLE if the closure time is less than 120 seconds. An engineering evaluation has determined that a RCS temperature greater than or equal to 320°F is required to provide sufficient steam energy to provide the motive force to operate the MSIVs. Therefore, below an RCS temperature of 320°F the MSIVs are not OPERABLE and are required to be closed.MILLSTONE -UNIT 3 B 3/4 7-6a MILLTON -NIT B /4 -5aAmendment No. X~g 185 REVERSE OF PAGE B 3/4 7-6a INTENTIONALLY LEFT BLANK LBDCR No. 04-MP3--015 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.1.6 STEAM GENERATOR ATMOSPHERIC RELIEF BYPASS LINES The OPERABILITY of the *steam generator atmospheric relief bypass valve (SGARBV)lines provides a method to recover from a steam generator tube rupture (SGTR) event dulring which the operator i's required to perform a-limited coo ldbwn establish adequate sub cooling as anecessary step to *limit the primary to secondary break flow into* the r, ptured steam generator.. The time required to limit the primary to"secondary break flow for an SGTR event is more critical than the time required to cooldown to RHR entry conditions. Because of these time constraints, these valves afnd associated flow paths must be OPERABLE from the control room. The number of SGA.RB Vs requiredi to be OPERABLE from the control room to satisfy the S GTR accident.analysis requires consideration of single failure criteria; Four SGARBV are required to be OPER~ABLE to ensure the credited steam release pathways available to conduct a unit cooldown following a SGTR." For other design events, the SGARBVs provide a safety grade method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sinik via the steam bypass system or the steam generator atmospheric relief valves be unavailable. Prior to operator action to cooldown, the main steam safety valves (MS SVs) are assumed to operate automatically to relieve steam and maintain the, steam generator pressure below design limits.Each SGARIBV line consists of one SGARBV and an associated block valve (main steam atmospheric relief isolation valve, 3MSS*MOV18SA/B/C/D). These block valves are used in the event a steam generator atmospheric relief valve (S GARY) or SGARBV fails to close. Becauise of the electrical power relationship .b.etw~en the SGARV and the block v~alys,.if a b~iqok yaly.e, is maintained closed, the SGARBV flow path is inoperable because of single failure consideration. The bases for the required ACTIONS can be found in NUREG 1431, Rev. 1.The LCO APPLICABILITY and ACTION statements uses the terms "MODE 4 when steam generator is relied *upon for heat removal" and "in MODE 4 without reliance upon steam generator for heat removal." This means that those steam generators which are credited for decay heat removal to comply with LCO 3.4.1.3 (Reactor Coolant System, HOT SHUTDOWN) shall have an OPERABLE SGARBV line. See Bases Section 3/4.4.1 for more detail.3/4.7..2 DELETED MILLSTONE -UNIT 3 B 3/4 7-7 Amendment No. 4-46, -448, 1-54-, 2-4, Acknowledged by NRC letter dated 08/25/05. LBDCR 3-22-02 March 14, 2002 PLANT SYSTEMS BASES 3/4.7.3 REACTOR PLANT COMPONENT COOLING WATER SYSTEM The OPERABILITY of the Reactor Plant Component Cooling Water. System ensures that sufficient cooling capacity is. available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is. consistent with the assumptions used in. the safety analyses.The Charging Pump/Reactor Plant Componenit Cooling Water Pump.Ventilation System is required to be available to. support reactor plant component cooling water pump operation. The Charging Pump/Reactor Plaint Component Cooling Water Pump Ventilation System consists of two redundant trains, each capablle of providing 100% of the required flow. Each train has. a two position, and "Auto," renmote control S'witch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the..operating train. The associated fans do not receive any safety related automatic start.signals (e.g., Safety Injection Signal).Placing the remote control switch for a Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train in the "Off' position to start the redundant train or to perform post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensurethe remote.control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use of an approved procedure and a designated individual .at the control switch for the respective Charging PumpReaetor" Planit Comrponeni Cooling'Water PUmp Ventilatiori Train Who6 apidly respond to instructions from procedures, or control room personnel, based on plant conditions. 3/4.7.4 SERVICE WATER SYSTEM The OPERABILITY of the Service Water System ensures that 'sufficient cooling capacity is available for contintied operation of safety-related equipmen~t during nonmal land accident conditions. The redundant.cooling Capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.An OPERABLE service water loop requires one OPERABLE service water pump and .associated strainer. Two OPERABLE service water loops, with one OPERABLE service water pump and associated strainer per loop, will provide sufficient core (and containment) decay heat removal during a design basis accident coincident with a loss of offsite power and a single failure.MILLSTONE -UNIT 3 B 3/4 7-7a Amendment No. 4-4-~,' Acknowledged by NRC letter dated 08/25/05 LBDCR No. 13-MP3-002 May 2, 2013 PLANT SYSTEMS BASES 3/4.7.5 ULTIMATE HEAT SINK BACKGROUND The ultimate heat sink (UIIS) for Millstone Unit No. 3 is Long Island Sound. The Long Island Sound is connected to the Atlantic Ocean and provides the required 30 day supply of water. It serves as a heat sink for both safety and nonsafety-related cooling systems. Sensible heat is discharged to the UHS via the service water (SW) and circulating water (CWV) systems.The basic performance requirement is that a 30 day supply of water be available, and that the design basis temperatures of safety related equipment not be exceeded.Additional information on the design and operation of the system, along with a list of components served, can be found in References 1, 2, and 3.APPLICABLE SAFETY ANALYSES The UIHS is the sink for heat removed from the reactor core following all accidents and anticipated operational occurrences in which the unit is cooled down and placed on residual heat removal (RTIR) operation. With UHS as the normal heat sink for condenser cooling via the CW System, unit operation at full power is its maximum heat load. Its maximum post accident heat load occurs <1 hour after a design basis loss of coolant accident (LOCA). Near this time, the unit switches from injection to recirculation and the containment recirculation system removes the core decay heat.The operating limits are based on conservative heat transfer analyses for the worst case LOCA.References 1, 2, and 3 provide the details of the assumptions used in the analysis, which include worst expected meteorological conditions, conservative uncertainties .when calciulating decay heat, and worst case single active failure (e.g., single failure of a man-made structure). The limitations on the temperature of the UTHS ensure that the assumption for temperature used in the analyses for cooling of safety related components by the SW system are satisfied. These analyses ensure that under normal operation, plant cooldown, or accident conditions, all components cooled directly or indirectly by SW will receive adequate cooling to perform their design basis functions. The UHS satisfies Criterion 3 of 10 CFR 50.3 6(c)(2)(ii). LCO The UHS is required to be OPERABLE and is considered OPERABLE if it contains a sufficient volume of water at or below the maximum temperature that would allow the SW System to operate for at least 30 days following the design basis LOCA without the loss of net positive MILLSTONE -UNIT 3B347-AmnetNo43-B 3/4 7-8 Amendment No. 4-36 REVERSE OF PAGE B 3/4 7-8 INTENTIONALLY LEFT BLANK LBDCR No. 13-MP3-002 May 2, 2013 PLANT SYSTEMS BASES LCO (Continued) suction head (NP SH), and without exceeding the maximum design temperature of the*equipment served by the SW System. To meet this condition, the UHS temperature should not exceed 80°F during normal unit operation. While the use of any supply side SW temperature indication is adequate to ensure compliance with the analysis assumptions, precision instruments installed at the inlet to the reactor plant closed cooling water (RPCCW) (CCP) heat exchanges will normally be used.Therefore, instrument uncertainty need not be factored into the surveillance acceptance criteria. All in-service instruments must be within the limit. If all of the precision instruments are out of service, alternative instruments that measure SW supply side temperature will be used. In this case, an appropriate instrument uncertainty will be subtracted from the acceptance criteria.Since Long Island Sound temperature changes relatively slowly and in a predictable fashion according to the tides, it is acceptable to monitor this temperature daily when there is ample (>5°F) margin to the limit. When within 5 0 F of the limit, the temperature shall be monitored every 6 hours to ensure that tidal variations are appropriately captured.APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of the equipment serviced by the UHS and required to be OPERABLE in these MODES.In MODE 5 or 6, the OPERABILITY requirements of the uHS are determined by the systems its supports.ACTION If the UHS is inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed inl at least HOT STANDBY within 6 hours and in COLD SHUTDOWN within the following 30 hours.The allowed outage times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.MILLSTONE -UNIT 3 B 3/4 7-9 Amendment No. 4-36, LBDCR 13-MP3-002 May 2, 2013 PLANT SYSTEMS BASES SURVEILLANCE REQUIREMENTS This surveillance requirement verifies that the UHS is capable of providing a 30 day cooling water supply to safety related equipment without exceeding its design basis temperature. This surveillance requirement verifies that the water temperature of the UHS is < 80°F.REFERENCES

1. FSAR, Section 6.2, Containment Systems 2. FSAR, Section 9.2, Water Systems 3. FSAR, Section 15.6, Decrease in Reactor Coolant Inventory 3/4.7.6 DELETED 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM BACKGROUND The control room emergency ventilation system provides a protected environment from whichd operators can control the unit following an uncontrolled release of radioactivity, hazardous 0 chemicals, or smoke. Additionally, the system provides temperature control for the control room : envelope (CRE) during normal and post-accident operations.

The control room emergency ventilation system is comprised of the CRE emergency air filtration system and a temperature control system..The control room emergency air filtration system consists of two redundant systems that recirculate and filter the air in the CRE and a CRE boundary that limits the inleakage of unfiltered air. Each control room emergency air filtration system consists of a moisture separator, electric heater, prefilter, upstream high efficiency particulate air (IiEPA) filter, charcoal adsorber, downstream 1-EPA filter, and fan. Additionally, ductwork, valves or dampers, and instrumentation form part of the system.The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and other non-critical areas including adjacent support offices, MILLSTONE -UNIT 3 B 3/4 7-10 Amendment No. 44l9, 4-36, 444, g--t4 O LBDCR No...08-MP3-014 October 21, 2008 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) BACKGROUND (Continued) toilet and utility rooms. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, ceiling, ducting, valves, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program and UFSAR Section 6.4.2.1.Normal Operation A portion of the control room emergency ventilation system is required to operate during norrnial operations to ensure the temperature of the control room is maintained at or below 95°0 F.Post Accident Operation The control room emergency ventilation systemn'is re quired to operate during post-accident operations to ensure the temperature of the CRE is maintained and to ensure the CRE will remain habitable during and following accident conditions. The following event occurs upon receipt of a control building isolation (CBI) signal or a signal indicating high radiation in the air supply duct to the CRE.The control room emergency ventilation system will automatically start in the emergency mode (filtered pressurization whereby outside air is diverted through the filters to the CRE to maintain a positive pressure). APPLICABLE SAFETY ANALYSIS The OPERABILITY of the Control Room Emergency Ventilation System ensures that: (1) the ambient air temperature does not exceed the allowable temperature for continuous-duty rating for the equipment and instrumentation cooled by this system, and (2) the CRE will remain MILLSTONE -UNIT 3 B 3/4 7-11 MILLTONE-UNT 3 3/4-11Amendment No. 4-3-6, 2-1-, LBDCR No._08-MP3-014 October 21, 2008 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) APPLICABLE SAFETY ANALYSIS (Continued) habitable for occupants during and following all credible accident conditions. The OPERABILITY of this system in conjunction with control room design provisions is based on limiting the radiation exposure to CRE occupants. For all postulated design basis accidents, the radiation exposure to CRE occupants shall be 5 rem TEDE or less, consistent with the requirements of 10 CFR 50.67. This limitation is consistent with the requirements of General Design Criterion 19 of Appendix A, 10 CFR Part 50.LIMITING CONDITION FOR OPERATION Two independent control room emergency air filtration systems are required to be OPERABLE to ensure that at least one is available in the event the other system is disabled.Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem TEDE to the CRE occupants in the event of a large radioactive release.A control room emergency air filtration system is OPERABLE when the associated:

a. Fan is OPERABLE;b. HEPA filters and charcoal adsorbers are not excessively restricting flow and are capable of performing their filtration, functions; and c. moisture separator, heater, ductwork, valveS, and dampers are OPERABLE, and air circulation can be maintained.

In order for the CREVs to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.TS LCO 3.7.7 is modified by a footnote allowing the CRE boundary to be opened intermittently under administrative controls. This footnote only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, MILLSTONE -UNIT 3 B 3/4 7-12 MILLTON -NIT B /4 -12Amendment No. 14-6, -2093, 2--9, LBDCR No.-0O8-MP3-014 October 21, 2008 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) LIMITING CONDITION FOR OPERATION (Continued) floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the GRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated. Operation of the Control Room Emergency Ventilation System in the emergency mode is credited for design basis accident mitigation. The fuel handling accident analyses assume the emergency mode will be established within 30 minutes of a fuel handling accident. The other applicable design basis accidents (e.g., large break loss of coolant accident) assume the emergency mode will be established within 101 minutes of the accident. Even though manual operator action to establish the emergency mode could be credited within these time periods, the system has been designed to automatically establish the required equipment alignment upon receipt of a Control Building Isolation signal. Therefore, when stopping a Control Room Emergency Filter Fan by placing the control switch in OFF, the fan remains OPERABLE. The administrative controls associated-with the procedure in use to stop the fan are sufficient to ensure the associated control switch is returned to the AUTO position.In addition, the Emergency Operating Procedure will ensure a Control Room Emergency Filter fan is running in the emergency mode post accident well within the credited accident mitigation time frame.Control Room inlet isolation valves 3HVC*AOV25 and 3HVC*A0V26 are maintained open with air isolated whenever Technical Specification 3.7.7 is applicable. The only procedural guidance to close 31H1VC*AO V25 when this specification is applicable is in the alarm response procedure for smoke in the control room air inlet ventilation duct. The alarm response procedure will provide direction to establish the filtered recirculation mode of operation by restoring air and closing 3HVC*AOV25. During this limited time period, both Control Room Emergency Filtration trains remain OPERABLE, but degraded. Even though 3HVC*AOV25 is closed, it is a fail open valve and will automatically open on a Control Building Isolation signal, making it OPERABLE. However, should it to fail open, the system will not function. Therefore, it is not single failure proof and is degraded.Operation in this condition should be minimized. MILLSTONE -UNIT 3 B 3/4 7-12a MILLTON -UIT B 34 712aAmendment No. 3-6, -2O)3, 2-1-, REVERSE OF PAGE B 3/4 7-12a INTENTIONALLY LEFT BLANK LBDCR 10-MP3-003 February 23, 2010 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) APPLICABILITY In MODES 1, 2, 3, and 4.During movement of recently irradiated fuel assemblies. ACTIONS a., b., and c. of this specification are applicable at all times during plant operation in MODES 1, 2, 3, and 4. ACTIONS d. and e. are applicable during movement of recently irradiated fuel assemblies. The CREVs is required to be OPERABLE during fuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 350 hours*).An analysis was completed that analyzed a bounding drop of a non-spent fuel component. The analysis showed that the amount of fuel damage from this drop resulted in control room dose less than 5 rem TEDE without operation of the control room ventilation system.ACTIONS MODES 1, 2. 3. and 4 a. With one control room emergency air filtration system inoperable for reasons other than an inoperable CRE boundary, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. In this condition, the remaining control room emergency air filtration system is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a single failure in the OPERABLE train could result in a loss of the control room emergency air filtration system function. The 7-day completion time is based on the low probability of a DBA occurring during this time period, and the ability of the remaining train to provide the required capability. If the inoperable train cannot be restored to an OPERABLE status within 7 days, the unit must be placed in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. These completion times are reasonable, based on operating experience, to reach the required unit condition from full power conditions in an orderly manner and without challenging unit systems.*During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.MILLSTONE -UNIT 3 B 3/4 7-13 MILLTONE-UNT 3 3/47-13Amendment No. 36, N3-3, LBDCR 07-MP3-033 June 25, 2007 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) ACTIONS (Continued)

b. With both control room emergency air filtration systems inoperable, except due to an inoperable CRE boundary, at least one control room emergency air filtration system must be restored to OPERABLE status within 1 hour, or the unit must be in HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. These completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.c. With one or more control room emergency air filtration systems inoperable due to an inoperable CRE boundary, (1) action must be immediately initiated to implement mitigating actions; (2) action must be taken within 24 hours to verify mitigating actions*ensure CRE occupant exposures to radiological and chemical hazards will not exceed limits, and mitigating actions are taken to smoke hazards; and (3) the CRE boundary must be restored to OPERABLE status within 90 days. Otherwise, the unit must be in HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants-ffom chemicals or smoke, the CRE boundary is inoperable.

Actions must be taken to restore an OPERABLE CRE boundary within 90 days.During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect MILLSTONE -UNIT 3 B 3/4 7-13a MILLSONE UNI 3 B3/4 -13aAmendment No. 36, 8--, 2413, 2-2-9, LBDCR 12-MP3-010 September 20, 2012 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) ACTIONS (Continued) their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.Immediate action(s), in accordance with the LCO ACTION Statements, means that the required action should be pursued without delay and in a controlled manner.During movement of recently irradiated fuel assemblies

d. With one control room emergency air filtration system inoperable, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. After 7 days, either* initiate and maintain operation of the remaining OPERABLE control room emergency air filtration system in the emergency mode or suspend the movement of fuel. Initiating and maintaining operation of the OPERABLE train in the emergency mode ensures: (i) OPERABILITY of the train will not be compromised by a failure of the automatic actuation logic; and (ii) active failures will be readily detected.e. With both control room emergency air filtration systems inoperable, or with the train required by ACTION 'd' not capable of being powered by an OPERABLE emergency power source, actions must be taken to suspend all operations involving the movement of recently irradiated fuel assemblies.

This action places the unit in a condition that minimizes risk. This action does not preclude the movement of fuel to a safe position.SURVEILLANCE REQUIREMENTS 4.7.7.a The CRE environment should be checked periodically to ensure that the CRE temperature control system is functioning properly. The surveillance frequency is controlled under the Surveillance Frequency Control Program. It is not necessary to cycle the CRE ventilation chillers. The CRE is manned during operations covered by the technical specifications. Typically, temperature aberrations will be readily apparent.4.7.7.b Standby systems should be checked periodically to ensure that they function properly. The surveillance frequency is controlled under the Surveillance Frequency Control Program.1 MILLSTONE -UNIT 3B/4-bAmnetNo B 3/4 7-13b Amendment No. LBDCR 12-MP3-010 September 20, 2012 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) SURVEILLANCE REQUIREMENTS (Continued) This surveillance requirement verifies a system flow rate of 1,120 cfln -20%. Additionally, the system is required to operate for at least 10 continuous hours with the heaters energized. These operations are sufficient to reduce the buildup of moisture on the adsorbers and HEPA filters due to the humidity in the ambient air.4.7.7.c The performance of the control room emergency filtration systems should be checked periodically by verifying the 1HEPA filter efficiency, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal. The frequency is as specified in the Surveillance Frequency Control Program and following painting, fire, or chemical release in any ventilation zone communicating with the system.ANSI N5 10-1980 will be used as a procedural guide for surveillance testing.Any time the OPERABILITY of a JiEPA filter or charcoal adsorber housing has been affected by repair, maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. 4.7.7.c.l This surveillance verifies that the system satisfies the in-place penetration and bypass leakage testing acceptance criterion of less than 0.05% in accordance with Regulatory Position C.5.a, C.5.c, and C.5.d of Regulatory Guide 1.52, Revision 2, March 1978, while operating the system at a flow rate of 1,120 cfm+/-+ 20%. ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in the regulatory guide.4.7.7.c.2 This surveillance requires that a representative carbon sample be obtained in accordance with Regulatory Position C.6.b of Regulatory Guide 1.52, Revision 2, March 1978 and that a laboratory analysis verify that the representative carbon sample meets the laboratory testing criteria of ASTM D3803-89 and Millstone Unit 3 specific parameters. The laboratory analysis is required to be performed within 31 days after removal of the sample. ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in Revision 2 of Regulatory Guide 1.52.MILLSTONE -UNIT 3 B 3/4 7-14 MILSTOE UNT 3B /4714Amendment No. -!-3-, 4-84, _2-06 LBDCR 12-MP3-010 September 20, 2012 PLANT SYSTEMS BASES 314.7.7 CONTROL ROOM EMERGENCY VENTILATION sYSTEM (Continued) SURVEILLANCE REGUIREMENTS (Continued) 4.7.7.c.3 This surveillance verifies that a system flow rate of 1,120 cfrn + 20%, during system operation when testing in accordance with ANSI N5 10-1980.4.7.7.d After 720 hours of charcoal adsorber operation, a representative carbon sample must be obtained in accordance with Regulatory Position C.6.b of Regulatory Guide 1.52, Revision 2, March 1978, and a laboratory analysis must verify that the representative carbon sample meets the laboratory testing criteria of ASTM D3803-89 and Millstone Unit 3 specific parameters. The laboratory analysis is required to be performed within 31 days after removal of the sample.ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in Revision 2 of Regulatory Guide 1.52.The maximum surveillance interval is 900 hours, per Surveillance Requirement 4.0.2. The 720 hours of operation requirement originates from Nuclear Regulatory Guide 1.52, Table 2, Note C. This testing ensures that the charcoal adsorbency capacity has not degraded below acceptable limits as well as providing trending data.4.7.7.e. 1 This surveillance verifies that the pressure drop across the combined IHEPA filters and charcoal adsorbers banks at less than 6.75 inches water gauge when the system is operated at a flow rate of 1,120 cfmn -20%. The surveillance frequency is controlled under the Surveillance Frequency Control Program.4.7.7.e.2 Deleted.4.7.7.e.3 This surveillance verifies that the heaters can dissipate 9.4 4- 1 kW at 480V when tested in accordance with ANSI N510-1980. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The heater kW measured must be corrected to its nameplate rating. Variations in system voltage can lead to measurements of kW which cannot be compared to the nameplate rating becaus~e the output kW is proportional to the square of the voltage.MILLSTONE -UNIT 3 MILSTOE -UNI 3B 314 7-15 Amendment No. 4-3-6,4-1-84-,--84, 2-0-3,20 LBDCR 07-MP3-033 June 25, 2007 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) SURVEILLANCE REOUIREMENTS (Continued) 4.7.7.f Following the complete or partial replacement of a HEPA filter bank, the OPERABILITY of the cleanup system should be confirmed. This is accomplished by verifying that the cleanup system satisfies the in-place penetration and bypass leakage testing acceptance criterion of less than 0.05% in accordance with ANSI N5 10-1980 for a DOP test aerosol while operating the system at a flow rate of 1,120 cfm d 20%.4.7.7.g_Following the complete or partial replacement of a charcoal adsorber bank, the OPERABILITY of the cleanup system should be confirmed. This is accomplished by verifying that the cleanup system satisfied the in-place penetration and bypass leakage testing acceptance criterion of less than 0.05% in accordance with ANSI N5I10-1 980 for a halogenated hydrocarbon refrigerant test gas while operating the system at a flow of 1,120 cfmn +/- 20%.4.7.7.h O This Surveillance verifies the OPERABILITY of the CR3 boundary by testing for unfiltered air inleakage past the CR3 boundary and into the CR3. The details of the testing are specified in the Control Room Envelope Habitability Program.The CR3_ is considered habitable when the radiological dose to CR3 occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem TEDE and the CR3 occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CR3 is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, ACTION c. must be entered. ACTION c. allows time to restore the CR3 boundary to OPERABLE status provided mitigating actions can ensure that the CR3 remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, which endorses, with exceptions, NEI 99-03.These compensatory measures may also be used as mitigating actions as required by ACTION c.Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY. Options for restoring the CR3 boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CR3 boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CR3 boundary has been restored to OPERABLE status.MILLSTONE -UNIT 3 B 3/4 7-16 Amendment No. .-34, _20-3, _206, O LBDCtR-07-MP3-033 June 25, 2007 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

References:

(1) Nuclear Regulatory Guide 1.52, Revision 2 (2) MP3 UFSAR, Table 1.8-1, NRC Regulatory Guide 1.52 (3) NRC Generic Letter 9 1-04 (4) Condition Report (CR) #M3-99-027 1 (5) NEI 99-03, "Control Room Habitability Assessment" (6) Letter from Eric 3. Leeds (NRC)'to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." 3/4.7.8 DELETED MILLSTONE -UNIT 3B3/7-7AedntN.4-6 B 3/4 7-17 Amendment No. LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE -UNIT 3 B 3/4 7-18 Amendment No. 4-36, 20-3, 2-1-9 NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK.ILLSTONE -UNIT. 3 B 3/4 7-19... Amendment No. 3-6, 2O-4, 24-9 NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK ..MILLSTONE -UNIT 3 B 3/4 7-20.Amendment No.4--36,4--84-, 20-3, 9 NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026 October 15, 2006* THIS PAGE INTENTIONALLY LEFT BLANK O -UNIT 3 B 3/4 7-21 Amendment No. 4-3~6, -2Ot-, -246 NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE TJN{IT 3 B 3/4 7-22.Amendment No. 4-36 NRC Verbal Acknowledgement: 07/05/07 LBDCR 12-MiP3-010 September 20, 2012 PLANT SYSTEMS BASES 3/4.7.9 AUXILIARY BUILDING FILTER SYSTEM The OPERABILITY of the Auxiliary Building Filter System, and associated filters and fans, ensures that radioactive materials leaking from the-~equipment within the charging pump, component cooling water pump and heat exchanger areas following a LOCA are filtered prior to reaching the environmnent. Periodic operation of the system with the heaters operating for at least 10 continuous hourns is sufficient to reduce the buildup of moisture on the ads orbers and 1-EPA filters. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The operation of thtis system and the resultant effect on offsite dosage calculations was assumed in the safety analyses. ANSI N510-1980 will be used as a procedural guide for surveillance testing. Laboratory testing of methyl iodide penetration shall be performed in accordance with ASTM D3 803-89 aind Millstone Untit 3 specific parameters. The heater kW measured must be corrected to its nameplate rating. Variations in system voltage can lead to measurements of kW which cannot be compared to the nameplate rating because the output kW is proportional to the square of the voltage.The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System is required to be available to support the Auxiliary Building Filter System and the Supplementaiy Leak Collection and Release System (SLCRS). The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System consists of two redundant trains, each capable of providing 100% of the required flow. Each train has a two position, "Off' and "Auto," remote control switch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the operating train. The associated fans do not receive any safety related automatic start signals (e.g. Safety Injection Signal).Placing the remote control switch for a Charging Pump/Reactor plant Component Cooling Water Pump Ventilation Train in the "Off' position to start the redundant train or to perform post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensure the remote control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use Of an approved procedure and a designated individual at the control switch for the respective Charging P~ump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respond to instructions from procedures, or control room personne, based on plant conditions. MILLSTONE -UNIT 3 B 3/4 7-23 Amendment No. &-7, 9, -!3, -!-84, LBDCR March 12, 2012 PLANT SYSTEMS BASES6 LCO 3.7.9 ACTION statement: With one Auxiliary Building Filter System inoperable, restoration to OPERABLE status within 7 days is required.The 7 days restoration time requirement is based on the following: The risk contribution is less for an inoperable Auxiliary Building Filter System, than for the charging pump or reactor plant component cooling water (RPCCW) systems, which have a 72 hour restoration time requirement. The Auxiliamyr Building Filter System is not a direct support system for the charging pumps or RPCCW pumps. Because the pump area is a colmmon area, and as long as the other train of the Auxiliary Building Filter System remains OPERABLE, the 7 day restoration timne limit is acceptable based on the low probability of a DBA occurring during the time period and the ability of the remaining train to provide the required capability. A concurrent failure of both trains would require entry into LCO 3.0.3 due to the loss of functional capability. The Auxiliary Building Filter System does support the Supplementary Leak Collection and Release System (SLCRS) and the LCO ACTION statement time of 7 days is consistent with that specified for SLCRS (See LCO 3.6.6.1).Any time the OPERABILITY of a I{EPA filter or charcoal adsorber housing has been affected by repail; maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. Surveillance Requirement 4.7.9.c O Surveillance requirement 4.7.9.c requires that after 720 hours of operation a charcoal sample must be taken and the sample must be analyzed within 31 days after removal.The 720 hours of operation requirement originates from Regulatory¢ Guide 1.52, Revision 2, March 1978, Table 2, Note "c", which states that "Testing should be perfonne~d (1) initially, (2)at least once per 18 months thereafter for systems maintained in a stanmdby status or after 720 hours of system operations, and (3) following painting, fire, or chemical release in any ventilation zone cormmunicating with the system." This testing ensures that the charcoal adsorbency capacity has not degraded below acceptable limits as well as providing trending data. The 720 hour figure is an arbitramyj numaber which is equivalent to a 30 day period. This criteria is directed to filter systems that are normally in operation and also provide emergency air cleaning functions in the event of a Design Basis Accident. The applicable filter units are not normaally in operation and sample canisters are typically removed due to the 18 month criteria.3/4.7.10 SNUJBBERS All snubbers are required OPERABLE to ensure that the structural integrity of the Reactor Coolant System and all other safety-related systems is maintained .during and following a seismic or other event initiating dynamic loads. For the purpose of declaring the affected system OPERABLE with the inoperable snubber(s), an engineering evaluation may be performed, in accordance with Section 50.59 of 10 CFR Part 50.MILLSTONE -UNIT 3 B 3/4 7-23 a Amendment No. 8-7-, 4-1--9, 4-1-6, -184 Q LBDCR 12-MP3-003 March 12, 2012 THIS PAGE INTENTIONALLY LEFT BLANK O@} MILLSTONE -UNIT 3 B 3/4 7-24 Amendment No. 4-6, -7,4-1-9, 43-6, LBDCR 12-MP3-003 March 12, 2012 PLANT SYSTEMS BASES 3/4.7.11 DELETED 314.7.14 DELETED 0/MILLSTONE -UNIT 3 B 3/4 7-25 Amendment Nos. g-g,--84, 4-1-, 4-19, 1362 14 LBDCR No. 04-MP3-015

• February 24, 2005 3/4.8 ELECTRICAL POWER SYSTEMS BASES I.: 3/4.8.1. 3/4.8.2 and 3/4.8.3 A.C. SOURCES, D.C. SOURCES, and ONSITE POWER DISTRIBUTION The OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety-related equipment required for: (1) the safe shutdown of the facility, and (2) the mitigation and control of accident conditions within the facility.

The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criterion 17 of Appendix A to 10 CFR Part 50.LCO 3.8.1.l.a LCO 3.8.1.1l.a requires two independent offsite power sources. With both the RSST and* the NSST available, either power source may supply power to the Vital busses to meet the intent of Technical Specification 3.8.1.1. The FSAR, and Regulatory Guide 1.32, 1.6, and 1.93 provide the basis for requirements concerning off-site power sources. The basic requirement is to have*two independent offsite power sources. The requirement to have a fast transfer is not Specifically stated. An automatic fast transfer is required for plants without a generator output trip breaker, where power from the NSST is lost on a turbine trip. The surveillance requirement for transfer from the nonnal circuit' to the alternate circuit is required for a transfer from the NS ST to the RSST in the event Of an electrical failure. There is no specific requirement to have an automatic transfer from the RSST to the NSST...S~i The ACTION requirements specified for the levels of degradation of the power sources;provide restriction upon continued facility operation commensurate with the level of degradation. The OPERBI-BLITY of the power sources are consistent with tche initi'al' conditiotn a~rpti'ons of the safety analy~ses anid are based upon. rnain~tainig at !east set of onsite AL., and.D.C. power sb~itees arid associa~ted' distrbtiofin systehs OPERABLE dturing accident conditions: coincident with an assumed loss-of-offsite power and single failure :of the other onsite A.C.source. The A.C. and D.C. source allowable out-of-service times are based in part on Regulatory Guide 1.93, "Availability of Electrical Power Sources," December 1974. Technical Specification 3.8.1.1 ACTION Statements b.2 and: c.2 provide an allowance to avoid unnecessary testing of the other OPERABLE diesel generator. If it can be determined that the cause of the inoperable diesel: generator does no~t exist on the OPERABLE diesel generator, Surveillance Requirement 4.8.1.1.2.a.5 does not have to be performed. If the cause of inoperability exists on the other OPERABLE diesel generator, the other OPERABLE diesel generator would be declared inoperable upon discovery, ACTION Statement

e. would be entered, and appropriate actions will be taken. Once the failure is corrected, the common cause failure no longer exists, and thle required ACTION Statements (b., c., and e.) will be satisfied.

If it can not be determined that the cause of the inoperable diesel generator* does not exist on the remaining diesel generator, performance of Surveillance Requirement 4.8.1.1 .2.a.5, within the allowed time period, suffices to provide assurance of continued OPERABILITY of the diesel generator. If the inoperable diesel generator is restored to OPERABLE status prior to the determination of the impact on the other diesel generator, evaluation will continue of the possible common cause failure. This continued evatuation is no O i MILLSTONE.- UNIT 3 B 3/4 8-1 Amendment No. 4-1-2,-1,-z0,* Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-01 5 February 24, 2005 3/4.8 ELECTRICAL POWER SYSTEMS BASES longer under the time constraint imposed while in ACTION Statements b.2 or c.2.The determination of the existence of a common cause failure that would affect the remaining diesel generator will require an evaluation of.the current failure and the applicability to the remaining diesel generator. Examples that would not be a common cause failure include, but are not limited to: 1. Preplanned preventative maintenance or testing; or 2. An inoperable support system With no potential common mode failure for the remaining diesel generator; or 3. An independently testable component with no potential common mode failure for the remaining diesel generator. 'When one diesel generator is inoperable, there is an additional ACTION requirement (b.3 and c.3) to verify that all required systems, subsystems, trains, compon~ents addevices, that depend on the remaining OPERABLE diesel generator as a source of emergency power, are also OPERABLE, and that the steam-driven auxiliary feedwater pump is OPERABLE. This requirement is intended to provide assurance that a loss-of-offsite power event will not result in a.complete loss of safety function of critical systems during the period One of the diesel generators is inoperable. The term, verify, as used in this context means to administratively check by examining logs or other information to determine if certain components are out-of-service for maintenance or other reasons. It does not mean to perform the Surveillance Requirements needed to demonstrate the OPERABILITY of the component. if one Mill~triie Uniit No iS3 diesl Nisinoperaible ini MODES 1 tlhroutghi 4, a 72 hour allowed outa~ge time :is :provcided by.ACTQNStat~emt to~allowi restoratiori

of the diesel generator, provided" the requirements oi ACTION Statements bi~l, b.2, and b.l3 ar-e met. This allowed outage time can be extended to 14 days if the additional requirements contained in ACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that the Millstone Unit No. 2 diesel generators are OPERABLE as required by the applicable Millstone Unit No. 2 Technical Specification (2 diesel generators in MODES 1 through 4, and 1 diesel generator in MODES 5 and 6) and the Millstone Unit No. 3 SBO diesel generator is available.

The term verify, as used in this context, means to administratively check by examining logs or other information to determine if the required Millstone Unit No. 2 diesel generators 'and the.Millstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. It does not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITY of the required Millstone Unit No. 2 diesel generators or availability of the Millstone Unit No. 3 SBO diesel generator. When using the 14 day allowed outage time provision and the Millstone Unit No. 2 diesel generator requirements and/or Millstone Unit No. 3 SBO diesel generator requirements .are not met, 72 hours is allowed for restoration of the required Millstone Unit No. 2 diesel generators and the Millstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 2 diesel generators and/or Millstone Unit No. 3 SBO diesel generator are not restored Within 72 hours, and one Millstone Unit No. 3 diesel generator is still inoperable, Millstone Unit No. 3 is required to shut down.MILLSTONE -UNIT 3 B 3/4 8-l a Amendment No.14-t-,24-0, Acknowledged by NRC letter dated 08/25/05 LBDCR 14-MP3-013 October 16, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES The 14 day allowed outage time for one inoperable Millstone Unit No. 3 diesel generator will allow perfonrmance of extended diesel generator maintenance and repair activities (e.g., diesel inspections) while the plant is operating. To minimize plant risk when using this extended allowed outage time the following additional Millstone Unit No. 3 requirements must be met: 1) The charging pump and charging pump cooling pump in operation shall be powered from the bus not associated with the out of service diesel generator. In addition, the spare charging pump will be available to replace an inservice charging pump if necessary.

2) The extended diesel generator outage shall not be scheduled when adverse or inclement weather conditions and/or unstable grid conditions are predicted or present.3) The availability of the Millstone Unit No. 3 SBO DG shall be verified by test performance within 30 days prior to allowing a Millstone Unit No. 3 EDG to be inoperable for greater than 72 hours.4) All activity in the switchyard shall be closely monitored and controlled.

No elective maintenance within the switchyard that could challenge offsite power availability shall be scheduled.

5) A contingency plan shall be available (OP 33 14J, Auxiliary Building Emergency Ventilation and Exhaust) to provide alternate room cooling to the charging and CCP pump area (24' 6" Auxiliary Building) in the event of a failure of the ventilation system prior to commencing an extended diesel generator outage.In addition, the plant configuration shall be controlled during the diesel generator maintenance and repair activities to minimize plant risk consistent with the Configuration Risk Management Program, as required by 10 CFR 50.65(a) (4).The OPERABILITY of the minimum specified A.C. and D.C.. power sources and associated distribution systems during shutdown and REFUELING ensures that: (1) the facility can be maintained in the shutdown or REFUELING condition for extended time periods, and (2)sufficient instrumentation and control capability is available for monitoring and maintaining the unit status.The Surveillance Requirements for demonstrating the OPERABILITY of the diesel generators are in accordance with the recommendations of Regulatory Guides 1.9, "Selection of Diesel Generator Set Capacity for Standby Power Supplies," March 10, 1971; 1.108, "Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants," Revision 1, August 1977; and 1.137, "Fuel-Oil Systems for Standby Diesel Generators," Revision 1, October 1979. The surveillance frequencies for demonstrating OPERABILITY of the diesel generators are in accordance with the Surveillance Frequency Control Program.LCO 3.8.1.1 ACTION statement b.3 and c.3 Required ACTION Statement b.3 and c.3 requires that all systems, subsystems, trains, components, and devices that depend on the remaining OPERABLE diesel as a source of emergency power be verified OPERABLE.MILLSTONE

-UNIT 3 B 3/4 8-lb Amendment No. 1-1-2., , LBDCR 12-MP3-010 September 20, 2012 3/4.8 ELECTRICAL POWER SYSTEMS BASES 3/4.8.1, 3/4.8.2, and 3/4.8.3 A.C. SOURCES, D.C. SOURCES, AND ONSITE POWER DISTRIBUTION Technical Specification 3.8.1.1 .b. 1 requires each of the diesel generator day tanks contain a minimum volume of 278' gallons. Technical Specification 3.8.1 .2.b.l requires a minimum volume of 278 gallons be contained in the required diesel generator day tank. This capacity ensures that a minimum usable volume of 189 gallons is available. This volume permits operation of the diesel generators for approximately 27 minutes with the diesel generators loaded to the 2,000 hour rating of 5335 kw. Each diesel generator has two independent fuel oil transfer pumps. The shutoff level of each fuel oil transfer pump provides for approximately 60 minutes of diesel generator operation at the 2000 hour rating. The pumps start at day tank levels to ensure the minimum level is maintained. The loss of the two redundant pumps would cause day tank level to drop below the minimum value.Technical Specification 3.8.1.1i .b.2 requires a minimum volume of 32,760 gallons be contained in each of the diesel generator's fuel storage systems. Technical Specification 3.8.1 .2.b.2 requires a minimum volume of 32,760 gallons be contained in the required diesel generator's fuel storage system. This capacity ensures that a minimum usable volume (29,180 gallons) is available to permit operation of each of the diesel generators for approximately three days with the diesel generators loaded to the 2,000 hour rating of 5335 kW. The ability to cross-tie the diesel generator fuel oil supply tanks ensures that one diesel generator may operate up to approximately six days.Additional fuel oil can be supplied to the site within twenty-four hours after contacting a fuel oil supplier.Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power source and distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit Safety systems.Surveillance Requirements 4.8.1.1.2.a.6, 4.8.1.1.2.b.2, and 4.8.1.1.2.j The Surveillances 4.8.1.l.2.a.6 and 4.8.l.1.2.b.2 verify that the diesel generators are capable of synchronaizing with the offsite electrical system and loaded to greater than or equal to continuous rating of the machine. A minimum time of 60 minutes is required to stabilize engine temperatures, wlhile MILLSTONE -UNIT 3 MILSTOE UM 3B 3/4 8-ilc Amendment No. 9-7, -I4t-, -t-3-7, 4-94, 24-Q, 2-LBDCR 12-MIP3-010 September 20, 2012 3/4.8 ELECTRICAL POWER SYSTEMS BASES minimizing the time that the diesel generator is connected to the offsite source. Surveillance Requirement 4.8.1.1 .2.j requires demonstration that the diesel generator can start and run continuously at full load capability for an interval of not less than 24 hours, _ 2 hours of which are at a load equivalent to 110% of the continuous duty rating and the remainder of the time at a load equivalent to the continuous duty rating of the diesel generator. The load band is provided to avoid routine overloading of the diesel generator. Routine overloading may result in more fr'equent teardown inspections in accordance with vendor recommendations in order to maintain diesel generator OPERABILITY. The load band specified accounts for instrumentation inaccuracies, operational control capabilities, and human factor characteristics. The note (*)acknowledges that a mnomentatmy transient outside the load range shall not invalidate the test. The surveillance flequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.8.1 .1.2.a.5, 4.8.1.1 .2.b.1, 4.8.1.1.2.g.4.b, 4.8.1.1.2.g.5, and 4.8.1.1.2.g.6.b Several diesel generator surveillance requirements specify that the emergency diesel generators are started from a standby condition. Standby conditions for a diesel generator means the diesel engine coolant and lubricating oil are being circulatced and temperatures are maintained within design ranges. Design ranges for standby temperatures are greater than or equal to the low temperature alann setpoints and less than or equal to the standby "keep-wanln" heater shutoff temperatures for each respective sub-system. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.8.1.1 .2.j The existing "standby condition" stipulation contained in specification 4.8.1.1 .2.a.5 is superseded when performing the hot restart demonstration required by 4.8.1.1 .2.j.Any time the OPERABILITY of a diesel generator haes been affected by repair, maintenance, or replacement activity, or by modification that could affect its interdependency, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B 3/4 8-1d MILLTO1SE -UNIT3 B3/4 -idAmendment No. 9-7-, 14-2, 4-3-7, 1-94, 4-0 LBDCR 12-MP3-010 September 20, 2012 ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES. D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued) The Surveillance Requirement for demonstrating the OPERABILITY of the station batt~eries are based on the recommendations of Regulatory Guide 1.129, "Maintenance Testing and Replacement of Large Lead Storage Batteries for Nuclear Power Plants," February 1978, and IEEE Std 450-1975 & 1980, "IEEE Recolmmended Practice for Maintenance, Testing, and Replacement of Large Lead Storage Batteries for Generating Stations and Substations." Sections 5 and 6 of IEEE Std 450-1980 replaced Sections 4 and 5 oflIEEE Std 450-1975. Guidance on bypassing weak cells, if required, is in accordance with section 7.4 of IEEE 450-2002. The balance of IEEE Std 450-1975 applies. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Verifying average electrolyte temperature above the minimum for which the battery was sized, total battery terminal voltage on float charge, connection resistance values, and the performance of battery service and discharge tests ensures the effectiveness of the charging system, the ability to handle high discharge rates, and compares the battery capacity at that time with the rated capacity.Table 4.8-2a specifies the normal limits for each designated pilot cell and each connected cell for electrolyte level, float voltage, and specific gravity. The limits for the designated pilot cells float voltage and specific gravity, greater than 2.13 volts and 0.015 below the manufacturer's full charge specific gravity or a battery charger current that had stabilized at a low val[ue, is characteristic of a charged cell with adequate capacity. The nonnal limits for each connected cell for float voltage and specific gravity, greater than 2.13 volts and not more than 0.020 below the manufacturer's full charge specific gravity with an average specific gravity of all the connected cells not more than 0.010 below the manufacturer's full charge specific gravity,.ensures the OPERABILITY and capability o~f the battery. with a battery cell's parameter outside the normal limit but within the allowable value specified in Table 4.8-2a is permitted for up to 7 days. During this 7-day period: (l)the allowable values for electrolyte level ensures no physical damage to the plates with an adequate electron transfer capability; (2) the allowable value for the average specific gravity of all the cells, not more than 0.020 below the manufacturer's recommended full charge specific gravity, ensures that the decrease in rating will be less than the safety margin provided in sizing; (3) the allowable value for an individual cell's specific gravity, ensures that an individual cell's specific gravity will not be more than 0.040 below the manufacturer's full charge specific gravity and that the overall capability of the battery will be maintained within an acceptable limit; and (4) the allowable value for an individual cell's float voltage, greater than 2.07 volts, ensures the battery's capability to perform its design function.If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6, operations involving CORE ALTERATIONS, positive reactivity changes, movem-ent of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the MIfLLSTONE -UNIT 3B348-AmnetNo B 3/4 8-2 Amenchnent No. LB3DCR 10-MP3-003 February 23, 2010 ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES. D.C. SOURCES. and ONSITE POWER DISTRIBUTION (Continued) previous 350 hours*), crane operation with loads over the fuel storage pooi, or operations with a potential for draining the reactor vessel are required to be suspended. 3/4.8.4 DELETED I*During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.MILLSTONE -UNIT 3 B 3/4 8-3 MILSTOE UNT 3B /4 -3Amendment No. , 89, -I-5-3, 4-7-, 49-2, REVERSE OF PAGE B 3/4 8-3 INTENTIONALLY LEFT BLANK 06/28/06 3/4.9 REFUELING OPERATIONS BASES --. .. ..3/4.9.1 BORON CONCENTRATION The limitations on reactivity conditions during REFUELING ensure that: (1) the reactor will remain subcritical during CORE ALTERATIONS, and (2) a uniform boron concentration is maintained for reactivity control in the water volume having direct access to the reactor vessel, The value of 0.95 or less for Keff includes a 1% Ak/k conservative allowance for uncertainties. Similarly, the boron concentration value specified in the CORE OPERATING LIMITS REPORT includes a conserx~ative uncertainty allowance of 50 ppm boron. The boron concentration, specified in the CORE OPERAT[NG LIMITS REPORT, provides for boron concentraition measurement uncertainty between the spent fuel pool and the RWST. The locking closed of the.required valves during refueling operations precludes the possibility of uncontrolled boron dilution of the filled portion of the RCS. This action prevents flow to the RCS of unborated water by closing flow paths from sources of unborated water.MODE ZERO shall be the Operational MODE where all fuel assemblies have been removed from containment to the Spent Fuel Pool. Technical Specification Table 1.2 defines MODE 6 as "Fuel in the reactor vessel with the vessel head closure bolts less than fully tensioned or with the head removed." With no fuel in the vessel the definition for MODE 6 no longer applies. The transition from MODE 6 to MODE ZERO occurs when the last fuel assembly of a full core off load has been transferred to the Spent Fuel Pool and has cleared the transfer canal while in transit to a storage location. This will:* Ensure Technical Specifications regarding sampling the transfer canal boron concentration are observed (4.9.-1.1.2);.

• Ensure that MODE 6 Technical Specification requirements are not relaxed prematurely during fuel movement in containment.

Concerning ACTION a., suspension of CORE ALTERATIONS and positive reactivity additions shall not preclude moving a component to a safe position. Operations that individually add limited positive reactivity (e.g., temperature fluctuations from inventory addition or temperature control fluctuations) but when combined with all other operations affecting core reactivity (e.g., intentional boration) result in overall net negative reactivity addition, are not precluded by this action.MILLSTONE -UNIT 3 B 3/4 9-1 MiLLSONE -UNIT B 3/ 9-1Amendment No. , 60, 14-8, 41-9, 230 LBDCR No. 10-MP3-006 March 9, 2010 3/4.9 REFUELING OPERATIONS BASES 3/4.9.1.2 BORON CONCENTRATION [N SPENT FUEL POOL During normal Spent Fuel Pool operation, the spent fuel racks are capable of maintaining Keff at less than or equal to 0.95 in an unborated water environment. This is accomplished in Region 1, 2, and 3 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers in some fuel storage regions, the limits on fuel burnup, fuel enrichment and minimum fuel decay time, and the use of blocking devices in certain fuel storage locations. The boron requirement in the spent fuel pool specified in 3.9.1.2 ensures that in the event of a fuel assembly handling accident involving either a single dropped or misplaced fuel assembly, the Keff of the Spent fuel storage racks will remain less than or equal to 0.95.3/4.9.2 INSTRUMENTATION The source range neutron flux monitors are used during refueling operations to monitor the core reactivity condition. The installed source range-neutron flux monitors are part of the Nuclear Instrumentation System (NIS). These detectors are located external to the reactor vessel and detect neutrons leaking from the core.There are two sets of source range neutron flux monitors: (1) Westinghouse source range neutron flux monitors, and (2) Gamma-Metrics source range neutron flux monitors.The Westinghouse monitors are the normal source range monitors used during refueling*activities. Gamma-Metrics source range neutron flux monitors are an acceptable equivalent control room indication for the Westinghouse source range neutron flux Monitors in MODE 6, including CORE Alterations, as follows: with the core in place within the reactor vessel or, with the Gamma Metrics source range neutron flux monitor(s) coupled to the core.Reactor Engineering shall determine whether each monitor is coupled to the core.This limiting condition for operation requires two source range neutron flux. monitors be OPERABLE to ensure that redundant monitoring capability is available to detect changes in core reactivity. To be OPERABLE, each monitor must provide visual indication in the control room. In addition, at least one of the two monitors must provide an OPERABLE audible count rate function in the control room and containment. MILLSTONE -UNIT 3 B 3/4 9-la Amendment No. 42, 60, 4-58, -204, 21-9, 2T3 LBDCR No. 1 0-MP3-006 March 9, 2010 3/4.9 REFUEL[NG OPERATIONS BASES The limiting condition for operation is satisfied .with either two Westinghouse source range neutron flux monitors OPERABLE, or with any combination that contains one OPERABLE Westinghouse source range neutron flux monitor (to provide audible indication) and one OPERABLE Gamma-Metrics source range neutron flux monitor that is coupled to the core.With only one Westinghouse source range neutron flux monitor OPERABLE and no Gamma-Metrics source range neutron flux monitors oPERABLE, ACTION a. must be entered.With both Westinghouse source range neutron flux monitors inoperable and one or more Gamma-Metrics source range neutron flux monitors OPERABLE and coupled to the core, ACTIONb.must be entered, since the Gamma-Metrics source range neutron flux monitors are incapable of providing audible indication in the containment. Concemning ACTION a., with only one of the required source range neutron flux monitor" OPERABLE, redundancy has been lost.. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with borOn concentration less than required to meet the minimum boron concentration of LCO 3.9.1.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Performance of ACTION a. shallnot preclude completion of movement of a component to a safe position.3/4.9.3 DECAY TIME The minimum requirement for reactor subcriticalityprior to movement of irradiated fuel assemblies in the reactor vessel ensures that sufficient time has elapsed to allow the radioactive decay of the short-lived fission products. This decay time is consistent with the assumptions used in the safety analyses.MILLSTONE -UNIT 3 B349l B 3/4 9-1b LBDCR No. 10-MP3-006 March 9, 2010 3/4.9 REFUIELING OPERATIONS BASES 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS S The requirements on containment penetration closure and OPERABILITY ensure that a release of radioactive material within containment to the environment will be minimized. The OPERABILITY, closure restrictions, and administrative controls are sufficient to minimize the release of radioactive material from a fuel element rupture based upon the lack of containment pressurization potential during the movement of fuel within containment. The containment purge valves are containment penetrations and must satisfy, all requirements specified for a containment penetration. ,: This specification is applicable during the movement of new and spent fuel assemblies within the containment building. The fuel handling accident analyses assume that during a fuel handling accident some of the fuel that is dropped and some of the fuel impacted upon is damaged.Therefore, the movement of either new or irradiated fuel can cause a fuel handling accident, and this specification is applicable whenever new or irradiated fuel is moved within the containment. Containment penetrations, including the personnel access hatch doors and equipment access hatch, can be open during the movement of fuel provided that sufficient administrative controls are in place such that any 0f these containment penetrations can be closed within 30 minutes.Following a Fuel Handling Accident, each penetration, including the equipment access hatch, is closed such that a containment atmosphere boundary can be established. However, if it is determined that closure of all containment penetrations would represent a significant radiological hazard to the personnel involved, the decision may be made to forgo the closure of the affected penetration(s). The containment atmosphere boundary is established when any penetration which provides direct access to the outside atmosphere is closed such that at least one barrier between the containment atmosphere and the outside atmosphere is established. Additional actions beyond establishing the containment atmosphere boundary, such as installing flange bolts for the equipment access hatch or a containment penetration, are not necessary. Administrative controls for opening a containment penetration require that one or more designated persons, as needed, be available for isolation of containment from the outside atmosphere. Procedural controls are also in place to ensure cables or hoses which pass through a containment opening can be quickly removed. The location of each cable and hose isolation device for those cables and hoses which pass through a containment opening is recorded to ensure timely closure of the containment boundary. Additionally, a closure plan is developed for each containment opening which includes an estimated time to close the containment opening. A log of personnel designated for containment closure is maintained, including identification of which containment openings each person has responsibility for closing. As necessary, equipment will be pre-staged to support timely closure of a containment penetration. MILLSTONE -UNIT 3 B349I mnmn o 3 B 3/4 9-1c Amendment No. [ March 17, 2004 3/4.9 REFUELING OPERATIONS BASES 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS (Continued) The ability to close the equipment access hatch penetration within 30 minutes is verified each refueling outage prior to the first fuel movement in containment with the equipment access hatch open. Prior to opening a containment penetration, a review of containment penetrations currently open is performed to verify that sufficient personnel are designated such that all containment penetrations can be closed within 30 minutes. Designated personnel may have other duties, however, they must be available such that their assigned containment openings can be closed within 30 minutes. Additionally, each new work activity inside containment is reviewed to consider its effect on the closure of the equipment access hatch, at least one personnel access hatch door, and/or other open containment penetrations. The required number of designated personnel are continuously available to perform closure of their assigned containment openings whenever fuel is being moved within the containment. Controls for monitoring radioactivity within containment and in effluent paths from containment are maintained consistent with General Design Criterion

64. Local area radiation monitors, effluent discharge radiation monitors, and containment gaseous and particulate radiation monitors provide a defense-in-depth monitoring of the containment atmosphere and effluent releases to the environment.

These monitors are adequate to identify the need for establishing the containment atmosphere boundary. When containment penetrations are open during a refueling outage under administrative control for extended periods of time, routine grab samples of the containment atmosphere, equipment access hatch, and personnel access hatch will be required.The containment atmosphere is monitored during normal and transient operations of the reactor plant by the containment structure particulate and gas monitor located in the upper level of the Auxiliary Building or by grab sampling. Normal effluent discharge paths are monitored duirirng plant operation by the ventilation particulate samples and gasmonitors in the Auxiliary Building.,Administrative controls are also in place to ensure that the containment atmosphere boundary is established if adverse weather conditions which could present a potential missile hazard threaten the plant. Weather conditions are monitored during fuel movement whenever a containment penetration, including the equipment access hatch and personnel access hatch, is open and a storm center is within the plant monitoring radius of 150 miles.The administrative controls ensure that the containment atmosphere boundary can be quickly established (i.e. within 30 minutes) upon determination that adverse weather conditions exist which pose a significant threat to the Millstone Site. A significant threat exists when a hurricane warning or tornado warning is issued which applies to the Millstone Site, or if an average wind speed of 60 miles an hour or greater is recorded by plant meteorological equipment at the meteorological tower. If the meteorological equipment is inoperable, information from the National Weather Service can be used as a backup in determining plant wind speeds. Closure of containment penetrations, including the equipment access hatch penetration and at least one personnel access hatch door, begin immediately upon determination that a significant threat exists.MILLSTONE -UNIT 3 B 3/4 9-2 MILLTON -NIT3 B3/49-2Amendment No, 4-9-7-, 219 LBDCR 04-MP3-013 November 29, 2004 3/4.9 REFUELING OPERATIONS BASES 3/4.9.5 DELETED 3/4.9.6 DELETED 3/4.9.7 DELETED 3/4.9.8 RESIDUAL HEAT REMOVAL AND COOLANT CIRCULATION 3/4.9.8.1 HIGH WATER LEVEL BACKGROUN.D The purpose of the Residual Heat Removal (RH-R) System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant and to prevent boron stratification. Heat is removed fr'om the RCS by circulating reactor coolant through the RHR heat exchanger(s), where the heat is transferred to the Reactor Plant Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR system for normal cooldown or decay heat removal is manually accomplished from the control room. The heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR system.MILLSTONE -UNIT 3 B 3/4 9-2a Amendment No. 2-1-, Acknowledged by NRC Letter dated 04/12/06 06/28/06 3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.1 Ii-UGH WATER LEVEL (continued) APPLICABLE SAFETY ANALYSES If the reactor coolant temperature is not maintained below 200°F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant would eventually challenge the integrity of the fuel cladding, which is fission product barrier. One train of the RHR system is required to be operational in MODE 6, with the water level > 23 ft above the top of the reactor vessel flange to prevent this challenge. The LCO does permit deenergizing the RI-R pump for short durations, under the conditions that the boron concentration is not diluted. This conditional deenergizing of the RHR pump does not result in a challenge to the fission product banrier.APPLICABILITY One RI-R loop must be OPERABLE and in operation in MODE 6, with the water level _ 23 ft above the top of the reactor vessel flange, to provide decay heat removal. The 23 ft level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.10, "Water Level -- Reactor Vessel." Requirements for the RH-R system in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency Core Cooling Systems (ECCS). RHiR loop requirements in MODE 6 with the water level < 23 ft are located in LCO 3.9.8.2, "Residual Heat Removal (RHR) and Coolant Circulation--Low Water Level." LIMITING CONDITION FOR OPERATION The requirement that at least one RHR loop be in operation ensures that: (1) sufficient cooling capacity is available to remove decay heat an maintain the water in the reactor vessel below 140°F as required during the REFUELING MODE, and (2) sufficient coolant circulation is maintained through the core to minimize the effect of a boron dilution incident and prevent stratification. An OPERABLE RHR loop includes an RIIR pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path. An operating RI-R flow path should be capable of determining the low-end temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs.The LCO is modified by a Note that allows the required operating RHR loop to be removed from operation for up to 1 hour per 8 hour period, provided no operations are permitted that would dilute the RCS boron concentration by introduction of coolant into the RCS with boron concentration less than required to meet the minimaum boron concentration of LCO 3.9.1.1I.Boron concentration reduction with coolant at boron concentrations less than required to assure the RCS boron concentration is maintained is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RI-R isolation valve testing. During this 1 hour period, decay heat is removed by natural convection to the large mass of water in the refueling cavity.MILLSTONE -UNIT 3 B 3/4 9-3 MILLTONE-UIT 3B 3/9-3Amendment No. 4-1-7-, _2--9-, 230 LBDCR 12-MP3-01i0 September 20, 2012 3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.1 HIGH WATER LEVJEL (continued) ACTIONS RHR loop requirements are met by haying one RER loop OPERABLE and in operations, except as penmitted in the Note to the LCO.If RHR ioop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimnum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. If RHR loop requirements are not met, actions shall be taken immediately to suspend loading of irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core.A minimumn refueling water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase decay heat load, such as loading a fuel assembly, is a prudent action under this condition. If RI-R loop requirements are not met, actions shall be initiated and continued in order to satisfy RI-R loop requirements. With the unit in MODE 6 and the refueling water level >_ 23 ft above the top of the reactor vessel flange, corrective actions shall be initiated immediately. If RtRR loop requirements are not met, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours. With the RK-R loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures dose limits are not exceeded.The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boiling in that time.Surveillance Requirement This Surveillance demonstrates that the RI-R loop is in operation and circulating reactor coolant.The flow rate is deternined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B 3/4 9-4 MILLTONE-UNT 3 3/49-4Amendment No. 44)-7, 2a-1-9-, 2 April 12, 1995.BASES 3/4.9.8.2 LOW WATER LEVEL BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant, and to prevent boron stratification. Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass lines. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR system.APPLICABLE SAFETY ANALYSES If the reactor coolant temperature is not maintained below 200°F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to the boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant will eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two trains of the RIIR System are required to be OPERABLE, and one train in operation, in order to prevent this challenge. LIMITING CONDITION FOR OPERATION In MODE 6, with the water leveI< 23 ft above the top of the reactor vessel flange, both RHR loops must be OPERABLE. Additionally, one loop of RUR must be in operation in order to provide: a. Removal of decay heat;b. Mixing of borated coolant to minimize the possibility of criticality; and c. Indication of reactor cooling temperature. The requirement to have two RHIR loops OPERABLE when there is less than 23 feet of water above the reactor vessel flange ensures that a single failure of the operating RHR loop will not result in a complete loss of residual heat removal capability. With the reactor vessel head removed and at least 23. feet of water above the reactor pressure vessel flange, a large heat sink is available for core cooling. Thus, in the event of a failure of the operating RHR loop, adequate time is provided to initiate emergency procedure to cool the core.MILLSTONE -UNIT 3"B34- mnmn o 0 B 3/4 9-5 Amendment No. 107 06/28/06 3/4.9 REFUELING OPERATIONS[ BASES 3/4.9.8.2 LOW WATER LEVEL (continued) An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path. An operating RHR flow path should be capable of determining the low end temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs.APPLICABILITY Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation in MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to proviide decay heat removal. Requirements for the RHR System in other MODES are covered by LCOs in Section 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level _ 23 ft are located in LCO 3.9.8.1, "Residual Removal (RHR) AND Coolant Circulation--High WCater Level." ACTIONS a. If less than the required number of RI-R loops are OPERABLE, actions shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status and to operation, or until _ 23 ft of water level is established above the reactor vessel flange. When the water level is _ 23 ft above the reactor vessel flange, the Applicability changes to that of LCO 3.9.8.1, and only one RHIR loop is required to be OPERABLE and in operation. An immediate Completion Time is necessary for an operator to initiate corrective action.b. If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a, boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. If no RH-R loop is in operation, actions shall be initiated immediately, and continued, to restore.one RHR loop to operation. Since the unit is in ACTIONS 'a' and 'b' concurrently, the restoration of two OPERABLE RITR loops and one operating RH-R loop should be accomplished expeditiously. If no RtHR loop is in operation, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures that dose limits are not exceeded.MILLSTONE -UNIT 3 B 3/4 9-6 MILSTNE UIT B3/4-6Amendment No. 230 LBDCR 12-IvP3-010 September 20, 2012 3/4.9 REFUELING OPERATIONS BASES The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boiling in that time.Surveillance Requirement This Surveillance demonstrates that one RIIR loop is in operation and circulating reactor coolant.The flow rate is detennined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. In addition, during operation of the RHR loop with the water level in the vicinity of the reactor vessel nozzles, the RHR pump suction requirements must be met. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B 3/4 9-7 MILLTON -NIT3 B3/49-7Amendment No. 4-05, 49-l-, 23-0 LIBDCR No. 06-MP3-026 October 15, 2006+3/4.9 R FiFITFLFNG OPER ATiONS BASES 3/4.9.10 AND 3/4.9.11 WATER LEVEL -REACTOR VES SEL AND STORAGE POOL The restrictions on minimum water level ensure that sufficient water depth is available to remove at least 99% of the assumed iodine gap activity released from the rupture of an irradiated fuel assembly. The minfimum water depth is consistent with the assumptions of the safety analysis.MILLSTONE -UNIT 3 13 3/4 9-8 Amendment No. 3?-9, -!-0-7, 4-58, 4-84-, -I-89,-20-., 24t-9 NRC Verbal Ackn~owledgement: 07/05/07 LBDCR No. 07-MiP3-037 July 12, 2007 REFUELING OPERATIONS BASES 3/4.9.13 SPENT FUEL POOL -REACTIVTY During normal spent fuel pool operation, the spent fuel racks are capable of maintaining Keff at less than or equal to 0.95 in an unborated water environment. Maintaining Keff~ at less than or equal to 0.95 is accomplished in Region 1 3-OUT-OF-4 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers in the racks, a maximum nominal 5 weight percent fuel enrichment, and the use of blocking devices in certain fuel storage locations, as specified by the interface requirements shown in Figure 3.9-2.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 1 4-OUT-OF-4 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers in the racks, and the limits on fuel enrichment/fuel burnup specified in Figure 3.9-1.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 2 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers in the racks, and the limits on fuel enrichment/fuel burnup and fuel decay time specified in Figure 3.9-3.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 3 storage racks by the combination of geometry of the rack spacing, and the limits on fuel enrichment/fuel burnup and fuel decay time specified in Figure 3.9-4 for assemblies used exclusively in the pre-uprate ](3411 Mwt) cores and Figure 3.9-5 for assemblies used in the post-update (3650 Mwt) cores.Fixed neutron absorbers are not credited in the Regioni 3 fuel storage racks.The limitations described by Figures 3.9-1, 3.9-2, 3.9-3, 3.9-4, and 3.9-5 ensure that the [reactivity of the fuel assemblies stored in the spent fuel pool are conservatively within the assumptions of the safety analysis.Administrative controls have been developed and instituted to verif~y that the fuel enrichment, fuel bumup, fuel decay times, and fuel interface restrictions specified in Figures 3.9-1, 3.9-2, 3.9-3, 3.9-4, and 3.9-5 as well as restrictions specified in the Note on Figures 3.9-3 and 3.9-5 are complied with.3/4.9.14 SPENT FUEL POOL -STORAGE PATTERN The limitations of this specification ensure that the reactivity conditions of the Region 1 3-OUT-OF-4 storage racks and spent fuel pool keff will remain less than or equal to 0.95.The Cell Blocking Devices in the 4th location of the Region 1 3-OUT-OF-4 storage racks are designed to prevent inadvertent placement and/or storage of fuel assemblies in the blocked locations. The blocked location remains empty to provide the flux trap to maintain reactivity control for fuel assemblies in adjacent and diagonal locations of the STORAGE PATTERN.STORAGE PATTERN for the Region 1 storage racks will be established and expanded from the walls of the spent fuel pool per Figure 3..9-2 to ensure definition and control of the Region 1 3-OUT-OF-4 Boundary to other Storage Regions and minimize the number of boundaries where a fuel misplacement incident can occur.MILLSTONE -UNIT 3 MILSTOE -UNI 3B 3/4 9-9 Amendment No. :39, 410-5, 4lOg, -8, 4189, 2O-REVERSE OF PAGE B 3/4 9-9 INTENTIONALLY LEFT BLANK 3/4.10 SPECIAL TEST EXCEPTIONS July 30, 2002 BASES 3/4.10.1 SHUTDOWN MARGIN This speci~altest,.ex~ception provides that..a minimum amount, of control rod worth is immedia~tely..available for reactivity control, when~tests are performed. for control rod worth, measurement.. Thi~s..sPecial .test exception .is requi~red to permit the periodicvyeri~fication of the actual versus predicted core reactivity condition occurring as.a result-of fuel .burnup or fuel cycling operations. 3/4.10.2 GRouP HEIGHT, INSERTION, AND POWER DISTRIBUTION LIMITS.This special .test except~ion, permits ind~ividual control .rods to be positioned-outside of their normal.-group: heights. and i~nsertion limits during the performance. of such PHYSICS TESTS as those required to: (1) measure control rod. worth, and (2) determine the reactor stability index and damping factor under xenon oscillation, condi~tions.i " ..""-3/4.10.3 PHYSICS TESTS This special test exception permits PHYSICS TESTS to be performed at less than or equal to 5% of RATED THERMAL POWER with. the RCS Tavg slightly lower than normally allowed so that the fundamental nuclear characteristics of the core and related instrumentation can be verified.. In order for various cha~rac-teristics t~o be accurately measured, it *is at times necessary to operate outside the normal restrictions of these Technical Specifications. For instance, to measure the moderator temperature coefficient at BOL, it is necessary to position the various control rods at heights which may not normally be allowed by Specification 3.1.3.6 which in turn may cause the RCS ITv to fall slightly below the minimum temperature of Specification 3.1.1.4.3/4.10.4 REACTOR COOLANT LOOPS This special test exception permits reactor criticality under no flow conditions and is required to perform certain STARTUP and PHYSICS TESTS while at low THERMAL POWER levels.3/4.10.5 DELETED MILLSTONE -UNIT 3 B 314 10-I MILLTON -NIT B /4 0-1Amendment No. 7J7, 207 Juiy 30, 200-2 THIS PAGE INTENTIONALLY LEFT BLANK MILLTON -NIT B /4 0-2Amendment No. XJ7, 207~i MILLSTONE -UNIT 3 B 3/4 10-2 November 28, 2000 3/4.11 DELETED BASES 3/4.11.1 -DELETED 3/4.11.2 -DELETED 3/4/11/3 -DELETED MILLSTONE -UNIT 3 B341- mnmn o 8 B 3/4 11-1 Amendment No= 188 ZUUUJ This page intentionally left blank MILLSTONE -UNIT 3 B341- mnmn o 8 B 3/4 11-2 Amendment NOo 188 November 28, 2000 This page intentionally left blank MILLSTONE -UNIT 3 B 3/4 11-3 MILL TON -NIT B /4 1-3Amendment No. , 188 REVERSE OF PAGE B 3/4 11-3 INTENTIONALLY LEFT BLANK . Dominion Nuclea Connecticut, Inc.Rope Ferry Rd., Waterford, CT 06385omn n Mailing Address: P.O. Box 128" Waterford, CT 06385 dom. com FEB 2 32016 U. S. Nuclear Regulatory Commission Serial No. 16-078 Attention: Document Control Desk NSS&LIWEB R0 Washington, DC 20555 Docket No. 50-336 50-423 License No. DPR-65, NPF-49 ': DOMINION NUCLEAR CONNECTICUT. INC.MILLSTONE POWER STATION UNITS 2 AND 3 CHANGES TO TECHNICAL SPECIFICATION BASES In accordance with the requirements of Millstone Power Station Unit 2 (MPS2)Technical Specification (TS) 6.23.d and Millstone Power Station Unit 3 (MPS3)TS 6.18.d, Dominion Nuclear Connecticut, Inc. (DNC) is providing the Nuclear Regulatory Commission (NRC) with changes to the MPS2 and MPS3 TS Bases.DNC is submitting a complete copy of the TS Bases for both MPS2 and MPS3.These TS Bases are provided for information only. Any changes to the Bases sections were made in accordance with the provisions of 10 CFR 50.59. These changes have been reviewed and approved by the Facility Safety Review Committee. Attachments 1 and 2 provide the TS Bases in their entirety for MPS2 and MPS3, respectively. If you have any questions or require additional information, please contact Mr.Thomas G. Cleary at (860) 444-4377.Sincerely, .-B. L. Stanley Director -Nuclear Station and Licensing Serial No. 16-078 Docket Nos. 50-336 and 50-423 Changes to MPS2 and MPS3 TS Bases Page 2 of 2 Attachments:

1. Bases Pages for Millstone Power Station Unit 2 2. Bases Pages for Millstone Power Station Unit 3 Commitments made in this letter: None.cc: U.S. Nuclear Regulatory Commission Region I 2100 Renaissance Blvd. Suite 100 King of Prussia, PA 19406-2713 Richard V. Guzman NRC Senior Project Manager U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop 08 C2 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector Millstone Power Station Serial No. 16-078 Docket No. 50-336 ATTACHMENT I BASES PAGES FOR MILLSTONE POWER STATION UNIT 2 DOMINION NUCLEAR CONNECTICUT, INC.MILLSTONE POWER STATION UNIT 2 August 1, 1975 BASES FOR SECTION 2.0 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS Y

2.1 SAFETY

LIMITS May 1, 2002 BASES 2.1.1 REACTOR CORE The restrictions of this safety ]imit prevent overheating of the fuel cladding and possible cladding perforation which would result in the release Qf fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate at or less than the fuel centerline melt linear heat rate limit. Centerline fuel melting will not occur for this peak linear heat rate. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature. Operation above the upper boundary of the nucleate boI-lIing regime could result in excessive cladding temperatures because of the onset of departure from nucleate boiling (DNB) and the resultant sharp reduction in heat transfer coefficient. DNB is not a directly measurable parameter during operation and therefore THERMAL POWER and Reactor Coolant Temperature and Pressure have been related to DNB through the HIP correlation. The HIP DNB correlation has been developed to predict the DNB flux and the location of DNB for axially uniform and non-uniform heat flux distributions. The local DNB heat flux ratio, DNBR, defined as the ratio of the heat flux that would cause DNB at a particular core location to the local heat flux, is indicative of the margin to DNB.The value of the DNBR during steady state operation, normal operational transients, and anticipated transients is limited to be no less than the DNB correlation limit. The correlation limit corresponds to a 95 percent probability at a 95 percent confidence level (i.e., 95/95 limit),that DNB will not occur and is chosen as an appropriate margin to DNB for all operating conditions. The curves of Figure 2.1-1 show the loci of points of THERMAL POWER, Reactor Coolant System pressure and maximum cold leg temperature with four Reactor Coolant Pumps operating for which the minimum DNBR is no less than the 95/95 limit for the DNB correlation. The limits in Figure 2.1-1 were calculated for reactor coolant inlet temperatures less than or equal to 580°F.The dashed line at 580°F coolant inlet temperatures is not a safety limit;however, operation above 580°F is not possible because of the actuation of the main steam line safety valves which limit the maximum value of reactor inlet temperature. Reactor operation at THERMAL POWER levels higher than 111.6% of RATED THERMAL POWER is prohibited by the high power level trip setpoint specified in Table 2.2-1. The area of saf~e operation is below and to the left of these lines.Revised by NRC Letter A15689 MILLSTONE -UNIT 2 B 2-1 Amendment No. 7, Jfl, 0803 October 6, 1980 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE UNIT 2 B 2-2 MILLTONE-UNT 2 2-2Amendment No. 61 LBDCR 04-MP2-016 February 24, 2005 SAFETY LIMITS BASES: The conditions for the Thermal Margin Safety Limit curves in figure 2.1-i to be valid are shown on the figure.The reactor protective system in combination with the Limiting Conditi~ons for Operation, is designed to prevent any anticipated combination of transient conditions for reactor coolant system temperature, pressure, and THERMAL POWER level that would result in a DNBR below the 95/95 limit for DNB correlation, and preclude the existence of flow instabilities.

2.1.2 REACTOR

COOLANT SYSTEM PRESSURE The restriction of this Safety Limit protects~the integrity of the Reactor Coolant System from overpressurization and thereby prevents the release of radionuclides contained in the reactor.coolant fr-om reaching the containment atmosphere. The reactor pressure vessel and pressurizer are designled to Section III of the ASME Code for Nuclear Power Plant Components which permits a maximum transient pressure of 110%(2750 psia) of design pressure. The Reactor Coolant System piping, valves and fittings, are designed to ANSI B3 1.7, Class I which permits a maximum transient pressure of 110% (2750 psia) of component design pressure. The Safety Limit of 2750 psia is therefore consistent with the design criteria and associated code requirements. The entire Reactor Coolant System is hydrotested at 3125 psia to demonstrate integrity prior to initial operation. MILLSTONE -UNIT 2 B 2-3 Amendment No. :g, gg, 64-, l-39, 26, Acknowledged by NRC letter dated 6/28/05 October 4, 2001 2.2 LIMITING SAFETY SYSTEM SETTINGS BASES: 2.2.1t REACTOR TRIP SET POINTS The Reactor Trip Setpoints specified in Table 2.2-il are the values at which the Reactor Trips are set for each parameter. The Trip Values have been selected to ensure that the reactor core and reactor coolant system are prevented from exceeding their safety limits. Operation with a Trip Setpoint less conservative than its setpoint but within its specified Allowable 'Value is acceptable on the basis that each Allowable Value is equal to or less than the drift allowance assumed to occur for each trip used in the accident analyses.Manual Reactor Trip The Manual Reactor Trip is a redundant channel to the automatic protective instrumentation channels and provides manual reactor trip capability. Power Level-Hig~h The Power Level-High trip provides reactor core protection against reactivity excursions which are too rapid to be protected by a Pressurizer Pressure-High or Thermal Margin/Low Pressure trip.The Power Level-High trip setpoint is operator adjustable and can be set no higher than 9.6% above the indicated THERMAL POWER level. Operator action is required to increase the trip set'point as THERMvAL POWER is increased. The trip setpoint is automatically decreased as THERMAL POWER decreases. The trip setpoint has a maximum value of 106.6% of RATED THERMAL POWER and a minimum setpoint of 14.6% of RATED THERMAL POWER.Adding to this maximum value the possible variation in trip point due to calibration and instrument errors, the maximum actual steady-state THERMAL POWER level at which a trip would be actuated is 111.6% of RATED THERMAL POWER, which is the value used in the accident analyses.Reactor Coolant Flow-Low The Reactor Coolant Flow-Low trip provides core protection to prevent DNB in the event of a sudden significant decrease in reactor coolant flow.MILLSTONE -UNIT 2 B 2-4 kAmendment No. 6t-, 226, Revised by NRC Letter dated October 4, 2001 May 1, 2002 LIMIINGSAFT YTMSTIG BASES Reactor Coolant Flow-Low (Continued) The low-flow trip setpoint and Allowable Value have been derived in consideration of instrument errors and response times of equipment involved to maintain the DNBR above the 95/95 limit for the DNB correlation under normal operation and expected transients."Pressurizer Pressure-High The pressurizer Pressure-High trip, backed up by the pressurizer code safety valves and main steam line safety valves, provides reactor coolant system protection against overpressurization in the event of loss of load without reactor trip. This trip's setpoint is approximately 100 psi below the nominal lift setting (2500 psia) of the pressurizer code safety valves and it~s concurrent operation with the power-operated relief valves avoids the undesirable operation of the pressurizer code safety valves.Containment Pressure-High The Containment Pressure-High trip provides assurance that a reactor trip is initiated concurrently with a safety injection. The setpont for this trip is identical to the safety injection setpoint.Steam Generator Pressure-Low The Steam Generator Pressure-Low trip provides protection against an excessive rate of heat extraction from the steam generators and subsequent cooldown of the reactor coolant. The trip setting is sufficiently below the full-load operating point so as not to interfere with normal operation, but still high enough to provide the required protection in the event of excessively high steam flow.MILLSTONE -UNIT 2 B 2-5 Revised by NRC letter A15689 Amendment No. 5-2, 641, 4-3-9, 2-2-6, February 20, 2003 LBDCR 2-21-02 LIMITING SAFETY SYSTEM SETTINGS BASES: Steam Generator Water Level -Low The Steam Generator Water Level-Low Trip provides core protection by preventing operation with the steam generator water level below the minimum volume required for adequate heat removal capacity and assures that the design pressure of the reactor coolant system will not be exceeded.Local Power Density-High The Local Power Density-High trip, functioning from AXIAL SHAPE INDEX monitoring, is provided to ensure that the peak local power density in the fuel which corresponds to fuel centerline melting will not occur as a consequence of axial power maldistributions. A reactor trip is initiated whenever the AXIAL SHAPE INDEX exceeds the allowable limits of Figure 2.2-2. The AXIAL SHAPE INDEX is calculated from the upper and lower ex-core neutron detector channels. The calculated setpoints are generated as a function of THERMAL POWER level. The trip is automatically bypassed below 15 percent power as sensed by the power range nuclear instrument Level 1 bistable.The maximum AZIMUTHAL POWER TILT and maximum CEA misalignment permitted for continuous operation are assumed in generation of the setpoints. In addition, CEA group sequencing in accordance with the Specifications 3.1.3.5 and 3.1.3.6 is assumed. Finally, the maximum insertion of CEA banks which can occur during any anticipated operational occurrence prior to a Power Level-High trip is assumed.Thermal Margin/Low Pressure The Thermal Margin/Low Pressure trip is provided to prevent operation when the DNBR is below the 95/95 limit for the DNB correlation. MILLSTONE -UNIT 2 B 2-6 Amendment No. 3-s, 4t-, g-, 6-1-, 4-3-3, Corrected by letter dated 11/26/2003. LBDCR 14-MP2-009 May 8, 2014 LIMITING SAFETY SYSTEM SETTINGS BASES: Thermal Margin/Low Pressure (Continued) The trip is initiated whenever the reactor coolant system pressure signal drops below either 1865 psia or a computed value as described below, whichever is higher. The computed value is a function of the higher of AT power or neutron power, reactor inlet temperature, the number of reactor coolant pumps operating and the AXIAL SHAPE INDEX. The minimum value of reactor coolant flow rate, the maximum AZIMUTHAL POWER TILT and the maximum CEA deviation permitted for continuous operation are assumed in the generation of this trip function. In addition, CEA group sequencing in accordance with Specifications 3.1.3.5 and 3.1.3.6 is assumed. Finally, the maximum insertion of CEA banks which can occur during any anticipated operational~occurrence prior to a Power Level-High trip is assumed.Thermal Margin/Low Pressure trip setpoints are derived from the core safety limits. A safety margin is provided which includes allowances for equipment response times, core power, RCS tempeiature, and pressurizer pressure measurement uncertainties, processing errors, and a further allowance to compensate for the time delay associated with providing effective termination of the occurrence that exhibits the most rapid decrease in margin to the safety limit.Loss of Turbine A Loss of Turbine trip causes a direct reactor trip when operating above 15% of RATED THERMAL POWER as sensed by the power range nuclear instrument Level 1 bistable. This trip provides turbine protection, reduces the severity of the ensuing transient and helps avoid the lifting of the main steam line safety valves during the ensuing transient, thus extending the service life of these valves. No credit was taken in the accident analyses for operation of this trip. Its functional capability at the specified trip setting is required to enhancethe overall reliability of the Reactor Protection System.The Wide Range Logarithmic Neutron Flux Monitor -Shutdown, Reactor Protection System Logic Matrices, Reactor Protection System Logic Matrix Relays, and Reactor Trip Breakers flmctional units are components of the Reactor Protective System for which OPERABILITY requirements are provided within the Technical Specifications (see Technical Specification 3.3.1.1, "Reactor Protective Instrumentation). These functional units do not have specific trip set-points or allowable values, similar to the manual reactor trip functional unit.However, these functional units are provided here for completeness and consistency with the RPS Instrumentation identified in Technical Specification 3.3.1.1.MILLSTONE -UNMT 2 B 2-7 Amendment No. 5-2, 4-39, -I-5-3, 22-6,.... , ..... September 25, 2003 LIMITING SAFETY SYSTEM SETTINGS BASES: DELETED 0)MILLSTONE -UNIT 2 -" ...... ....... -........ B 2-8......... ..... ............. ..... ............ -......E- KI2 B -_ ._ -A 64-2,--t ---- .... " August 1, *1975...SECTIONS 3.0 AND 4.03 LIMITING CONDITIONS FOR ORPEATION* AND SURVEILLANCE REQUIREMENTS February 26, 1991 3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS 3/4.0 APPLICABILITY BASES Specification

3.0.1 through

3.0.4 establish the general requirements applicable to Limiting Conditions for Operation. These requirements are based on the requirements fdr Limiting Conditions for Operation stated in the Code of Federal Regulations, 10OCFR5O.36(c)(2): "Limiting conditions for oper'ation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. 'When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specification until the condition can be met." Specification

3.0.1 establishes

the Applicability statement within each individual specification as the requirement for when (i.e., in which OPERATIONAL MODES or other specified conditions) conformance to the Limiting Conditions for Operation is required for safe operation of the facility. The ACTION requirements establish those remedial measure that must be taken within specified time limits when the requirements of a Limiting Condition for Operation are not met.There are two basic types of ACTION requirements. The first specifies the remedial measures that permit continued operation of the facility which is not further restricted by the time limits of the ACTION requirements. In this case, conformance to the ACTION requirements provides an acceptable level of safety for unlimited continued operation as long as the ACTION requirements continue to be met. The second type of ACTION requirement specifies a time limit in which conformance to the conditions of the Limiting Condition for Operation must be met. This time limit is the allowable outage time to restore an inoperable system or component to OPERABLE status or for restoring parameters within specified limits. If these actions are not completed within the allowable outage time limits, a shutdown is required to place the facility in a MODE or condition in which the specification no longer applies. It is not intended that the shutdown ACTION requirements be used as an operational convenience which permits (routine) voluntary removal of a system(s) or component(s) from service in lieu of other alternatives that would not result in redundrant systems or components being inoperable. The specific time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. The time limits of the ACTION requirements are also applicable when a system or component is removed from service for surveillance testing or investigation of operational problems. Individual specifications may.include a specified time limit for the completion of a Surveillance Requirement when equipment is removed from service. In this case, the allowable outage time MILLSTONE -UNIT 2 B 3/40-1 MILLTONE-UIT 2B 3/0-IAmendment Nos. 61, 151 LBDCR 04-MP2-016 February 24, 2005 3/4.0 APPLICABILITY BASES (Con't) 0 )limits of ACTION requirements are applicable when this limit expires if the surveillance has not been completed. When a shutdown is required to comply with ACTION requirements, the plant may have entered a MODE in which a new specification becomes applicable. In this case, the time limits of the ACTION requirements would apply from the point in time that~the new specification becomes applicable if the requirements of the Limiting Condition for Operation are not met.Specification

3.0.2 establishes

that noncompliance with a specification exists when the requirements of the Limiting Condition for Operation are not met and the associated ACTION requirements have not been implemented within the specified time interval. The purpose of this specification is to clarify that (1) implementation of the ACTION requirements within the specified time interval constitutes compliance with a specification and (2) completion of the remedial measures of the ACTION requirements is not required when compliance with a Limiting Condition of Operation is restored within the time interval specified in the associated ACTION requirements. Specification

3.0.3 establishes

the shutdown ACTION requirements that must be implemented when a Limiting Condition for Operation is not met and the condition is not specifically addressed by the associated ACTION requirements. The purpose of thlis specification is to delineate the time limits for placing the unit in a safe operation defined by the Limiting Conditions for Operation and its ACTION requirements. It is not intended to be used as an operational convenience which permits (routing) voluntary removal of .redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. This time permits the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the cooldown capa~bilities of the facility assuming only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the primarY coolant system and the potential for a plant upset that could challenge safety systems under conditions for which this specification applies.If remedial measure permitting limited continued operation of the facility under the provisions of the ACTION requirements are completed, the shutdown may be terminated. The time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. Therefore, the shutdown may be terminated if the ACT[ON requirements have been met or the time limits of the ACTION requirements have not expired, thus providing an allowance for the completion of the required ACTIONS.0 " MILLSTONE -UNIT 2 B 3/4 0-2 Amendment Nos. 6-2, 4-5--, Acknowledged by NRC letter dated 6/28/05 February 26, 1991 APPLICABILITY BASES (Con't)The time limits of Specification

3.0.3 allow

37 hours for the plant to be in the COLD SHUTDOWN MODE when a shutdown is required duiing the POWER MODE of operation. If the plant is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE of operation applies. However, if a lower MODSE of operation is reached in less time than allowed, the total allowance time to reach COLD SHUTDOWN, or other applicable MODE, is not reduced. For example, if HOT STANDBY is reached in 2 hours, the time allowed to reach HOT SHUTDOWN is the next 11 hours because the total time to reach HOT SHUTDOWN is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to POWER operation, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.The same principle applies with regard to the allowable outage time limits of the ACTION requirements, if compliance with the ACTION requirements for one specification results in ently into a MODE or condition of operation for another specification in which the requirements of the Limiting Condition for Operation are not met. If the new specification becomes applicable in less time than specified, the difference may be added to the allowable outage time limits of the second specification. However, the allowable outage time limits of ACTION requirements for a higher MODE of operation may not be used to extend the allowable outage time that is applicable when a Limiting Condition for 'Operation is not met in a lower MODE of operation. The shutdown requirements of Specification 3.0.3 do not apply in MODES 5 and 6, because the ACTION requirements of individual specifications define the remedial measures to be taken.Specification

3.0.4 establishes

limitations on MODE changes when a Limiting Condition for Operation is not met. It precludes placing the facility in a higher MODE of operation when the requirements for a Limiting Condition for Operation are not met and continued noncompliance to these conditions would result in a shutdown to comply with the ACTION requirements if a change in MODES were permitted. The purpose of this specification is to ensure that facility operation is not initiated or that higher MODES of operation are not entered wheni corrective action is being traken to obtain compliance with a specification by restoring equipment to OPERABLE status or parameters to specified limits. Compliance with ACTION requirements that permit continued operation of the facility for an unlimited period of time provides an acceptable level of safety for continued operation without regard to the status of the plant before.or after a MODE change. Therefore, in this case, entry into an OPERATIONAL MODE or other specified condition may be made in accordance 'with the provision of the ACTION requirements. The provisions of this specification should not, however, be interpreted as endorsing the failure to exercise good practice in restoring systems or components to OPERABLE status before plant startup.MILLSTONE -UNIT 2 B 3/4 0-3 MILLTON -NIT2 B3/40-3Amendment Nos. 62, 15 l LBDCR 04-MP2-016 February 24, 2005 APPLICABILITY BASES (Con't) 0 : When a shutdown is required to comply with ACTION requirements, the provisions of Specification 3.0.4 do not apply because they would delay placing the facility in a lower MODE of operation. Specification

3.0.5 delineates

what additional conditions must be satisfied to permit operation to continue, consistent with the ACTION statements for power sources, when a normal or emergency power source in not OPERABLE. It specifically prohibits operation when one division is inoperable because its normal or emergency power source is inoperable and a system, subsystem, train, component or device in another division is inoperable for another reason.The provisions of this specification permit the ACTION statements associated with individual systems, subsystems, trains, components, or devices to be consistent with the ACTION statements of the associated electrical power source. It allows operation to be governed by the time limits of the ACTION statement associated with the Limiting Condition for Operation for the normal or emergency power source, not the individual ACTION statements for each system, subsystem, train, component or device that is determined to be inoperable solely because of the inoperability of its normal emergency power source.For example, Specification 3.8.1.1 requires in part that two emergency diesel generators be OPERABLE. The ACTION statement provides for a 72-hour out-of-service time when one emergency diesel generator is not OPERABLE. If the definition of OPERABLE were applied without consideration of Specification 3.0.5, all systems, subsystems, trains, components and devices supplied by the inoperable emergency power source would also be inoperable. This would dictate invoking the applicable ACTION statement for each of the applicable Limiting Conditions for Operation. However, the provisions of Specification

3.0.5 permit

the time limits for continued operation to be consistent with the ACTION statement for the inoperable emergency diesel generator instead, provided the other specified conditions are satisfied. In this case, this would mean that the corresponding normal power source must be OPERABLE, and all redundant systems, subsystems, trains, components, and devices must be OPERABLE, or otherwise satisfy.Specification 3.0.5 (i.e., be capable of performing their design function and have at least one normal or one emergency power source OPERABLE). If they, are not satisfied, ACTION is required in accordance with this specification. As a further example, Specification 3.8.1.1 requires in part that two physically independent circuits between the offsite transmission network and the onsite Class 1 E distribution system be OPERABLE. The ACTION statement provides a 24-hour out-of-service time when both required offsite circuits are not OPERABLE. If the definition of OPERABLE were applied without consideration of Specification 3.0.5, all systems, subsystems, trains, components and devices supplied by the inoperable normal power sources, both of the offsite circuits, would also be inoperable. This would dictate invoking the applicable ACTION statements for each of the applicable LCOs. However, the provisions of Specification

3.0.5 permit

the time limits for continued operation toV MILLSTONE -UNIT 2 B 3/4 0-4 Amendment Nos. 7:4, 4-54-, Acknowledged by NRC letter dated 6/28/05 LB DCR 04-MP2-016 February 24, 2005 BASES (Can't)be consistent with the ACTION statement for the inoperable normal power sources instead, provided the other specified conditions are satisfied. In this case, this would mean that for one division the emergency power source must be OPERABLE (as must be the components supplied by the emergency power source) and all redundant systemas, subsystems, trains, components and devices in the other divisions must be OPERABLE, or likewise satisfy Specification 3.0.5 (i.e., bel capable of performing their design functions and have an emergency power source OPERABLE). In other words, both emergency power sources must be OPERABLE and all redundant systems, subsystems, trains, components and devices in both divisions must also be OPERABLE. If these conditions are not satisfied, ACTION is required in accordance with this specification. In MODES 5 and 6 Specification 3.0.5 is not applicable, and thus 'the individual ACTION statements for each applicable Limiting Condition for Operation in these MODES must be adhered to.Specification

3.0.6 establishes

the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to' provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required ACTION(s)) to allow the performance of surveillance requirements to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allo~ved surveillance requirements. The Specification does not provide time to perform any other preventive or corrective maintenance. An example of demonstrating the OPERABILITY of equipment being returned to service is reopening a containment isolation valve that has been closed to comply with the Required ACTIONS andTnust be reopened to perform the surveillance requirements. An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of a surveillance requirement on another channel in the other trip system.A similar example of demonstrating the OPERABILITY of other equipment is taking an-inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of a surveillance requirement on another channel in the same trip system.MILLSTONE -UNIT 2 B 3/4 0-5 Amendment No. 4-54, 4-52, 30, Acknowledged by NRC letter dated 6/28/05 October 15, 2002 BASES (Con't).9O Specification 4.0.1l through 4.0.5 establish the general requirements applicable to Surveillance Requirements. These requirements are based on the Surveillance Requirements stated in the Code of Federal Regulations, 10OCFR50.3 6(c)(3): "Surveillance requirements are requirements relating to test, calibration, or inspection to ensure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met.".Specification

4.0.1 establishes

the requirement that surveillances must be met during the OPERATIONAL MODES or other conditions for which the requirements of the Limiting Conditions for Operation apply unless otherwise stated in an individual Surveillance Requirements. The purpose of this specification is to ensure that surveillances are performed to verify the OPERABILITY of systems and components and that parameters are within specified limits to ensure safe operation of the facility when the plant is in a MODE or other specified condition for which the associated Limiting Conditions for Operation are applicable. Failure to meet a Surveillance within the specified surveillance interval, in accordance with Specification

4.0.2 constitutes

a. failure to meet a Limiting Condition for Operation.

Systems and components are assumed to be OPERABLE when the associated Surveillance Requirements have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when either: a. The system or components are known to be inoperable, although still meeting the Surveillance Requirements or 9.b. The requirements of the Surveillance(s) are known to be not met between required Surveillance performances. Surveillance Requirements do not have to be performaed when the facility is in an Operational Mode or other specified conditions for which the requirements of the associated Limiting Condition for Operation do not apply unless otherwise specified. The Surveillance Requirements associated with a Special Test Exception are only applicable when the Special Test Exception is used as an allowable exception to the requirements of a specification. Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given Surveillaiice Requirement. In this case, the unplanned event may be credited as fulfilling the performance of the Surveillance Requirement. This allowance includes those Surveillance Requirements whose performance is normally precluded in a given Mode or other specified condition. Surveillance Requirements, including Surveillances invoked by ACTION requirements, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with Specification 4.0.2, prior to returning equipment to Operable status.Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with Specification 4.0.2. Post maintenance testing may not be MILLSTONE -UNIT 2 B 3/4 0-5a Amendment No. 30, 271 LBDCR No. 04-MP2-016 February 24, 2005 BASES (Can't)possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed. -..Some examples of this process are: a. Auxiliary feedwater (AFW) pump turbine maintenance during refueling that requires testing at steam pressure > 800 psi. However, if other appropriate testing.is satisfactorily completed, the AFW System can be considered OPERABLE. This allows startup and other necessary testing to proceed until the plant reaches the..steam pressure required to perform the testing.b. High pressure safety injection (HPSI) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPSI considered OPERABLE.This allows operation to reach the specified pressure to complete the necessary" post maintenance testing.Specification 4.0.2 This specification establishes the limit for which the specified time interval for Surveillance Requirements may be extended. It permits an allowable extension of the formal.surveillance interval to facilitate surveillance scheduling and consideration of plant operating conditions that may not be suitable for conducting the surveillance; e.g., transient conditions or .other ongoing surveillance or maintenance activities. It also provides flexibility to accommodate the length of a fuel cycle for surveillances that are performed at each refueling outage and are specified with an 18-month surveillance interval. It is not intended that this provision be used repeatedly as a convenience to extend surveillance intervals beyond that specified for surveillances that are not performed during refueling outages. The limitation of Specification 4.0.2 is based on engineering judgment and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the Surveillance; Requirements. This provision is sufficient to ensure that the reliability ensured through surveillance activities is not significantly degraded beyond that obtained from the specified.surveillance interval.Specification

4.0.3 establishes

the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified surveillance interval. A delay period of up to 24 hours or up to the limit of the specified siurveillance interval, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with Specification 4.0.2, and not at the time that the specified surveillance interval was not met.This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with ACTION requirements or other remedial measures that mnight preclude completion of the Surveillance. MILLSTONE -UNIT 2 B 3/4 0-Sb Amendment No. 23-0, 2-7-1-, Acknowledged by NRC letter dated 6/28/05 LBDCR 04-MP2-016 February 24, 2005 BASES (Con't)0: The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements. When a Surveillance. with a surveillance interval based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations, (e.g., prioft0 entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, Specification

4.0.3 allows

for the full delay period of up to the specified surveillance interval to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity. Specification

4.0.3 provides

a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by ACTION requirements. Failure to comply with specified surveillance intervals for the Surveillance Requirements is expected to be an infrequent occurrence. Use of the delay period established by Specification 4.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours or the limit of the specified surveillance interval is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to d : perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, *planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1. 182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration* of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent cofidition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action- All missed Surveillances will be placed in the licensee's Corrective Action Program.If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the entry into the ACTION requirements for the applicable Limiting Condition for Operation begins immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and entry into the ACTION requirements for the applicable Limiting Condition for Operation begins immediately upon the failure of the Surveillance. Completion of the Surveillance within the delay period allowed by this Specification, or within the Allowed Outage Time of the applicable ACTIONS, restores compliance with Specification 4.0. l. 0: MILLSTONE -UNIT 2 B 3/4 0 -6 Amendment No. 2-7-1-, Acknowledged by NRC letter dated 6/28/05 -June 19, 2007 LBDCR 07-MP2-014 3/4.0 APPLICABILITY BASES (Con't)Specification

4.0.4 establishes

the requirement that all applicable surveillances must be met before entr}, into and OPERATIONAL MODE or other condition of operation specified in the Applicability statement. The purpose of this specification is to ensure that system and component OPERABILITY requirements or parameter limits are met before entry into a MODE or condition for which these systems and components ensure safe operation of the facility. This provision applies to changes in OPERATIONAL MODES or other specified conditions associated with plant shutdown as well as startup.Under the provisions of this specification, the applicable Surveillance Requirements must be performed within the specified surveillance interval to ensure that the Limiting Conditions for Operation are met during initial plant startup or following a plant outage.When a shutdown is required to comply with ACTION requirements, the provisions of Specification 4.0.4 do not apply because this would delay placing the facility in a lower MODE of operation. Specification

4.0.5 establishes

the requirement that inservice testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with a periodically updated version of the ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code) and applicable Addenda as required by 10 CFR 50.55a(f). These requirements apply except when relief has been provided in writing by the Commission. This specification includes a clarification of the frequencies for performing the inservice testing activities required by the ASME OM Code and applicable Addenda. This clarification is provided to ensure consistency in surveillance intervals throughout the Technical Specifications and to remove any ambiguities relative to the frequencies for performing the required inservice testing activities. Under the terms of this specification, the more restrictive requirements of the Technical Specifications take precedence over the ASME OM Code and applicable Addenda. The requirements of Specification 4.0.4 to perform surveillance activities before entry into an OPERATIONAL MODE or other specified condition takes precedence over the ASME OM Code provision which allows pumps and valves to be tested up to one week after return to normal operation. MILLSTONE -UNIT 2B3/0-AmnetNo---I B 3/4 0-7 Amendment No. 4-54 REVERSE OF PAGE B 3/4 0-7 INTENTI.ONALLY LEFT BLANK September 25, 2003 3/4.1 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1 REACTIVITY CONTROL SYSTEMS 3/4.1.1.1 SHUTDOWN MARGIN A sufficient SHUTDOWN MARGIN ensures that 1) the reactor can be made subcritical from all operating conditions, 2) the reactivity transients associated with postulated accident conditions are controllable within acceptable limits, and 3) the reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition. SHUTDOWN MARGIN requirements vary throughout core life as a function of fuel depletion, RCS boron concentration, and RCS Tavg The most restrictive conditiori occurs at EOL, with Tav at no load operating temperature, and is associated with a postulated steam line break accident and resulting uncontrolled RCS cooldown. In the analysis of this accident, the minimum SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT is initially required to control the reactivity transient. Accordingly, the SHUTDOWN MARGIN required by Specification 3.1.1.1 is based upon this limiting condition and is consistent with FSAR accident analysis assumptions. For earlier periods during the fuel cycle, this value is conservative. The SHUTDOWN MARGIN is verified by performing a reactivity balance calculation, considering the listed reactivity effects: a. RCS boron concentration;

b. CEA positions;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;

e. Xenon concentration;

f. Samarium concentration; and g. Isothermal temperature coefficient (ITC).Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical and the fuel temperature will be changing at the same rate as the RCS temperature.

3/4.1.1.2 REACTIVITY BALANCE Reactivity balance is used as a measure of the predicted versus measured core reactivity during power operation. The periodic confirmation of core reactivity is necessary to ensure that Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity difference could be the result of unanticipated changes in fuel, control element assembly (CEA) worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity, and could potentially result in a loss of SHUTDOWN MARGIN (SDM) or violation of acceptable fuel design limits. Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analy sis and supports the SDM demonstrations (LCO 3.1.1.1,"SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to cold, subcritical conditions. The normalization of predicted RCS boron concentration to the measured value is typically performed after reaching RATED THERMAL POWER following startup from a refueling outage, with the CEAs in their normal positions for power operation. The normalization is performed at BOC conditions, so that core MILLSTONE -UNIT 2 B3/4 1-1 MILLTON -NIT2 B3/41-1Amendment No. 39, 4-48, 8-, 280 September 9, 2004 3/4.1 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1 REACTIVITY CONTROL SYSTEMS (Continued) 3/4.1.1.2 REACTIVITY BALANCE (Continued) reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.When measured core reactivity is within +1% Ak/k of the predicted value at steady state thermal conditions, the core is considered to be operating within acceptable design limits.The limits on core reactivity must be maintained during MODES 1 and 2 because a reactivity balance must exist when the reactor is critical or producing THERMAL POWER. This Specification does not apply in MODES 3 ,4 and 5 because the reactor is shut down and the reactivity balance is not changing.In MODE 6, fuel loading results in a continually changing core reactivity. Boron concentration requirements (LCO 3.9.1, "Boron Concentration") ensure that fuel movements are performed within the bounds of the safety analysis.3/4.1.1.3 BORON DILUTION A minimum flow rate of at least 1000 GPM provides adequate mixing, prevents stratification and ensures that reactivity changes will be gradual during reductions in Reactor Coolant System boron concentration. The 1000 GPM limit is the minimum required shutdown cooling flow to satisfy the boron dilution accident analysis. This 1000 GPM flow is an analytical limit. Plant operating procedures maintain the minimum shutdown cooling flow at a higher value to accommodate flow measurement uncertainties. While the plant is operating in reduced inventory operations, plant operating procedures also specify an upper flow limit to prevent vortexing in the shutdown cooling system. A flow rate of at least 1000 GPM will circulate the full Reactor Coolant System volume in approximately 90 minutes. With the RCS in mid-loop operation, the Reactor Coolant System volume will circulate in approximately 25 minutes. The reactivity change rate associated with reductions in Reactor Coolant System boron concentration will be within the capability for operator recognition and control.A maximum of two charging pumps capable of injecting into the RCS when RCS cold leg temperature is < 300°F ensures that the maximum inadvertent dilution flow rate assumed in the boron dilution analysis is not exceeded.MILLSTONE -UNIT 2 B 3/4 1-la Amendment No. 4-39, 4.4&, 8-5, 2,80, 283 LBDCR 09-MP2-017 September 15, 2009 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1.3 BORON DILUTION (Continued~) A charging pump can be considered to be not capable of injecting into the RCS by use of any of the following methods and the appropriate administrative controls.1. Placing the motor circuit breaker in the open position.2. Removing the charging pump motor overload heaters from the charging pump circuit.3. Removing the charging pump motor controller from the motor control center.4. Placing a charging pump control switch in the Pull-To-Lock (PTL) position.3/4.1.1.4 MODERATOR TEMPERATURE COEFFICIENT (MTC)The limitations on MTC are provided to ensure that the assumptions used in the accident and transient analyses remain valid through each fuel cycle. The surveillance requirements for measurement of the MTC during each fuel cycle are adequate to confirm the MTC value since this coefficient changes slowly due principally to the reduction in RCS boron concentration associated with fuel burnup. The confirmation that the measured MTC value is within its limit provides assurance that the coefficient will be maintained within acceptable values throughout each fuel cycle.3/4.1.1.5 MINIMUM TEMPERATURE FOR CRITICALITY The MTC is expected to be slightly negative at operating conditions. However, at the beginning of the fuel cycle, the MTC may be slightly positive at operating conditions and since it will become more positive at lower temperatures, this specification is provided to restrict reactor operation when Tav is significantly below the normal operating temperature. .3/4.1.2 DELETED 3/4.1.3 MOVEABLE CONTROL ASSEMBLIES The specifications of this section ensure that (1) acceptable power distribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effects of a CEA ejection accident are limited to acceptable levels.The ACTION statements which permit limited variations from the basic requirements are accompanied by additional restrictions which ensure that the original criteria are met.MILLSTONE -UNIT 2 B 3/4 1-2 Amendment No. -3~, 3g, 3-39, 4&, 2N-l-, 28-, Page B 3/4 1-3 has been removed from Technical Specifications September 25, 2003 BASES 3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued) A CEBA may become misaligned, yet remain trippable. In this condition, the CEA can still perform its required function of adding negative reactivity should a reactor trip be necessary. If one or more CEAs (regulating or shutdown) are misaligned by > 10 steps and < 20 steps but trippable, or one CEA is misaligned by >20 steps but trippable, continued operation in MODES 1 and 2 may continue, provided, within 1 hour, the power is reduced to < 70% RATED THERMAL POWER, and within 2 hours CEA alignment is restored. If negative reactivity insertion is required to reduce THERMAL POWER, boration shall be used. Regulating CEA alignment can be restored by either aligning the misaligned CEA(s) to within 10 steps of all other CEAs in its group or aligning the misaligned CEA's group to within 10 steps of the misaligned CIBA. A Regulating CEA is considered fully inserted when either the Dropped Rod indication or lower Electrical Limit indication lights on the core mimic display are illuminated. A Regulating CEA is considered to be fully withdrawn when withdrawn > 176 steps. Shutdown CIBA alignment can only be restored by aligning the misaligned CIBA(s) to within 10 steps of its group.Xenon redistribution in the core starts to occur as soon as a CIBA becomes misaligned. Reducing THERMAL POWER ensures acceptable power distributions are maintained. For small misalignments (< 20 steps) of the CEAs, there is: a. A small effect on the time dependent long term power distributions relative to those used in generating LCOs and limiting safety system settings (LSSS)set-points;

b. A negligible effect on the available SHUTDOWN MARGIN; and c. A small effect on the ejected CIBA worth used in the accident analysis.With a large CIBA misalignment ( > 20 steps), however, this misalignment would cause distortion of the core power distribution.

This distortion may, in turn, have a significant effect on the time dependent, long term power distributions relative to those used in generating LCOs and LSSS setpoints. The effect on the available SHUTDOWIN MARGIN and the ejected CEA worth used in the accident analysis remain small. Therefore, this condition is limited to a single CEBA misalignment, while still allowing 2 hours for recovery.In both cases, a 2 hour time period is sufficient to: a. Identifyr cause of a misaligned CIBA;b. Take appropriate corrective action to realign the CEAs; and c. Minimize the effects of xenon redistribution. If a CIBA is untrippable, it is not available for reactivity insertion during a reactor trip. With an untrippable CIBA, meeting the insertion limits of LCO 3.1.3.5 and LCO 3.1.3.6 does not ensure that adequate SHUTDOWN MARGIN exists. With one or more CIBAs untrippable the plant is transitioned to MODE 3 within 6 hours.MILLSTONE -UNIT 2 B 3/4 1-4 MILLTONE-UNT 2 3/41-4Amendment No. 3-8, 4-t-9,280 LBDCR 14-MP2-016 September 4, 2014 BASES 3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued), The CEA motion inhibit permits CEA motion within the requirements. of LCO 3.1.3.6,"Regulating Control Element Assembly (CEA) Insertion Limits," and the CEA deviation circuit prevents regulating CEAs from being misaligned from other CEAs in the group. With the CEA motion inhibit inoperable, a time of 6 hours is allowed for restoring the CEA motion inhibit to OPERABLE status, or placing and maintaining the CEA drive switch in either the "off' or"manual" position, fully withdrawing all CEAs in group 7 to < 5% insertion. Placing the CEA drive switch in the "off' or "manual" position ensures the CEAs will not move in response to Reactor Regulating System automatic motion commands. Withdrawal of the CEAs to the positions required in the Required ACTION B.2 ensures that core perturbations in local bumup, peaking factors, and SHUTDOWN MARGIN will not be more adverse than the Conditions assumed in the safety analyses and LCO setpoint determination. Required ACTION B.2 is modified by a Note indicating that performing this Required ACTION is not required when in conflict with Required ACTIONS A.1 or C. 1.Continued operation is not allowed in the case of more than one CEA misaligned from any other CEA in its group by >20 steps, or one or more CEAs untr-ippable. This is because these cases are indicative of a loss of SHUTDOWN MARGIN and power distribution changes, and a loss of safety function, respectively. OPERABILITY of the CEA position indicators (Specification 3.1.3.3) is required to determine CEA positions and thereby ensure compliance with the CEA alignmaent and insertion limits and ensures proper operation of the CEA Motion Inhibit and CEA deviation block circuit.The CEA "Full In" and "Full Out" limit Position Indicator channels provide an additional independent means for determining the CEA positions when the CEAs are at either their fully inserted or fully withdrawn positions. Therefore, the ACTION statements applicable to inoperable CEA position indicators permit continued operations when the positions of CEAs with inoperable position indicators can be verified by the "Full In" or "Full Out" limit Position Indicator channels.CEA positions and OPERABILITY of the CEA position indicators are required to be verified at the frequency specified in the Surveillance Frequency Control Program with more frequent verifications required if ani automatic monitoring channel is inoperable. The surveillance frequency is controlled under the Surveillance Frequency Control Program.The maximum CEA drop time permitted by Specification 3.1.3.4 is the assumed CEA drop time used in the accident analyses. Measurement with Tavg > 51 5°F and with all reactor coolant pumps operating ensures that the measured drop times will be representative of insertion times experienced during a reactor trip at operating conditions. MILLSTONE -UNIT 2 B 3/4 1-4a Amendment No. -t-33, 24-6, 29-g, September 25, 2003 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.3 MOVEABLE CONTROL ASSEMBLIES (Continued) The LSSS setpoints and the power distribution LCOs were generated based upon a core burnup which would be achieved with the core operating in an essentially unrodded configuration. Therefore, the CEA insertion limit specifications require that during MODES 1 and 2, the CEAs be nearly fully withdrawn. The amount of CEA insertion permitted by the Long Term Steady State Insertion Limits of Specification 3.1.3.6 will not hav~e a significant effect upon the unrodded burnup assumption but will still provide sufficient reactivity control. The Transient Insertion Limits of Specification 3.1.3.6 are provided to ensure that (1) acceptable power distribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effects of a CEA ejection accident are limited to acceptable levels; however, long term operation at these insertion limits could have adverse effects on core power distribution during subsequent operation in an unrodded configuration. The PDIL alarm, CEA Motion Inhibit and CEA deviation circuit are provided by the CEAPDS computer.The control rod drive mechanism requirement of specification 3.1.3.7 is provided to assure that the consequences of an uncontrolled CEA withdrawal from subcritical transient will stay within acceptable levels. This specification assures that reactor coolant system conditions exist which are consistent with the plant safety analysis prior to energizing the control rod drive mechanisms. The accident is precluded when conditions exist which are inconsistent with the safety analysis since deenergized drive-mechanisms cannot withdraw a CEA. The drive mechanisms may be energized with the boron concentration greater than or equal to the refueling concentration since, under these conditions, adequate SHUTDOWN MARGIN is maintained, even if all CEAs are fully withdrawn from the core.MILLSTONE -UNIT 2 B 3/4 1-5 MILLTONE-UNT 2 3/41-5Amendment No. 3-&, 446, 24-6, 280 REVERSE OF PAGE B 3/4 1-5 INTENTIONALLY LEFT BLANK LBDCR 04-MP2-016 February 24, 2005 3/4.2 POWER DISTRIBUTION LIMvITS BASES 3/4.2.1 LINEAR HEAT RATE The limitation on linear heat rate ensures that in the event of a LOCA, the peak temperature of the fuel cladding will not exceed 2200°F.Either of the two core power distribution monitoring systems, the Excore Detector Monitoring System and the Incore Detector Monitoring System, provide adequate monitoring of the core power distribution and are capable of verifying that the linear heat rate does not exceed its limits. The Excore Detector Monitoring System perfonus this function by continuously monitoring the AXIAL SHAPE INDEX with two OPERABLE excore neutron flux detectors and verifying that the AXIAL SHAPE INDEX is maintained within the allowable limits specified in the CORE OPERATING LIMITS REPORT using the Power Ratio Recorder. The power[dependent limits of the Power Ratio Recorder are less than or equal to the limits specified in the CORE OPERATING LIMITS REPORT. In conjunction with the use of the excore monitoring [system and in establishing the AXIAL SHAPE INDEX limits, the following assumptions are made: 1) the CEA insertion limits of Specifications 3.1.3.5 arid 3.1.3.6 are satisfied, 2) the AZIIMUTHAL POWER TILT restrictions of Specification 3.2.4 are satisfied, and 3) the TOTAL TINRODDED INTEGRATED RADIAL PEAKING FACTOR does not exceed the limits of Specification 3.2.3.The Incore Detector Monitoring System continuously provides a direct measure of the peaking factors and the alarms which have been established for the individual incore detector segments ensure that the peak linear heat rates will be maintained within the allowable limits specified in the CORE OPERATING LIMITS REPORT. The setpoints for these alarms include allowances, set in the conservative direction. The Incore Detector Monitoring System is not used to monitor linear heat rate below 20% of RATED THERMAL POWER.. The accuracy of the neutron flux infonnation from the incore detectors is not reliable at THERMAL POWER < 20%RATED THERMAL POWER.3/4.2.3 ANT) 3/4.2.4 TOTAL UNIRODDED INTEGRATED RADIAL PEAKING FACTORS FTr ANT) AZIMUTHAL POWER TILT -T~q The limitations on Far and Tq are provided to 1) ensure that the assumptions used in the analysis for establishing the Linear Heat Rate and Local power Density -High LCOs and LSSS setpoints remain valid during operation at the various allowable CEA group insertion limits, and, 2) ensure that the assumptions used in the analysis establishing the DNB Margin LCO, and Thermal Margin/Low Pressure LSSS setpoints remain valid during operation at the various allowable CEA group insertion limits. If F'r or Tq exceed their basic limitations, operation may continue under the additional restrictions imposed MILLSTONE -UNIT 2 B 3/4 2-1 Amendment No. g3g, 5-2,4-2-2,1439, 448, 4-5-5~,-1-94,-2-30,220g, Acknowledged by NRC letter dated 6/28/05 LBDCR 14-MP2-016 September 4, 2014 POWER DISTRIBUTION LIMITS BASES by the ACTION statements since these additional restrictions provide adequate provisions to assure that the assumptions used in establishing the Linear Heat Rate, Thermal Margin!Low Pressure and Local Power Density -High LCOs and LSSS setpoints remain valid. An AZIMUTHAL POWER TILT > 0.10 is not expected and i~fit should occur, subsequent operation would be restricted to only those operations required to identify the cause of this unexpected tilt.Core power distribution is a concern any time the reactor is critical. The Total Integrated Radial Peaking Factor -FTr LCO, however, is only applicable in MODE 1 above 20% of RATED THERMAL POWER. The reasons that this LCO is not applicable below 20% of RATED THERMAL POWER are: a. Data from the incore detectors are used for determining the measured radial peaking factors. Technical Specification 3.2.3 is not applicable below 20% of RATED THERMAL POWER because the accuracy of the neutron flux information from the incore detectors is not reliable at THERMAL POWER< 20% RATED THERMAL POWER.b. When core power is below 20% of RATED THERMAL POWER, the core is operating well below its th~ermal limits, and the Local Power Density (fuel pellet.melting) and Thermal Margin/Low Pressure (DN-B) trips are highly conservative. The surveillance requirements for verifying that FTr and Tq are within their limits provide assurance that the actual values ofFTr and Tq do not exceed the assumed values. These surveillance frequencies are controlled under the Surveillance Frequency Control Program.Verifying FTr after each fuel loading prior to exceeding 70% of RATED THERMAL POWER provides additional assurance that the core was properly loaded. '" 3/4.2.6 DNB MARGIN The limitations provided in this specification ensure that the assumed margins to DNB are maintained. The limiting values of the parameters in this specification are those assumed as the initial conditions in the accident and transient analyses; therefore, operation must be maintained within the specified limits for the accident and transient analyses to remain valid.MILLSTONE -UNIT 2 B 3/4 2-2 Amendment No. , 4-,--22, -3~9, 55,-2--0, O LBDCR 14-MP2-016 September 4, 2014 3/4.3 INSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF' INSTRUMENTATION The OPERABILITY of the protective and ESF instrumentation systems and bypasses ensure that 1) the associated ESF action and/or reactor trip will be initiated when the parameter monitored by each channel or combination thereof exceeds its setpoint, 2) the specified coincidence logic is maintained, 3) sufficient redundancy is maintained to permit a channel to be out of service for testing or maintenance, and 4) sufficient system functional capability is available for protective and ESE purposes from diverse parameters. The OPERABILITY of these systems is required to provide the overall reliability, redundance and diversity assumed available in the facility design for the protection and mitigation of accident and transient conditions. The integrated operation of each of these systems is consistent with the assumptions used in the accident analyses.ACTION Statement 2 of Tables 3.3-1 and 3.3-3 requires an inoperable Reactor Protection System (RPS) or Engineered Safety Feature Actuation System (ESFAS) channel to be placed in the bypassed or tripped condition within 1 hour. The inoperable channel may remain in the bypassed condition for a maximum of 48 hours. While in the bypassed condition, the affected functional unit trip coincidence will be 2 out of 3. After 48 hours, the channel must either be declared OPERABLE, or placed in the tripped condition. If the channel is placed in the tripped condition, the affected functional unit trip coincidence will become 1 out of 3. One additional channel may be removed from service for up to 48 hours, provided one of the inoperable channes is placed in the tripped condition. Plant operation with an inoperable pressurizer high pressure reactor protection channel in the tripped condition is restricted because of the potential inadvertent opening of both pressurizer power operated relief valves (PORVs) if a second pressurizer high pressure reactor protection channel failed while the first channel was in the tripped condition. This plant operating restriction is contained in the Technical Requirements Manual.The reactor trip switchgear consists of eight reactor trip circuit breakers, which are operated in four sets of two breakers (four channels). Each of the four trip legs consists of two reactor trip circuit breakers in series. The two reactor trip circuit breakers within a trip leg are actuated by separate initiation circuits. For example, if a breaker receives an open signal in trip leg A, an identical breaker in trip leg B will also receive an open signal. This arrangement ensures that power is intenrupted to both Control Element Drive Mechanism buses, thus preventing a trip of only half of the control element assemblies (a half trip). Any one inoperable breaker in a channel will make the entire channel inoperable. The surveillance requirements specified for these systems ensure that the overall system functional capability is maintained comparable to the original design standards. TheseJ surveillance frequencies are controlled under the Surveillance Frequency Control Program.The surveillance testing verifies OPERABILITY of the RPS by overlap testing of the four interconnected modules: measurement channels, bistable trip units, RPS logic, and reactor trip circuit breakers. When testing the measurement channels or bistable trip units that provide an automatic reactor trip function, the associated RPS channel will be removed from service, MILLSTONE -UNIT 2 B 3/4 3-1 Amendment No.4-67-, 4-1-gg 4-98, 2-2-5, 2-82, Azkncl ...... N.., C lcttDz" 1 at- d 6/28,-f/'05I LBDCR 06-MP2-036 October 12, 2006 3/4.3 INSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF) INSTRUMENTATION (continued') declared inoperable, and ACTION Statement 2 of Technical Specification 3.3.1.1 entered. When testing the RPS logic (matrix testing), the individual RPS channels will not be affected. Each of the parameters within each RPS channel supplies three contacts to make up the 6 different logic ladders/matrices (AB, AC, AD, BC, BD, and CD). During matrix testing, only one logic matrix is tested at a time. Since each RPS channel supplies 3 different logic ladders, testing one ladder matrix at a time will not remove an RPS channel from the overall logic matrix. Therefore, matrix testing will not remove an RPS channel from service or make the RPS channel inoperable. It is not necessary to enter an ACTION Statement for any of the parameters associated with each RPS channel while performling matrix testing. This also applies when testing the reactor trip circuit breakers since this test will not remove an RPS channel from service or make the RPS channel inoperable. ACTION Statements for the RP'S logic matrices and RIPS logic matrix relays are required to be entered during matrix testing as these functional units become inoperable when the "HOLD" button is depressed during testing.The RIPS bypasses and their allowable values are addressed in footnotes to Table 3.3-1. They are I not otherwise addressed as specific table entries.0 The RPS automatic bypass removal features must function as a backup to manual actions for all safety related trips to ensure the trip functions are not operationally bypassed when the safety analysis assumes the functions are available. The RPS automatic bypass removal feature of all four operating bypass channels must be OPERABLE for each RIPS function with an operating bypass in the MODES addressed in the specific LCO for each function. All four bypass removal channels must be OPERABLE to ensure that none of the four RP'S channels are inadvertently bypassed.ACTION Statements 7 and 8 apply to the RPS bypass removal feature only. If the bypass enable function is failed so as to prevent entering a bypass condition, operation may continue.ACTION Statement 7 applies to one automatic bypass removal channel inoperable. If the bypass removal channel for any operating bypass cannot be restored to OPERABLE status, the associated RIPS channel may be considered OPERABLE only if the bypass is not in effect.Otherwise, the affected RP'S channel must be declared inoperable, as in ACTION Statement 2, and the bypass either removed or the bypass removal channel repaired. The allowed outage times are the same as for ACTION Statement 2.MILLSTONIE.-UNIIT2 B 3/4 3-la Amendment No. 2-2--, 3, 245-, 2-82, LBDCR 14-MiP2-016 September 4, 2014 3/4.3 INSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 PROTECTIVE ANT) ENGINEERED SAFETY FEATUIRES (ESE) INSTRUMENTATION (continued) ACTION Statement 8 applies to two inoperable automatic bypass removal channels. If the bypass removal channels cannot be restored to OPERABLE status, the associated RPS channel may be considered OPERABLE only if the bypass is not in effect. Otherwise, the affected RPS channels must be declared inoperable, and the bypass either removed or the bypass removal channel repaired. Also, ACTION Statement 8 provides for the restoration of the one affected automatic trip channel to OPERABLE status within the allowed outage time specified under ACTION Statement 2.ACTION Statements 7 and 8 contain the term "disable the bypass channel." Compliance with ACTION Statements 7 or 8 is met by placing or verifying the Zero Mode Bypass Switch(es) in"Off." No further action (i.e., key removal, periodic verification, etc.) is required. These switches are administratively controlled via station procedures; therefore the requirements of ACTION Statements 7 and 8 are continuously met.SR 4.3.1.1.2 and SR 4.3 .2.1.2 specify a CHANNEL FUNCTIONAL TEST of the bypass function and automatic bypass removal once within 92 days prior to each reactor startup. The total bypass function shall be demonstrated OPERABLE periodically during CHANNEL CALIBRATION testing of each channel affected by bypass operation. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL FUNCTIONAL TEST is similar to the CHANNEL FUNCTIONAL TESTS already required by SR 4.3.1.1.1 and SR 4.3.2.1.1, except the CHANNEL FUNCTIONAL TEST is applicable only to bypass functions and is performed once within 92 days prior to each startup. The MPS2 RPS is an analog system while the design of the MIPS2 ESFAS includes both an analog portion and a digital portion. With respect to the analog portion of the systems, a successful test of the required contact(s) of a channel relay may be perfonnted by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other TS tests at least once per refueling interval with applicable extensions. Proper operation of bypass permissives is critical during plant startup because the bypasses must be in place to allow startup operation and must be removed at the appropriate points during power ascent to enable certain reactor trips. Consequently, the appropriate time to verify bypass removal function OPERABILITY is just prior to start-up. The allowance to conduct this test within 92 days of startup is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation," which is referenced in NUREG-1432 and is applicable to MIPS2. Once the operating bypasses are removed, the bypasses must not fail in such a way that the associated trip function gets inadvertently bypassed. This feature is verified by the trip function CHANNEL FUNCTIONAL TESTS SR 4.3.1.1.1 and SR 4.3.2.1.1. Therefore, further testing of the bypass function after startup is unnecessary. MILLSTONE -UNIT 2 B343l mnmn o B 3/4 3-1b Amendment No. LBDCR 14-MIP2-016 September 4, 2014 3/4.3 TINSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF) INSTRUMENTATION (continued) The ESFAS includes four sensor subsystems and two actuation subsystems for each of the functional units identified in Table 3.3-3. Each sensor subsystem includes measurement channels and bistable trip units. Each of the four sensor subsystem channels monitors redundant and independent process measurement channels. Each sensor is monitored by at least one bistable.The bistable associated with each ESFAS Function will trip when the monitored variable exceeds the trip setpoint. When tripped, the sensor subsystems provide outputs to the two actuation subsystems. The two independent actuation subsystems each compare the four associated sensor, subsystem outputs. If a trip occurs in two or more sensor subsystem channels, the two-out-of-four automatic actuation logic will initiate one train of ESFAS. An Automatic Test Inserter (ATI), for which the automatic actuation logic OPERABILITY requirements of this specification do not apply, provides automatic test capability for both the sensor subsystems and the actuation subsystems. The provisions of Specification 4.0.4 are not applicable for the CI-ANNEL FUNCTIONAL TEST of the Engineered Safety Feature Actuation System automatic actuation logic associated with Pressurizer Pressure Safety Injection, Pressurizer Pressure Containment Isolation, Steam Generator Pressure Main Steam Line Isolation, and Pressurizer Pressure Enclosure Building Filtration for entry into MODE 3 or other specified conditions. After entering MODE 3, pressurizer pressure and steam generator pressure will be increased and the blocks of the ESF actuations on low pressurizer pressure and low steam generator pressure will be automatically removed. After the blocks have been removed, the CHANNEL FUNCTIONAL TEST of the ESF automatic actuation logic can be performed. The CHANNEL FUNCTIONAL TEST of the ESF automatic actuation logic must be perfonrned within 12 hours after establishing the appropriate plant conditions, and prior to entry into MODE 2.The periodic measurement of response time provides assurance that the protective and ESF action function associated with each channel is completed within the time limit assumed in the accident analyses. These surveillance frequencies are controlled under the Surveillance Frequency Control Program. No credit was taken in the analyses for those channels with response times indicated as not applicable. The Reactor Protective and Engineered Safety Feature response times are contained in the Millstone Unit No. 2 Technical Requirements Manual. Changes to the Technical Requirements Manual require a 10OCFR5O.59 review as well as a review by the Site Operations Review Cormnittee. MILLSTONE -UNIT 2 B343i mnmn o B 3/4 3-1e Amendment No. LBDCR 04-MP2-016 February 24, 2005 INSTRUMENTATION BASES 3/4.3.1 AND 3/4.3.2 PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESF)INSTRUMENTATION (Continued) SRAS LOGIC MODIFICATION ACTION Statement 4 of Table 3.3-3, which applies only to the SRAS logic, specifies that during surveillance testing the second inoperable channel must also be placed in the bypassed condition. For the SRAS logic, placing the second inoperable channel in the tripped condition (as in ACTION Statement

2) could result in the false generation of a SRAS signal due to an additional failure which causes a trip signal in either of the remaining channels at the onset of a LOCA. The false generation of the SRAS signal leads to unacceptable consequences for LOCA mitigation.

With ACTION Statement 4, during the two-hour period when two channels are bypassed, no additional failure can result in the false generation of the SRAS signal. However, an additional failure that prevents a trip of either of the two remaining channels may prevent the generation of a true SRAS signal while in this ACTION Statement. If no SRAS is generated at the appropriate time, operating procedures instruct the operator to ensure that the SRAS actuation occurs when the refueling water storage tank level decreases. Due to the limited period of vulnerability, and the existence of operator requirements to manually initiate an SPAS if an automatic initiation does not occur, this risk is considered acceptable. STEAM GENERATOR BLOWDOWN ISOLATION Automatic isolation of steam generator blowdown will occur on low steam generator water level. An auxiliary feedwater actuation signal will also be generated at this steam generator water level. Isolation of steam generator blowdown will conserve steam generator water inventory following a loss of main feedwater. SENSOR CABINET POWER SUPPLY AUCTIONEERING The auctioneering circuit of the ESFAS sensor cabinets ensures that two sensor cabinets do not de-energize upon loss of a D.C. bus, thereby resulting in the false generation of an SRAS.Power source VA-10 provides normal power to sensor cabinet A and backup power to sensor cabinet D. VA-40 provides normal power to sensor cabinet D and backup power to cabinet A.Power sources VA-20 and VA-30 and sensor cabinets B and C are similarly arranged.If the normal or backup power source for an ESFAS Sensor Cabinet is lost, two sensor cabinets would be supplied from the same power source, but would still be operating with no subsequent trip signals present. However, any additional failure associated with this power source would result in the loss of the two sensor cabinets, consequently generating a false SPAS.The 48-hour ACTION Statement ensures that the probability of a ACTION Statement and an additional failure of the remaining power source, while in this ACTION Statement is sufficiently small.MILLSTONE -UNIT 2 B 3/4 3-2 Amendment No. 4-5-7, 4-7-9, -226, 5, Acknowledged by NRC letter dated 6128105 LBDCR 09-MP2-013 July 7, 2009 BASES(Continued) 3/4.3.3 MONITORING INSTRUMENTATION 3/4.3.3.1 RADIATION MONITORING INSTRUMENTATION The OPERABILITY of the radiation monitoring channels ensures that 1) the radiation levels are continually measured in the areas served by the individual channels and 2) the alarm or automatic action is initiated when the radiation level trip setpoint is exceeded.The analyses for a Steam Generator Tube Rupture, Waste Gas System Failure, Cask Tip and Fuel Handling Accident credit the control room ventilation inlet duct radiation monitors with closure of the Unit 2 control room isolation dampers. In the event of a single failure in either channel (1 per train), the control room isolation dampers automatically close. The response time test for the control room isolation dampers includes signal generation time and damper closure.The response time for the control room isolation dampers is maintained within the applicable facility surveillance procedure. The containment airborne radiation monitors (gaseous and particulate) provide early indication of leakage from the Reactor Coolant System as specified in Technical Specification 3.4.6.1.MILLSTONE -UNIT 2 B 3/4 3-2a Amendment No. 4-5-7-, 4-7-9, -2~--, 30, 2-28-, 284, LBDCR 14-MP2-016 September 4, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.3 RELIEF VALVES (Continued) discovered to be inoperable, or if both block valves are discovered to be inoperable at the same time. In the event of a loss of feedwater, the PORVs would be used to remove core heat. In order to minimize the consequences of a loss of feedwater while two block valves are inoperable, Required Action e. 1 requires that LCO 3.7.1.2, "Auxiliary Feedwater Pumps," be verified to be met within 1 hour. The inoperability of two block valves during the 8 hour allowed outage time has been shown to be acceptable based on the infrequent use of the Required Actions and the small incremental effect on plant risk (Ref. 1).SURVEILLANCE REQUIREMENT 4.4.3.1 .C requires operating each PORV through one complete cycle of full travel at conditions representative of MODES 3 or 4. This is nonnally perfonned in MODE 3 or 4 as the unit is descending in power to commence a refueling outage.This test will normally be a static test, whereby a P0RV will be exposed to MODE 3 or 4 temperatures, the block valve closed, and the PORV tested to verifyr it strokes through one complete cycle of full travel. PORV cycling demonstrates its function. SURVEILLANCE REQUIREMENT 4.4.3.1 .C is consistent with the NRC staff position outlined in Generic Letter 90-06, which requires that the PORV stroke test be performed at conditions representative of MODE 3 or 4. The surveillance frequency is controlled under the Surveillance Frequency Control Program. Testing in the manner described is also consistent with the guidance in NI-REG 1482,"Guidelines for Inservice Testing at Nuclear Power Plants," Section 4.2.10, that describes the PORVs function during reactor startup and shutdown to protect the reactor vessel and coolant system from low-temperature overpressurization conditions, and indicates they should be exercised before system conditions warrant vessel protection. If post maintenance retest is warranted, the affected valve(s) will be stroked under amabient conditions while in Mode 5, 6, or defueled. A Hot Functional Test is required to be performed in MODE 4 prior to entry into MODE 3. The actual stroke time in the open? and close direction will be measured, recorded and compared to the test results obtained during pre-installation testing to assess acceptability of the affected valve(s).SURVEILLANCE REQUIREMENT 4.4.3.2 verifies that a block valve(s) can be closed if necessary. This SURVEILLANCE REQUIREMENT is not required to be performed with the block valve(s) closed in accordance with the ACTIONS of TS 3.4.3. Opening the block valve(s)in this condition increases the risk of an unisolable leak from the RCS since the PORV(s) is already inoperable. REFERENCE 1. WCAP-16 125-NP-A, "Justification for Risk-Infonned Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B 3/4 4-2b Amendment No. 2a2, 3-7-, 5, 66, 8-, 444,1---2-1-, 4-3g, 94 LBDCR 14-MVP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.4 PRESSURIZER An OPERABLE pressurizer provides pressure control for the reactor coolant system during operations with both forced reactor coolant flow and with natural circulation flow. The minimum water level in the pressurizer assures the pressurizer heaters, which are required to achieve and maintain pressure control, remain covered with water to prevent failure, which occurs*if the heaters are energized uncovered. The maximum water level in the pressurizer ensures that this parameter is maintained within the envelope of operation assumed in the safety analysis. The maxfimum water level also ensures that the RCS is not a hydraulically solid system and that a steam bubble will be provided to accommodate pressure surges during operation. The steam bubble also protects the pressurizer code safety valves and power operated relief valve against water relief. With pressurizer water level not within the limit, action must be taken to restore the plant to operation within the bounds of the safety analyses. To achieve this status, the unit must be brought to at least HOT STANDBY with the reactor trip breakers open within 6 hours and in HOT SHUTDOWN within the following 6 hours. This takes the plant out of the applicable MODES and restores the plant to operation within the bounds of the safety analyses. The requirement that a minimum number of pressurizer heaters be OPERABLE enhances the capability of the plant to control Reactor Coolant System pressure and establish and maintain natural circulation. If two required groups of pressurizer heaters are inoperable, restoring at least one group of pressurizer heaters to OPERABLE status is required within 24 hours. The Condition is modified by a Note stating it is not applicable if the second group of required pressurized heaters is intentionally declared inoperable. The Condition is not intended for voluntary removal of redundant systems or components from service. The Condition is only applicable if one group of required pressurized heaters is inoperable for any reason and the second group of required pressurized heaters is discovered to be inoperable, or if both groups of required pressurized heaters are discovered to be inoperable at the same time. If both required groups of pressurizer heaters are inoperable, the pressurizer heaters may not be available td help maintain subcooling in the RCS loops during a natural circulation cooldown following a loss of offsite power. The inoperability of two groups of required pressurizer heaters during the 24 hour allowed outage time has been shown to be acceptable based on the infrequent use of the Required Action and the small incremental effect on plant risk (Ref. 1).The requirement for two groups of pressurizer heaters, each having a capacity of 130 kW, is met by verifying the capacity of the pressurizer proporlional heater groups 1 and 2. Since the pressurizer proportional heater groups 1 and 2 are supplied from the emergency 480V electrical buses, there is reasonable assurance that these heaters can be energized during a loss of off'site power to maintain natural circulation at HOT STANDBY.REFERENCE 1. WCAP- 161 25-NP-A, "Justification for Risk-Infonrmed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B3442 mnmn o B 3/4 4-2c Amendment No. I NSTRUMENTAT ION July 13, 1g99 BASES 3/4.3.3.2 -DELETED 3/4.3.3.3 -DELETED 3/4.3.3.4 -DELETED 3/4.3,3.5 REMOTE SHUTDOWN INSTRUMENTATION The OPERABILITY of the remote shutdown instrumentation ensures that sufficient -capability is available to permit shutdown and maintenance of HOT SHUTDOWN of the facility from locations outside of the control room. This capability is required in the event control room habitability is lost and is consistent with General Design Criteria 19 of 10 CFR 50.MILLSTONE -UNIT 2 e 3/4 3-3 MILLTON -NIT2 B3/43-3Amendment N~o XF, 237 November 3, 1995 INSTRUMENTATI ON BASES 3/4.3.3.6 DELETED 3_/4.3.3.7 DELETED 3L/4.3.3,8 Accident Monitoring Instrumentation The OPERABILITY of the accident monitoring instrumentation ensures that sufficient information is available on selected plant parameters to monitor and assess these variables during and following an accident. This capability is consistent with the recommnendations of NUREG-0578, "TMI-2 Lessons Learned Task Force Status Report and Short-Term Reconvnendations". 0:I MILLSTONE -UNIT 2 01 .B 3/4 3-4191 November 28, 2000 THIS PAGE INTENTIONALLY LEFT BLANK OMILLSTONE -UNIT 2 B 3/4 3-5 MILLTON -N~t2 B3/43-5Amendment No. 4-04, 5, 250 LBDCR 04-MP2-0 11 December 8, 2005 INSTRUMENTATION BASES 3/4.3.3.9 -DELETED 3/4.3.3.10 -DELETED 3/4.3.4 -DELETED MILLSTONE-UNIT 2 B 3/4 3-6 MILSTOE -UXIT B /4 -6Amendment No. 4-04, 24-5, 5, 84, May 1, 2002 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION The plant is designed to operate with both Reactor Coolant System (RCS) loops and associated reactor coolant pumps (RCPs) in operation, and maintain the DNBR above the 95/95 limit for the DN-B correlation during all normal operations and anticipated transients. In MODES 1 and 2, both RCS loops and associated RCPs are required to be OPERABLE and in operation. In MODE 3 , a single RCS loop with one RCP and adequate steam generator secondary water inventory provides sufficient heat removal capability. However, both RCS loops with at least one RCP per loop are required to be OPERABLE to provide redundant paths for decay heat removal. In addition, as a minimum, one RCS loop must be in operation. Any exceptions to these requirements are contained in the LCO Notes.In MODE 4, one RCS loop with onae RCP and adequate steam generator secondary water inventory, or one shutdown cooling. (SDC) train provides sufficient heat removal capability. However, two loops or trains, consisting of any combination of RCS loops or SDC trains, are required to be OPERABLE to provide redundant paths for decay heat removal. In addition, as a minimum, one RCS loop or SDC train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.In MODES 3 and 4 , an OPERABLE RCS loop consists of the RCS loop, associated steam generator, and at least one RCP. The steam generator must have sufficient secondary water inventory for heat removal.In MODE 5, with the RCS loops filled, the SDC trains are the primary means of heat removal. One SDC train provides sufficient heat removal capability. However, to provide redundantpaths for decay heat removal either two SDC trains are required to be OPERABLE, or one SDC train is required to be OPERABLE and both steam generators are reqtiired to have adequate steam generator secondary water inventory. In addition, as a minimum, one SDC train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.By maintaining adequate secondary water inventory and makeup capability, the steam generators will be able to support natural circulation in the RCS loops. In addition, the ability to pressurize and control RCS pressure is necessary to support RCS natural circulation. If the pressurizer steam bubble has been collapsed and the RCS has been depressurized or drained sufficiently that voiding of the steam generator U-tubes may have occurred, the RCS loops should be considered not filled unless ana evaluation is performed to verify the ability of the RCS to suppornt natural circulation. If the RCS loops are considered not filled, the RCS must be refilled, pressurized, and the RCPs bumped (unless a vacuum fill of the RCS was performed) before the RCS loops can be considered filled.In MODE 5, with the RCS loops not filled, the SDC trains are the only means of heat removal. One SDC train provides sufficient heat removal capability. However, to provide redundant paths for decay heat removal, two SDC trains are required to be OPERABLE. In addition, as a mininmumn, one SDC MILLSTONE -UNIT 2 B 3/4 4-1 Revised by NRC Letter A15689 Amendment No. &O, 6-6, 69, 9, 24--I8, 2n19, LBDCR 15-MP2-003 March 26, 2015 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued') train must be in operation. Any exceptions to these requirements are contained in the LCO Notes.An OPERABLE SDC train, for plant operation in MODES 4 and 5, includes a pump, heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine RCS temperature. The flow path starts at the RCS hot leg and is returned to the RCS cold legs.In MODE 4, an OPERABLE SDC train consists of the following equipment:

1. An OPERABLE SDC pump (low pressure safety injection pump);2. The associated SDC heat exchanger from the same facility as the SDC pump;3. The associated reactor building closed cooling water loop from the same facility as the SDC pump;4. The associated service water loop from the same facility as the SDC pump; and 5. All valves required to support SDC System operation are in the required position or are capable of being placed in the required position.In MODE 4, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchangers, 2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headers and 2 SW headers are required to support the SDC heat exchangers, consistent wvith the requirements of Technical Specifications 3.7.3.1 and 3.7.4.1.In MODE 5, an OPERABLE SDC ti-ain consists of the following equipment:

1. An OPERABLE SDC pump (low pi'essure safety injection pump);2. The associated SDC heat exchanger fr'om the same facility as the SDC pump;3. An: RBCCW pump, powered from the same facility as the SDC pump, and RBCCW heat exchanger capable of cooling the associated SDC heat exchanger;

4. A SW pump, powered from the same facility as the SDC pump, capable of supplying cooling water to the associated RBCCW heat exchanger; and 5. All valves required to support SDC System operation are in the required position or are capable of being placed in the required position MILLSTONE -UNIT 2 B 3/4 4-la Rovisod. ,by1:rr NR Lot. ^tcrM5GS Amendment No. 5-0, 66, 69-9, 4--, 2-i-s, LBDCR 06-MP2-030 September 14, 2006 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued)

In MODE 5, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchangers, 2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headers are required to provide cooling to the SDC heat exchangers, but only 1 SW header is required to support the SDC trains. The equipment specified is sufficient to address a single active failure of the SDC System and associated support systems.In addition, twvo SDC trains can be considered OPERABLE, with only one 125-volt D.C.bus train OPERABLE, in accordance with Limiting Condition for Operation (LCO) 3.8.2.4. 2-SI-306 and 2-SI-657 are b~oth p.ow..r~ed:. from.the~same 125.-volt D.C. bus, on Facility I. Should.these .~e~ikndr~&i w~P~oidnkneb lge to c o ol thf RCS:.-: ttowever~a ldesignated': operator.isqas~signed~ toTeposi~ti~orrth~e al~e as ness'ary in thd: &v~rit*125-volt D.C. power is lost. Consistent with the bases for LCO 3.8.2.4, the 125-volt D.C. support system operability requirements for both trains of SDC are satisfied in MODE 5 with at least one 125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied. The operation of one Reactor Coolant Pump or one shutdown cooling pump provides adequate..flow t stratificati~on _anproduce~graduat reacti~v4iy changes..... during boron concentration reductions in the Reactor Coolant System. The reactivity change rate associated with boron reductions will, therefore, be within the capability of operator recognition and control. : The restrictions on starting a Reactor Coolant Pump in MODE 4 with one or more RCS cold legs < 275°F and in MODE 5 are provided to prevent RCS pressure transients, caused by energy additions from the secondary system, which could exceed the limits of Appendix G to 10 CFR Part 50. The RCS will be protected against overpressure transients and will not exceed the limits of Appendix G by: 1. Restricting pressuriz'er water volume to ensure sufficient steam volume is available to accommodate the insurge;: 2. Restricting pressurizer pressure to establish an initial pressure that will ensure system pressure does not exceed the limit; and 3. Restricting primary-to secondary system delta-T to reduce the energy addition from the secondary system.If these restrictions are met, the steam bubble in the pressurizer is sufficient to ensure the Appendix G limits will not be exceeded. No credit has been taken for PORV actuation to limit RCS pressure in the analysis of the energy addition transient. MILLSTONE -UNIT 2 B 3/4 4-lb Amendment No. -50, 66, 69, 41-39, 2---8, :28 Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030 September 14, 2006 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued) The limitations on pressurizer water level, pressurizer pressure, and primary to secondary delta-T.are necessary to ensure the validity of the analysis of the energy addition due to starting an RCP.The values for pressurizer water level and pressure can be obtained from control room indications. The. primary to secondary system delta-T can be obtained from Shutdown Cooling (SDC) System outlet temperature and the saturation temperature for indicated steam generator pressure. If there is no indicated steam generator pressure, the steam generator shell temperature indicators can be used. If these indications are not available, other appropriate instrumentation can be used.Th~e ROP starting:gi--riiriavalu~s for pressui'izer water level; pressurizer-pressure, and primairy to adjusted for instrument uncertainty. The values for these parameters contained in the procedures that will be used to start an RCP have been adjusted to compensate for instrument uncertainty. The value of RCS cold leg temperature (_< 275 0 F ) used to determine if the RCP start criteria applies, will be obtained from SDC return temperature if SDC is in service. If SDC is not in servdc~e,_oranatural..cireculation~is.nccurrng, .RCS~cold ieg.temp eraturewiUlbenuse~cL ................. Average Coolant Temperature (Tavg) values are derived under the following 3 plant conditions, using the designated formula as appropriate for use in Unit 2 operating procedures.

• RCP Operation: (Tcold1 + Tcold2 + ThotI + Thot2) / 4 = Tv Natural circulation only flow: (Tcodld + Tcold2 + Thotl + Thot2) / 4 =Tv*SDC flow greater than 1000 gpm: (SDCoutiet

+/- SDC 1 inlt) / 2 =Tavg (exception: Tavg is not expected to be calculated by this definition during the initial portion of the initiation phase of SDC. The transition point from loop temperature average to SDC system average during cooldowns is when T3 51 Y decreases below Loop Tcold) ...During operation with one or more Reactor Coolant Pumps (RCPs) providing forced flow and during natural circulation conditions, the, loop Resistance Temperature Detectors (RTDs)represent the inlet and outlet temperatures of the reactor and hence the average temperature of the water that the reactor is exposed to. This holds during concurrent RCP/SDC operation also.MILLSTONE -UNIT 2 B 3/4 4-1c Amendment No. 50, 66, 69, 4-3~9, l-, 248, 249, Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030 September 14, 2006 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 COOLANT LOOPS AND COOLANT CIRCULATION (continued) During Shutdown Cooling (SDC) only operation, there is no significant flow past the loo1p RTDs. Core inlet and outlet termperatures are accurately measured during those conditions by using T351lY, SDC return to RCS temperature indication, and T351 X, RCS to SDC temperature indication. The average of these two indicators provides a temperature that is equivalent to the average RCS temperature in the core.During the transition from Steam Generator (SG) and SDC heat removal to SDC only heat removal, actual core average temperature results from a mixture of both SDC flow and loop flow" from T~his ,m.ch~e t!ime co~oling :is .in iti~ated.u~ntil!.$S.G calculatedck However, the .average o~f t~he ,stil;toappropriate, fo r use."Thi-s; .'provides a straightforward process for determining Tavg.During some transient conditions, such as heatups on SDC, the value calculated by this average definition will be slightly higher than the actual core aiverage. During other transients, such as cooldowns where SG heat removal~is Still taking place causing some natural circulation conditions. For the purpose of determining MODE changes and technical specification applicability, these transient condition results are conservative. The Notes in LCOs 3.4.1.2, 3.4.1.3, 3.4.1.4, and 3.4.1.5 permit a limited period of operation without RCPs and shutdown cooling pumps. All RCPs and shuitdown cooling pumps may be removed from operation for _< 1 hour per 8 hour period. This means thatnatural circulation has been established. When in natural circulation,-a reduction in boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1.1t is maintained is prohibited because an even concentration distribution throughout the RCS cannot be ensured.Core outlet temperature is to be maintained at least 10°F below the saturation temperature so that no vapor bubble may form and possibly cause a natural circulation flow obstruction. Concerning TS 3.4.1.2, ACTION b.; 3.4.1.3, ACTION c.; 3.4.1.4, ACTION b.; and 3.4.1.5, ACTION b., if two required loops or trains are inoperable or a required loop or train is not in operation except during conditions permitted by the note in the LCO section, all operations involving introduction of coolant into the RCS with boron concentration less than requiredto meet the minimum SDM of LCO 3.1.1.1 must be suspended and action to restore one RCS loop or SDC train to OPERABLE status and operation must be initiated. The required margin to criticality must not be reduced in this type of operation. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDMo~f LCO 3.1. 1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron MILLSTONE -UNIT 2 B 3/4 4-1d Amendment No. gO, 66, 69, 4-3-9, 8, 248, 249, , Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-030 September 14, 2006 3/44SEACOSOLATSSE BASES 3/4A. 1 COOLANT LOOPS AND COOLANT CIRCULATION (continued) concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immnediate completion time~s reflect the, importance of decay heat removal. The ACTION to restore must continue until one ioop or train is restored to operation.* Technical Specification 3.4.1.6 limits the number of reactor co~olant pumps that may be*operational during MODE 5. This will limit the pressure drop across the core when the pumps are operated during low-temperature conditions. Controlling the pressure drop across the core. will maintain maximum RCS pressure within the maximum allowable pressure as calculated in Code Case.No.,,,N-I14. ..Limi~ting two rea~cto~r-..coo1!ptrp~!s. .Qpop..r~tatw~h~e.n.theiRC.S cold-..{.e.. " not exce~eded. .'.Surveillanee, 4,;#:4A 6-.supportw:this-requirement. ... .. ..3/4.4.2 SAFETY VALVES The pressurizer code safety valves operate toprevent the RCS from being, pressurized. above its Safety Limit of 2750 psia. Each safety valve is designed to relieve 296,000 lbs per hour of saturated steam at the valve setpoint. The relief capapcty of a ingles.~fety valve is adequate to_relieve any overpressure condition which could occur during shutdown. If any pressurizer code safety valve is inoperable, and cannot be restored to OPERABLE status, the ACTION statement requires the plant to be shut down and cooled down such that Technical Specification 3.4.9.3 will become applicable and require the Low Temperature Overpressure Protection System to be placed in service to provide overpressure protection MILLSTONE -UNIT 2 B 3/4 4-1e Amendment No. 93-, Acknowledged By NRC July 5, 2007 LBDCR 04-MP2-016 February 24, 2005 3/4.4 REACTOR COOLANT SYSTEM BASES During operation, all pressurizer code safety valves must be OPERABLE to prevent the RCS from being pressurized above its safety limit of 2750 psia. The combined relief capacity of these valves is sufficient to limit the Reactor Coolant System pressure to within its Safety Limit of 2750 psia following a complete loss of turbine generator load while operating at RATED THIERMAL POWER and assuming no reactor trip until the first Reactor Protective System trip setpoint (§Pressurizer Pressure-High) is reached (i.e., no credit is taken for a direct reactor trip on the loss of turbine) and also assuming no operation of the pressurizer power operated relief valve or steam dumrp valves.3/4.4.3 RELIEF VALVES The power operated relief valves (PORVs) operate to relieve RCS pressure below the setting of the pressurizer code safety valves. These relief valves have remotely operated block valves to provide a positive shutoff capability should a relief valve become inoperable. The electrical power for both the relief valves and the block valves is capable of being supplied from an emergency power source to ensure the ability to seal this possible RCS leakage path.The PORVs are also used for low temperature overpressure protection when the RCS is cooled down to or below 275 0 F. This is covered by Technical Specification 3.4.9.3 and discussed in the respective Bases section. The discussion below only addresses the PORVs in MODES 1, 2 and 3.With the PORV inoperable and capable of being manually cycled, either the PORV must be restored, or the flow path isolated within 1 hour. The block valve should be closed, but the power must be maintained to the associated block valve, since removal of power would render the block valve inoperable. Although the PORV mnay be designated inoperable, it may be able to be manually opened and closed and in this manner can be used to perform its function. PORV inoperability may be due to seat leakage, instrumentation problems, aiutomatic control problems, or other causes that do not prevent manual use and do not create a possibility for a small break LOCA. Operation of the plant may continue with the PORV in this inoperable condition for a limited period of time not to exceed the next refueling outage, so that maintenance can be perfolrmed on the PORVs to eliminate the degraded condition. The PORVs should normally be available for automatic mitigation of overpressure events when the plant is at power.Quick access to the PORV for pressure control can be made when power remaints on the closed block valve.If one block valve is inoperable, then it must be restored to OPERABLE status, or the associated PORV prevented from opening automatically. The prime irnportance for the capability to maintain closed the block valve is to isolate a stuck open PORV. Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour, the required ACTION is to prevent the associated PORV from automatically opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable. This may be accomplished by MILLSTONE -UNIT 2 B 3/4 4-2 Amendment No. O, 46,469., 9, 2---8, Acknowledged by NRC letter dated 6128105 LBDCR 14-MP2-001 May 20, 2014 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.3 RELIEF VALVES (Continued) various methods. These methods include, but are not limited to, placing the NORMVAL/ISOLATE switch at the associated Bottle Up Panel in the "ISOLATE" position or pulling the control power fuses for the associated PORV control circuit.Although the block valve may be designated inoperable, it may be able to be manually opened and closed and in this manner can be used to perform its function. B lock valve inoperability may be due to seat leakage, instrumentation problems, or other causes that do not prevent manual use and do not create a possibility for a small break LOCA. This condition is only intended to permit operation of the plant for a limited pei'iod of time. The block valve should normally be available to allow PORV operation for automatic mitigation of overpressure events. The block valves must be returned to OPERABLE status prior to entering MODE 3 after a refueling outage.If two PORVs are inoperable and not capable of being manually cycled, it is necessary to isolate the flow path by closing and removing the power to the associated block valves within 1 hour and to restore at least one PORV within 8 hours. The Condition is modified by a Note stating it is not applicable if the second PORV train is intentionally declared inoperable. The Condition does not apply to voluntamy¢ removal of redundant systems or components from service. The Condition is applicable if one PORV is inoperable for any reason and the second PORV is discovered to be inoperable, or if both PORVs are discovered to be inoperable at the same time.In the event of a loss of feedwater, the PORVs would be used to remove core heat. In order to minimize the consequences of a loss of feedwater while two PORVs are inoperable, Required Action c.3 requires that LCO 3.7.1.2, "Auxiliary Feedwater Pumps," be met to ensure AFEW is available. The inoperability of two PORVs during the 8 hour allowed outage time has been shown to be acceptable based on the infrequent use of the Required Action and the Small incremental effect on plant risk (Ref. 1). If one PORV is restored and one PORV remains inoperable, then the plant will be in Condition

b. with the time clock started at the original declaration of having two P ORVs inoperable.

If two block valves are inoperable, it is necessary to .restore at least one block valve to OPERABLE status within 8 hours. The Condition is modified by a Note stating it is not applicable if the second block valve is intentionally declared inoperable. The Condition does not apply to voluntary removal of redundant systems or components fr'Qm service. The Condition is only applicable if one block valve is inoperable for any reason and the second block valve is MILLSTONE -UNIT 2 B 3/4 4-2a Amendment No. 2, 3-, 66, 9-7, I-8-, 2-l8, 2461-LBDCR 14-MP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES.3/4.4.3 RELIEF VALVES (Continued) discovered to be inoperable, or if both block valves are discovered to be inoperable at the same time. In the event of a loss of feedwater, the PORVs would be used to remove core heat. In order to minimize th~e consequences of a loss of feedwater while two block valves are inoperable, Required Action e. 1 requires that LCO 3.7.1.2, "Auxilia1iy Feedwater Pumps," be verified to be met within 1 hour. The inoperability of two block valves during the 8 hour allowed outage time has been shown to be acceptable based on the infrequent use of the Required Actions and the small incremental effect on plant risk (Ref. 1).SURVEILLANCE REQUIREMENT 4.4.3.l.c requires operating each PQRV through one complete cycle of full travel at conditions representative of MODES 3 or 4. This is normnally performed in MODE 3 or 4 as the unit is descending in power to colmmence a refueling outage.This test will normally be a static test, whereby a PORV will be exposed to MODE 3 or 4 temperatures, the block valve closed, and the PORV tested to verify it strokes through one complete cycle of full travel. PORV cycling demonstrates its function. The Frequency of 18 months is based on a typical refueling cycle and industry accepted practice. SURVEILLANCE REQUIREMENT 4.4.3.1 .c is consistent with the NRC staff position outlined in Generic Letter 90-06, which requires that the 18-month PORV stroke test be performed at conditions representative of MODE 3 or 4. Testing in the manner described is also consistent with the guidance in NUREG 1482, "Guidelines for Inservice Testing at Nuclear Power Plants," Section 4.2.10, that describes the PORVs function during reactor startup and shutdown to protect the reactor vessel and coolant system from low-temperature overpressurization conditions, and indicates they should be exercised before system conditions warrant vessel protection. If post maintenance retest is warranted, the affected valve(s) will be stroked under amabient conditions while in Mode 5, 6, or defueled. A Hot Functional Test is required to .be performed in MODE 4 prior to entry into MODE 3. The actual stroke time in the open and close direction will be measured, recorded and compared to the test results obtained during pre-installation testing to assess acceptability of the affected valve(s).SURVEILLANCE REQUIREMENT 4.4.3.2 verifies that a block valve(s) can be closed if necessary. This SURVEILLANCE REQUIREMENT is not required to be perform~ed with the block valve(s) closed in accordance with the ACTIONS of TS 3.4.3. Opening the block valve(s)in this condition increases the risk of an unisolable leak fr'om the RCS since the PORV(s) is already inoperable. REFERENCE 1. WCAP-16 125-NP-A, "Justification for Risk-Informed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -U/NIT 2 B 3/4 4-2b Amendment No. -22, .3-7, g-2, 66, 89,-14-1, -t2-1, 3-, -t94 LBDCR 14-MiP2-001 Mlay 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.4 PRESSURIZER An OPERABLE pressurizer provides pressure control for the reactor coolant system during operations with both forced reactor coolant flow and with natural circulation flow. The minimum water level in the pressurizer assures the pressurizer heaters, which are required to achieve and maintain pressure control, remain covered with water to prevent failure, which occurs if the heaters are energized uncovered. The maximum water level in the pressurizer ensures that this parameter is maintained within the envelope of operation assumed in the safety analysis. The maximum water level also ensures that the RCS is not a hydraulically solid system and that a steam bubble will be provided to accommodate pressure surges during operation. The steam bubble also protects the pressurizer code safety valves and power operated relief valve against water relief. With pressurizer water level not within the limit, action must be taken to restore the plant to operation within the bounds of the safety analyses. To achieve this status, the unit must be brought to at least HOT STANDBY with the reactor trip breakers open within 6 hours and in HOT S1{UTDOWN within the following 6 hours. This takes the plant out of the applicable MODES and restores the plant to operation within the bounds of the safety analyses. The requirement that a minimum number of pressurizer heaters be OPERABLE enhances the capability of the plant to control Reactor Coolant System pressure and establish and maintain natural circulation. If two required groups of pressurizer heaters are inoperable, restoring at least one group of pressurizer heaters to OPERABLE status is required within 24 hours. The Condition is modified by a Note stating it is not applicable if the second grohp of requi-ed pressurized heaters is intentionally declared inoperable. The Condition is not intended for voluntary removal of redundant systems or components from service. The Condition is only applicable if one group of required pressurized heaters is inoperable for any reason and the second group of required pressurized heaters is discovered to be inoperable, or if both groups of required pressurized heaters are discovered to be inoperable at the same time. If both required groups of pressurizer heaters are inoperable, the pressurizer heaters may not be available to help maintain subcooling in the RCS loops during a natural circulation c ooldown following a loss of' offsite power. The inoperability of two groups of required pressurizer heaters during the 24 hour" allowed outage timae has been shown to be acceptable based on the infrequent use of the Required Action and the small incremental effect on plant risk (Ref. 1).The requirement for two groups of pressurizer heaters, each having a capacity of 130 kW, is met by verifying the capacity of the pressurizer proportional heater groups 1 and 2. Since the pressurizer proportional heater groups 1 and 2 are supplied fr'om the emergency 480V electrical buses, there is reasonable assurance that these heaters can be energized during a loss of offsite power to maintain natural circulation at HOT STANDBY.REFERENCE 1. WCAP-1 6125-NP-A, "Justification for Risk-Informed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2B /42AmnetNo B 3/4 4-2c Amendment No. LBDCR 14-MP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY LCO The LCO requires that steam generator (SG) tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the plugging criteria be plugged in accordance with the Steam Generator Program.During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging. If a tube was determined to satisfy the plugging criteria but was not plugged, the tube may still have tube integrity. In the context of this Specification, a SG tube is defined as the entire length of the tube, including the tube wall between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 6.26, "Steam Generator Program," and describe acceptable SG tube performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria. There are three SG perfolniance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.The structural integrity performance criterion provides a mar'gin of safety against tube burst or collapse under nonanal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as,"The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area inc~reased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance onassessing loads that have a significant effect on burst or collapse. In that context, the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumnferential degradation, axial thermaal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primalmy or secondary loads will be evaluated on a case-by-case basis. The division between primary and secondary classifications will be based on detailed analysis and/or testing.MILLSTONE -UNIT 2 B3442 mnmn o B 3/4 4-2d Amendment No. LBDCR 14-MVP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) LCO (Continued) Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormaal conditions) transients included in the design specification. This includes safety factors and applicable design basis loads based on ASME Code, Section III, Subsection NB (Reference

4) and Draft Regulatory Guide 1.121 (Reference 5).The accident induced leakage performance criterion ensures that the primary to secondaiy' LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions.

The accident analysis assumes that accident induced leakage does not exceed 150 GPD per SG. The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in LCO 3.4.6.2, "Reactor Coolant System Operational LEAKAGE," and limits primary' to secondary LEAKAGE through any one SG to 75 gallons per day. This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative. APPLICABILITY Steam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced during MODES 1, 2, 3, and 4.RCS conditions are far less challenging during MODES 5 and 6 than during MODES 1, 2, 3, and 4. During MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.ACTIONS The ACTIONS are modified by a NOTE clarifying that the ACTIONS may be entered independently for each SG tube. This is acceptable because the ACTIONS provide appropriate conmpensatory actions for each affected SG tube. Complying with the ACTIONS may allow for continued operation, and subsequent affected SG tubes are governed by subsequent ACTION entry and application of associated ACTIONS.MILLSTONE -UNIT 2 B 3/4 4-2e Amendment No. LBDCR 14-MP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) ACTIONS (Continued) a.1 and a.2 ACTION a. applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube plugging criteria but were not plugged in accordance with the Steam Generator Program as required by TS 4.4.5.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG perfonmance criteria described in the Steam Generator Progr'am. The SG plugging criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the thne the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, ACTION b. applies.A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity. If the evaluation determines that the affected tube(s) have tube integrity, ACTION a.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection intearval continues to be supported by an operational assessment that reflects the affected tube(s). However, the affected tube(s) must be plugged prior to entering HOT SHUTDOWN following the next refueling outage or SG inspection. This Completion Time is ,acceptable since operation until the next inspection is supported by the operational assessment. b.1 and b.2 If the ACTIONS and associated Completion Times of ACTION a. are not met or if SG tube integrity is not being maintained, the reactor must be brought to HOT STANDBY within 6 hours and COLD SHUTDOWN within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.MIILLSTOKE -UITh2 B/4 mnmn o B 3/4 4-2f LBDCR 14-MIP2-001 May 20, 2014 REACTOR. COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) SURVEILLANCE REQUIREMENTS TS 4.4.5.1 During shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Progr'am Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices. During S G inspections a condition monitoring assessment of the S G tubes is performed. The condition monitoring assessment determines the "as found" condition of the SG tubes. The purpose of the. condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.The Steam Generator Program determnines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube plugging criteria. Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a fuanction of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation. Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations. The Steam Generator Program defines the Frequency of TS 4.4.5.1. The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Reference 6). The Steam Generator Program uses infonnation on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 6.26 contains prescriptive requirements concerning inspection intervals to provide.added assurance that the SG performance criteria will be met between scheduled inspections. If crack indications are found in any SG tube, the maximum inspection interval for all affected and potentially affected SGs is restricted by Specification 6.26 until subsequent inspections support extending the inspection interval.Tx/ArT T VTC'NTTP _ T ThTTT ) D1 "21A AO,-r A nnchln~pij 1'J 0 O ~II J. -- J.£ .L LBDCR 14-MiP2.-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 314.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) SURVEILLANCE REQUIREMENTS (Continued) TS 4.4.5.2 During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed fr'om service by plugging. The tube plugging criteria delineated in Specification 6.26 are intended to ensure that tubes accepted for continued service satisfy the SG perfonnmace criteria with allowance for error in the flaw size measurement and for future flaw growth. In additioni, the tube plugging criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.The Frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the plugging criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential. BACKGROUND SG tubes are small diameter, thin walled tubes that carry primary coolantt thr-ough the primary to secondary heat exchangers. The SG tubes have a number of imnportant safety functions. SG tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary system's pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primnaly and secondary systems to remove heat from the system. Thtis Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO. 3.4.1.1, "RCS STARTUP AND POWER OPERATION," LCO 3.4.1.2, "RCS HOT STANDBY," LCO 3.4.1.3, "RCS HOT SHUTDOWN," and LCO 3.4.1.4, "RCS COLD SHUTDOWN-LOOPS FILLED." SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements. SG tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively. The SG performance criteria are used to manage SG tube degradation. MILLSTONE -UNIT 2 B3442 mnmn o B 3/4 4-2h Amendment No. LBDCR 14-MP2-001 May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GEN~ERATOR TUBE INTIEGRITY (Continued) BACKGROUND (Continued) Specification 6.26, "Steam Generator (SG) Program," requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 6.26, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 6.26. Meeting the SG performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions. The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Reference 1).APPLICABLE SAFETY ANALYSES The steam generator tube rupture (SGTR) accident is the limiting design basis event for SG tubes and avoiding an SGTR is the basis for this Specification. The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate equal to the operational LEAKAGE rate limits in LCO 3.4.6.2, "'RCS Operational LEAKAGE," plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumies the contaminated secondary fluid is released to the atmosphere via safety valves or atmospheric dump valves.The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture). In these analyses, the steam discharge to the atmosphere is based on the total primary to secondary LEAKAGE from any one SG of 150 gpd or from all SGs of 300 gpd as a result of accident induced conditions. For accidents that do not involve fuel damage, the primamy coolant activity level of DOSE EQUIVALENT 1-131 is assumed to be equal to the LCO 3.4.8, "RCS Specific Activity" limits.For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Reference 2), 10 CFR 50.67 (Reference

3) or the NRC approved licensing basis (e.g., a small fraction of these limits).Steam Generator tube integrity satisfies Criterion 2 of 10 CER 50.36(c)(2)(ii).

MILLSTONE -UNIT 2B3442AmnetNo B 3/4 4-2i Amendment No. LBDCR 14-.MP2-01l May 20, 2014 REACTOR COOLANT SYSTEM BASES 3/14.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) REFERENCES

1. NEI 97-06, "Steam Generator Program Guidelines." 2. 10 CFR 50 Appendix A, GDC 19.3. 10 CER 50.67.4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines." MILLSTONE

-UNIT 2B3/42AmnetNo B 3/4 4-2j Amendment No. August 08, 2007 07-MP2-0 12 REACTOR COOLANT SYSTEMI BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.1 LEAKCAGE DETECTION SYSTEMS The RCS leakage detection systems requir~ed by this specification are provided to monitor and detect leakage fr~om the Reactor Coolant Pressure Boundary. These detection systems are consistent with the recommendations of Regulatory Guide 1.45, "Reactor Coolant Pressure Boundaiyz Leakage Detection Systems." Action c provides a 72 hour allowed outage time (AOT) when both the containment atmosphere particulate radioactivity mnonitoring channels are inoperable and containment sump level monitoring system is inoperable. The 72 hour AOT is appropriate since additional actions will be taken during this limited time period to ensure RCS leakage, in excess of the unidentified leakage TS limit of 1 gpm (TS 3.4.6.2), will be readily detectable. This will provide reasonable assurance that any significant reactor coolant pressure boundaiy* degradation is detected soon after occurrence to minimize the potential for propagation to a gross failure. This is consistent with the requirements of General Design Criteria (GDC) 30 and also Criterion 1 of 10 CFR 50.36(d)(2)(ii) which requires installed instrumentation to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary. The RCS water inventory balance calculation determines the magnitude of RCS unidentified leakage by use of0 instrumentation readily available to the control room operators.. However, the proposed additional actions will not restore the continuous monitoring capability nonnally provided by the inoperable equipment. The RCS water inventory balance is capable of identifying a one gpmnRCS leak rate. The containment grab samples will also indicate an increase in RCS leak rate which would then be quantified by the RCS water inventory balance. Since these additional actions are sufficient to ensure RCS leakage is within TS limits, it is appropr'iate to provide a limited time period to restore at least one of the TS-required leakage monitoring systems.MILLSTONE -UNIT 2 B 3/4 4-3 Amendment No. t, 38,-22-8, August 08, 2007 07-MP2-0 12 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE LCO RCS operational LEAKAGE shall be limited to: a PRESSURE BOUNDARY LEAKAGE No PRESSURE BOUNDARY LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is notPRESSURE BOUNDARY LEAKAGE.b UNIDENTIFIED LEAKAGE One gallon per minute (gpm) of UNIDENTIFIED LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.c Primary to Secondary_ LEAKAGE through-Any-One Steam Generator The limit of 75 gallons per day per Steam Generator (SG) is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines (Reference

4) and the accident analysis described in the FSAR (Reference 3). The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states,"The RCS operational primary to secondary leakage through any one SG shall be limited to 150 gallons per day." The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational leakage rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.

The main steam line break (MSLB) accident analysis assumes a primary to secondary leakage of 150 gallons per day per 8G.MILLSTONE -UNIT 2 B3443 mnmn o B 3/4 4-3a Amendment No. LBDCR 09-MP2-004 May 28, 2009 .::.REACTOR. COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE LCO (Continued) d IDENTIFIED LEAKAGE Up to 10 gpm of IDENTIFIED LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of UNIDENTIFIED LEAKAGE and is well within the capability of the RCS makeup system. IDENTIFIED LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include PRESSURE BOUNDARY LEAKAGE or CONTROLLED LEAKAGE. Violation of this LCO could result in continued degradation of a component or system.The IDENTIFIED LEAKAGE and UNIDENTIFIED LEAKAGE limits listed in LCO 3.4.6.2 only apply to the RCPB within the containment. Leakage outside of the second isolation valve for containment,, which is included in the RCS Leak Rate Calculation, is not considered RCS LEAKAGE and can be subtracted from RCS UNIDENTIFIED LEAKAGE. The definitions for IDENTIFIED LEAKAGE and UNIDENTIFIED LEAKAGE are provided in the technical .specifications definitions section, Definition 1.14.APPLICABILITY -...In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.' In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.ACTIONS a UNIDENTIFIED LEAKAGE or IDENTIFIED LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify UNIDENTIFIED LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.MILLSTONE -UNIT 2 B 3/4 4-3b Amendment No. ,l Auagust 08, 2007 07-MP2-0 12 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE ACTIONS (Continued) b If any PRESSURE BOUNDARY LEAKAGE exists, or primary to secondary LEAKAGE is not within limits, or if UNIDENTIFIED or IDENTIFIED LEAKAGE cannot be reduced to within limits within 4 hours, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE. The reactor must be brought to HOT STANDBY within 6 hours and COLD SHUTDOWN within 36 hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In COLD SHUTDOWN, the pressure stresses acting on the reactor coolant pressure boundary are much lower, and further deterioration is much less likely.SURVEILLANCE REQUIREMENTS 4.4.6.2.1 Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB is maintained. PRESSURE BOUNDARY LEAKAGE would at first .appear as UNIDENTIFIED LEAKAGE and can only be positively identified by inspection. UNIDENTIFIED LEAKAGE and IDENTIFIED LEAKAGE are determined by performance of an RCS water inventory balance.The RCS water inventory balance must be performed with the reactor at steady state operating conditions (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal leakoff flows). The Surveillance is modified by two Notes. Note 1 states that this SR is not required to be performed until 12 hours after establishing steady state Operation. The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established. MILLSTONE -UNIT 2 B3443 mnmn o B 3/4 4-3c Amendment No. August 08, 2007 07-MP2-0 12 REACTOR COOLANT SYSTEM BASES0 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE SURVEILLANCE REOUIREMENTS (Continued) Steady state operation is required to perform a proper water inventory balance since calculations during maneuvering are not useful. For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal leakoff flows.An early warning of PRESSURE BOUNDARY LEAKAGE or UNIDENTIFIED LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. These leakage detection systems are specified inl LCO 3.4.6.1, "Leakage Detection Systems." Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 75 gallons per day cannot be measured accurately by an RCS water inventory balance.The 72 hour Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. 4.4.6.2.2/ This SR verifies that primary to secondary LEAKAGE is less than or equal to 75 gallons per day through any one SG. Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCO* 3.4.5, "Steam Generator Tube Integrity," should be evaluated.

• The 75 gallons per day limit is measured at room temperature as described in Reference

5. The Operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours after establishment of steady state operation.

For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal leakoff flows.MILLSTONE -UNIT 2 B 3/4 4-3d Amendment No. LBDCR 14-MP2-016 September 4, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE SUIRVEILLANCE REOUIREMENTS (Continued) The frequency specified in the Surveillance Frequency Control Program is a reasonable interval to trend primary to secondary LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPR[ guidelines (Reference 5).BACKGROUNhD Components that contain or transport the coolant to or from the reactor core make up the reactor coolant system (RCS). Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either nonnal operational wear or mechanical deterioration. The purpose of the RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.10 CFR 50, Appendix A, GDC 30 (Reference 1), requires mneans for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Reference

2) describes acceptable methods for selecting leakage detection systems.The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration.

Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIIDENTIFIED LEAKAGE is necessary to provide quantitative information to the. operators, allowing them to take colTective action should a leak occur detrimental to the safety of the facility and the public.A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight. Leakage fronl these systems should be detected, located, and isolated from~.the containment atmosphere, if possible, to not interfere with RCS LEAKAGE detection. This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analysis radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).MILLSTONE -UNIT 2 B/43 mnmn o B 3/4 4-3e Amendment No. August 08, 2007 07-MP2-012 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE APPLICABLE SAFETY ANALYSES -OPERATIONAL LEAKAGE Except for primary to secondary LEAKAGE, the safety analyses do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA;the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGE from any one steam generator (SG) of 150 gpd or from all SGs of 300 gpd as a result of accident induced conditions. The LCO requirement to limit primary to secondary LEAKAGE through any one SG to less than or equal to 75 gallons per day is significantly less than the conditions assumed in the safety analysis.Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a main steam line break (MSLB) accident. To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR). The leakage contaminates the secondary fluid. The FSAR (Reference

3) analysis for SGTR assumes the contaminated secondary fluid is only briefly released via safety valves or atmospheric dump valves.The MSLB is the more limiting accident for MPS2 control room dose. The safety analysis for the MSLB accident assumes 150 gpd primary to secondary.LEAKAGE is through~the affected generator and 150 gpd from the intact SG as an initial condition.

The dose consequences resulting from the MSLB accident are well within the limits defined in 10 CER 50.67 or the staff approved licensing basis (i.e., a small fraction of these limits).The RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). MILLSTONE -UNIT 2 B 3/4 4-3f Amendment No. l March 18, 2008" LBDCR 08-MP2-013 REACTOR COOLANT SYSTEM BASES 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.2 REACTOR COOLANT SYSTEM OPERATIONAL LEAKAGE REFERENCES 110 CFR 50, Appendix A, GDC 30.2 Regulatory Guide 1.45, May 1973.3 ESAR, Section 14 4 NEI 97-06, "Steam Generator Program Guidelines." 5 EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines." 3/4.4.7 DELETE 3/4.4.8 SPECIFIC ACTIVITY BACKGROUND The maximum dose that an individual at the exclu~sion .a~reaboundary can receive for 2 hours following an accident, or at the low population zone outer boundary for the radiological release duration, is specified in 10 CFR 50.67 (Ref. 1). Doses to control room occupants must be limited per GDC 19. The limits on specific activity ensure that the offsite and Control Room Envelope (CRE) doses are appropriately limited during :analyzed transients and accidents. The RCS specific activity LCO limits the allowable concentration of radionuclides in the reactor coolant. The LCO limits are established to minimize the dose consequences in the event of a steam line break (SLB) or steam generator tube rupture (SGTR) accident.The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and DOSE EQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and CRE doses meet the appropriate acceptance criteria in the Standard Review Plan (Ref. 2).MILLSTONE -UNIT 2 B 3/4 4-4 MILLTON -NIT2 B3/44-4Amendment No. 44--5, -194, 2-66, March 18, 2008 LBDCR 08-MP2-013 REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVITY (continued) APPLICABLE SAFETY ANALYSES The LCO limits on the specific activity of the reactor coolant ensure the resulting offsite and CRE doses meet the appropriate SRP acceptance criteria following a SLB or SGTR accident. The safety analyses (Refs. 3 and 4) assume the specific activity of the reactor coolant is at the LCO limits, and an existing reactor coolant steam generator (SG) tube leakage rate of 150 gpd exists.The~safety analyses assume the specific activity of the secondary coolant is at its limit of 0.1 igCi/gm DOSE EQUIVALENT I- 131 from LCO 3.7.1.4, "Activity." The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specific activity. Reference to these analyses is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.The safety analyses consider two cases of reactor coolant iodine specific activity. One case assumes specific activity at 1.0 jiCi/gm DOSE EQUIVALENT 1- 131 with a concurrent large iodine spike that increases the rate of release of iodine from the fuel rods containing cladding defects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factor of 335), respectively. The second case assumes the initial reactor coolant iodine activity at 60.0 pCi/gm DOSE EQUIVALENT I- 131 due to an iodine spike caused by a reactor or an RCS transient prijor to the accident. In both cases, the noble gas specific activity is assumed to be 1100 p.tCi/gm DOSE EQUIVALENT XE-133.... The SGTR analysis assumes a rise in pressure in the ruptured SG causes radioactively contaminated steam to discharge to the atmosphere through the atmospheric dump valves or the.main steam safety valves. The atmospheric discharge stops when the turbine bypass to the condenser removes the excess energy to rapidly reduce the RCS pressure and close the valves.The unaffected SG removes core decay heat by venting steam until the cooldown ends and the Shutdown Cooling (SDC) system is placed in service.The SLB radiological analysis assumes that offsite power is lost at the same time as the pipe break occurs outside containment. The affected SG blows down completely and steam is vented directly to the atmosphere. The unaffected SG removes core decay heat by venting steam to the atmosphere until the cooldown ends and the SDC system is placed in service.Operation with iodine specific activity levels greater than 1 giCi/gm but less than or equal to 60.0 pCi/gm is permissible for up to 48 hours while efforts are made to restore DOSE EQUIVALENT 1-131 to within the 1 [iCi/gm LCO limit. Operation with iodine specific activity levels greater than 60 jiCi/gm is not permissible. MILLSTONE -UNIT 2 B3444 B 3/4 4-4a March 18, 2008 LBDCR 08-MP2-013 REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVITY (continued) APPLICABLE SAFETY ANALYSES (continued) The RCS specific activity limits are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices. RCS spedific activity satisfies Criterion 2 of 10 CFR 50.3 6(c)(2)(ii). LCO The iodine specific activity in the reactor coolant is limited to 1.0 pCi/gm DOSE EQUIVALENT I-131, and the noble gas specific activity in the reactor coolant is limited to 1 100 pCi/gm DOSE EQUIVALENT XE-133. The limits on specific activity ensure that offsite and CRE doses will meet the appropriate SRP acceptance criteria (Ref. 2).The SLB and SGTR accident analyses (Refs. 3 and 4) show that the calculated doses are within acceptable limits. Operation with activities in excess of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SLB or SGTR, lead to doses that exceed the SRP acceptance criteria (Ref. 2).APPLICABILITY In MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT 1-13 1 and DOSE EQUIVALENT XE- 133 is necessary to limit the potential consequences of a SLB or SGTR to within the SRP acceptance criteria (Ref. 2).In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS and steam generators are depressurized, and primary to secondary leakage is minimal. Therefore, the monitoring of RCS specific activity is not required.MILLSTONE -UNIT 2 B3444 B 3/4 4-4b March 18, 2008 LBDCR 08-MP2-013 REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVITY (continued) ACTIONS a. and b.With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of four hours must be taken to demonstrate that the specific activity is _< 60 jiCi/gm. Four hours is required to obtain and analyze a sample. Sampling is continued every four hours to provide a trend.The DOSE EQUIVALENT I-131 must be restored to within limit within 48 hours. The completion time of 48 hours is acceptable since it is expected that, if there were an iodine spike, the normal coolant iodine concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.A statement in ACTION b. indicates the provisions of LCO 3.0.4 are not applicable. This exception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTIONS a. and b- while the DOSE EQUIVALENT I-131 LCO is not met. This exception is acceptable due to the significant conservatism incorporated into the RCS specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, power operation. c..__If the required action and completion time of ACTION b. is not met, or if the DOSE EQUIVALENT 1-131 is > 60 jpCi/gm, the reactor must be brought to HoT STANDBY (MODE 3)within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.MILLSTONE -UNIT 2 B3444 B 3/4 4-4c LBDCR 14-MP2-016 September 4, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVTY (continued) ACTIONS (continued) d__.With the RCS DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENT XE-133 must be restored to within limit within 48 hours. The allowed completion time of 48 hours is acceptable since it is expected that, if there were a noble gas spike, the normal coolant noble gas concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.A statement in ACTION d. indicates the provisions of LCO 3.0.4 are not applicable. This exception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTION d. while the DOSE EQUIVALENT XE-133 LCO is not met. This exception is acceptable due to the significant conservatism incorporated into the RCS specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, POWER OPERATION. e_.If the required action and completion time of ACTION d. is not met, the reactor must be, brought to HOT STANDBY (MODE 3) within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.*SURVEILLANCE REQUIREMENTS 4.4.8.1 Surveillance Requirement 4.4.8.1 requires performing a gamma isotopic analysis as a measure of the noble gas specific activity of the reactor coolant. This measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance Requirement provides an indication of any increase in the noble gas specific activity. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Trending the results of this Surveillance Requirement allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. MILLSTONE -UNIT 2 B3444 B 3/4 4-4d LBDCR 14-MP2-016 September 4, 2014 REACTOR COOLANT SYSTEM BASES 3/4.4.8 SPECIFIC ACTIVITY (continued). SURVEILLANCE REQUIREMENTS (continued) 4.4.8.1 (continued) Due to the inherent difficulty in detecting Kr-85 in a reactor coolant sample due to masking from radioisotopes with similar decay energies, such as F-18 and 1-134, it is acceptable to include the minimum detectable activity for Kr-85 in the Surveillance Requirement 4.4.8.1 calculation. If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE- 133 is not detected, it should be assumed to be present at the minimum detectable activity.A Note modifies the Surveillance Requirement to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows the Surveillance Requirement to be performed in those MODES, prior to entering MODE 1.4.4.8.2 This Surveillance Requirement is performed to ensure iodine specific activity remains within the LCO limit during normal operation and following fast power changes when iodine spiking is more apt to occur. The frequency specified in the Surveillance Frequency Control Program is adequate to trend changes in the iodine activity level. The frequency of between 2 and 6 hours after a power change __ 15% RTP within a 1 hour period is established because the iodine levels peak during this time following iodine spike initiation; samples at other times would provide inaccurate results.The Note modifies this Surveillance Requirement to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows the Surveillance Requirement to be performed in those MODES, prior to entering MODE 1.REFERENCES

1. 10CFR 50.67.2. Standard Review Plan (SRP) Section 15.0.1 "Radiological Consequence Analyses Using Alternate Source Terms." 3. FSAR, Section 14.1.5.4. FSAR, Section 14.6.3.MILLSTONE

-UNIT 2 B3444 B 3/4 4-4e March 18, 2008 LBDCR 08-MP2-013 REACTOR COOLANT SYSTEM BASES 3/4.4.9 PRESSURE/TEMPERATURE LIMITS*All components in the Reactor Coolant System are designed to with-stand the effects of cyclic loads due to system temperature and pressure changes. These cyclic loads are introduced by normal load transients, reactor trips, and startup and shutdown operations. The various categories of load cycles Used for design purposes are provided in Section 4.0 of the FSAR.During startup and shutdown, the rates of temperature and pressure changes are limited so that the maximum specified heatup and cooldown rates are consistent with the design assumptions and satisfy the stress limits for cyclic operation. In addition, during heatup, and cooldown evolutions, the RCS ferriticmaterials transition between ductile and-brittle (non-ductile) behavior. To provide adequate protection, the pressure/temperature limits were developed in accordance with the 10CFR5O Appendix G requirements to ensure the margins of safety against non-ductile failure are maintained during all normal and anticipated operational occurrences. These pressure!temperature limits are provided in Figures 3.4-2a and 3.4-2b and the heatup and cooldown rates are contained in Table 3.4-2.During heatup, the thermal gradients in the reactor vessel wall produce thermal stresses whichvary from compressive at the inner wall~to tensile at the outer wall. These thermally induced compressive stresses at the inside wall tend to alleviate the tensile stresses induced by the internal pressure. Therefore, a pressure-temperature curve based on steady state conditions (i.e., no thermal stresses) represents a lower bound of all similar curves for finite heatup rates when the inner wall of the vessel is treated as the governing location.The heatup analysis also covers the determination of pressure-temperature limitations for the case in which the outer wall of the vessel *becomes the controlling location. The thermal gradients established during heatup produce tensile stresses at the outer wall of the vessel. These stresses are additive to the pressure induced tensile stresses which are already present. The thermally induced* stresses at the outer wall of the vessel are tensile and are dependent on both the rate of heatup and the time along the heatup ramp; therefore, a lower bound curve similar to that described for the heatup of the inner wall cannot be defined. Subsequently, for the cases in which the outer wall of the vessel becomes the stress controlling location, each heatup rate of interest must be analyzed on an individual basis.MILLSTONE -UNIT 2 B3445AedetN.2lg B 3/4 4-5 Amendment No. 2-t4, July 1, 1998 REACTOR COOLANT SYSTEM BASES The heatup and cooldown limit curves (Figures 3.4-2a and 3.4-2b) are composite curves which were prepared by determining the most conservative case, with either the inside or outside wall controlling, for any heatup or cooldown rates of up to the maximums described in Technical Specification 3.4.9.1, Table 3.4-2. The heatup and cooldown curves were prepared based upon the most limiting value of the predicted adjusted reference temperature at the end of the service period indicated on Figures 3.4-2a and 3.4-2b.Verification that RCS pressure and temperature conditions are within the limits of Figures 3.4-2a and 3.4-2b and Table 3.4-2, at least once per 30 minutes, is required when undergoing planned changes of___ 10°F or _> 100 psi. This frequency is considered reasonable since thie location of interest during cooldown is over two inches (i.e. 1/4 t location) from the interface with the reactor coolant. During heatup the location of interest is over six inches from .the interface with the reactor coolant. This c~ombined with the relatively large heat retention capability of the reactor vessel ensures that small temperature fluctuations such as those expected during normal heatup and cooldown evolutions do not challenge the structural integrity of the reactor vessel when monitored on a 30 minute frequency. The 30 minute time interval permits assessment and correction for minor deviations within a reasonable time.During RCS heatup and cooldown the magnitude of the stresses across the reactor vessel wall are controlled by restricting the rate of temperature change and the system pressure, The RCS pressure/temperature limits are provided in Figures 3.4-2a and 3.4-2b, and the heatup and cooldown rates are contained in Table 3.4-2. The following guidelines should'be used tO ensure compliance with the Technical Specification lim~its. _1. When changing RCS temperature, with any reactor coolant pumps in operation, the rate of temperature change is calculated by using RCS loop cold leg temperature indications. This also applies during parallel reactor coolant pump and shutdown cooling (SDC) pump operation because the RCS loop cold leg temperature is the best indication of the temperature of the fluid in contact with the reactor vessel wall. Even though SDC return temperature may be belowRCS cold leg temperature, the mixing of a large quantity of RCS cold leg water and a small quantity of SDC return water will result in the temperature of the water reaching the reactor vessel wall being very close to RCS cold leg temperature.

2. When changing RCS temperature via natural circulation, the rate of temperature change is calculated by using RCS loop cold leg temperature indications.

3. When changing RCS temperature with only SDC in service, the rate of temperature change is calculated by using SDC return temperature indication.

MILLSTONE -UNIT 2 B 3/4 4-6 MILLTON -NIT2 B3/44-6Amendment No. 94, 4-t--3, 4--70, 218 July 1, 1998 REACTOR COOLANT SYSTEM BASES 4. During the transition from natural circulation flow, to forced flow with SDC pumps, the rate of temperature change is calculated by using RCS loop cold leg temperature indications. SDC return temperature should be used to calculate the rate of temperature change after SDC is in service, RBCCW flow has been established to the SDC heat exchanger(s), and SDC return temperature has decreased below RCS cold leg temperature.

5. During the transition from parallel reactor coolant pump and SDC pump operation, the rate of temperature change is calculated by using RCS loop cold leg temperature indications until all reactor coolant pumps are secured. SDC return temperature should be used to calculate the rate of temperature change after all reactor coolant pumps have been secured.6. The temperature change limits are for a continuous one hour period. Verification of operation within the limit must compare the current RCS water temperature to the value that existed one hour before the current time. If the maximum temperature increase or decrease, during this one hour period, exceeds the Technical Specification limit, appropriate action should be taken.7. When a new, more restrictive temperature change limit is approached, it will be necessary to adjust the current temperature change rate such that as soon as the new rate applies, the total temperature change for the previous one hour does not exceed the new more restrictive rate.The same principle applies when moving from one temperature change limit curve to another. If the new curve is above the current curve (higher RCS pressure for a given RCS temperature), the new curve will reduce the temperature change limit, it will be necessary to first ensure the new more restrictive temperature change limit will not be exceeded by looking at the total RCS temperature change for the previous one hour time period. If the magnitude of the previous one hour temperature change will exceed the new limit, RCS temperature should be stabilized to allow the thermal stresses to dissipate.

This may require up to a one hour soak before RCS pressure may be raised within the limits of the new curve.If the new curve is below the current curve (lower.RCS pressure for a given RCS temperature), the new curve will allow a higher temperature change limit. All that is necessary is to lower RCS pressure, and then apply the new higher temperature change limit.8. When performing evolutions that may result in rapid and significant temperature swings (e.g. placing SDC in service or shifting SDC heat exchangers), the total temperature change limit for the previous one hour period must not be exceeded. If a significant temperature change is anticipated, and an RCS heatup or cooldown is in progress, the plant should be stabilized for up to one hour, before performing this type of evolution. Stabilizing the plant for up to one hour will allow the thernal stresses, from any previous RCS temperature change, to dissipate. This will allow rapid RCS temperature changes up to the applicable Technical Specification temperature change limit.MILLSTONE -UNIT 2B344.6AmnetNo21 B 3/4 4-6a Amendment No. 21 8 LBDCR 05-MP2-003 December 27, 2005 REACTOR COOLANT SYSTEM BASES The reactor vessel materials have been tested to determine their initial RTNDT; the results of these tests are shown in Table 4.6-1 of the Final Safety Analysis Report. Reactor operation and resultant fast neutron irradiation will cause an increase in the RTNDT. Therefore, an adjusted reference temperature, based upon the fluence, can be predicted using the methods described in Revision 2 to Regulatory Guide 1.99.The heatup and cooldown limit curves shown on Figures 3.4-2a and 3.4-2b include predicted adjustments for this shift in RTNDT at the end of the applicable service period, as well as adjustments for possible uncertainties in the pressure and temperature sensing instruments. The adjustments include the pressure and temperature instrument and loop uncertainties associated with the main control board displays, the pressure drop across the core (RCP operation), and the elevation differences between the location of the pressure transmitters and the vessel beltline region. In addition to these curve adjustments, the LTOP evaluation includes adjustments due to valve stroke times, PORV circuitry reaction times, and valve discharge backpressure. The actual shift in RTNDT of the vessel material is established periodically during operation by removing and evaluating, in accordance with 1OCFR5O Appendix H, reactor vessel material irradiation surveillance specimens installed near the inside wall of the reactor vessel in the core area. Since the neutron spectra at the irradiation samples and vessel inside radius are similar, the measured transition shift for a sample can be correlated to the adjacent section of the reactor vessel. The heatup and cooldown curves must be recalculated when the ARTNDT determined from the surveillance capsule exceeds the calculated ARTNDT for the equivalent capsule radiation exposure.The pressure-temperature limit lines shown on Figures 3.4-2a and 3.4-2b for reactor criticality have been provided to assure compliance with the minimum temperature requirements of Appendix G to 10 CFR 50 for reactor criticality. For inservice leak and hydrostatic testing, use of the heatup curve on Figure 3.4-2a and associated rates provide a conservative limit in lieu of a curve developed specifically for inservice leak and hydrostatic testing. Therefore, a separate leak and hydrostatic curve is not explicitly included on Figure 3.4-2a.The maximum RTNDT for all reactor coolant system pressure-retaining materials, with the exception of the reactor pressure vessel, has been determined to be 50°F. The Lowest Service Temperature limit is based upon this RTNDT since Article NB-2332 (Summer Addenda of 1972)of Section III of the ASME Boiler and Pressure Vessel Code requires the Lowest Service Temperature to be RTNDT + I100 0 F for piping, pumps and valves. Below this temperature, the system pressure must be limited to a maximum of 20% of the system's hydrostatic test pressure of 3125 psia. Operation of the RCS within the limits of the heatup and cooldown curves will ensure compliance with this requirement. MILLSTONE -UNIT 2 B 3/4 4-6b Amendment No. 2-18, Acknaowledged by NRC letter dated 12/I19/06 LBDCR 06-MP2-041 November 2, 2006 REACTOR COOLANT SYSTEM BASES Included in this evaluation is consideration of flange protection in accordance with 10 CFR 50, Appendix G. The requirement makes the minimum temperature RTNDT plus 90°F for hydrostatic test and RTND.T plus. 120 0 F fornonmal operation when the pressure .exceeds 20 percent of the preservice system hydrostatic test pressure. Since the flange region RTNDT has been calculated to be 30°F,. the minimum flange pressurization temperature during normal operation is 1 50 0 F (163°F with instrument uncertainty) when the pressure exceeds 20% of the preservice hydrostatic pressure. Operation of the RCS Within the limits of the heatup and cooldown curves will ensure compliance with this requirement. To establish the minimum boltup temperature, ASME Code Section XI, Appendix G, requires thet.ernperature~of the flange and-adjiacent, shell .-ad~head. reg~ion!s .shall! be. abo-ve -the.results in a minimum boltup temperature of 43°F. For additional conservatism, a minimum boltup temperature of 70°F is specified on thie heatup and cooldown curves. The head and vessel flange region temperature must be greater than 70 0 F, whenever any reactor vessel stud is tensioned. The Low Temperature Overpressure Protection (LTOP) System provides a physical barrier :againshtexceeding the IOC-FR50 Appendix G pressure/temaperature.-limits during, low temperature RCS operation either With a steam bubble in the pressurizer or during water solid conditions. This system consists of either two PORVs with a pressure setpoint 415 psia, or an RCS vent of sufficient size. Analysis has confirmed that the design basis mass addition transient discussed below will be mitigated by operation of the PORVs or by establishing an RCS vent of sufficient size.The LTOP System is required to be OPERABLE when RCS cold leg temperature is at or below 275 0 F (Technical Specifidation 3.4.9.3). However, if the RCS is in MODE 6 and the reactor vessel head has been removed, a Vent of sufficient sizehas beenestablished such that RCS pressurization is not possible. Therefore, an LTOP System is not required (Technical Specification 3.4.9.3 is not applicable). Adjusted Referenced Temperature (ART) is the RTNDT adjusted for radiation effects plus a margin term r-equired by Revision 2 of Regul~atory Guide 1.99. The LTOP System' is armed at a temperature which exceeds the limiting l/4t ART plus 50°F as required by ASME Section XI, Appendix G. For the operating period up to 54 EFPY, the limiting 1/4t ART is 175°F whicli results in a minimum LTOP System enable temperature of at least 271 0 F when corrected for instrument uncertainty. The current value of 275 0 F will be retained.MILLSTONE.- UNIT 2 B 3/4 4-7 Amendment No. g0, :70, 94, -1-, 66,2-72, Acknowledged By NRC July 5, 2007 LBDCR 06-MP2-041 November 2, 2006 REACTOR COOLANT SYSTEM BASES The mass input analysis performed to ensure the LTOP System is capable of protecting the reactor vessel assumes that all pumps capable of injecting into the RCS start, and then one PORV fails to actuate (single active failure). Since the PORVs have limited relief capability, certain.administrative restrictions have been implemented to ensure that the mass input transient will not exceed the relief capacity of a PORV. The analysis has determinied two PORVs (assuming one PORV fails) are-sufficient if the mass addition transient is limited to the inadvertent start of one high pressure safety injection (HPSI) pump and two charging pumps when RCS temperature is at or below 275 0 F and above 190°F, and the inadvertent start of one charging pump When RCS temperature is at or below 190°F..The_ LTOP analysis assumes .oly...one PQRV open due. to. sin~gle a~civ.e:fai ue_,of the other Appendix during owwttemperaiurecope~ation.

'if-he-RGS i}s-;.*:-depressurized and vented through at least a 2.2 square inch vent,, the peak RCS pressure, resulting from the maximum mass input transient allowed by Technical specification 3.4.9.3, will not exceed 300 psig (SDC System suction side design pressure).

When the RCS is at or below 190°F, additional pumping capacity can be. made capable of in~ cingj .o ~h ..Q _b~y es~tablis~h~in!g an .R.C .S .ve~ntof _a~t.lea~s~t2.2..s~qu.a~re_.in~ches._ ._R~em ovin~g the_.pressurizer manway cover, pressurizer vent port cover or a pressurizer safety relief valve will result in a passive vent of at least 2.2 square inches. Additionailmethods to establish the required RCS vent are acceptable, provided the proposed Vent has been evaluated to ensure the flow characteris'tics are equivalent to one of these.Establishing a pressurizer steam bubble of sufficient size will be sufficient to protect the reactor vessel from the energy addition transient associated with the start of an RCP, provided the restrictions contained in Technical Specification 3.4.1.3 are met. These restrictions limit the heat input from. the secondary, syistem. They also ensure sufficient Steam *volume. exists in the pressurizer to accommodate thie insurge. No credit for PORV actuation Wvas assumed in the LTOP analysis, of the energy addition transient. The restrictions apply only to the start of the first RCP. Once at least. one RCP is running, equilibrium is achieved between the primary and secondary temperatures, elimina~tipng any significant energy addition associated with the start of the second RCP.The LTOP restrictions are based on RCS cold leg temperature. This temperature Will be determined by using RCS cold leg temperature indication when RCPs are running, or natural circulation if it is occurring. Otherwise, SDC return temperature indication will be used.MILLSTONE -UNIT 2 B 3/4 4-7a Amendment No. S, Acknowledged By NRC July 5, 2007 LBDCR 09-MP2-017 September 15, 2009 REACTOR COOLANT SYSTEM BASES Restrictions on RCS makeup pumping capacity are included in Technical Specification 3.4.9.3. These restrictions are based on balancing the requirements for LTOP and shutdown risk.For shutdown risk reduction, it is desirable to have maximum makeup capacity and to maintain the RCS full (not vented). However, for LTOP it is desirable to minimize makeup capacity and vent the.RCS.. To satisfy these competing requirements, makeup pumps can be made not capable of injecting, but available at short notice.A charging~pump can be considered to be not capable of injecting into the RCS by use of any of the following methods and the, appropriate administrative controls.1. Placing the motor circuit breaker in the open position.2. Removing the charging pump motor overload heaters from the charging pump circuit.3. Removing the charging pump motor controller from the motor control center.4. Placing a charging pump control switch in the. Pull-To-Lock (PTL) position.A HPSI pump can be considered to be not capable of injecting into the RCS by use of any of the following methods and the appropriate administrative controls.1. Racking down the motor circuit breaker from the power supply circuit.2. Shutting and tagging the discharge valve with the key lock on the control panel (2-SI-654 or 2-SI-656).

3. .Placing the pump control switch in the pull-to-lock position and removing the breaker control power fuses.4. Placing the pump control switch in the position and shutting the discharge valve with the key lock on the control panel (2-SI-654 or 2-SI-656).

These methods to prevent charging pumps and UPSI pumps from injecting into the RCS, when combined with the appropriate administrative controls, meet the requirement for two independent means to prevent pump injection as a result of a single failure or inadvertent single action.These methods prevent inadvertent pump injections while allowing manual actions to rapidly restore the makeup capability if conditions require the use of additional charging or HPSI pumps for makeup in the event of a loss of RCS inventory or reduction in SHUTDOWN MARGIN.MILLSTONE -UNIT 2 B 3/4 4-7b MILLTON -NIT B /4 -7bAmendment No. 2-28, -7-, 242-, LBDCR 05-MP2-003 December 27, 2005 REACTOR COOLANT SYSTEM BASES If a loss of RCS inventory or reduction in SHUTDOWN MARGIN event occurs, the appropriate response will be to correct the situation by starting RCS makeup pumps. If the loss of inventory or SHUTDOWN MARGIN is significant, this may necessitate the use of additional RCS makeup pumps that are being maintained not capable of injecting into the RCS in accordance with Technical Specification 3.4.9.3. The use of these additional pumps to restore RCS inventory or SHUTDOWN MARGIN will require entry into the associated ACTION statement. The ACTION statement requires immediate action to comply with the specification. The restoration of RCS inventory or SHUTDOWN MARGIN can be. considered to be part of the immediate actioni to restore the additional RCS makeup pumps to a not capable of injecting status.While recovering RCS inventory or SHUTDOWN MARGIN, RCS pressure will be maintained below the Appendix G limits. After RCS inventory or SHUTDOWN MARGIN has been restored, the additional pumps should be immediately made not capable of injecting and the ACTION statement exited.An exception to Technical Specification 3.0.4 is specified for Technical Specification 3.4.9.3 to allow a plant cooldown to MODE 5 if one or both PORVs are inoperable. MODE 5 conditions may be necessary to repair the PORV(s).3/4.4.10 DELETED MILLSTONE -UNIT 2 B 3/4 4-7c Amendment No. 248-, 3, 24-3, -264, Acknowledged by NRC letter dated 12/119/06 May 8, 2002.BASES 3/4.4.11 DELETED MILLSTONE -UNIT 2 B 314 4-B MILLTON -NIT2 B3/44-8 Amendment No. 266 REVERSE OF PAGE B 3/4 4-8 INTENTIONALLY LEFT BLANK September 3, 1998 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES 3/4.5.1 SAFETY INJECTION TANKS The OPERABILITY of each of the RCS SITs ensures that a sufficient volume of borated water will be immediately forced into the reactor core through each of the cold legs in the event the RCS pressure falls below the pressure of the SITs. This initial surge of water into the core provides the initial cooling mechanism during large RCS pipe ruptures.The limits on SIT volume, boron concentration and pressure ensure thaf the assumptions used for SIT injection in the accident analysis are met.If the boron concentration of one SIT is not within limits, it must be returned to within the limits within 72 hours. In this condition, ability to maintain subcriticality or minimum boron precipitation time may be reduced, but the reduced concentration effects on core subcriticality during reflood are minor. Boiling of the ECCS water in the core during reflood concentrates the boron in the saturated liquid that remains in the core. In addition, the volume of the SIT is still available for injection. Since the boron requirements are based on the average boron concentration of the total volume of three SITs, the consequences are less severe than they would be if a SIT were not available for injection. Thus, 72 hours is allowed to return the boron concentration to within limits.If one SIT is inoperable, for a reason other than boron concentration or the inoperability of water level or pressure channel instrumentation, the SIT must be returned to OPERABLE status within 24 hours. In this condition, the required contents of three SITs cannot be assumed to reach the core during a LOCA as is assumed in Appendix K to 1OCIFR50.Reference 1 provides a series of deterministic and probabilistic analysis findings that support 24 hours as being either "risk beneficial" or "risk neutral" in comparison to shorter periods for restoring the SIT to OPERABLE status. Reference 1 discusses recent best-estimate analysis that confirmed that for large-break LOCAs, core melt can be prevented by either operation of one LPSI pump or the operation of one HPSI piunp and a single SIT. Reference 1 also discusses plant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour recovery period in comparison to shorter recovery periods.If the SIT cannot be restored to OPERABLE status within the associated completion time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this' status, the plant must be brought to at least MODE 3 Reference 1 CE NPSD-994, "CEOG Joint Applications Report on Safety Injection Tank AOT/SIT Extension," April 1995.MILLSTONE -UNIT 2 B 3/4 5-1 MILSTOE -UNI 2 3/4-l Amendment No. 64-, 7-2;, 59, 24--7, 220 September 9, 2004 3/4.5 EMERGENCY CORE COOLING SYSTEMS (EGGS)BASES 3/4.5.1 SAFETY INJECTION TANKS (continued) within 6 hours and pressurizer pressure reduced to < 1750 psia within 12 hours. The allowed completion times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.If more than one SIT is inoperable, the unit is in a condition outside the accident analyses.Therefore, LCO 3.0.3 must be entered immediately. LCO 3.5.1 .a requires that each reactor coolant system safety injection tank shall be OPERABLE with the isolation valve open and the power to the valve operator removed.This is to ensure that the valve is open and cannot be inadvertently closed. To meet LCO 3.5.1.a requirements, the valve operator is considered to be the valve motor and not the motor control circuit. Removing the closing coil while maintaining the breaker closed meets the intent of the Technical Specification by ensuring that the valve cannot be inadvertently closed.Removing the closing coil and verifying that the closing coil is removed (Per SR 4.5.1 .e) meets the Technical Specification because it prevents energizing the valve operator to position the valve in the close direction. noOpeninga ialthe otnbreakersi ein lieu of removing the closing coil, to remove power to the valve operator isO i 1. Millstone Unit 2 Safety Evaluation Report (SER) Docket No. 50-336, dated May 10, 1974, requires two independent means of position indication.

2. Surveillance Requirement 4.5.1 .a requires the control/indication circuit to be energized, to verify that the valve is open.3. Technical Specification 3/4.3.2, Engineered Safety Feature Actuation System Instrumentation, requires these valves to open on a SIAS signal.Opening the breaker would eliminate the ability to satisfy the above three items.3/4.5.2 and 3/4.5.3 EGGS SUBSYSTEMS The OPERABILITY of two separate and independent EGGS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure consideration.

Either subsystem operating in conjunction with the safety injection tanks is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double ended break of the largest RCS cold leg pipe downward.MILLSTONE -UNIT 2 B 3/4 5-2 Amendment No. 6t1-, :h3 59, N-1-7, 20,-2-3, 283 LBDCR 04-MP2-016 February 24, 2005 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued) Each Emergency Core Cooling System (ECCS) subsystem required by Technical Specification 3.5.2 for design basis accident mitigation includes an OPERABLE high pressure safety injection (HIPSI) pump and a low pressure safety injection (LPSI) pump. Each of these pumps requires an OPERABLE flow path capable of taking suction from the refueling water storage tank (RWST)on a safety injection actuation signal (SIAS). Upon depletion of the inventory in the RWST, as indicated by the generation of a Sump Recirculation Actuation Signal (SPAS), the suction for the HPSI pumps will automatically be transferred to the contaimnent sump. The SRAS will also secure the LPSI pumps. The ECCS subsystems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii) as design basis accident mitigation equipment. Flow from the charging pumps is no longer required for design basis accident mitigation. The loss of coolant accident analysis has been revised and no credit is taken for charging pump flow.As a result, the charging pumps no longer meet the first three criteria of 10OCFR 50.36 (c)(2)(ii) as design basis accident mitigation equipment required to be controlled by Technical Specifications. In addition, risk evaluations have been performed to demonstrate that the charging system is not risk significant as defined in 1OCFR 50.3 6(c)(2)(ii) Criterion

4. However, the charging system is credited in the PRA model for mitigating two beyond design basis events, Anticipated Transients Without Scram (ATWS) and Complete Loss of Secondary Heat Sink. On this basis, the requirements for charging pump OPERABILITY will be retained in Technical Specification

3.5.2. Consistent

with the surveillance requirements, only the charging pump will be included in determining ECCS subsystem OPERABILITY. As a result of the risk insight, the charging pump will be included as an Emergency Core Cooling System subsystem required by Technical Specification 3.5.2. That is, an. ECCS subsystem will include one OPERABLE charging pump. The charging pump credited for each ECCS subsystem must meet the surveillance requirements specified in Section 4.5.2. Consistent with the risk insights, automatic start of the charging pump is not required for compliance to TS 3.5.2. Thus, Section 4.5.2 does not specify any testing requirements for the automatic start of the credited charging pump. Similarly, since the ECCS flow path is not credited in the riskevaluation, there are no charging flow path requirements included in TS 3.5.2.The requirements for automatic actuation of the charging pumps and the associated boration system components (boric acid pumps, gravity feed valves, boric acid flow path valves), which align the boric acid storage tanks to the charging pump suction on a SIAS have been relocated to the Technical Requirements Manual. These relocated requirements do not affect the OPERABILITY of the charging pumps for Technical Specification

3.5.2 MILLSTONE

-UNIT 2 B 3/4 5-2a Amendment No. 6-t-, 7-2, 4-5-9, 1-, 2-, 36, Acknowledged by NRC letter dated 6/28/05 LBDCR i4-MP2-016 September 4, 2014 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued) Surveillance Requirement 4.5.2.a verifies the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths to provtide assurance that the proper flow paths will exist for ECCS operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position; since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time.This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5.2.b verifies proper valve position to ensure that the flow path from the ECCS pumps to the RCS is maintained. Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removing power to the valve operator ensures that the valves cannot be inadvertently misalig-ned or change position as the result of an active failure. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.5.2.c and 4.5.2.d, which address periodic surveillance testing of the ECCS pumps (high pressure and low pressure safety injection pumps) to detect gross degradation 0-caused by impeller structural damage or other hydraulic component problems, is required by the ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OM Code). This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the perfonnance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program. The ASME OM Code provides the activities and frequencies necessary to satisfy the requirements. Surveillance Requirement 4.5 .2.e, which addresses periodic surveillance testing of the charging pumps to detect gross degradation caused by hydraulic component problems, is required by the ASMIfE OM Code. For positive displacement pumps, this type of testing may be accomplished by comparing the measured pump flow, discharge pressure and vibration to their respective acceptance criteria. Acceptance criteria are verified to bound the assumptions utilized in accident analyses. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test point is greater than or equal to the performance assumed for mitigation of the beyond design basis events. The surveillance requirements are specified in the Inservice Testing Program. The ASIME OM Code provides the activities and frequencies necessary to satisfy the requirements. MILLSTONE -UNIT 2 B 3/4 5-2b Amendment No. 45-, 6-1-, 7-, 4-l-9, 8-5,4-t6,24al-7, -220, 2, 2a34, 2 LBDCR 14-MP2-016 September 4, 2014 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued) Surveillance Requirements 4.5.2.f, 4.5.2.g, and 4.5.2.h demonstrate that each automatic ECCS flow path valve actuates to the required position on, an actual or simulated actuation signal (SIAS or SRAS), that each ECCS pump starts on receipt of an actual or simulated actuation signal (SIAS), and that the LPSI pumps stop on receipt of an actual or simulated actuation signal (SRAS). This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The surveillance frequency is controlled under the Surveillantce Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment perfonnance is monitored as part of the Inservice Testing Program.Surveillance Requirement 4.5.2.i verifies the high and low pressure safety injection valves listed in Table 4.5-1 will align to the required positions on an SIAS for proper. ECCS performance. The safety injection valves have stops to position them properly so that flow is restricted to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5 .2.j addresses periodic inspection of the containment sump to ensure that it is unrestricted and stays in proper operating condition. The surveillance fr'equency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.5.2.k verifies that the Shutdown Cooling (SDC) System open permissive interlock is OPERABLE to ensure the SDC suction isolation valves are prevented from being remotely opened when RCS pressure is at or above the SDC suction design pressure of 300 psia. The suction piping of the SDC pumps (low pressure safety injection pumps) is the SDC component with the limiting design pressure rating. The interlock provides assurance that double isolation of the SDC System from the RCS is preserved whenever RCS pressure is at or above the design pressure. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 2 B 3/4 5-2c Amendment No. 4-5, 4-59, Ig-, 2-1-5, 2-46, -220, 22g, 24--6, 28g3 LBDCR 04-MP2-016 February 24, 2005 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES 314.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued Only one EGGS subsystem is required by Technical Specification 3.5.3 for design basis accident mitigation. This ECGS subsystem requires one OPERABLE I-PSI pump and an OPERABLE flow path capable of taking suction from the RWST on a SIAS. Upon depletion of the inventory in the RWST, as indicated by the generation of a SRAS, the suction for the I!WSI pump will automatically be transferred to the containment sump. This ECCS subsystem satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii) as design basis accident mitigation equipment. Surveillance Requirement 4.5.3.1 specifies the surveillance requirements of Technical Specification 3.5.3 that are required to demonstrate that the required EGGS subsystem of Technical Specification 3.5.3 is OPERABLE. The required ECCS subsystem of Technical Specification 3.5.3 does not include any LPSI components. LPSI components are not required when Teclnical Specification 3.5.3 is applicable to allow the LPSI components to be used for SDC System operation. In MODE 4 the automatic safety injection signal generated by low pressurizer pressure and high containment pressure and the automatic sump recirculation actuation signal generation by low refueling water storage tank level are not required to be OPERABLE. Automatic actuation in d MODE 4 is not required because adequate time is available for plant operators to evaluate plant 0 conditions and respond by manually operating engineered safety features components. Since the manual actuation (trip pushbuttons) portion of the safety injection and sump recirculation actuation signal generation is required to be OPERABLE in MODE 4, the plant operators can use the manual trip pushbuttons to rapidly position all components to the required accident position.Therefore, the safety injection and sump recirculation actuation trip Pushbuttons satisfy the requirement for generation of safety injection and sump reciixculation a~ctuation signals in MODE 4.In MODE 4, the OPERABLE U-IPSI pump is not required to start automatically on a SIAS.Therefore, the pump control switch for this OPERABLE pump may be placed in the pull-to-lock position without affecting the OPERABILITY of the pump. This will prevent the pump from starting automatically, which could result in overpressurization of the Shutdown Cooling System.Only one H-PSI pump may be OPERABLE in MODE 4 with RCS temperatures less than or equal to 275°F due to the restricted relief capacity with Low-Temperature Oveirpressure Protection System. To reduce shutdown risk by having additional pumping capacity readily available, a HPSI pump may be made inoperable but available at short notice by shutting its discharge valve with the key lock on the control panel.MILLSTONE -UNIT 2 B 3/4 5-2d Amendment No. 4-5, 4-1-g, -,O-2-2-, -, Acknowledged by NRC letter dated 6/28/05 LBDCR 10-MP2-016 May 16, 2011 3/4.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)BASES: 3/4.5.2 and 3/4.5.3 ECCS SUBSYSTEMS (continued) The provision in Specification 3.5.3 that Specifications 3.0.4 and 4.0.4 are not applicable for entry into MODE 4 is provided to allow for connecting the HPSI pump breaker to the respective power supply or to remove the tag and open the discharge valve, and perform~ the subsequent testing necessary to declare the inoperable HPSI pump OPERABLE. Specification 3.4.9.3 requires all HPSI pumps to be not capable of injecting into the RCS when RCS temperature is at or below I90°F. Once RCS temperature is above 190°F one HPSI pump can be capable of injecting into the RCS. However, sufficient time may not be available to ensure one HPSI pump isOPERABLE prior to entering MODE 4 as required by Specification

3.5.3. Since

Specifications

• 3.0.4 and 4.0.4 prohibit a MODE change in this situation, this exemption will allow Millstone* Unit No. 2 to enter MODE 4, take the steps necessary to make the HPSI pump capable of"injecting into the RCS, arid then declare the pump OPERABLE.

If it is necessary to use this exemption during plant heatup, the appropriate ACTION statement of Specification

3.5.3 should

be entered as soon as MODE 4 is reached.3/4.5.4 REFUELING WATER STORAGE TANX (RWST)The OPERABILITY of the RWST as part of the ECCS ensures that a sufficient supply of borated water is available for injection by the ECCS in the event of a LOCA. A minimum usable volume of 370,000 gallons is required for ECCS injection above the earliest or highest level of SRAS initiation accounting for indicator accuracy. The limits on RWST minimum volume and boron concentration ensure that 1) sufficient water is available within containment to permit recirculation cooling flow to the core, anid 2) after a LOCA the reactor will remain subcritical in the cold condition following mixing of the RWST and the RCS water volumes. Small break LOCAs assume that all control rods are inserted, except for the control element assembly (CEA)of highest worth, which remains withdrawn from the core. Large break LOCAs assume that all CEAs remain withdrawn from the core.MILLSTONE -UNIT 2 B 3/4 5-2e Amendment No. 28-3-, Acknowledged by NRC letter dated 6/28/05 LBDCR 05-MP2-001 February 10, 2005 EMERGENCY CORE COOLING SYSTEMS BASES 3/45.5 TRISODIUM PHOSPHATE (TSP)BACKGROUND Trisodium phosphate (TSP) is placed on the floor or in the sump of the containment building to ensure that iodine, which may be dissolved in the recirculated reactor cooling water following a loss of coolant accident (LOCA), remains in solution. TSP also helps inhibit stress corrosion cracking (SCC) of austenitic stainless steel components in containment during the recirculation phase following an accident.Fuel that is damaged during a LOCA will release iodine in several chemical forns to the reactor coolant and to the containment atmosphere. A portion of the iodine in the containment atmosphere is washed to the sump by containment sprays. The emergency core cooling water is borated for reactivity control. This borated water causes the sump solution to be acidic. In a low pH (acidic) solution, dissolved iodine will be converted to a volatile form. The yolatile iodine will evolve out of solution into the containment atmosphere, significantly increasing the levels of airborne iodine. The increased levels of airborne iodine in containment contribute to the radiological releases and increase the consequences from the accident due to containment atmosphere leakage.After a LOCA, the components of the core cooling and containment spray systems will be exposed to high temperature borated water. Prolonged exposure to the core cooling water combined with stresses imposed on the components can cause SCC. The SCC is a function of stress, oxygen and chloride concentrations, pH, temperature, and alloy composition of the components. High temperatures and low pH, which would be present after a LOCA, tend to promote SCC. This can lead to the failure of necessary safety systems or components. Adjusting the pH of the recirculation solution to levels above 7.0 prevents a significant fraction of the dissolved iodine from converting to a volatile form. The higher pH thus decreases the level of airborne iodine in containment and reduces the radiological consequences from containment atmosphere leakage following a LOCA. Maintaining the solution pH above 7.0 also reduces the occurrence of SCC of austenitic stainless steel components in containment. Reducing SCC reduces the probability of failure of components. MILLSTONE -UNIT 2 B 3/4 5-3 Amendment No. a-!-7g, Acknowledged by NRC letter dated 12/!19/06 LBDOR 05-MP2-001 February 10, 2005 EMvERGENCY CORE COOLING SYSTEMS BASES 3/4.5.5 TRISODIUM PHOSPIHATE (TSP)BACKGROUND (continued) TSP is employed as a passive form of pHI control for post LOCA containm-ent spray and core cooling water. Baskets of TSP are placed on the floor or in the sump of the containment building to dissolve from released reactor coolant water and containment sprays after a LOCA.Recirculation of the water for core cooling and containment sprays then provides mixing to achieve a uniform solution pH. The hydrated form (45- 57% moisture) of TSP is used because of the high humidity in the containment building during normal operation. Since the TSP is hydrated, it is less likely to absorb large amounts of water from the humid atmosphere and will undergo less physical and chemical change than the anhydrous form of TSP.APPLICABLE SAFETY ANALYSES The LOCA radiological consequences analysis takes credit for iodine retention in the sump solution based on the recirculation water pH being _> 7.0. The radionuclide releases from the containment atmosphere and the consequences of a LOCA would be increased if the pH of the recirculation water were not adjusted to 7.0 or above.LIMITING CONDITION FOR OPERATION The TSP is required to adjust the pH of the recirculation water to > 7.0 after a LOCA. A pH >7.0 is necessary to prevent significant.amounts of iodine released from fuel failures and dissolved in the recirculation water from converting to a volatile fonnl and evolving into the containment atmosphere. Higher levels of airborne iodine in contaimnlent may increase the release of radionuclides and the consequences of the accident. A pH > 7.0 is also necessary to prevent SCC of austenitic stainless steel components in containment. SeCCincreases the probability of failure of components. The required amount of TSP is based upon the extreme cases of Water volume and pH possible in the containment sump after a large break LOCA. The minimum required volume is the volume of TSP that will achieve a sump solution pH of > 7.0 when taking into consideration the maximum possible sump water volume and the minimum possible pH. The amount of TSP needed in the containment building is based on the mass of TSP required to achieve the desired pH. However, a.required volume is specified, rather than mass, since it is not feasible to weigh the entire amount of TSP in containment. The minimum required volume is based on the manufactured density of TSP. Since TSP can have a tendency to agglomerate from high humidity in the containment building, the density may increase and the volume decrease during normal plant operation. Due to possible agglomeration and increase in density, estimating the minimum volume of TSP in contaimnent is conservative with respect to achieving a minimum required pH.MVILLSTONE -UNIT 2 B 3/4 5-4 Amendment No.Acknowledged by NRC letter dated 12/19/06 LBDCR 14-MIP2-016 September 4, 2014 EMERGENCY CORE COOLING SYSTEMS BASES '3/4.5.5 TRISODIUM PHOSPHATE (TSP') (continued) APPLICABILITY In MODES 1, 2, and 3, the RCS is at elevated temperature and pressure, providing an energy potential for a LOCA. The potential for a LOCA results in a need for the ability to control the pH of the recirculated coolant.In MODES 4, 5, and 6, the potential for a LOCA is reduced or nonexistent, and TSP is not required.ACTIONS If it is discovered that the TSP in the containment building sump is not within limits, action must be taken to restore the TSP to within limits. During plant operation the containment sump is not accessible and corrections may not be possible.The completion time of 72 hours is allowed for restoring the TSP within limits because 72 hours is the same time allowed for restoration of other ECCS components. L If the TSP cannot be restored within limits within the 72 hour completion time, the plant must be brought to a MODE inl which the LCO does not apply. The specified completion times for reaching MODES 3 and 4 were chosen to allow reaching the specified conditions from full power in an orderly manner without challenging plant systems.SURVEILLANCE REQUIREMENTS ..Surveillance Requirement 4.5.5.1 Periodic determination of the volume of TSP in containment must be performed due to the possibility of leaking valves and components in the containment building that could cause dissolution of the TSP during normal operation. This periodic surveillance is required to determine visually that a minimum of 282 cubic feet is contained in the TSP baskets. This requirement ensures that there is an adequate volume of TSP to adjust the pH of the post LOCA sump solution to a value _> 7.0. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 2 B 3/4 5-5 Amcndmcnt,.,,, N,, y I'LR " lott.e. d..LLVI LBDCR 14-MrP2-016 September 4, 2014 EMERGENCY COPE COOLING SYSTEMS BASES 3/4.5.5 TRISODITUM PHOSPHATE (TSP') (continued) Surveillance Requirement 4.5.5.2 Testing must be performed to ensure the solubility and buffering ability of the TSP after exposure to the containment environment. Passing this test verifies the TSP is active and provides assurance that the stored TSP will dissolve in borated water at postulated post-LOCA temperatures. This test is performed by submerging a sample of 0 .6662 +/- 0.0266 grams of TSP from one of the baskets in containment in 250 +/- 10 milliliters of water at a boron concentration of 2482 +/- 20 ppm, and a temperature of 77+/-+ 5°F. Without agitation, the solution is allowed to stand for four hours. The liquid is then decanted, mixed, and the pH measured. The pH must be > 7.0.The TSP sample weight is based on the minimum required TSP mass of 12,042 pounds, which at the manufactured density corresponds to the minimum volume of 223 f& (The minimum Technical Specification requirement of 282 ft 3 is based on 223 ft3 of TSP for boric acid neutralization and 59 ft 3 of TSP for neutralization of hydrochloric and nitric acids.), and the maximum sump water volume (at 77°F) following a LOCA of 2,046,441 liters, normalized to buffer a 250 +/- 10 milliliter sample. The boron concentration of the test water is representative of the maximum possible concentration in the sump following a LOCA. Agitation of the test solution is prohibited during TSP dissolution since an adequate standard for the agitation intensity cannot be specified. The dissolution time of four hours is necessary to allow time for the dissolved TSP to naturally diffuse through the sample solution. In the containmnent sump following a LOCA, rapid mixing will occur, significantly decreasing the actual amount of time before the required pH is achieved. The solution is decanted after the four hour period to remove any undissolved TSP prior to mixing and pH measurement. Mixing is necessary for proper operation of the pH instrument. The surveillance frequency is controlled under the Surveillance Frequency [Control Program ...MILLSTONE -UNIT 2 B 3/4 5-6 Amznmon N...÷,T.........d.e by, RC ........r dated REVERSE OF PAGE B 3/4 5-6 INTENTIONALLY LEFT BLANK LBDCR 05-MP2-029 December 9, 2008 3/4.6 CONTAINMENT SYSTEMS BASES 3/4.6.1 PRIMARY CONTAINMENT 3/4.6.1. 1 CONTAINMENT INTEGRITY Primary CONTAINMENT INTEGRITY ensures that the release of radioactive materials from the containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the accident analyses. Thisrestriction, in conjunction with the leakage rate limitation, will limit the SITE BOUNDARY radiation doses to within the limits of 10 CFR 50.67 during accident conditions. Primary CONTAINMENT INTEGRITY is required in MODES 1 through 4. This requires an OPERABLE containment automatic isolation valve system. In MODES 1, 2, and 3 this is satisfied by the automatic containment isolation signals generated by low pressurizer pressure and high containment pressure. In MODE 4 the automatic containment isolation signals generated by low pressurizer pressure and high containment pressure are not required to be OPERABLE.Automatic actuation of the containment isolation system in MODE 4 is not required because adequate time is available for plant operators to evaluate plant. conditions and respond by manually operating engineered safety features components. Since the manual actuation (trip pushbuttons) portion of the containment isolation system is required to be OPERABLE in MODE 4, the plant operators can use the manual pushbuttons to rapidly position all automatic containment isolation valves to the required accident position. Therefore, the containment isolation trip pushbuttons satisfy the requirement for an OPERABLE containment automatic isolation valve system in MODE 4.3/4.6.1.2 CONTAINMENT LEAKAGE The limitations on containment leakage rates ensure that the total containment leakage volume will not exceed the value assumed in the accident analyses at thlepeak accident pressure of Pa. As an added conservatism, the measured overall integrated leakage rate is further limited to< 0.75 La during performance of the periodic tests to account for possible degradation of the containment leakage barriers between leakage tests.The surveillance testing for measuring leakage rates is in accordance with the Containment Leakage Rate Testing Program.The Millstone Unit No. 2 FSAR contains a list of the containment penetrations that have been identified as secondary containment bypass leakage paths.3/4.6.1.3 CONTAINMENT AIR LOCKS The limitations on closure and leak rate for the containment air locks are required to meet the restrictions on CONTAINMENT INTEGRITY and leak rate given in Specifications 3.6.1.1 and MILLSTONE -UNIT 2 B3/4 6-1 MILLTON -NIT2 B3/46-1Amendment No. 41-24, 34, April 14, 1999 3/4.6 CONTAINMENT SYSTEMS BASES 3.6.1.2. The limitations on the air locks allow entry and exit into and out of the containment during operation and ensure through the surveillance testing that air lock leakage will not become excessive through continuous usage.The ACTION requirements are modified by a Note that allows entry and exit to perform repairs on the affected air lock components. This means there may be a short time during which the containment boundary is not intact (e.g., during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed.ACTION a. is only applicable when one air lock door is inoperable. With only one air lock door inoperable, the remaining OPERABLE air lock door must be verified closed within 1 hour.This ensures a leak tight containment barrier is maintained by use of the remaining OPERABLE air lock door. The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, the remaining OPERABLE air lock door must be locked closed within 24 hours and' then verified periodically to ensure an acceptable containment leakage boundary is maintained. Otherwise, a plant shutdown is required.ACTION b. is only applicable when the air lock door interlock mechanism is inoperable. With only the air lock interlock mechanism inoperable, an OPERABLE air lock door must be verified closed within 1 hour. This ensures a leak tight containment is maintained by use of an OPERABLE air lock door. The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, an OPERABLE air lock door must be locked closed within 24 hours and then verified periodically to ensure an acceptable containment leakage boundary is maintained. Otherwise, a plant shutdown is required. In addition, entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock) is permitted. ACTION c. is applicable when both air lock doors are inoperable, or the air lock is inoperable for any other reason excluding the door interlock mechanism. With both air lock doors inoperable or the air lock otherwise inoperable, an evaluation of the overall containment leakage rate per Specification 3.6.1.2 shall be initiated immediately, and an air lock door must be verified closed within 1 hour. An evaluation is acceptable since it is overly conservative to immediately declare the containment inoperable if both doors in the air Jock have failed a seal test or if overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour (per Specification 3.6.1.1) would be provided to restore the air lock to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In addition, the air lock and/or at least one air lock door must be restored to OPERABLE status within 24 hours or a plant shutdown is required.MILLSTONE -UNIT 2 B 3/4 6-1a MILLTON -NIT B /4 -laAmendment No. 34, 267 June 7, 2002 CONTAINMENT SYSTEMS BASES Continued Surveillance Requirement 4.6.1 .3.1 verifies leakage through the containment air lock is within the requirements specified in the Containment Leakage Rate Testing Program. The containment air lock leakage results are accounted for in the combined Type B and C containment leakage rate. Failure of an air lock door does not invalidate the previous satisfactory overall air lock leakage test because either air lock door is capable of providing a fission product barrier in the event of a design basis accident.MILLSTONE -UNIT 2AmnetNo26 B 3/4 6-lb Amendment No. 267 July 25, 2003 CONASNENESSTM BASES 3/4.6.1.4 INTERNAL PRESSURE The limitations on containment internal pressure ensure that the containment peak pressure does not exceed the design pressure of 54 psig during MSLB or LOCA conditions. The maximum peak pressure is obtained from a MSLB event. The limit of 1.0 psig for initial positive containment pressure will limit the total pressure to less than the design pressure and is consistent with the accident analyses.3/4.6.1.5 AIR TEMPERATURE The limitation on containment air temperature ensures that the containment air temperature does not exceed the worst case combined LOCA/MvSLB air temperature profile and the liner temperature of 289°F. The containment air and liner temperature limits are consistent with the accident analyses.The temperature detectors used to monitor primary containment air temperature are located on the 38 ft. 6 in. floor elevation in containment. The detectors are located approximately 6 feet above the floor, on the southeast and southwest containment walls.3/4.6.1.6 DELETED%MILLSTONE -UNIT 2 B 3/4 6-2 Amendment No. 2-5, -3, 1-39, 204,-2-09, 9, 278 LBDCR 14-MIP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 314.6.2 DEPRESSURIZATION ANTD COOLING SYSTEMS 3/4.6.2.1 CONTATNMENT SPRAY AND COOLING SYSTEMS The OPERABILITY of the containment spray system ensures that contaimnent depressurization and cooling capability will be available in the event of a LOCA. The pressure reduction and resultant lower containment leakage rate are consistent with the assumptions used in the accident analyses.The OPERABILITY of the containment cooling system ensures that 1) the containment air temperature will be maintained within limits during normal operation, and 2) adequate heat removal capacity is available when operated in conjunction with the containment spray system during post-LOCA conditions. To be OPERABLE, the two trains of the containment spray system shall be capable of taking a suction from the refueling water storage tank on a containmenat spray actuation signal and automatically transferring suction to the containment surnp on a sump recirculation actuation signal. Each containment spray train flow path fr'om the containmrent sump shall be via an OPERABLE shutdown cooling heat exchanger. 'The containment cooling system consists of two containment cooling trains. Each containment cooling train has two containment air recirculation and cooling units. For the purpose of applying the appropriate ACTION statement, the loss of a single containment air recirculation and cooling unit will make the respective containment cooling train inoperable. Either the containmrent spray system or the containment cooling system is sufficient to mitigate a loss of coolant accident. The containmaent spray system is nmore effective than the containment cooling system in reducing thetemperature of superheated steam inside containment following a mafin steam line break. Because of this, the containment spray system is required to mitigate a main steam line break accidenat inside cdntainmaent, In addition, the containment spray system provides a mechanism for removing iodine fr-om the containment atmosphere. Therefore, at least one train of containment spray is required to be OPERABLE when pressurizer pressure is> 1750 psia, and the allowed outage time for one train of containment spray reflects the dual function of containment spray for heat removal and iodine removal.With one containment spray train inoperable, the inoperable containment spray train must be restored to OPERABLE status within 72 hours. In this Condition, the remaining OPERABLE spray and cooling trains are adequate to perform the iodine removal and containment cooling functions. The 72 hours allowed outage time takes into account the redundant heat removal capability afforded by the Contafinment Spray System and reason~able time for repairs.MILLSTONE -UNIT 2 B 3/4 6-3 Anmendment No. 2-5, 6-, o2---0, 4-l-, 2-s, -6, LBDCR 14-MIP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued) With one required containment cooling train inoperable, the inoperable containment cooling train must be restored to OPERABLE status within 7 days. The components in this degraded condition are capable of providing greater than 100% of the heat removal needs (for the condition of one containment cooling train inoperable) after an accident.With one containmaent spray train and one containment cooling train inoperable, one*required containment spray train or one required containment cooling train must be restored to OPERABLE status within 48 hours. The components in this degraded condition provide iodine removal capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 48 hour allowed outage time was developed taking into account the redundant heat removal capabilities afforded by combinations of the Containment Spray System and Containment Cooling System, the iodine removal function of the Containment Spray System, and the low probability of a DBA occurring during this period.With two required containment spray trains inoperable, at least one of the required containment spray trains must be restored to OPERABLE status within 24 hours. Both trains of containment cooling must be OPERABLE or be in H-OT SI{UTD OWN within the next 12 hours.The Condition is modified by a Note stating it is not applicable if the second containment spray train is intentionally declared inoperable. The Condition does not apply to voluntaiy removal of redundant systems or components fr'om service. The Condition is only applicable if one train is inoperable for any reason and the second train is discovered to be inoperable, or if both trains are discovered to be inoperable at the same time. In addition, LCO 3.7.6.1, "Control Room Emergency Ventilation System," mnust be verified to be met within 1 hour. The components in this degraded condition are capable of providing

greater than 100% of the heat removral needs after an accident.

The allowed outage time is based on Reference 1 which demonstrated that the 24 hour allowed outage time is acceptable based on the redundant heat removal capabilities afforded by the Containment Cooling System, the~iodine removal capability of the Control Room Emergency Air Cleanup System, the infrequent use of the Required Action, and the small incremental effect on plant risk.With two required containment cooling trains inoperable, one of the required containment cooling trains mustbe restored to OPERABLE status within 48 hours. The components in this degraded condition provide iodine removal capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 48 hour allowed outage time was developed taking into account the redundant heat removal capabilities afforded by combinations of the Containment Spray System and Containment Cooling System, the iodine removal function of the Containment Spray System, and the low probability of a DBA occurring during this period.MILLSTONE -UNIT 2 B 3/4 6-3a Amendment No. -l-0, 24-&-, 293~6, 2L7-8, LBDCR 14-MvP2-016 September 4, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued) Surveillance Requirement 4.6.2.1.1 .a verifies the correct alignment for manual, power operated, and automatic valves in the Contailnment Spray System flow paths to provide assurance that the proper flow paths will exist for contaimnent spray operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. R~ather, it involves verification that those valves capable of being mispositioned are in the correct position. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.6.2.1.1 .b, which addresses periodic surveillance testing of the containment spray pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems, is required by the ASME OM Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured perfonnance is within an acceptable tolerance of the original pump baseline performaance and that the performance at the test flow is greater than or equal to the performance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program. The ASME~ OM Code provides the activities and frequencies to satisfy the requirements. Surveillance Requirements 4.6.2.1.1l.c and 4.6.2.1.1.d demonstrate that each automatic containment spray valve actuates to the required position on an actual or simulated actuation signal (CSAS or SRAS), and that each containmaent spray pump starts..on receipt of an actual or simulated actuation signal (CSAS). This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. These surveillance frequencies are controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS)testing, and equipment performance is monitored as part of the Inservice Testing Program.MILLSTONE -UNIT 2 B 3/4 6-3b Amendment No. , 24g, 3, 7-S, LBDCR 14-MP2-01I6 September 4, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.2.1 CONTAINMENT SPRAY AND COOLING SYSTEMS (Continued) Surveillance Requirement 4.6.2. 1.1.e requires verification that each spray nozzle is unobstructed following maintenance that could cause nozzle blockage. Normal plant operation and maintenance activities are not expected to trigger performance of this surveillance requirement. However, activities, such as an inadvertent spray actuation that causes fluid flow through the nozzles, a major configuration change, or a loss of foreign material control when working within the respective system boundary may require surveillance performance. An evaluation, based on the specific situation, will determnine the appropriate method (e.g., visual inspection, air or smoke flow test) to verify' no nozzle obstruction. Surveillance Requirement 4.6.2.1 .2.a demonstrates that each containment air recirculation and cooling unit can be operated in slow speed for > 15 minutes to ensure OPERABILITY and that all associated controls are functioning properly. It also ensures fan or motor failure can be detected and corrective action taken. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.6.2.1.2.b demonstrates a cooling water flow rate of> 500 gpm to each containment air recirculation and cooling unit to provide assurance a cooling water flow path through the cooling unit is available. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.6.2.1 .2.c demonstrates that each containment air recirculation and cooling unit starts on receipt of an actual or simulated actuation signal (SIAS). The surveillance frequency is controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety~ Feature Actuation System (ESFAS)testing, and equipment perfonrmance is monitored as part of the Inservice Testing Program.REFERENCE 1. WCAP- 161 25-NP-A, "Justification for Risk-Informed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UJNJIT 2 B 3/4 6-3c Amendment No. 0, 24-4, 2-36, 7-8, LBDCR 14-MP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 314.6.3 CONTAINMENT IS OLATION VALVES The Technical Requirements Manual contains the list of containment isolation valves (except the containment air lock and equipment hatch). Any changes to this list will be reviewed under 10CFR50.59 and approved by the committee(s) as described in the QAP Topical Report.The OPERABILITY of the containment isolation valves ensures that the containment atmosphere will b~e isolated from the outside enviromnent in the event of a release of radioactive material to the containment atmosphere or pressurization of the containment. Containment isolation within the time limnits specified ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a LOCA.The containment isolation valves are used to close all fluid (liquid and gas) penetrations not required for operation of the engineered safety feature systems, to prevent the leakage of radioactive materials to the enviromnent. The fluid penetrations which may require isolation after an accident are categorized as Type P, 0, or N. The penetration types for each containment isolation valve are listed in PSAR Table 5.2-11, Containment Structure Isolation Valve Information. Type P penetrations are lines that connect to the reactor coolant pressure boundary (Criterion 55 of 10OCFR5O, Appendix A). These lines are provided with two containment isolation valves, one inside containment, and one outside containment. Type 0 penetrations are lines that are open to the containment internal atmosphere (Criterion 56 of 10CFR5O, Appendix A). These lines are provided with two containment isolation valves, one inside containment, and one outside containment ... " Type N penetrations are lines that neither connect to the reactor coolant pressure boundary nor are open to the contaimnent internal atmospher~e, but do form a closed system within the containment structure (Criterion 57 of IOCFR50, Appendix A). These lines are provided with single containment isolation valves outside containment. These valves are either remotely operated or locked closed manual valves.With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that carmot be adversely affecte~d by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. MILLSTONE -UNIT 2 B 3/4 6-3d Amendment No. 2-10, , -6, 7, 2g8-, LBDCRI14-MiP2-016 September 4, 2014 CONTAINMENT SYSTEMS BASES 314.6.3 CONTAINMENT ISOLATION VALVES (Continued) If the containment isolation valve on a closed system becomes inoperable, the rem~aining barrier is a closed system since a closed system is an acceptable alternative to an automatic valve.However, ACTIONS must still be taken to meet Technical Specification ACTION 3.6.3.1 .d and the valve, not normally considered as a containment isolation valve, and closest to the containment wall should be put into the closed position. No leak testing of the alternate valve is necessary to satisfy the ACTION statement. Placing the manual valve in the closed position sufficiently deactivates the penetration for Technical Specification compliance. Closed system isolation valves applicable to Technical Specification ACTION 3.6.3.1 .d are included in FSAR Table 5.2-11, and are the isolation valves for those penetrations credited as General Design Criteria 57, (Type N penetrations). The specified time (i.e., 72 hours) of Technical Specification ACTION 3.6.3.l.d is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, aind 4. In the event the affected penetration is isolated in accordance with 3.6.3.1 .d, the affected penetration flow path must be verified to be isolated on a periodic basis, (Surveillance Requirement 4.6.1t.1 .a). This is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The surveillance frequency is controlled under the Surveillance Frequency Control Program.[O For the purposes of meeting this LCO, neither the containment isolation valve, nor any alternate valve on a closed system have a leakage limit associated with valve OPERABILITY. Containment isolation valves may be opened on an intennittent basis provided appropriate administrative controls are established. The position of the NRC concerning acceptable administrative controls is contained in Generic Letter 91-08, "Removal of Component Lists from Technical Specifications," and includes the following considerations: (1) stationing an operator, who is in constant communication with the control room, at the valve controls, (2) instructing this operator to close these valves in an accident situation, and (3) assuring that environmental conditions will not preclude access to close the valve and that this action will prevent the release of radioactivity outside the containment. The appropriate administrative controls, based on the above considerations, to allow containment isolation valves to be opened are contained in the procedures that will be used to operate the valves. Entries should be placed in the Shift Manager Log when these valves are opened and closed. However, it is not necessary to log into any Technical Specification ACTION Statement for these valves, provided the appropriate administrative controls have been established. MILLSTONE -UNIT 2 B 3/4 6-3e Amendment No. 21-O, 2-5~, -236, 2-g, gt LBDCR 14-MvlP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued) If a containment isolation valve is opened while operating in accordance with Abnormal or Emergency Operating Procedures (AOPs and EOPs), it is not necessaiy to establish a dedicated operator. The AOPs and EOPs provide sufficient procedural control over the operation of the conatainment isolation valves.Opening a closed containment isolation valve bypasses a plant design feature that prevents the release of radioactivity outside the containment. Therefore, this should not be done frequently, and the time the valve is opened should be minimized. As a general guideline, a closed containment isolation valve should not be opened longer than the time allowed to restore the valve to OPERABLE status, as stated in the ACTION statement for LCO 3.6.3.1 "Containment Isolation Valves." A discussion of the appropriate administrative controls for the containment isolation valves, that are expected to be opened during operation in MODES 1 through 4, is presented below.Manual contaimnent isolation valve 2-SI-463, safety injection tank (SIT) recirculation header stop valve, is opened to fill or drain the SITs and for Shutdown Cooling System (SDC)boron equalization. While 2-SI-463 is open, a dedicated operator, in continuous commcrunication with the control room, is required.When SDC is initiated, SDC suction isolation remotely operated valves 2-SI-652 and 2-SI-651 (inside containment isolation valve) and manual valve 2-SI-709 (outside containment isolation valve) are opened. 2-SI-65 1 is normally operated from the cbnitrol room. While in MODES 1, 2 or 3, 2-SI-65 1 is closed with manual disconnect switch NSI65 1 locked open to satisfy Appendix R requirements. It does not receive an automatic contailnment isolation closure signal, but is interlocked to prevent opening if Reactor Coolant System (RCS) pressure is greater than approximately 275 psia. When 2-SI-65 1 is opened fr'om the control room, either one of the two required licensed (Reactor Operator) control room operators can be credited as the dedicated operator required for administrative control. It is not necessary to use a separate dedicated operator.When valve 2-SI-709 is opened locally, a separate dedicated operator is not required to remain at the valve. 2-SI-709 is opened before 2-SI-651. Therefore, opening 2-SI-709 will not establish a connection between the RCS and the SDC System. Opening 2-SI-651 will connect the RCS and SDC System. If a problem then develops, 2-SI-651 can be closed from the control room.MILLSTONE -UNIT 2 B 3/4 6-3f Amendment No.24-0, 2-4,-2-36, 2-7-g, 2g3,......l.... by, NR ...C letter ae6//5 LBDCR 14-MP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued) The administrative controls for valves 2-SI-651 and 2-SI-709 apply only during preparations for initiation of SDC, and during SDC operations. They are acceptable because RCS pressure and temperature are significantly below normal operating pressure and temperature when 2-SI-651 and 2-SI-709 are opened, and these valves are not opened until shortly before SDC flow is initiated. The penetration flowpath can be isolated from the control room by closing either 2-SI-652 or 2-SI-651, and the manipulation of these valves, during this evolution, is controlled by plant procedures. The pressurizer auxiliary, spray valve, 2-CH-5 17, can be used as an alternate method to decrease pressurizer pressure, or for boron precipitation control following a loss of coolant accident. When this valve is opened from the control room, either one of the two required licensed (Reactor Operator) control room operators can be credited as the dedicated operator required for administrative control. It is not necessary to use a separate dedicated operator.The exception for 2-CH-517 is acceptable because the fluid that passes through this valve will be collected in the Pressurizer (reverse flow firom the Pressurizer to the charging system is prevented by check valve 2-CH-43 1), and thle penetration associated with 2-CH-5 17 is open during accident conditions to allow flow from the charging pumaps. Also, this valve is normally 9,.: operated from the control room, under the supervision of the licensed control room operators, in accordance with plant procedures. A dedicated operator is not required when opening remotely operated valves associated with Type N fluid penetrations (Criterion 57 of 10OCFR5O, Appendix A). Operating these valves fr'om the control room is sufficient. The main steam isolation valves (2-MS-64A and 64B), atmospheric steam dump valves (2-MS-1 90A and 190B), and the containmaent air recirculation cooler RBCCW discharge valves (2-RB-28.2A-D).are examples of remotely operated contaim~aent isolation valves associated with Type N fluid penetrations. MSIV bypass valves 2-MS-65A and 65B are remotely operated MOVs, but while in MODE 1, they are closed with power to the valve motors removed via lockable disconnect switches located at their respective MCC to satisfy' Appendix "R" requirements. Local operation of the atmospheric steam dump valves (2-MS-i190A and t 90B), or other remotely operated valves associated with Type N fluid penetrations, will require a dedicated operator in constant communication with the control room, except when operating in accordance with AOPs or EOPs. Even though these valves can not be classified as locked or sealed closed, the use of a dedicated operator will satisfy administrative control requirements. Local operation of these valves with a dedicated operator is equivalent to the operation of other manual (locked or sealed closed) containment isolation valves with a dedicated operator.MILLSTONE -UNIT 2 B 3/4 6-3g Amendment No. 21-i-, 2-6, 7-3, 2-7-8, LBDCR 14-MP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued) The main steam supplies to the turbine driven auxiliary feedwater pump (2-MS-201 and 2-MS-202) are remotely operated valves associated with Type N fluid penetrations. These valves are maintained open during power operation. 2-MS-20 1 is maintained energized, so it can be closed fr'om the control room, if necessary, for containment isolation. However, 2-MS-202 is deenergized open by removing power to the valve's motor via a lockable disconnect switch to satisfy Appendix R requirements. Therefore, 2-MS-202 cannot be closed irmmediately fr-om the control room, if necessary, for containment isolation. The disconnect switch key to power for 2-MS-202 is stored in the Unit 2 control room, and can be used to re-power the valve at the MCC;this will allow the valve to be closed fr'om the control room. It is not necessary to maintain a dedicated operator at 2-MS-202 because this valve is already in the required accident position.Also, the steam that passes through this valve should not contain any radioactivity. The steam generators provide the barrier between the containment and the atmosphere. Therefore, it would take an additional structural failure for radioactivity to be released to the environment thr-ough this valve.Steam generator chemical addition valves, 2-F W-15A and 2-F W-15B, are opened to add chemicals to the steam generators using the Auxiliary Feedwater System (AFW). When either 2-F W-15A or 2-F W-15B is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of these valves is expected during plant startup and shutdown.The bypasses around the main steam supplies to the turbine dr'iven auxiliary feedwater pump (2-MS-201 and 2-MS-202), 2-MS-458 and 2-MS-459, are opened to drain water from the steam supply lines. When either 2-MS-458 or 2-MS-459 is opened, a dedicated operator, in continuous communication with the control room, is required. Operatlion of these valves is expected during plant startup.The containment station air header isolatioin, 2-SA- 19, is opened to supply station air to containment. When 2-SA-1 9 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected for maintenance activities inside conatahnment. The backup air supply master stop, 2-IA-5 66, is opened to supply backup air to 2-CH-5 17, 2-CH-5 18, 2-CH-5 19, 2-EB-88, and 2-EIB-89. When 2-IA-566 is opened; a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected in response to a loss of the normal air supply to the valves listed.MILLSTONE -UNIT 2 B 3/4 6-3h Amendment No. 4-0, 1-, 2-l-6, 7-, 2-7 g 2 -83 LBDCR 14-MIP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES: 3/4.6.3 CONTAINMENT ISOLATION VALVES (Continued) The nitrogen header drain valve, 2-S1-045, is opened to depressurize the containment side of the nitrogen supply header stop valve, 2-8I-312. When 2-SI-045 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is only expected after using the high pressure nitrogen system to raise SIT nitrogen pressure.The containment waste gas header test connection isolation valve, 2-GR-63, is opened to sample the drain tank for oxygen and nitrogen. When 2-GR-63 is opened, a dedicated operator, in continuous communication with the control room, is required. Operation of this valve is expected during plant startup and shutdown.The upstream vent valves for the steam generator atmospheric dump valves, 2-MS-369 and 2-MS-3 71, are opened during steam generator safety valve set point testing to allow steam header pressure instrumentation to be placed in service. When either 2-MS-3 69 or 2-MS-3 71 is opened, a dedicated operator in continuous communication with the control room is required.The detennination of the appropriate administrative controls for these containment isolation valves included an evaluation of the expected enviromnental conditions. This evaluation has concluded environmental conditions will not preclude access to close the valve, and this action will prevent the release of radioactivity outside of contaimntent through the respective penetration. The containment purge supply and exhaust isolation valves are required to be sealed closed during plant operation since these valves have not been demonstr'ated capable of closing during a LOCA or steam line break accident. Such a denmonstration would require justification of the mechanical OPERABILITY of the purgevyalves and consideration of the appropriateniess of the electrical override circuits. Maintaining these valves closed during plant operations ensures that excessive quantities of radioactive materials will not be released via the containment purge system. The containment purge supply and exhaust isolation valves are sealed closed by isolating instrument air and removing power from the valves, This is accomplished by closing the instrument air isolation valves and pulling the control power fuses for. each of the valves. The associated instrument air isolation valves and fuse blocks are then locked. This is consistent with the guidance contained in NUREG-0737 Item II.E.4.2 and Standard Review Plan 6.2.4,"Containment Isolation System," Item II.f.Surveillance Requirement 4.6.3.l.a verifies the isolation time of each power operated automatic containment isolation valve is within limits to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and surveillance frequency are in accordance with the Inservice Testing Progr'am.MILLSTONE -UNIT 2 B 3/4 6-3i Amendment No. 2-3, 9 LBDCR 14-MP2-016 September 4, 2014 CBNASES NSSTM BASES 3/4.6.4 COMBUSTIBLE GAS CONTROL Surveillance Requirement 4.6.3.1 .b demonstrate that each automatic containment isolation valve actuates to the isolation position on an actual or simulated containment isolation signal [containment isolation actuation signal (CIAS) or containment high radiation actuation signal (containment purge valves only)]. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under admninistrative controls. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ES FAS)testing, and equipment performance is monitored as part of the Inservice Testing Program.The OPERABILITY of the equipment and systems required for control of hydrogen gas ensures that this equipment will be available to maintain the hydrogen concentration within contaimnent below its flammable limit during post-LOCA conditions. The post-incident recirculation systems are provided to ensure adequate mixing of the containment atmosphere following a LOCA. This mixing action will prevent localized accumulations of hydrogen from exceeding the flammable limit.MILLSTONE -UNIT 2 B 3/4 6-4 Amendment No .-2~-3-3, Ackncw~gccl y NRC1011(31dAt REVERSE OF PAGE B 3/4 6-4 INTENTIONALLY LEFT BLANK LBDCR 14-MiP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.5 SECONDARY CONTAIN~MENT 3/4.6.5.1 ENCLOSURE BUILDING FILTRATION SYSTEM The OPERABILITY of the Enclosure Building Filtration System ensures that containment leakage occurring during LOCA conditions into the annulus will be filtered through the filters and charcoal adsorber trains prior to discharge to the atmosphere. This requirement is necessary to meet the assumptions used in the accident analyses and limit the SITE BOUNDARY radiation doses to within the limits of 10 CFR 50.67 during LOCA conditions. With one Enclosure Building Filtration System Train inoperable, the inoperable train must be restored to OPERABLE status within 7 days. The components in this degraded condition are capable of providing 100% of the iodine removal needs after a DBA. The 7 day allowed outage tune is based on consideration of such factors as the availability of the OPERABLE redundant Enclosure Building Filtration System Train and the low probability of a DBA occurring during this period.If two Enclosure Building Filtration System Trains are inoperable, at least one Enclosure Building Filtration System Train must be returned to OPERABLE status within 24 hours. The Condition is modified by a Note stating it is not applicable if the second Enclosure Building Filtration System train is intentionally declared inoperable. The Condition does not apply to voluntary removal of redundant systems or components from service. The Condition is only applicable if one train is inoperable for any reason and the second train is discovered to be inoperable, or if both trains are discovered to be inoperable at the same time. In addition, at least one train of containment spray must be verified to be OPERABLE within 1 hour. In the event of an accident, containmaent spray reduces the potential radioactive release from the containment, which reduces the consequences of the inoperable Enclosure Building. Filtration System Trains.The allowed outage time is based on Reference 1 which demonstrated that the 24 hour allowed outage time is acceptable based on the infrequent use of the Required Actions and the small incremental effect on plant risk.The laboratory testing requirement for the charcoal sample to have a removal efficiency of> 95% is more conservative than the elemental and organic iodine removal efficiencies of 90%and 70%, respectively, assumed in the DBA analyses for the EBFS charcoal adsorbers in the Millstone Unit 2 Final Safety Analysis Report. A removal efficiency acceptance criteria of 95%will ensure the charcoal has the capability to perform its intended safety function throughout the length of an operating cycle.MILLSTONE -UNIT 2 B3465AedetN.2~ B 3/4 6-5 Amendment No. gO8, LBDCR 14-MiP2-016 September 4, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.5.1 ENCLOSURE BUILDING FILTRATION SYSTEM (Continued) Surveillance Requirement 4.6.5.1 .b.l dictates the test frequency, method and acceptance criteria for the EBFS trains (cleanup trains). These criteria all originate in the Regulatory Position sections of Regulatory Guide 1.52, Rev. 2, March 1978 as discussed below: Section C.5 .a requires a visual inspection of the cleanup system be made before the following tests, in accordance with the provisions of section 5 of AINSI N5 10-1975:* in-place air flow distribution test* DOP test* activated carbon adsorber section leak test Section C.5 .c requires the in-place Dioctyl phthalate (DOP) test for HiEPA filters to section 10 of ANSI N5 10-1975. The HEPA filters should be tested in place (1) initially, (2) at the frequency specified in the Surveillance Frequency Control Program, and (3) following painting, fire, or chemical release in any ventilation zone communicating with the system. The testing is to confirm a penetration of less than or equal to 1 %* at rated flow. Q Section C.5.d requires the charcoal adsorber section to be leak tested with a gaseous halogenated hydrocarbon refrigerant, in accordance with section 12 of ANSI N5 10-1975 to ensure that bypass leakage through the adsorber section is less than or equal to 1%.** Adsorber leak testing should be conducted (1) initially, (2) at the frequency specified in the Surveillance Freqluency Control Program, (3) following removal of an adsorber sample for laboratorytesting if the integrity of the adsorber section is affected, and (4) following painting, fire, or chemical release in any ventilation zone communicating with the system.REFERENCE 1. WCAP-16 125-NP-A, "Justification for Risk-Informed Modifications to Selected Technical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.* Means that the lIEPA filter will allow passage of less than or equal to 1% of the test concentration injected at the filter inlet from a standard DOP concentration injection.

• • Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of the injected test concentration around the charcoal adsorber sections.MILLSTONE

-UNIT 2 B 3/4 6-5a Amendment No. 2Og, " LBDCR 14-MIP2-001 May 20, 2014 CONTAINMENT SYSTEMS BASES 3/4.6.5.2 ENCLOSURE BUILDING The OPERABILITY of the Enclosure Building ensures that the releases of radioactive materials fr'om the primary containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the accident analyses. This restriction, in conjunction with operation of the Enclosure Building Filtration System, will limit the SITE BOUNDARY radiation doses to within the limits of 10 CFR 50.67 during accident conditions. One Enclosure Building Filtration SysteLn tr'ain is required to establish a negative pressure of 0.25 inches W.G. in the Enclosure Building Filtration Region within one minute after an Enclosure Building Filtration Actuation Signal is generated. The one minute time requirement does not include the time necessary for the associated emergency diesel generator to start and power Enclosure Building Filtration System equipment. To enable the Enclosure Building Filtration System to establish the required negative pressure in the Enclosure Building, it is necessary to ensure that all Enclosure Building access openings are closed. For double door access openings, only one door is required to be closed and latched, except for nornal passage. For single door access openings, that door is required to be closed and latched, except for nonnal passage.If a required door that is designated to automatically close and latch is not capable of automatically closing and latching, the door shall be maintained closed and latched, or personnel shall be stationed at the door to ensure that the door is closed and latched after each trafisit through the door. Otherwise, the access opening (door) should be declared inoperable and appropriate technical specification ACTION statement entered.MILLSTONE -UNIT 2 B346S mnmn o 0g B 3/4 6-5b Amendment No. -a@8, [ REVERSE OF PAGE B 314 6-5b INTENTIONALLY LEFT BLANKK May 7, 2003 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES The OPERABILITY of the main steam line code safety valves (MSSVs) ensures that the secondary system pressure will be limited to within 110% of the design pressure during the most severe anticipated system operational transient. The Loss of Electrical Load with Turbine Trip and the single main steam isolation valve (MSIV) closure event were evaluated at various power levels with a corresponding number of inoperable MSSVs. The limiting anticipated system operational transient is the closure of a single MSIV.The specified valve lift settings an~d relieving capacities are in accordance with the requirements of Section III of the ASME Boiler and Pressure Vessel Code, 1971 Edition. The total rated capacity of the main steam line code safety valves is 12.7 x 106 lbs/hr. This is sufficient to relieve in excess of 100% steam flow at RATED THERMAL POWER.The LCO requires all MSSVs to be OPERABLE. An alternative to restoring the inoperable MSSV(s) to OPERABLE status is to reduce power so that the available MSSV relieving capacity meets ASME Code requirements for the power level. POWER OPERATION is allowed with inoperable MSSVs as specified within the limitations of the ACTION requirements. Less than the full number of OPERABLE MSSVs requires limitations on allowable THERMAL POWER and adjustment to the Power Level-High trip setpoint in accordance with ACTIONS a. 1 and a.2. The 4 hours provided for ACTION a. 1 is a reasonable time period to reduce power level and is based on the low probability of an event occurring during this period that would require activation of the MSSVs. ACTION a.2 provides for 36 hours to reduce the Power Level-High trip setpoint. This time for ACTION a.2 is based on a reasonable time to correct the MSSV inoperability, the time required to perform the" power reduction, operating experience in resetting all channels of a protective function, and on the low probability of the occurrence of a transient that could resulf in steam generator overpressure during this period.As described in Section 2.2.1 of the BASES, during a power reduction the Power Level-High trip setpoint automatically tracks TI-ERMAL POWER downward so that it remains a fixed increment above the current power level, subject to a minimum value. Therefore, during short term reduced power evolutions e.g., MSSV testing, it is permissible to only reduce THERMAL POWER in accordance with ACTION a. 1 (the protective function of ACTION a.2 is automatically provided due to the nature of the Power Level-High trip setpoint), provided that the MSSV testing can be completed within the 36 hours provided for ACTION a.2.MILLSTONE -UNIT 2 B 3/4 7-1 MILLTONE-UIT 2B 3/7-IAmendment No. 5-2, 6-1-, 4-, 275 LBDCR 04-MP2.-016 February 24, 2005 3/.7PLNS SSTM 0 BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) The OPERABILITY of the MSSVs is defined as the ability to open within the setpoint tolerances, relieve steam generator overpressure. and reseat when pressure has been reduced. The lift setpoints for the MSSVs are listed in Table 4.7-1. This table allows a + 3% setpoint tolerance (allowable value) on the lift setting for OPERABILITY to account for drift over a cycle. Each MSSV .is demonstrated OPERABLE, with lift settings as shown in Table 4.7-1, in accordance with Specification 4.0.5. A footnote to Table 4.7-1 requires that the lift setting be restored to within 4- 1% of the setpoint (trip setpoint) following testing to allow for drift. While the lift settings are being restored to a tolerance of+ 1-%, the MSSV will remain OPERABLE with lift settings out of tolerance by as much as +- 3%.MILLSTONE -UNIT 2 B 3/4 7-la Amendment No. 6-t-, 2-1-1-, 2t-5-, Acknowledged by NRC letter dated 6/28/05 LBDCR 11-MP2-013 August 25, 2011 3/4.7 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEEDWATER PUMPS The OPERABILITY of the auxiliary feedwater pumps ensures that the Reactor Coolant System can be cooled down to less than 3 00°F from nornal operating conditions in the event of a total loss of off-site power.The FSAR Chapter 14 Loss of Normal Feedwater: QON-F) analysis evaluates the event occurring with and without offsite power available, and a single active failure. This analysis has determined that one motor driven AFW pump is not sufficient to meet the acceptance criteria.Therefore, two AFW pumps (two motor-driven AFW pumps, or one-motor driven AMW pump and the steam-driven AFW pump) are required to meet the acceptance criteria for this moderate frequency event. To meet the requirement of two AFW pumps available for mitigation, all three pumps must be OPERABLE to accommodate the failure of one pump. This is consistent with the limiting cQndition for operation and ACTION statements of Technical Specification 3.7.1.2.Although not part of the bases of Technical Specification 3.7.1.2, the less conservative FSAR Chapter 10 Best Estimate Analysis of the LONF event was performed to demonstrate that one motor-driven AEW pump is adequate to remove decay heat, prevent steam generator drout, maintain Reactor Coolant System (RCS) subcooling, and prevent pressurizer level from exceeding acceptable limits. This best estimate analysis is performed to demonstrate the automatic start of both motor driven AFW pumps on low steam generator level satisfies the automatic AFW initiation requirements of NUiREG-0737 Item lI.E. 1.2. Automatic start of the turbine driven AFW pump is not required. From this best estimate analysis of the LONE event, an evaluation was performed to demonstrate that a single motor-driven AEW pump has sufficient capacity to reduce the RCS temperature to 3 00°F (in addition to decay heat removal) where the Shutdown Cooling System may be placed into operation for continued cooldown. As a result of these evaluations, one motor-driven AEW pump (or the steam-driven AFW pump which has twice the capacity of a motor-driven AFW pump) can meet the requirements to remove decay heat, prevent steam generator dryout, maintain RCS subcooling, prevent the pressurizer from exceeding acceptable limits, and reduce RCS temperature to 3 00°3 F.+The Auxiliary Feed Water (AFW) system is OPERABLE when the MFW pumps and flow paths required to provide MFW to the steam generators are OPERABLE. Technical Specification 3.7. 1.2 requires three MFW pumps to be OPERABLE and provides ACTIONS to address inoperable AMW pumps. The MFW flow path requirements are separated into MFW pump suction flow path requirements, MFW pump discharge flow path to the common discharge header requirements, and common discharge header to the steam generators flow path requirements. There are two MFW pump suction flow paths from the Condensate Storage Tank to the MFW pumps. One flow path to the turbine driven MFW pump, and one flow path to both motor driven MFW pumps. There are three MFW pump discharge flow paths to the common discharge header, one flow path from each of the three MFW pumps. There are two MFW discharge flow paths from the common discharge header to the steam generators, one flow path to each steam generator. With 2-F W-44 open (normal position), the discharge from any MFW pump will be supplied to both steam generators through the associated MFW regulating valves.MILLSTONE -UN[T 2 B 3/4 7-2 Amendment No. g2, 64-, 6-3, 44-t, 2, 36,'2-4, LBD CR 04-MP2-016 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued) 2-F W-44 should remain open when the AFW system is required to be OPERABLE (MODES 1, 2, and 3). Closing 2-F W-44 places the plant in a configuration not considered as an initial condition in the Chapter 14 accident analyses. Therefore, if 2-F W-44 is closed while the plant is operating in MODES 1, 2, or 3, two AEW pumps should be considered inoperable and the appropriate ACTION requirement of Technical Specification 3.7.1.2 entered to limit plant operation in this configuration. A flow path may be considered inoperable as the result of closing a manual valve, failure of an automatic valve to respond correctly to an actuation signal, or failure of the piping. In the case of an inoperable automatic AFW regulating valve (2-F W-43A or B), flow path OPERABILITY can be restored by use of a dedicated operator stationed at the associated bypass valve (2-F W-56A or B) as directed by OP 2322. Failure of the common discharge header piping will cause both discharge flow paths to the steam generators to be inoperable. An inoperable suction flow path to the turbine driven AFW pump will result in one inoperable AFW pump. An inoperable suction flow path to the motor driven AFW pumps will result in two inoperable MFW pumps. The ACTION requirements of Technical Specification 3.7.1.2 are applicable based on the number of inoperable AFW pumps.An inoperable pump discharge flow path from an MFW pump to the common discharge header will cause the associated AFW pump to be inoperable. The ACTION requirements of Technical Specification 3.7.1.2 for one MFW pump are applicable for each affected pump discharge flow path.MFW must be capable of being delivered to both steam generators for design basis accident mitigation. Certain design basis events, such as a main steam line break or steam generator tube rupture, require that the affected steam generator be isolated, and the RCS decay heat removal safety function be satisfied by feeding and steaming the unaffected steam generator. If a failure in an MFW discharge flow path from the common discharge header to a steam generator prevents delivery of MFW to a steam generator, then the design basis events may not be effectively mitigated. In this situation, the ACTION requirements of Technical Specification 3.0.3 are applicable and an immediate plant shutdown is appropriate. Two inoperable AFW System discharge flow paths from the common discharge header to both steam generators will result in a complete loss of the ability to supply MFW flow to the steam generators. In this situation, all three MFW pumps are inoperable and the ACTION requirements of Technical Specification 3.7.1.2. are applicable. Immediate corrective action is required.However, a plant shutdown is not appropriate until a discharge flow path from the common discharge header to one steam generator is restored.MILLSTONE -UNIT 2 B 3/4 7-2a Amendment No. , Acknowledged by NRC letter dated 6/28/05 November 10, 2005 LBDCR 04-MP2-013 3/4.7 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued) If the turbine-driven auxiliary feedwater train is inoperable due to an inoperable steam supply in MODES 1, 2, and 3, or if the turbine-driven auxiliary feedwater pump is inoperable while in MODE 3 immediately following REFUIEL1INJQ action must be taken to restore the inoperable equipment to an OPERABLE status within 7 days. The 7 day allowed outage time is reasonable, based on the following:

a. For the inoperability of the turbine-driven auxiliary feedwater pump due an inoperable steam supply, the 7 day allowed outage time is reasonable since the auxiliary feedwater system design affords adequate redundancy for the steam supply line for the turbine-driven pump.b. For the inoperability of a turbine-driven auxiliary feedwater pump while in MODE 3 immediately subsequent to a refueling, the 7 day allowed outage time is reasonable due to the minimal decay heat levels in this situation.

c. For both the inoperability of the turbine-driven pump due to an inoperable steam supply and an inoperable turbine-driven auxiliary feedwater pump while in MODE 3 immediately following a refueling outage, the 7 day allowed outage time is reasonable due to the availability of redundant OPERABLE motor driven auxiliary feedwater pumps, and due to the low probability of an event requiring the use of the turbine-driven auxiliary feedwater pump.When one steam supply to the turbine-driven auxiliary feedwater pump is inoperable, the turbine-driven auxiliary feedwater pump is inoperable.

In this case, although the turbine-driven auxiliary feedwater pump with a single oper~able steam supply is capable of perfonning its safety function in the absence of a single failure, the turbine-driven auxiliary feedwater pump is considered inoperable due to the lack of redundancy with respect to steam supplies.The required ACTION dictates that if the 7 day allowed outage time is reached the unit must be in at least HOT STAND)BY within the next 6 hours and in HOT SHUTDOWN within the following 12 hours.The allowed time is reasonable, based on operating experience, to reach the required conditions from full power conditions in an orderly manner and without challenging plant systems.MILLSTONE -UNIT 2 B 3/4 7-2b Amendment No. g2, 6-1-, 63-, 2-l44,-2-36, 2g3-2, LB3DCR 14-MIP2-016 September 4, 2014 3/4.7 PLANT SYSTEMS BASES 0 3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued') A Note limits the applicability of the inoperable equipment condition

b. to when the unit has not entered MODE 2 following a REFUELING..Required ACTION b. allows one auxiliary feedwater pump to be inoperable for 7 days vice the 72 hour allowed outage time in required ACTION c. This longer allowed outage time is based on the reduced decay heat following REFUELING and prior to the reactor being critical.With one of the auxiliary feedwater PUmps inoperable in MODE 1, 2, or 3 for reasons other than ACTION a. or b., ACTION must be taken to restore the inoperable equipment to OPERABLE status within 72 hours. This includes the loss of both steam supply lines to the turbine-driven auxiliary feedwater pump. The 72 hour allowed outage time is reasonable, based on redundant capabilities afforded by the auxiliary feedwater system, time needed for repairs, and the low probability of a DBA occurring during this time period. Two auxiliary feedwater pumps and flow paths remain to supply feedwater to the steam generators.

If all three AFW pumps are inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with non-safety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW pump to OPERABLE status. Required ACTION e. is modified by a Note indicating that all required MODE changes or power reductions are suspended until one MFW pump is restored to OPERABLE status. Ina this case, LCO 3.0,3 is not applicable because it could force the unit into a less safe condition. During periodic surveillance testing. of the turbine driven AFW pump, valve 2-CN-27A is closed and valve 2-CN-28 is opened to prevent overheating the water being circulated. In this configuration, the suction of the turbine driven AFW pump is aligned to the Condensate Storage Tank via the motor driven AFW pump suction flow path, and the pump minimum flow is directed to the Condensate Storage Tank by the turbine driven AFW pump suction path upstream of 2-CN-27A in the reverse direction. During this surveillance, the suction path to the motor driven AFW pump suction path remains OPERABLE, and the turbine driven AFW suction path is inoperable. In this situation, the ACTION requirements of Technical Specification 3.7.1.2 for one MFW pump are applicable. The surveillance frequency is controlled under the Surveillance Frequency Control Program.I MILLSTONE -UNIT 2 B3472 mnmn o 8-B 3/4 7-2c Amendment No. -2gg, LBDCR 14-MP2-016 September 4, 2014 3/4.7 PLANT SYSTEMS BASES 3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued) Surveillance Requirement 4.7.1I.2.a verifies the correct alignment for manual, power operated, and automatic valves in the Auxiliary Feedwater (AFW) System flow paths (water and steam) to provide assurance that the proper flow paths will exist for AFW operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The surveillance frequency is controlled under the Surveillance Frequency Control Progr'am.Surveillance Requirement 4.7.1.2.b, which addresses periodic surveillance testing of the AFW pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems, is required by the ASMIE Code for Operations and Maintenance of Nuclear Power Plants (ASME GM Code). This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the perfonnance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program. The ASME GM Code provides the activities and frequencies necessary to satisfy the requirements. This surveillance is modified to indicate that the test can be deferred for the steam driven AFW pump until suitable plant conditions are established. This deferral is required because steam pressure is not sufficient to perform the test until after MODE 3 is entered. Once the unit reaches 800 psig, 24 hours would be allowed for completing the surveillance. However, the test, if required, must be performed prior to entering MODE 2.Surveillance Requirements 4.7.1.2.c and 4.7.1 .2.d demonstrate that each automatic AFW valve actuates to the required position on an actual or simulated actuation signal (AF WAS) and that each AFW pump starts on receipt of an actual or simulated actuation signal (AF WAS). This surveillance is not required for valves that are locked, sealed, or Otherwise secured in the required position under administrative controls. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program. These surveillances do not apply to the steam driven AFW pump and associated valves which are not automatically actuated.MILLSTONE -UNIT 2 B3472 mnmn o B 3/4 7-2d Amendment No. November 10, 2005 LBDCR 04-MP2-013 3/.7PLNS SSTM 0 BASES 3/4.7.1.2 AUXILIARY FEED WATER PUMPS (Continued) Surveillance Requirement 4.7.1 .2.e demonstrates the AIEW System is properly aligned by verifyiing the flow path to each steam generator prior to entering MODE 2, after 30 cumulative days in MODE 5, MODE 6, or a defueled condition. OPERABILITY of the AFW flow paths must be verified before sufficient core heat is generated that would require operation of the AFW System during a subsequent shutdown. To further ensure AEW System alignment, the OPERABILITY of the flow paths is verified following extended outages to determine that no misalignmaent of valves has occurred. The frequency is reasonable, based on engineering judgment, and other administrative controls to ensure the flow paths are OPERABLE.3/4.7.1.3 CONDENSATE STORAGE TANK The OPERABILITY of the condensate storage tank with the minimum water volume ensures that sufficient water is available for cooldown of the Reactor Coolant System to less than 300°F in the event of a total loss of off-site power. The minimum water volume is sufficient to maintain the RCS at HOT STANDBY conditions for 10 hours with steam discharge to atmosphere. The contained water volume limit includes an allowance for water not usable due to discharge nozzle pipe elevation above tank bottom, plus an allowance for vortex formation. ib 3/4.7.1.4 ACTIVTY The limitations on secondary system specific activity ensure that the resultant off-site radiation dose will be limited to a small fraction MILLSTONE -UNIT 2 B 3/4 7-2e Amendment No. . LBDCR 04-MP2-016 February 24, 2005 PLANT SYSTEMS BASES..3/4.7.1i.4 ACTIVITY (Continued) of 10 CFR Part 100 limits in the event of a steam line rupture. The dose calculations for an assumed steam line rupture include the effects of a coincident 1.0 GPM primary to Secondary tube -.leak in the steam generator of the affected steam line and a concurrent loss of offsite electrical power. These values are consistent with theassumptions used in the accident analyses.3/4.7.1.5 MAIN STEAM. LINE IsoLATIoN VALVES The OPERABILITY of the main steam line isolation valves ensures, that no *more than one steam generator will blowdown in the event of a steam line rupture. This restriction is *required to 1I) minimize te p~ositi.ve Teactivity ffe tfth'e Ractor, Coklant;,Siystem-.o-ol[down i.sso~5iated. with the blowdown, and:2) -limiti-the!pr~es~sure-rise:w~ithin-coigtginmehtiin:he-eve-nt--th, steoan l~ine rupture occurs within conitainment. fTheOP'ERABILITY of the maini steam valves within the closure times of the surveillance requiremenats are consistent with the assumptions used in the accident analyses.The ability of the main steam line isolation valves (MSIVs) to close is verified after the plant has been heated up. Since it is necessary to establish a high Reactor Coolant System temperature before the surveillance test can be performed, on exception to Technical Specification 4.0.4 has been added to SR 4.7.1.5 to allow entry into MODE 3. This is necessary to allow plant startup to proceed with equipment that is believed to be OPERABLE; but that Cannot be verified by performance of the surveillance test until the appropriate plant conditions have been established. After entering MODE 3 and establishing the necessary plant conditions (Tavg > 51 5 0 F), the MSIVs will be declared inoperable if SR 4.7.1.5 has not been performed within the required frequency, plus 25%, in accordance with Technical Specifications 4.0:2 and 4.0.3. The ACTION statement for MODES 2 and 3 Would thenbe entered. However, the required ACTIONS can be deferred for up to 24 hours (Technical Specification 4.0.3) to allow performance of SR 4.7.1.5. If the surveillance test is not performed within this 24 hour time period, the requirements of the ACTION statement for MODES 2 and 3 apply, and the MSIV(s) [must be either restored to OPERABLE status or closed. Closing the MSIV(s) put the valve(s) in the required accident condition. However, the MSIV(s) may be opened to perform SR 4.7.1.5. If the MSIV(s) carmnot be closed, the plant must be shut down to MODE 4.3/4.7.1.6 MAMN FEEDWATER ISOLATION COMIPONENTS (MFICS)Feedwater isolation response time ensures a rapid isolation of feed flow to the steam.generators via the feedwater regulating valves, feedwater bypass Valves, and: as backup, feed pump discharge valves. :The response time includes signal generation time and valve stroke. Feed line block valves also receive MILLSTONE -UNIT 2 'B 3/4 7-3 Amendment No. 4-88, 24-9, Acknowledged by NRC letter dated 6/28/05 LBDCR 07-MP2-03 1 August 8, 2007 PLANT SYSTEMS BASES a feedwater isolation signal Since the steam line break accident analysis credits them in prevention of feed line volume flashing in some cases. Feedwater pumps are assumed to trip immediately with an MSI signal.3/4.7.1.7 ATMOSPHERIC DUMP VALVES The atmospheric dump valve (ADV) lines provide a method to maintain the unit* in HoT STANDBY, and to replace or supplement the condenser steam dump valves to cool the unit to Shutdown Cooling (SDC) entry conditions. Each ADV line contains an air operated.ADV, and an uipstream manual isolation Vcalve. The manual isolation valves are normally open; anid the ADVS closed. The ADVs, which are normally operated from the main control* room, can be operated*locally using a manual handwheel. An ADV is, ..if the manual iso~latin val~ve-,iS,,pen and .if~tocal:-mranual.. of theADN.c~an bed u ;9:4 t: eroxc~nrolole4;0r~easeofgstamn .t t~he *atospere. If:the manual isolation valve is closed the ADV line is inoperable The considerable: time and effort required to open the valve Wvould challenge the timing of critical operator act~ions and established operator dose limits. This is consistent with the LOCA analysis and Steam Generator Tube Rupture analysis which credits local manual operation of the ADV lines for accident mitigation. 3/4.7.1.8 STEAM GENERATOR BLOWDOWN ISOLATION VALVES The steam generator blowdown isolation valves will isolate steam generator blowdown on*low steam generator water level; An auxiliary feedwater actuation signal will also be generated at*this steam generator water level. Isolation of steam generator: blowdown will conserve steam generator water inventory following, a loss of main feedwater. The steam generator blowdown isolation valves will also*close automatically upon receipt of a containment isolation signal or a high radiation signal (steam generator blowdown or condenser air ejector discharge). 3/4.7.2 DELETED... 3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER sYSTEM The OPERABILITY of the Reactor Building Closed Cooling Water*(RBCCw) System ensures that sufficient cooling capacity is available for continued operation of vital components and Engineered Safety Feature equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the ass used in the accident analyses... The RBcCW loops areredundant of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of a'design basis accident,: one RBCCW ioop is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to. which it supplies cooling water. To enSure this requirement is met, two RBCCW loops must be OPERABLE, and independent to the extent" necessary to ensure that a single failure will not result in the unavailability MILLSTONE -UNIT 2 B 3/4 7-3a Amendment No. 2N-l9, &224, 226,24m6,-~2-8,-2-7-2, January 10, 2002 PTSCR 2-18-01 May 1, 2002 PLANT SYSTEMS BASES of both RBCCW loops. At least one RBCCW ioop will operate assuming the worst single active failure occurs following a design basis accident coincident with a loss of offsite power, or the worst single passive failure occurs during post-loss of coolant accident long tenn cooling. System design is assumed to mitigate the single active failure. System design or operator action is assumed to mitigate the passive failure.The RBCCW System has numerous cross connection points between the redundant loops, with manual valve isolation capability. When these valves are opened, the two system ioops are no longer independent. The loss of independence will result in one large RBCCW loop. This may adversely impact the ability of the RBCCW System to mitigate the design basis events if a single failure, active or passive, occurs. Opening the manual cross-connection valves during normal operation should be evaluated to ensure system stability, minimum component cooling flow requirements, and the ability to mitigate the design basis events coincident with a single failure are maintained. Continuous operation with cross-connection valves open is acceptable if the configuration has been evaluated and protection against a single failure can be demonstrated.(Several system configurations that have been evaluated and determined acceptable for continuous plant operation are identified below). If opening a cross-connection valve will result in a plant configuration that does not provide adequate protection against a single failure, the following guidance app lies. If only the manual cross-connect valves have been opened, and the R.BCCW System is in a normal configuration otherwise, with all system equipment OPERABLE, one RBCCW loop should be considered inoperable and the ACTION requirements of Technical Specification 3.7.3.1 applied. If the RBCCW System is not in a normal configuration otherwise and/or not all equipment is OPERABLE, both RBCCW loops should be considered inoperable and the ACTION requirements of Technical Specification 3.0.3 applied.The loss of loop independence is equivalent to the situation w!here one loop is inoperable. If one loop is inoperable, the remaining OPERABLE loop will be able to meet all design basis accident functions, assuming an additional single failure does not occur. If the loops are not independent, the remaining single large OPERABLE loop will be able to meet all design basis accident functions, assuming a single failure does not occur. Operation in a plant configuration where protection against a single failure can not be shown is acceptable provided the time period in that configuration is limited to less than the Technical Specification specified allowed outage trine. It is acceptable to operate in the off normal plant configurations identified in the ACTION requirements for the time periods specified due to the low probability of occurrence of a designl basis event concurrent with a single failure during this limited trime period. The allowed outage time for one inoperable RBCCW loop provides an appropriate lrimit for continued operation with only one OPERABLE RBCCW loop, and can be applied to a plant configuration where only loop independence has been compromised. The loop determined to be inoperable should be the loop that results in the most adverse plant configuration with respect to the availability of accident mitigation equipment. Restoration of loop independence within the trime constraints of the allowed outage time is required, or a plant shutdown is necessary. MILLSTONE -UNIT 2 B 3/4 7-3b Revised by NRC Letter A 15689 Amendment No. LIBDCR 14-MIP2-016 September 4, 2014 PLANT SYSTEMS BASES 3/4.7.3 REACTOR BUILDING CLOSED COOLING WATER SYSTEM (Continued) It is acceptable to operate with the RBCCW pump minimum flow valves (2-RB-107A, 2-RB-l07B, 2-RiB-107C), RBCCW pump sample valves (2-RB-56A, 2-RiB-56B, and 2-RB-56C), and the RBCCW pump radiation monitor stop valves (2-RIB-39, 2-RB-4t,and 2-RB-43) open. An active single failure will not adversely impact both RBCCW loops with these valves open. In addition, protection against a passive single failure after the initiation of post-loss of coolant accident long term cooling is achieved by manually closing these accessible valves, as directed by the emergency operating procedures. In addition, operation with RBCCW chemical addition valves (2-RB-50A and 2-RB-50B) open during chemical addition evolutions is acceptable since these normally closed valves are opened to add chemicals to the RBCCW and then closed as directed by nonnal operating procedures. Therefore, operation with these valves open does not affect OPERABILITY of the RBCCW loops.Surveillance Requirement 4.7.3.1 .a verifies the correct alignment for manual, power operated, and automatic valves in the RBCCW System flow paths to provide assurance that the proper flow paths exist for RBCCW operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since thlese valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position.The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.7.3.1 .b and 4.7.3.1 .c demonstrate that each automatic RBCCW valve actuates to the required position on an actual or simulated actuation signal and that each RBCCW pump starts on receipt of an actual or simulated actuation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. These surveillance frequencies are controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing; and equipment performance is monitored as part of the Inservice Testing Program.3/4.7.4 SERVICE WATER SYSTEM The OPERABILITY of the Service Water (SW) System ensures that sufficient cooling capacity is available for continued operation of vital components and Engineered Safety Feature equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is consistent with the assumptions used in the accident analyses.MILLSTONE -UNIT 2 B 3/4 7-3c Amendment No. -249, g22, 36, 2-3&, 2a7-3 February 13, 2003 PLANT SYSTEMS BASES 3/4.7.4 SERVICE WATER SYSTEM (continued) The SW loops are redundant of each other to the degree that each has separate controls and power supplies and the operation Of one does not depend on the other. In the event of a design basis accident, one SW loop is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two SW loops must be OPERABLE, and independent to the extent necessary to ensure that a single failure will not result in the unavailability of both SW loops. At least one SW loop will operate assuming the worst single active failure occurs following a design basis accident coincident with a loss of offsite power, or the worst single passive failure occurs post-loss of coolant accident long term cooling. System design is assumed to mitigate the single active failure. System design or operator action is assumed to mitigate paissive failure.The SW System has numerous cross connection points between the redundant loops, with manual valve isolation capability. When these valves are opened, the two system loops are no longer independent. The loss of independence will result in one large SW loop. This may adversely impact the ability of the SW System to mitigate the design basis events if a single failure, active or passive, occurs. Opening the manual cross-connection valves during normal operation should be evaluated to ensure system stability, minimum component cooling flow requirements, and the ability to mitigate the design basis event coicident with a single failure are maintained. Continuous operation with cross-connection valves open is acceptable if the configuration has been evaluated and protection against a single failure can be demonstrated. (SeVeral system configurations that have been evaluated and determined acceptable for continuous plant operation are identified below). If opening a cross-connection valve will result in a plant configuration that does not provide adequate protection against a single failure, the following guidance applies: If only the manual cross-connect valves have been opened, and the SW System is in a normal configuration otherwise, with all system equipment OPERABLE, one SW loop should be considered inoperable and the ACTION requirements of Technical Specification 3.7.4.1 applied. If the SW System is not in a normal configuration otherwise and/or not all equipment is OPERABLE, both SW loops should be considered inoperable and the ACTION requirements of Technical Specification 3.0.3 applied.The loss of loop independence is equivalent to the situation where one loop is inoperable. If one loop is inoperable, the remaining OPERABLE loop will be able to meet all design basis accident functions, assuming an additional single failure does not occur. If the loops are not independent, the remaining single large OPERABLE loop will be able to meet all design basis accident functions, assuming a single failure does not occur. Operation in a plant configuration where protection against a single failure can not be shown is acceptable provided the time period in that configuration is limited to less then the Technical Specification specified allowed outage time. It is acceptable to operate in the off normal plant configurations identified in the ACTION requirements for the time periods specified due to the low probability of occurrence of a design basis event concurrent with a single failure during this limited time period. The allowed outage time for one inoperable SW loop provides an appropriate limit for continued operation with only one OPERABLE SW loop, and can be applied to a plant configuration where only loop independence has been compromised. The loop MILLSTONE -UNIT 2B3473AmnetNo23 B3/4 7-3d Amendment No. 273 REVERSE OF PAGE B314 7-3d INTENTIONALLY LEFT BLANK LBDCR I4-MiP2-016 September 4, 2014 PLANT SYSTEMS BASES 3/4.7.4 SERVICE WATER SYSTEM (Continued) determined to be inoperable should be the ioop that results in the most adverse plant configuration with respect to the availability of accident mitigation equipment. Restoration of ioop independence within the time constraints of the allowed outage time is required, or a plant shutdown is necessary.-Branch lines are supplied to isolation valves in the intake for lubrication to the circulating water pump bearings (2-S W-298 and 2-S W-299), and alternate supply connections (2-S W-84A, and 2-S W-84B). The flow restricting orifices in these lines ensure that safety related loads continue to receive minimum required flow during a LOCA (in which the lines remain intact), or during a seismic event (when the lines break) even with the valves open. Therefore, operation with these valves open does not affect OPERABILITY of the SW loops.Surveillance Requirement 4.7.4.1 .a verifies the correct alignment for manual, power operated, and automatic valves in the Service Water (SW) System flow paths to provide assurance that the proper flow paths exist for SW operation. This surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position.The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.7.4.1l.b and 4.7.4.l.c demonstrate that each automatic SW valve actuates to the required position on an actual or simulated actuation signal and that each SW pump starts on receipt of an actual or simulated actuation signal. This surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. These surveillance frequencies are controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program..3/4.7.5 DELETED MILLSTONE -UNIT 2 B 3/4 7-4 MILLTON -NIT2 B3/47-4Amendment No. 2g-36, June 25, 2007 LBDCR 07-MP2-013 PLANT SYSTEMS BASES 0 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM The OPERABILITY of the Control Room Emergency Ventilation System ensures that 1) the ambient air temperature does not exceed the allowable temperature for continuous duty rating for the equipment and instrumentation cooled by this system and 2) the control room will remain habitable for operations personnel during and following all credible accident conditions. The OPERABILITY of thiis system in conjunction with control room design provisions is based on limiting the radiation exposure to personnel occupying the control room. For all postulated design basis accidents, the radiation exposure to personnel occupying the control room shall be 5 rem TEDE or less consistent with the requirements of 10 CFR 50.67 The Control Room Envelope (CRIB) is the area within the confines of the GRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and other non-critical areas including adjacent support offices, and utility rooms. The GRE is protected during normal operation, natural events, and accident conditions. The GRE boundary is the combination of walls, floor, ceiling, ducting, valves, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the GRE will not exceed the inleakage assumed in the licensing basisa analysis of design basis accident (DBA) consequences to GRE occupants. The GRE and boundary are defined in the Control Room Envelope Habitability Program.In order for the control room emergency ventilation systems to be considered OPERABLE, the GRE boundary must be maintained such that the GRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that GRE occupants are protected from hazardous chemicals and smoke.TS LCO 3.7.6.1 is modified by a footnote allowing the GRE boundary to be opened intermittently under administrative controls. This footnote only applies to openings in the GRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening Who is in continuous communication with the operators in the GRE. This individual will have a method to rapidly close the opening and to restore the GRE boundary to a condition equivalent to the design condition when a need for GRE isolation is indicated. MILLSTONE -UNIT 2 B 3/4 7.-4a Amendment No. 22S, 2-36, 7-3, 4ng4, LBDCR 14-MIP2-001 May 20, 2014 PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) ACTIONS a. 1, b. 1, b.2, b.3, c. 1, c.2 and c.3 of this specification are applicable at all times during plant operation in MODES 1, 2, 3, and 4. ACTIONS d.1, d.2, and e.1 are applicable in MODES 5 and 6, or when recently irradiated fuel assemblies are being moved. The control room emergency ventilation system is required to be OPERABLE during fuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 300 hours).With one Control Room Emergency Ventilation (CREV) train inoperable except due to an inoperable CREV boundary, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CREV subsystem is adequate to perform control room radiation protection function. However, the overall reliability is reduced because a single failure in the OPERABLE CREV train could result in loss of CREV function. The 7 day allowed outage time is based on the low probability of a DBA occunring during this time period, and the ability of the remaining train to provide the required capability. If both CREV trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable control room boundary (i.e., Condition c), at least one CREV train must be returned to OPERABLE status within 24 hours. The Condition is modified by a Note stating it is not applicable if the second CREV train is intentionally declared inoperable. The Condition does not apply to voluntary removal of redundant systems or components from service. The Condition is only applicable if one train is inoperable for any reason and the second train is discovered to be inoperable, or if both trains are discovered to be inoperable at the same time. During the period that the CREV trains are inoperable, action must be initiated to implement mitigating actions to lessen the effect on control room (CR) occupants from potential hazai'ds while both trains of.CREV are inoperable. In the event of a DBA, the mitigating actions will reduce the consequences of radiological exposures to the CR occupants. Specification 3.4.8, "Reactor Coolant System Specific Activity," allows limited operation with the reactor coolant system (RCS) activity significantly greater than the LCO limit. This presents a risk to the plant operator during an accident when all CREV trains are inoperable. Therefore, it must be verified within 1 hour that LCO 3.4.8 is met. This Required Action does not require additional RCS sampling beyond that normnally required by LCO 3.4.8.At least one CREV train must be returned to OPERABLE status within 24 hours. The allowed outage time is based on Reference 1 whtich demonstrated that the 24 hour allowed outage time is acceptable based on the infrequent use of the Required Actions and tlhe small incremental effect on plant risk.MILLSTONE -UNIT 2 B 3/4 7-4b Amendment No. 2-g, 2-36, 5, -24, -54, 2g4, LBDCR 14-Mv~P2-001 May 20, 2014 PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) If the control room boundary is in~operable in MODES 1, 2, 3, and 4, the CREV trains cannot perfonn their intended functions. Actions must be taken to restore an OPERABLE control room boundary within 90 days. During the period that the control room boundary is inoperable, appropriate compensatory measures (consistent with the intent of GDC 19) should be utilized to protect contr~ol room operators from potential hazards such as radioactive contamination, toxic chemicals, smoke, temperature and relative humidity, and physical security. Preplarned measures should be available to address these concerns for intentional and unintentional entry into the condition. The 90 days allowed outage time is reasonable based on the low probability of a DBA occurring during this time period, and the use of compensatory measures. The 90 days allowed outage time is a typically reasonable time to diagnose, plan and possibly repair, and test most problems with the control room boundary.In MODE 5 or 6, or during movement of recently irradiated fuel assemblies, if Required Action d. 1 cannot be completed within the required allowed outage time, the OPERABLE CREV train must be immediately placed in the recirculation mode of operation. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure will be readily detected. i An alternative to Required Action d. 1 s to immediately suspend activities that could result in-a release of radioactiv;ity that might require isolation of the control room. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel assemblies to a safe position.When in MODES 5 and 6, or during movement of recently irr-adiated, fuel assemblies, with two CREV trains inoperable, action muist be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the control roomJ This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.The control room radiological dose calculations use the conservative minimum acceptable flow of 2250 cfm based on the flowrate surveillance requirement of 2500 cfm 4+ 10%.MILLSTONE -UNIT 2 B 3/4 7-4c Amendment No. 2-, 2--6, -2A-5, 2a4g,-2-54, 84, LBDCR 14-MP2-001 May 20, 2014 PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) Currently there are some situations where the CREV System may not automatically start on an accident signal, without operator action. Under most situations, the emergency filtration fans will start and the CREV System will be in the accident lineup. However, a failure of a supply fan (F21A or B) or an exhaust fan (F31lA or B), will require operator action to return to a full train lineup. Also, if a single emergency bus does not power up for one train of the CREV System, the opposite train filter fan will automatically start, but the required supply and exhaust fans will not automatically start. Therefore, operator action is required to establish the whole train lineup. This action is specified in the Emergency Operating Procedures. The radiological dose calculations do not take credit for CREV System cleanup action until 1 hour into the accident to allow for operator action.When the CREV System is checked to shift to the recirculation mode of operation, this will be performed from the nonnal mode of operation, and from the smoke purge mode of operation. If the unfiltered inleakage of potentially contaminated air past the CRE boundaiy and into the CR3 can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour allowed outage time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day allowed outage time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day allowed outage time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CR3 boundary.MILLSTON~E -UNIT 2 B3474 mnmn o B 3/4 7-4d Amendment No. LBDCR 14-MIP2-016 September 4, 2014 PLANT SYSTEMS BASES I1 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) Irmrediate action(s), in accordance with the LCO Action Statements, means that the required action should be pursued without delay and in a controlled manner.Surveillance Requirement 4.7.6.1 .c. 1 dictates the test frequency, methods and acceptance criteria for the Control Room Emergency Ventilation System trains (cleanup trains). These criteria all originate in the Regulatory Position sections of Regulatory Guide 1.52, Rev. 2, March 1978 as discussed below.Section C.5 .a requires a visual inspection of the cleanup system be made before the following tests, in accordance with the provisions of section 5 of ANSI N510-1975:

• in-place air flow distribution test o DOP test o activated carbon adsorber section leak test Section C.5 .c requires the in-place Dioctyl phthalate (DOP) test for IT]EPA filters to conform to section 10 of ANSI N510-1975.

The HEPA filters should be tested in place (1) initially, (2) at the frequency specified in the Surveillance Frequency Control Program, and (3) following painting, fire, or chemical release in any ventilation zone communicating with the system. The testing is to confirm a penetration of less than or equal to 1%* at rated flow.Section C.5 .d requires the charcoal adsorber section to be leak testedwvith a gaseous halogenated hydrocarbon refrigerant, in accordance with. section 12 of ANSI N5 10-1975 to ensure that bypass leakage through the adsorber section is less than or equal to 1%. ** Adsorber leak testing should be conducted (1) initially, (2) at the frequency specified in the Surveillance Frequency Control Program, (3) following removal of an adsorber sample for laboratoiy testing if the integrity of the adsorber section is affected, and (4) following painting, fire, or chemical release in any ventilation zone communicating with the system.* Means that the HIEPA filter will allow passage of less than or equal to 1% of the test concentration injection at the filter inlet from a standard DOP concentration injection.

• Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of the injected test concentration around the charcoal adsorber section.MILLSTONE

-UNIT 2 B 3/4 7-4e Amendment No. LBDCR 14-MP2-001 May 20, 2014 PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) The ACTION requirements to immediately suspend various activities (CORE ALTERATIONS, irradiated fuel movement, etc.) do not preclude completion of the movement of a component to a safe position.Technical Specification 3.7.6.1 provides the OPERABILITY requirements for the Control Room Emergency Ventilation Trains. If a Control Room Emergency Ventilation Train emergency power source or normal power source becomes inoperable in MODES 1, 2, 3, or 4 the requirements of Technical Specification

3.0.5 apply

in determining the OPERABILITY of the affected Control Room Emergency Ventilation Train. If a Control Room Emergency Ventilation Train emergency power source or normal power source becomes inoperable in MODES 5 or 6 the guidance provided by Note "**~" of this specification applies in determining the OPERABILITY of the affected Control Room Emergency Ventilation Train. If a Control Room Emergency Ventilation Train emergency power source or normal power source becomes inoperable while not in MODES 1, 2, 3, 4, 5, or 6 the requirements of Technical Specification

3.0.5 apply

in determining the OPERABILITY of the affected Control Room Emergency Ventilation Train.Surveillance Requirement 4.7.6.1.h verifies the OPERABILITY of the CRE boundary by testing for -unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.*Means that the HF-EPA filter will allow passage of less than or equal to 1% of the test concentration injection at the filter inlet from a standard DOP concentration injection.

• • Means that the charcoal adsorber sections will allow passage of less than or equal to 1% of the injected test concentration around the charcoal adsorber section.MILLSTONE

-UNIT 2 B3474 mnmn o B 3/4 7-4f Amendment No. ] LBDCR 14-MIP2-001 ~May 20, 2014 PLANT SYSTEMS BASES 3/4.7.6 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) The GRE is considered habitable when the radiological dose to GRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 remn TEDE and the GRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the GRE is no greater than the flow rate assumed in the licensing basis analyses of DB3A consequences. When unfiltered air inleakage is greater than the assumed flow rate, ACTION c. must be entered. ACTION c. allows time to restore the GRE boundary to OPERABLE status provided mitigating actions can ensure that the GRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, which endorses, with exceptions, NEI 99-03.These compensatory measures may also be used as mitigating actions as required by ACTION c.Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY. Options for restoring the GRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the GRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the GRE boundary has been restored to OPERABLE status.REFERENCE !1. WCAP- 16 125-NP-A, "Justification for Risk-Informed Modifications to Selected Teclmical Specifications for Conditions Leading to Exigent Plant Shutdown," Revision 2, August 2010.MILLSTONE -UNIT 2 B 3/4 7-4g 10O LBDCR 11-MP2-010 August 23, 2011 PLANT SYSTEMS BASES 3/4.7.7 DELETED 3/4.7.8 SNUBBERS All snubbers are required OPERABLE to ensure that the structural integrity of the reactor coolant system and all other safety related systems is maintained during and following a seismic or other event initiating dynamic loads. Snubbers excluded from this inspection program are those installed on nonsafety-related systems and then only if their failure or failure of the system on xWhich they are installed would have no adverse effect on any safety-related system.MILLSTONE -UNIT 2 B 3/4 7-5 Amendment No. 141, 3-5, 96, 4-1-6, LW2: LBDCR 11-MP2-010 August 23, 2011 PLANTSYSTM 0 BASES 3/4.7.9 DELETED MILLSTONE -UNIT 2 B 3/4 7-6 Amendment No.. 1-t, 2_,-, %, -t-l-, 49-1-,-244 LBDCR 13-MP2.-004 May 2, 2013 PLANT SYSTEMS BASES 3/4.7.10 DELETED 3/4.7.11 ULTIMATE HEAT SINK BACKGROUND The ultimate heat sink (UI-{S) for Millstone Unit No. 2 is Long Island Sound. The Long Island Sound is connected to the Atlantic Ocean and provides the required 30 day supply of water.It serves as a heat sink for both safety and non-safety-related cooling systems. Sensible heat is discharged to the UtIIS via the service water (SW) and circulating water (CW) systems.The basic performance requirement is that a 30 day supply of water be available, and that the design basis temperatures of safety related equipment not be exceeded.Additional information on the design and operation of the system, along with a list of components served, can be found in References 1, 2, and 3.APPLICABLE SAFETY ANALYSES The U-FIS is the sink for heat removed from the reactor core following all accidents and anticipated operational occurrences in which the unit is cooled down and placed on shutdown cooling system (SDC) operation. With UHIS as the normal heat sink for condenser cooling via the CW System, unit operation at full power is its maximum heat load. Its maximum post accident heat load occurs < 1 hour after a design basis loss of coolant accident (LOCA). Near this time, the unit switches from injection to recirculation and the containment cooling system is required to remove the core decay heat ...The operating limits are based on conservative heat transfer analyses for the worst case LOCA. References 1, 2, and 3 provide the details of the assumptions used in the analysis, which include worst expected meteorological conditions, conservative uncertainties when calculat~ing decay heat, and worst case single active failure (e.g., single failure of a man-made structure). The limitations on the temperature of the UHIS ensure that the assumption for temperature used in the analyses for cooling of safety related components by the SW system are satisfied. These analyses ensure that under normal operation, plant cooldown, or accident conditions, all components cooled directly or indirectly by SW will receive adequate cooling to perform their design basis functions. The UJIS satisfies Criterion 3 of 10 CFR 50.3 6(c)(2)(ii). M'VILLSTON\E -UNIT 2 B 3/4 7-7 Amendment No. 4-t4-, 1I94I-, 1-, 24-7-, 2 5~7 , 2 1 4 I~A gx...... 1 byI,- l./t-r dat+cd-12,'l9/'0 LBDCR 14-MP2-016 September 4, 2014 PLAINT SYSTEMS BASES 3/4.7.11 ULTIMATE HEAT SINK (Continued) LCO The UIHS is required to be OPERABLE and is considered OPERABLE if it contains a sufficient volume of water at or below the maximum temperature that would allow the SW System to operate for at least 30 days following the design basis LOCA without the loss of net positive suction head (NPSHJ), and without exceeding the maximum design temperature of the equipment served by the SW System. To meet this condition, the UJIS temperature should not exceed 80 0 F during normal unit operation. While the use of any supply side SW temperature indication is adequate to ensure compliance with the analysis assumptions, precision instruments installed at the inlet to the reactor building closed cooling water (RBCCW) heat exchangers will normally be used.Therefore, instrument uncertainty need not be factored into the surveillance acceptance criteria.All in-service instruments must be within the limit. If all of the precision instruments are out of service, alternative instruments that measure SW supply side temperature will be used. In this case, an appropriate instrument uncertainty will be subtracted from the acceptance criteria.Since Long Island Sound temperature changes relatively slowly and in a predictable fashion according to the tides, it is acceptable to monitor this temperature at the frequency0 specified in the Surveillance Frequency Control Program when there is ample (>5°F) margin to the limit. When within 5°F of the limit, the temperature shall be monitored every 6 hours to ensure that tidal variations are appropriately captured.APPLICABILITY In MODES 1, 2, 3, and 4, the UIIS is required to support the OPERABILITY of the equipment serviced by the UIH-S and required to be.OPERABLE in these MODES.In MODE 5 or 6, the OPERABILITY requirements of the UIIS are determined by the systems it supports.ACTION If the U911 is inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least HOT STANDBY within 6 hours and in COLD SHUTDOWN within the following 30 hours.The allowed outage times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.MILLSTONE -UNIT 2B3/7-B 3/4 7-8 LBDCR 13-MP2-004 May 2, 2013 PLANT SYSTEMS BASES 3/4.7.11 ULTIMATE HEAT SINK (Continued) SURVEILLANCE REQUIREMENTS This surveillance requirement verifies that the UTIS is capable of providing a 30 day cooling water supply to safety related equipment without exceeding its design basis temperature. This surveillance requirement verifies that the water temperature of the UHIS is < 80°F.REFERENCES

1. FSAR, Sections 6.3, 6.4, 6.5, and 6.6 addressing Containment Systems.2. FSAR, Sections 9.3, 9.4, and 9.5 addressing Water Systems.3. FSAR, Section 14.6, Decrease in Reactor Coolant Inventory.

MILLSTONE -UNIT 2B3/79 B 3/4 7-9 REVERSE OF PAGE B 3/4 7-9 INTENTIONALLY LEFT BLANK : LBDCR 11-MP2-012 December 21, 2011 3/4.8 ELECTRICAL POWER SYSTEMS BASES The OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety related equipment required for 1) the safe shutdown of the facility and 2) the mitigation and control of accident conditions within the facility. The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criteria 17 of Appendix "A" to 10 CFR 50.The required circuits between the offsite transmission network and the onsite Class 1E distribution system (Station Busses 24C, 24D, and 24E) that satisfy Technical Specification 3.8.1.1 .a (MODES 1, 2, 3, and 4) consist of the following circuits from the switchyard to the onsite electrical distribution system: a. Station safeguards busses 24C and 24D via the Unit 2 Reserve Station Service Transformer; and b. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer (energized with breaker 1 5G-13T-2 (13T) and associated disconnect switches open) and bus 34A or 34B.When taking credit for the Unit 3 Normal Station Service Transformer as a second offsite circuit, breaker 13T and its associated disconnect switches are required to be open. This removes the potential for a single failure (that of breaker 13T) to cause a simultaneous loss of both offsite circuits. Should the other offsite circuit (i.e., the Unit 2 Reserve Station Service Transformer) already be inoperable, the requirement for maintaining breaker 1 3T and its associated disconnect switches open is no longer applicable. If the plant configuration will not allow Unit 3 to supply power to Unit 2 from the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer within 3 hours, Unit 2 must consider the second offsite source inoperable and enter the appropriate ACTION statement of Technical Specification 3.8.1.1 for an inoperable offsite circuit.This is consistent with the GDC 17 requirement for two offsite sources. Each offsite circuit is required to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded.The first source is required to be available within a few seconds to supply power to safety related equipment following a loss of coolant accident. The second source is not required to be available* immediately and no accident is assumed to occur concurrently with the need to use the second source. However, the second source is required to be available in sufficient time to assure the reactor remains in a safe condition The 3 hour time period is based on the Millstone Unit No. 2 Appendix R analysis. This analysis has demonstrated that the reactor will remain in a safe condition (i.e., the pressurizer will not empty) if charging is restored within 3 hours.MILLSTONE -UNIT 2 B 3/4 8-1 MILSTOE UNT 2B /4 -1Amendment No. 4-l-, 4-92, 3-1-, LBDCR 11-MP2-012 December 21, 2011 3/4.8 ELECTRICAL POWER !BASES In MODES 1 through 4 (Technical Specification 3.8.1 .1), the Unit 2 Normal Station Service Transformer can be used as the second offsite source after the main generator disconnect links have been removed and the backfeed lineup established. The required circuit between the offsite transmission network and the onsite Class lE distribution system (Station Busses 24C, 24D, and 24E) that satisfies Technical Specification 3.8.1 .2.a (MODES 5 and 6) consists of the following circuit from the switchyard to the onsite electrical distribution system: a. Station safeguards bus 24C or 24D via the Unit 2 Reserve Station Service Transformer; or b. Station safeguards bus 24C or 24D via the Unit 2 Normal Station Service Transformer and bus 24A or 24B after the main generator disconnect links have been removed and the back~feed lineup established; or c. Station bus 24E via the Unit 3 Reserve Station Service Transformer or Unit 3 Normal Station Service Transformer and bus 34A or 34B.When the plant is operating with the main generator connected to the grid, the output of the main generator will normally be used to supply the onsite Class lE distribution sYstem.During this time the required offsite circuits will be in standby, ready to supply power to the onsite Class lE distribution system if the main generator is not available. When shut down, only one of the offsite circuits will normally be used to supply the onsite Class lE distribution system.The other offsite circuit, if required, will be in standby. Verification of the required offsite circuits consists of checking control power to the breakers (breaker indicating lights), proper breaker position for the current plant configuration, and voltage indication as appropriate for the current plant configuration. The ACTION requirements specified for the levels of degradation of the power sources provide restriction upon continued facility operation commensurate with the level of degradation. The OPERABILITY of the power sources are consistent with the initial condition assumptions of the accident analyses and are based upon maintaining at least one of each of the onsite A.C. and D.C. power sources and associated distribution systems OPERABLE during accident conditions coincident with an assumed loss of offsite power and single failure of the other onsite A.C.source............ MILLSTONE-UNIT 2 " B 3/4 8:-2 ......--MILSTOE -UNI 2 3/4~2.... Amendment No:4-148; 4-9W2g34-, LBDCR 07-MP2-009" March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES Technical Specification 3.8.1.1 ACTION Statements b and c provide an allowance to avoid unnecessary testing of the other OPERABLE diesel generator. If it can be determined thatcause of the inoperable diesel generator does not exist on the OPERABLE diesel generator, Surveillance Requirement 4.8.1.1 .2.a.2 does not have to be performed. If the cause of inoperability exists on the other OPERABLE diesel generator, the other OPERABLE diesel generator would be declared inoperable upon discovery, ACTION Statement e would be entered, and appropriate ACTIONS will be taken. Once the failure is corrected, the common cause failure no longer exists, and the required ACTION Statements (b, c, and e) will be Satisfied. If it cannot be determined that the cause of the inoperable diesel generator does not exist on the remaining diesel generator, performance of Surveillance Requirement 4.8.1i.1 .2.a.2, within the allowed time period, suffices to provide assurance of continued OPERABILITY of the diesel generator. If the inoperable diesel generator is restored to OPERABLE status prior to the determination of the impact on the other diesel generator, evaluation will continue of the possible common cause failure. This continued evaluation is no longer under the time constraint imposed while in ACTION Statement b or c.The determination of the existence of a common cause failure that would affect the remaining diesel generator will require an evaluation of the current failure and the applicability to the remaining diesel generator. Examples that would not be a common cause failure include, but are not limited to: 1. Preplanned preventive maintenance or testing, or 2. An inoperable support system with no potential common mode failure for the remaining diesel generator, or 3. An independently testable component with no potential common mode failure for the remaining diesel generator. If one Millstone Unit No. 2 diesel generator is inoperable in MODES 1 though 4, ACTION Statements b.3 and c.3 require verification that the steam-driven auxiliary feedwater pump is OPERABLE (MODES I; 2, and 3 only). If the steam-driven auxiliary feedwater pump is inoperable, restoration within 2 hours is required or a plant shutdown to MODE 4 will be necessary. This requirement is intended to provide assurance that a loss of offsite power event will not result in degradation of the auxiliary feedwater safety function to below accident mitigation requirements during the period one of the diesel generators is inoperable. The term verify, as used in this context, means to administratively check by examining logs or other information to determine if the steam-driven auxiliary feedwater pump is out of service for mainten~ance or other reasons. It does not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITY of the steam-driven auxiliary feedwater pump.MILLSTONE -UNIT 2 B 3/4 8-3 Amendment No. 4-8, +/-9-2,, 23-1-, 248,-2-6, LBDCR 07-MP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS 9 BASES If one Millstone Unit No. 2 diesel generator is inoperable in MODES 1 through 4, a 72 hour allowed outage time is provided by ACTION Statement b.5 to allow restoration of the diesel generator, provided the requirements of ACTION Statements

b. I, b.2, and b.3 are met. This allowed outage time can be extended to 14 days if the additional requirements contained in ACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that the Millstone Unit No. 3 diesel generators are OPERABLE as required by the applicable Millstone Unit No. 3 Technical Specification (2 diesel generators in MODES 1 through 4, and 1 diesel generator in MODES 5 and 6) and the Millstone Unit No. 3 SBO0 diesel generator is available.

The term verify, as used in this context, means to administratively check by examining logs or other information to determine if the required Millstone Unit No. 3 diesel generators and the Millstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. It does not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITY of the required Millstone Unit No. 3 diesel generators or availability of the Millstone Unit No. 3 SBO diesel generator. When using the 14 day allowed outage time provision and the Millstone Unit No. 3 diesel generator and/or the Millstone Unit No. 3 SBO diesel generator requirements are not met, 72 hours is allowed for restoration of the required Millstone Unit No. 3 diesel generators and the Millstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 3 diesel : generators and/or the Millstone Unit No. 3 SBO diesel generator are not restored within 72. hours,l i, , and one Millstone Unit No. 2 diesel generator is still inoperable, Millstone Unit No. 2 is required..... to shut down.The 14 day allowed outage time for one inoperable Millstone Unit No. 2 diesel generator will allow performance of extended diesel generator maintenance and repair activities (e.g., diesel inspections) while the plant is operating. To minimize plant risk when using this extended allowed outage time the following additional requirements must be met: 1. The extended diesel generator maintenance outage shall not be scheduled when adverse or inclement weather conditions and/or unstable grid conditions are predicted or present.2. The availability of the Millstone Unit No. 3 SBO DG shall be verified by test performance within the previous 30 days prior to allowing a Millstone Unit No. 2 diesel generator to be inoperable for greater than 72 hours.3. All activity in the switchyard shall be closely monitored and controlled. No elective maintenance within the switchyard that could challenge offsite power availability shall be scheduled. MILLSTONE -UNIT 2 B 3/4 8-4 Amendment No. 4-8, 40-2-, ;3-i-, 948, I ".j ,6-1-, 77, LBDCR 07-MvP2-009 March 29, 2007 3/4.8 ELECTRICAL POWER SYSTEMS BASES In addition, the plant configuration shall be controlled during the diesel generator-maintenance and repair activities to minimize plant risk consistent with a Conafiguration Risk Management Program, as required by 10 CFR 50.65(a) (4).Diesel Generator Testing An engine prelube period is allowed prior to engine start for all diesel generator testing.This 'will minimize wear on moving parts that do not get lubricated when the engine is not running.When specified in the surveillance tests, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations. SR 4.8.1.l.2.a.2 This surveillance helps to ensure the availability of the standby electrical power supply to mitigate design basis accidents and transients and to maintain the unit in a safe shutdown condition. It verifies the ability of the diesel generator to start from a standby condition and achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify' degradation of governor or voltage regulator performance when testing in accordance with the requirements of the surveillance. This surveillance is modified by two notes. Note 1 allows the use of a modified start based on recommnendations of the manufacturer to reduce stress and wear on diesel engines.When using a modified start, the starting speed of the diesel generators is limited, wanmup is limited to this lower speed, and the diesel generators are gradually accelerated to synchronous speed prior to loading. If a modified start is not used, the 15 second start requirement of SR 4.8.l.I.2.d applies. Note 2 states that SR 4.8.1.1.2;d, ainore rigorous test, may be perfornned in lieu of 4.8.1.l.2.a. During performance of SR 4.8.1.1.2.a.2, the diesel generator shall be started by using one of the following signals: 1. Manual;2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;3. Simulated safety injection actuation signal alone; or 4. simulated loss of power alone.MILLSTONE -UNIT 2 B3485AedetN.m B 3/4 8-5 Amendment No. g7-7, [ LBDCR 14.-MIP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES The surveillance frequency is controlled under the Surveillance Frequency Control Program.SR 4.8.1.1 .2.a.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation. This surveillance is modified by five Notes. Note 1 indicates that diesel engine runs for this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance. Note 5 states that SR 4.8.1.1 .2.d, a more rigorous test, may be performed in lieu of 4.8.1.1.2.a. The surveillance frequency is controlled under the Surveillance Frequency Control Program.SR 4.8.l.1.2.b.1 Microbiological fouling is a major cause of fuel' oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the three fuel storage tanks at the frequency specified in the Surveillance Frequency Control Program eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during EDG operation. Water may come from any of several sources, including condensation, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. This surveillance is for preventative maintenance. The presence of water does not necessarily represent failure of this surveillance provided the accumulated water is removed during performance of the surveillance. MILLSTONE -UNMT 2 B3486Aed~n o -7 B 3/4 8-6 Amendment No. ggg, LBDCR April 3, 2012 3/4.8 ELECTRICAL POWER SYSTEMS BASES SR 4.8.1.1.2.b.2 This surveillance requires testing of the new and stored fuel oil in accordance with the Diesel Fuel Oil Testing Program, as defined in Section 6 of the Technical Specifications. The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows (more restrictive State of Connecticut and/or equipment limits may apply): a. Sample the new fuel oil in accordance with ASTM D4057, b. Verify in accordance with the tests specified in ASTM D975-81 that the sample has an absolute specific gravity at 60/60°F of 0.83 and < 0.89, or an API gravity at 60°F of> 270 and < 390, a kinematic viscosity at 40°C of> 1.9 centistokes and <4.1 centistokes (alternatively, Saybolt viscosity, STJS at 100°F of> 32.6 bit< 40.1)and a flash point _> 125°F, and c. Verify that the new fuel oil has a clear and bright appearance with proper color when tested in accordance with ASTM D4176 or a water and sediment content within limits when tested in accordance with ASTM D2709 or D1796.Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM D975-8:1 are met for new fuel oil when tested in accordance with ASTM D975-81, except that the analysis for sulfur may be performed in accordance with ASTM D 1552 or ASTM D2622. The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an imnmediate effect on DG operation. This surveillance ensures the availability of high quality fuel oil for the diesel generators. Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure. Particulate concentrations should be determined in accordance with ASTM D2276-78, Method A, every 92 days. This method involves a gravimetric MILLSTONE -UNIT 2B3/8-AmnetNo 7, B 3/4 8-7 Amendment No. 7--7, LBDCR 14-MP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES deternination of total particulate concentration in the fuel oil and has a limit of 10 rag/I. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of fied testing.The frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between surveillance intervals. SR 4.8.1.1.2.c.2 Under accident and loss of offsite power conditions, loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the diesel generators due to high motor starting currents. The load sequence time interval tolerances ensure that sufficient time exists for the diesel generator to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding Engineered Safety Features (ESE) equipment time delays are not violated.The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally perforning the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomPlete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment detertnines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed surveillance, a successful surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when the surveillance is performed in MODE 1, 2, 3, or 4. Risk insights or deterninistic methods may be used for this assessment. MILLSTONE -UNIT 2 B3488AedetN.2-- B 3/4 8-8 Amendment No. LBDCR 14-MiP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES SR 4.8.1 .3.2.c.3 Each diesel generator is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This surveillance demonstrates the diesel generator load response characteristics and capability to reject the largest single load without exceeding a predetermined frequency limit. The single largest load for each diesel generator is identified in the FSAR (Tables 8.3-2 and 8.3-3).This surveillance may be accomplished by either: a. Tripping the diesel generator output breaker with the diesel generator carrying greater than or equal to its associated single largest post-accident load while paralleled to offsite power or while solely supplying the bus; or b. Tripping the equivalent of the single largest post-accident load with the diesel generator solely supplying the bus.The time, voltage, and frequency tolerances specified in this surveillance are based on the repneduring load sequence intervals. The 2.2 seconds seiidi qa o4%o h .second load sequence interval associated with sequencing of the largest load (Safety Guide 9).The voltage and frequency spe~cified are consistent with the design range of the equipment powered by the diesel generator. SR 4.8.1.1.2.c.3.a corresponds to the maximum frequency excursion, while SR 4.8.1.1.2.c.3.b and SR 4.8.1.1.2.c.3.c are steady state voltage and frequency values to which the system must recover following load rejection. The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as practical. When synchronized with offsite power, testing should be performed at a power factor of_< 0.9 lagging. This power factor is representative of the inductive loading a diesel generator would see based on the motor rating of the single largest load. It is within the adjustment capability of the Control Room Operator based on the use of reactive load indication to establish the desired power factor. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than_<0.9. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to _ 0.9 results in voltages on the emergency buses that are too MILLSTON'E -UNIT 2 B3489AedetN.2~ B 3/4 8-9 Amendment No. 7-7, LBDCR 14-MIP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES high. Under these conditions, the power factor should be maintained as close as practicable to 0.9 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.9 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel generator. In such cases, the power factor shall be maintained as close as practicable to 0.9 lagging without exceeding the diesel generator excitation limits.SR 4.8.1.1.2.c.4 This surveillance demonstrates the diesel generator capability to reject a rated load without overspeed tripping. A diesel generator rated load rejection may occur because of a system fault or inadvertent breaker tripping. This surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the diesel generator experiences following a rated load rejection and verifies that the diesel generator will not trip upon loss of the load. While the diesel generator is not expected to experience this transient during an event, this response ensures that the diesel generator is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.This surveillance is performed by tripping the diesel generator output breaker with the diesel generator carrying the required load while paralleled to offsite power.The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by a Note to ensure that the diesel generator is tested under load conditions that are as close to design basis conditions as practical. When synchronized with offsite power, testing should be performed at a power factor of < 0.83 lagging. This power factor is representative of the inductive loading a diesel generator would see under design basis accident conditions. Under certain conditions, however, the note allows the surveillance to be conducted at a power factor other than < 0.83. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to < 0.83 results in voltages on the emergency buses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.83 while still maintaining acceptable voltage limits on the emergency buses. In other circumstances, the grid voltage may be such that the diesel generator excitation levels needed to obtain a power factor of 0.83 may not cause unacceptable voltages on the emergency buses, but the excitation levels are in excess of those recommended for the diesel MILLSTON"E -UNIT 2B3/8-0AedntN.27 B 3/4 8-10 Amendment No. LBDCR 14-MiP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES generator. In such cases, the power factor shall be maintained as close as practicable to 0.83 lagging without exceeding the diesel generator excitation limits.SR 4.8.1 .1 1.2 .c.5 In the event of a design basis accident coincident with a loss of offsite power, the diesel generators are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded. This surveillance demonstrates the diesel generator operation during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection of pernanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.The surveillance frequency is controlled under the Surveillance Frequency Control Program. *..For the purpose of this testing, .the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recormmendations. This surveillance is modified by a Note. The reason for the Note is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and MILLSTOYNE -UNIT 2B318-1AedntN.27 B 3/4 8-11 Amendment No. LBDCR 14-MP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES other unanticipated OPERABILITY concerns) provided an assessment detennines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment. SR 4.8.l. 1.2.c.6 This surveillance demonstrates that diesel generator noncritical protective functions (e.g., high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESF actuation test signal. During this time, the critical protective functions (engine overspeed, generator differential current, low lube oil pressure [2 out of 3 logic], and voltage restraint overcurrent) remain available to trip the diesel generator andlor output breaker to avert substantial damage to the diesel generator unit. An EDG Emergency Start Signal (Loss of Power signal or SIAS) bypasses the EDG mechanical trips in the EDG control circuit, except engine overspeed, and switches the low lube oil trip to a 2 of 3 coincidence. The loss of power to the emergency bus, based on supply breaker position (A302, A304, and A505 for Bus 24C; A410, A4tl, and A505 for Bus 24D), bypasses the EDG electrical trips in the breaker control circuit except generator differential current and voltage restraint over current. The noncritical trips are bypassed during design basis accidents and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The diesel generator availability to mitigate the design basis accident is more critical than protecting the engine against minor problems that are not inrmediately detrimental to emergency operation of the diesel generator. The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by a Note. The reason for the Note is that perfonning the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment detennines plant safety is MILLSTONE -UNIT 2B3/812AedntN.7, B 3/4 8-I2 Amendment No. -7-7-, LBDCR September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or deterministic methods may be used for the assessment. SR 4.8.1.1 .2.c.7 This surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the diesel generator. It further demonstrates the capability of the diesel generator to automatically achieve the required voltage and speed (frequency) within the specified time. The diesel generator auto-start time of 15 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. The surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the diesel generator loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the diesel generator system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by two Notes. The reason for Note 1 is that performing the surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally perfonning the surveillance in MODE 1, 2, 3, or 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete SUlrveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is MILLSTONE -UNIT 2 B3481 mnmn o 7-B 3/4 8-13 Amendment No. LBDCR 14-MP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial surveillance, a successful partial surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and start up to determine that plant safety is maintained or enhanced when portions Of the surveillance are performed in MODE 1, 2, 3, or 4. Risk insights or detenninistic methods may be used for the assessment. Surveillance Note 2 specifies that the start of the diesel generator from a standby condition is not required if this surveillance is performed in conjunction with SR 4.8.l.l.2.c.5. Since this test is normally performed in conjunction with SR 4.8.1.1.2.c.5, the proposed note will exclude the requirement to start fr'om a standby condition to minimize the time to perfonn this test. This will reduce shutdown risk since plant restoration, and subsequent equipment availability will occur sooner. In addition, it is not necessary to test the ability of the EDG to auto start from a standby condition for this test since that ability will have already been verified by SR 4.8.1.1.2.c.5, which will have just been performed if the note's exclusion is to be utilized. If this test is to be performed by itself, the EDG is required to start from a standby condition. SR 4.8.1.1.2.c.8 This surveillance demonstrates that the diesel generator automatically starts and achieves the required voltage and speed (frequency) within the specified tine (15 seconds) fr~om the design basis actuation signal (Safety Injection Actuation Signal) and operates for >5 minutes. The 5 minute period provides sufficient time to demonstrate stability. Since the specified actuation signal (ESF signal without loss of offsite power) will not cause the emergency bus loads to be shed, and will not cause the diesel generator" to load, the surveillance ensures that permanently connected loads and autoconnected loads remain energized from the offsite electrical power system (Unit 2 RSST or NSST, or Unit 3 RSST or NSST). In certain circumstances, many of these loads cannot actually be connected without undue hardship or potential for undesired operation. It is not necessary to verify all autoconnected loads remain connected. A representative sample is acceptable. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 2B3/8-4AedntN.2, B 3/4 8-14 Amendment No. 7-7-, LBD CR 14-MP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations. SR 4.8.1.1.2.c.9 This surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from a normal surveillance, and achieve the required voltage and speed within 15 seconds. The 15 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.The surveillance frequency is controlled under the Surveillance Frequency Control Program.This surveillance is modified by a Note. The Note ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the diesel generator. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain diesel generator OPERABILITY. The requirement that the diesel has operated for at least 1 hour at rated load conditions prior to performance of this surveillance is based on manufacturer recotmmendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test.SRs 4.8.1.l.2.d.1 and 4.8.l.1.2.d.2 SR 4.8.1.1 .2.d. 1 verifies that, at the frequency specified in the-Surveillan~ce Frequency Control Program, the diesel generator starts from standby conditions and achieves required voltage and speed (frequency) within 15 seconds. The 15 second start requirement supports the assumptions of the design basis LOCA analysis in the FSAR. Diesel generator voltage and speed will continue to increase to rated values, and thern should stabilize. SR 4.8.l.1.2.d.2 verifies the ability of the diesel generator to achieve steady state voltage and frequency conditions. The time for voltage and speed (frequency) to stabilize is periodically monitored and the trend evaluated to identify degradation of governor or voltage regulator performance when besting in accordance with the requirements of this surveillance. These surveillance frequencies are controlled under the Surveillance Frequency Control Program. In addition, SR 4.8.1.1.2.d may be performed in lieu of 4.8.1.1.2.a. MILLSTONE -UNIT 2B3/815AedntN.27 B 3/4 8-15 Amendment No. LBDCR 14-MP2-016 September 4, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES For the purpose of this testing, the diesel generators must be started from a standby condition. Standby condition for a diesel generator means the diesel engine coolant and oil are being circulated and temperature is being maintained consistent with manufacturer recommendations. During performance of SR 4.8.1.1,2.d. 1, the diesel generators shall be started by using one of the following signals: 1. Manual;2. Simulated loss of offsite power in conjunction with a safety injection actuation signal;3. Simulated safety injection actuation sign~al alone; or 4. Simulated loss of power alone.SR 4.8.1.1.2.d.3 This surveillance verifies that the diesel generators are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the diesel generator is connected to the offsite source. Although no power factor requirements are established by this surveillance, the diesel generator is normally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while 1.0 is an operational limitation. The surveillance frequency is controlled under the Surveillance Frequency Control [ProgramI This SR is modified by four Notes. Note 1 indicates that diesel engine runs for this surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit will not invalidate the test. Note 3 indicates that this surveillance should be conducted on only one diesel generator at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this surveillance. A successful diesel generator start must precede this test to credit satisfactory performance. MILLSTONE -UNIT 2 B 3/4 8-16 Amendment No. 4g, 92, 2-3-1-, 248, 2641-, 2-T, , February 19, 2009 LBDCR 09-MP2-002 3/4.8 ELECTRICAL POWER SYSTEMS BASES The OPERABILITY of the minimum specified A.C. and D.C. power sources and associated distribution systems during shutdown and refueling ensures that 1) the facility can be maintained in the shutdown or REFUELING condition for extended time periods and 2) sufficient instrumentation and control capability is available for monitoring and maintaining the facility status. If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6, operations involving CORE ALTERATIONS, positive reactivity additions, or movement of recently irradiated fuel assemblies are required to be suspended. Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. The.movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 300 hours), is also required to be suspended. Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power source or distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.Each 125-volt D.C. bus train consists of its associated 125-volt D.C. bus, a 125-volt D.C.battery bank, and a battery charger with at least 400 ampere charging capacity. To demonstrate OPERABILITY of a 125-volt D.C. bus train, these components must be energized and capable of performing their required safety functions. Additionally;in~MODES 1 through 4 at least one tie breaker between the 125-volt D.C. bus trains must be open for a 125-volt D.C. bus train to be considered OPERABLE.For MODES 5 and 6, each battery is sized to supply the total connected vital loads (one battery connected to both buses) for one hour without charger support. Therefore, in MODES 5 and 6 with at least one. 125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied, the 125-volt D.C: support system operability requirements for both buses-are satisfied. Footnote (a) to Technical Specification Tables 4.8-i and 4.8-2 permits the electrolyte level to be above the specified maximum level for the Category A limits during equalizing charge, provided it is not overflowing. Because of the internal gas generation during the performance of an equalizing charge, specific gravity gradients and artificially elevated electrolyte levels are produced which may exist for several days following completion of the equalizing charge. These limits ensure that the plates suffer no physical damage, and that adequate electron transfer capability is maintained in the event of transient conditions. In accordance with the recommendations of IEEE 450-1980, electrolyte level readings should be taken only after the battery has been at float charge for at least 72 hours.MILLSTONE -UNIT 2 B 3/4 8-17 Amendment No. 4-88, 4-9-2, 2-34-, 248~,-264-, mg, 27-9, 3, March 29, 2007 LBDCR 07-MP2-009 3/4.8 ELECTRICAL POWER SYSTEMS BASES1 Based on vendor recommendations and past operating experience, seven (7) days has been determined a reasonable time frame for the 1 25-volt D.C. batteries electrolyte level to stabilize and to provide sufficient time to verify battery electrolyte levels are with in the Category A limits.Footnote (b) to Technical Specification Tables 4.8-1 and 4.8-2 requires that level correction is not required when battery charging current is < 5 amps on float charge. This current provides, in general, an indication of overall battery condition. Footnote (c) to Technical Specification Tables 4.8-1 and 4.8-2 states that level correction is not required when battery charging current is < 5 amps on float charge. This currentprovides, in general, an indication of overall battery condition. Because of specific gravity gradients that are produced during the recharging process, delays of several days may occur while waiting for the specific gravity measurement for determining the state of charge. This footnote allows the float charge current to be used as an alternative to specific gravity to show OPERABILITY of a battery for up to seven (7) days following the completion of a battery equalizing charge. Each connected cells specific gravity must be measured prior to expiration of the 7 day allowance. Surveillance Requirements 4.8.2.3.2.c. 1 and 4.8.2.5.2.c.1 provide for visual inspection of the battery cells, cell plates, and battery racks to detect any indication of physical damage or abnormal deterioration that could potentially degrade battery performance. The non-safety grade 125V D.C. Turbine Battery is required for accident mitigation for a main steam line break within containment with a coincident loss of a vital D.C. bus. The Turbine Battery provides the alternate source of power for Inverters 1 & 2 respectively via non-safety grade Inverters 5 & 6. For the loss of a D.C. eveit[ wiiltaicbincident steam line break within containment, the feedwater regulating valves are required to close to ensure containment design pressure is not exceeded.The Turbine Battery D.C. electrical power subsystem consists of 125-volt D.C. bus 201D and 125-volt D.C. battery bank 201D. To demonstrate OPERABILITY of this subsystem, these components must be energized and capable of performing their required safety functions.

• The feedwater regulating valves require power to close. On loss of a vital D.C. bus, the alternate source of power to the vital A.C. bus via the Turbine Battery ensures power is available to the affected feedwater regulating valve such that the valve will isolate feed flow into the faulted generator.

The Turbine Battery is considered inoperable when bus voltage is less than 125 volts D.C., thereby ensuring adequate capacity for isolation functions via the feedwater regulating. valves during the onset of a steam line break.The Turbine Battery Charger is not required to be included in Technical Specifications even though the Turbine Battery is needed to power backup Inverters 5 & 6 for a main steam line break inside containment coincident with a loss of a Class 1 E D.C. bus. This is due to the fact that feedwater isolation occurs within seconds from the onset of the event.MILLSTONE -UNIT 2 B 3/4 8-18 Amendment No. 4-18, 4-9, -24%, j 9 June 28, 2006.3/4.9 REFUELING OPERATIONS BASES 3/4.9 REFUELING OPERATIONS The ACTION requirements to immediately suspend various activities (CORE ALTERATIONS, fuel movement, CEA movement, etc.) do not preclude completion of the movement of a component to a safe position.3/4.9.1 BORON CONCENTRATION The limitations on reactivity conditions during REFUELING ensure that: 1) the reactor will remain subcritical during CORE ALTERATIONS, and 2) sufficient boron concentration is maintained forlreactivity control in the water volume having direct access to the reactor vessel.These limitations are consistent with the initial conditions assumed for the boron dilution incident in the accident-analyses. Reactivity control in the water volume having direct access to the reactor vessel is achieved by determining boron concentration in the refueling canal. The refueling canal is defined as the entire length of pool stretching from refuel pool through transfer canal to spent fuel pool.The applicability is modified by a Note. The Note states that the limits on boron concentration are only applicable to the refueling canal when this volume is connected to the Reactor Coolant System (RCS). When the refueling canal is isolated from the RCS, no potential.~ *path for boron dilution exists. Prior to reconnecting portions of the refueling canal to the RCS, S Surveillance 4.9.1 .2 must be met. If aydilution activity has occurred while the refueling canal: was disconnected from the RCS, this ansurveillance ensures the correct boron concentration prior to communication with the RCS.Concerning the ACTION statement, operations that individually add limited positive reactivity (e.g., temperature fluctuations from inventory addition or temperature control fluctuations), but when combined with all other operations affecting core reactivity (e.g., intentional boration)result in overall net negative reactiv'ity addition, are not precluded by this ACTION.314.9.2 INSTRUMENTATION The OPERABILITY of the source range neutron flux monitors ensures that redundant monitoring capability is available to detect changes in the reactivity condition of the core.Concerning ACTION a., with only one SRM OPERABLE, redundancy has been lost. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that which would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Performance of ACTION a. shall not preclude completion of movement of a component to a safe position..MILLSTONE -UNIT 2 B 3/4 9-1 Amendment No. 72, 14, 4-50, 1-, 24-5, 26-3, 293 LBDCR 1 0-MP2-007 June 22,.2010 REFUELING OPERATIONS BASES (continued) 3/4.9.3 DECAY TIME The minimum requirement for reactor subcriticality prior to movement of irradiated fuel ensures that sufficient time has elapsed to allow the radioactive decay of the-short-lived fission products so that the calculated radiological dose consequences of the fu~el handling accident are bounding.3/4.9.4 CONTAINMENT PENETRATIONS The requirements on containment penetration closure and OPERABILITY ensure that a release of radioactive material within containment to the environment will be minimized. The OPERABILITY, closure restrictions, and administrative controls are sufficient to minimize the release of radioactive material from a fuel element rupture based upon the lack of containment pressurization potential durirng the movement of in'adiated fu~el assemblies within containment. The containment purge valves are containment penetrations and must satisfy all requirements specified for a containment penetration. Containment penetrations, including the personnel airlock doors and equipment door, can be open during the movement of irradiated fuel provided that sufficient administrative controls are in place such that any of these containment penetrations can be closed within 30 minutes.Following a Fuel Handling Accident, each penetration, including the equipment door, is closed such that a containment atmosphere boundary can be established. However, if it is that closure of all containment penetrations would represent a significant radiological hazard to the personnel involved, the decision may be made to forgo the closure of the affected penetration(s). The containment atmosphere boundary is established when any penetration which provides direct access to the outside atmosphere is closed such that at least one barrier between the containment atmosphere and the outside atmosphere is established. Additional actions beyond establishing the containment atmosphere boundary, such as installing flange bolts for the equipment door or a containment penetration, are not necessary. Administrative controls for opening a containment penetration require that one or more designated persons, as needed, be available for isolation of containment from the outside atmosphere. Procedural controls are also in place to ensure cables or hoses which pass through a containment opening can be quickly removed. The location of each cable and hoses isolation device for those cables and hoses which pass through a containment opening is recorded to ensure timely closure of the containment boundary. Additionally, a closure plan is developed for each containment opening which includes an estimated time to close the containment opening. A log of personnel designated for containment closure is maintained, including identification of which containment openings each person has responsibility for closing. As necessary,equipment will be pre-staged to support timely closure of a containment penetration. MILLSTONE -UNIT 2 B 3/4 9-l a Amendment No. 7-2-, -144, 1-N0, 20-1,, 240, 24#5, 24, September 20, 2004 REFUELING OPERATIONS BASES (continued) 3/4.9.4 CONTAINMENT PENETRATIONS (Continued') Prior to opening a containment penetration, a review of containment penetrations currently open is performed to verify that sufficient personnel are designated such that all containment penetrations can be closed within 30 minutes. Designated personnel may have other duties, however, they must be available such that their assigned containment openings can be closed within 30 minutes. Additionally, each new work activity inside containment is reviewed to consider its effect on the closuire of the equipment dooi, personnel air lock, and/or other open containmaent penetrations. The required number of designated personnel are continuously available to perform closure of their assigned containment openings whenever irradiated fuel is being moved within the containmaent. Administrative controls are also in place to ensure that the containment atmosphere boundary is established if adverse weather conditions which could present a potential missile hazard threaten the plant. Weather conditions are monitored during irradiated fuel movement whenever a containment penetration, including the equipment door and personnel air lock, is open and a storm center is within the plant monitoring radius of 150 miles.The administrative controls ensure that the containment atmosphere boundary can be quickly established (i.e., within 30 minutes) upon determining that adverse weather conditions exist which pose a significant threat to the Millstone Site. A significant threat exists when a hurricane warning or tornado warning is issued which applies to the Millstone Site, or if an average wind speed of 60 miles an hour or greater is recorded by plant meteorological edluipment at the meteorological tower. If the meteorological equipment is inoperable, information from the National Weather Service can be used as a backup in determining plan~t wind speeds. Closure of contaimnent penetrations, including the equipment door and personnel air lock door, begin immediately upon determination that a significant threat exists.When severe weather conditions which could generate a missile are within the plant monitoring radius, containment and spent fuel pool penetrations are closed to establish the containment atmosphere boundary.314.9.5 DELETED MILLSTONE -UNIT 2 B349l mnmn o 8 B 3/4 9-1b Amendment No. 284 LIBDCR 15-MP2-003 March 26, 2015 REFUELING OPERATIONS E BASES 3/4.9.6 DELETED 3/4.9.7 DELETED 3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION In MODE 6 the shutdown cooling trains are the primary means of heat removal. One SDC train provides sufficient heat removal capability. However, to provide redundant paths for heat removal either two SDC trains are required to be OPERABLE and one SDC train must be in operation, or" one SDC train is required to be OPERABLE and in operation with the refueling cavity water level 23 feet above the reactor vessel flange. This volume of water in the refueling cavity will provide a large heat sink in the event of a failure of the operating SDC train. Any exception to these requirements are contained in the LCO Notes.An OPERABLE SDC train, for plant operation in MODE 6, includes a pump, heat exchangei; valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine RCS temperature. In addition, sufficient portions of the Reactor Building Closed Cooling Water (RBCCW) and Service Water (SW) Systems are available to provide cooling to the SDC heat exchanger. The flow path starts at the RCS hot leg and is retum-ed to the RCS cold legs.An OPERABLE SDC train consists of the following equipment:

1. An OPERABLE SDC pump (low pressure safety injection pump);2. The associated SDC heat exchanger from the same facility as the SDC pump;3. An RBCCW pump, powered from the same facility as the SDC pump, and RBCCW heat exchanger capable of cooling the associated SDC heat exchanger;

4. A SW pump, powered from the same facility as the SDC pump, capable of supplying cooling water to the associated RBCCW heat exchanger; and 5. All valves required to support SDC System operation are in the required position or are capable of being placed in the required position.In MODE 6, two OPERABLE SDC trains require 2 SDC pumps, 2 SDC heat exchanger-s, 2 RBCCW pumps, 2 RBCCW heat exchangers, and 2 SW pumps. In addition, 2 RBCCW headers are required to provide cooling to the SDC heat exchangers, but only 1 SW header is required to support the SDC trains. The equipment specified is sufficient to address a single active failure of the SDC System and associated support systems.MILLSTONE

-UNIT 2 B 3/4 9-2 Amendment No. 6-9, p-l-, 4-7, 4-8g, 24G, 244, -240., September 14, 2006 LBDCR 06-MP2-030 REFUELING OPERATIONS BASES 3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued) In addition, two SDC trains can be considered OPERABLE, with only one 125-volt D.C.bus train OPERABLE, in accordance with Limiting Condition for Operation (LCO) 3.8.2.4.2-SI-306 and 2-SI-657 are both powered from the same 125-volt D.C. bus, on Facility 1. Should these valves reposition due to a loss of power, SDC would no longer be aligned to cool the RCS.However, a designated operator is assigned to reposition these valves as necessary in the event 125-volt D.C. power is lost. Consistent with the bases for LCO 3.8.2.4, the 125-volt D.C. support system operability requirements for both trains of SDC are satisfied in MODE 6 with at least one 125-volt D.C. bus train OPERABLE and the 125-volt D.C. buses cross-tied. Either SDC pump may be aligned to the refueling water storage tank (RWST) to support filling the fueling cavity or for performance of required testing. A SDC pump may also be used to transfer water from the refueling cavity to the RWST. In addition, either SDC pump may be aligned to draw a suction on the spent fuel pool (SFP) through 2-RW- 11 and 2-SI-442 instead of the normal SDC suction flow path, provided the SFP transfer canal gate valve 2-RW-280 is open under administrative control (e.g., caution tagged). When using this alternate SDC flow path, it will be necessary to secure the SFP cooling pumps, and limit SDC flow as specified in the appropriate procedure, to prevent vortexing in the suction piping. The evaluation of this alternate SDC flow path assumed that this flow path will not be used during a refueling outage until after the completion of the fuel shuffle such that approximately one third of the reactor core will contain new fuel. By waiting until the completion of the fuel shuffle, sufficient time (at least 14 days from reactor shutdown) will have elapsed to-.ensure-the limited SDC flow rate specified for this alternate lineup will be adequate for decay heat removal from the reactor core and the spent fuel pool. In addition, CORE ALTERATIONS shall be suspended when using this alternate flow path, and this flow path should only be used for short time periods, approximately 12 hours. If the alternate flow path is expected to be used for greater than 24 hours, or the decay heat load will not be bounded as previously discussed, further evaluation is required to ensure that this alternate flow path is acceptable. These alternate lineups do not affect the OPERABILITY of the SDC train. In addition, these alternate lineups will satisfy the requirement for a SDC train to be in operation if the minimum required SDC flow through the reactor core is maintained. In MODE 6, with the refueling cavity filled to >_ 23 feet above the reactor vessel flange, both SDC trains may not be in operation for up to 1 hour in each 8 hour period, provided no operations are permitted that would dilute the RCS boron concentration by introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1. Boron concentration reduction with coolant at boron concentrations less than required to assure the RCS boron concentration is maintained is prohibited because MILLSTONE -UJNIT 2 B 3/4 9-2a Amendment No. 69, 7-l-, 4-1-7-, -l-8-5, 24O, 24-5, 2.49,-2-g4,-29)3, Acknowledged By NRC July 5, 2007 January 27, 2009 LBDCR 08-MP2-030. REFUELING OPERATIONS BASES 314.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued) uni~form concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles, and RCS to SDC isolation valve testing. During this 1 hour period, decay heat is removed by natural convection to the large mass o fwater in the refueling pool.In MODE 6, with the refueling cavity filled to >_ 23 feet above the reactor vessel flange, both SDC trains may also not be in operation for local leak rate testing of the SDC cooling suction line (containment penetration number 10) or to permit maintenance on valves located in the common SDC suction line. This will allow the performance of required maintenance and testing that otherwise may require a full core offload. an adition to the requirement prohibiting operations that would dilute the RCS boron concentration by introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1, CORE ALTERATIONS are suspended and all containment penetrations providing direct access from the containment atmosphere to outside atmos phere must be closed. The containment purge valves are containment penetrations and must satisf all requirements specified for a containment penetration. No time limit is specified to operate in this configuration. However, factors such as scope of the work, decay heat load/heatup rate, and RCS temperature should be considered to determine if it is feasible to perform the work. Prior to using thisprovision, a review and approval of the evolution by the Facility Safety Review Committee (FSRC is required. This review will evaluate currentplant conditions and the proposed work to determine if this provision should be used, and to establi~sh the termination criteria and appropriate contingency plans. ~During this period, decay heat is removed by natural convection to the large mass of water in the0 In Mode 6, with the refueling cavity filled to > 23 feet above the reactor vessel flange and the required shutdown cooling train inoperable or not-in operation (with the exceptions provided in the note. following LCO 3.9.8.1I), there will be no forced circulation to provide mixing to ensure uniform boron concentration distribution. Suspending posi~tive reactivity additions that could result in failure to meet the boron concentration-i-riihit in aiccordance with LCO 3.9.1 is required to assure continued safe .operation. Also, actions shall be taken immediately to suspend loading irradiated fuel assemblies in the core. With no forced circulation cooling, decay neat removal from the core occurs by natural convection to the heat sink provided by the water above the core.A minimum refueling water level of 23 feet above the reactor vessel fange provides an adequate available heat sink. Suspending any operation that would increase the decay heat load, such as loading an irradiated fuel assembly, is a prudent action under this condition. However, suspension of loading irradiated fuel assemblies shall not preclude completion of movement of an irradiated fuel assembly to a safe position outsidte the core." The requirement that at least one shutdown cooling loop be in operation at >_ 1000 g pm ensures that (1) sufficient cooling capacity is available to remove decay heat and maintain the water in the reactor pressure vessel below 1 40 0 F as required during the REFUELING MODE, (2)sufficient coolant circulation is maintained through the reactor core to minimize the effects of a boron dilution incident and prevent boron stratification, and (3) is consistent with boron dilution analysis assumptions. The 1000 gpm shutdown cooling flow limit is the minimum analytical limit. Plant operating procedures maintain the minimum shutdown cooling flow at a higher value to accommodate flow measurement uncertainties. Average Coolant Temperature (Tavg) values are derived under shutdown cooling conditions, using the designated formula for use in Unit 2 operating procedures.

• SDC flow greater than 1000 gpm: (SDCoutiet

+ SDCiniet) / 2 = Tav 0 MILLSTONE -UNIT 2 B 3/4 9-2b Amendment No. 69, 7-l-, 44-7-, 4-84, 240,-24-5, 249, 29-LBDCR 06-MP2-030 September 14, 2006 REFUELING OPERATIONS BASES 3/4.9.8 SHUTDOWN COOLING AND COOLANT CIRCULATION (Continued) During SDC only operation, there is no significant flow past the loop RTDs. Core inlet and outlet temperatures are accurately measured during those conditions by using T3 51 Y, SDC return to RCS temperature indication, and T351IX, RCS to SDC temperature indication. The.average of these two indicators provides a temperature that is equivalent to the average RCS temperature in the core.T35 IX will not be available when using the alternate SDC suction flow path from the SFP.Substitute temperature monitoring capability shall be established to provide indication of reactor core o~utlet temp~erature. ..A portable temp~erature device can be used.to -indicate reactor, core outlet. to ,thle cottrl .rod'tu petr'oi~tel.: A~r~nmfte {teevisioti cdti-neia dr- an a~sgigifi~d individual are acceptable alternative methods to provide this indication to control room personnel. 3/4.9.9 AND_3/4.9.10 DELETED 3/4.9.11 AND 3/4.9.12 WATER LEVEL-REACTOR VESSEL AND STORAGE POOL WATER LEVEL The restrictions on minimum water level ensure that sufficient water depth is available to remove 99% of the assumed 10% iodine gap activity released from the rupture of an irradiated fuel assembly. The minimum water depth is consistent with the assumptions of the accident.analysis.MILLSTONE -UNIT 2 B 3/4 9-2c Amendment No.Acknowledged By NRC July 5, 2007 .REVERSiE OF PAGE B 3/4 INTENTIONALLY LEFT BLANK... September 20, 2004 F" REFUELING OPERATIONS BASES 3/4.9.13 DELETED 3/4,9.14 DELETED 3/4.9.15 DELETED MILLSTONE -UNIT 2 B 3/4 9-3 Amendment No. gO, 4-09, 44-7, 4-5n, 4-1-5, 4~-7, g08, 24g, 284 September 20, 2004 THIS PAGE TNTENTIONALLY LEFT BLANK OMILLSTONE -UNIT 2 B 3/4 9-3a Amendment No. 3%, 4-09, 4-4-, 4-5-4, 4-5-7, 4-7-2, Q, 245-, 284 LBDCR 14-MP2-016 September 4, 2014 REFUELING OPERATIONS BASES (Continued) 314.9.16 SHIELDED CASK The limitations of this specification ensure that in the event of a shielded cask drop accident the doses from ruptured fuel assemblies will be within the assumptions of the safety analyses.3/4.9.17 SPENT FUEL PO OL B ORON CONCENTRATION The limitations of this specification ensures that sufficient boron is present to maintain spent fuel pool Keff_< 0.95 under accident conditions. Postulated accident conditions which could cause an increase in spent fuel pool reactivity are: a single dropped or mis-loaded fuel assembly, a single dropped or mis-loaded Consolidated Fuel Storage Box, or a shielded cask drop onto the storage racks. A spent fuel pool soluble boron concentration of 1400 ppm is sufficient to ensure Keff _ 0.95 under these postulated accident conditions. The required spent fuel pool soluble boron concentration of___ 1720 ppm conservatively bounds the required 1400 ppm. The ACTION statement ensure that if the soluble boron concentration falls below the required amount, that fuel movement or shielded cask movement is stopped, until the boron concentration is restored to within limits.An additional basis of this LCO is to establish 1720 ppm as the minimum spent fuel pooi soluble boron concentration which is sufficient to ensure that the design basis value of 600 ppm soluble boron is not reached due to a postulated spent fuel pool boron dilution event. As part of the spent fuel pool criticality design, a spent fuel soluble boron concentration of 600 ppm is sufficient to ensure Keff < 0.95, provided all fuel is stored consistent with LCO requirements. By maintaining the spent fuel pool soluble boron concentration > 1720 ppm, sufficient time is provided to allow the operators to detect a b~oron dilution event, and terminate the event, prior to the spent fuel pool being diluted below 600 ppm. In the unlikely event that the spent fuel pool soluble boron concentration is decreased to 0 ppm,. Keff will be maintained <1.00, provided all fuel is stored consistent with LCO requirements. The ACTION statement ensures that if the soluble boron concentration falls below the required amount, that immediate action is taken to restore the soluble boron concentration to within limits, and that fuel movement or shielded cask movement is stopped. Fuel movement and shielded cask movement is stopped to prevent the possibility of creating an accident condition at the same time that the minimum soluble boron is below limits for a potential boron dilution event.The surveillance of the spent fuel pool boron concentration within 24 hours of fuel movement, consolidated fuel movement, or cask movement over the cask layout area, verifies that the boron concentration is within limits just prior to the movement. The periodic surveillance interval is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 2 B 3/4 9-3b Amnendment No. g-Q, 1409,1447, 4--57, 1-7-2, 208, 2Ag, 2-74,2,84,...n.....g.. N,. C .. uly. 5, 2007 April 1, 2003 R.EFUELING OPERATIONS BASES 3/4.9.18 SPENT FUEL POOL -STORAGE The limitations described by Figures 3.9-la, 3.9-Ib, and 3.9-3 ensure that the reactivity of fuel assemblies and consolidated fuel storage boxes, introduced into the Region C spent fuel racks, are conservatively within the assumptions of the safety analysis.The limitations described by Figure 3.9-4 ensure that the reactivity of the fuel assemblies, introduced into the Region A spent fuel racks, are conservatively within the assumptions of the safety analysis.3/4.9.19 SPENT FUEL POOL -STORAGE PATTERN The limitations of this specification ensure that the reactivity condition of the Region B storage racks and spent fuel pool Keffwill remain less than or equal to 0.95.The Cell Blocking Devices in the 4th location of the Region B storage racks are designed to prevent inadvertent placement andlor storage in the blocked locations. The blocked location remains empty, or a Batch B fuel assembly may be stored in the blocked location, to maintain reactivity control for fuel assembly storage in any adjacent locations. Region B (non-cell blocker locations) is designed for the storage of new assemblies in the spent fuel pool, and for fuel assemblies which have not sustained sufficient burnup to be stored in Region A or Region C.This LCO is not applicable during the initial installation of Batch B fuel assemblies in the cell blocker locations of Region B. This is acceptable because only Batch B fuel assemblies will be moved during the initial installation of Batch B fuel assemblies, under the Region B cell blockers. Batch B fuel assemblies are qualified for storage in any spent fuel pool storage rack location, hence a fuel misloading event which causes a reactivity consequence is not credible.This exception is valid only during the initial installation of Batch B fuel assemblies in the cell blocker locations. 3/4.9.20 SPENT FUEL POOL -CONSOLIDATION The limitations of these specifications ensure that the decay heat rates and radioactive inventory of the candidate fuel assemblies for consolidation are conservatively within the assumptions of the safety analysis.MILLSTONE -UNIT 2 B 3/4 9-4 Amendment No. -447, 4-1-5, 4-58, 4-7-2, 274 September 25, 2003 P 3.4.10 SpECIAL TEST EXCEPTIONS BASES 3/4.10.1 SHUTDOWN MARGIN This special test exception provides that a minimum amount of CEA worth is immediately available for reactivity control or that the reactor is sufficiently subcritical so as to provide safe operating conditions when tests are performed for CEA worth measurement. This special test exception is required to permit the periodic verification of the actual versus predicted core reactivity condition oecuring as a result of fuel bumup or fuel cycling operations. 3/4.10.2 GROUP HEIGHT ANTD INSERTION LIMITS This special test exception permits individual CEAs to be positioned ouside of their normal group heights and insertion limits during the performance of such PHYSICS TESTS as those required .to 1) measure CEA worth and 2) determine the reactor stability index and damping factor under xenon oscillation conditions. S MiLLSTONE -UNIT 2 3401AedetN.,28 B 3/4 10-1 Amendment No. 280 October 27, 1977 DELETED I27 MILLSTONE -UNIT 2 B341-B 3/4 10-2 November 28, 2000 3/4.11 DELETED BASES 3/4.11.1 -DELETED 3/4.11.2 -DELETED 3/4.11.3 -DELETED MILLSTONE -UNIT 2 B 3/4 11-1 MILLTONE-UNT 2 3/411-1Amendmient No. 250 November 28, 2000 This page intentionally left blank Nillstone Unit 2 B 3/4 11-2 MilltoneUnit2 B /4 1-2 /Aendment No. J79, 250 November 28, 2000 This page intentionally left blank MILLSTONE -UNIT 2 B 3/4 11-3 MILLTON -NIT B /4 1-3Amendment No. 250 November 28, 2000 This page intentionally left blank MILLSTONE -UNIT 2 B 3/4 11-4 MILLTONE-UNT 2 3/411-4Amendment No. JX9, 250 Serial No. 16-078 Docket No. 50-423 ATTACHMENT 2 BASES PAGES FOR MILLSTONE POWER STATION UNIT 3 DOMINION NUCLEAR CONNECTICUT, INC.MILLSTONE POWER STATION UNIT 3 BASES FOR SECTION 2.0 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS NOTE The BASES contained in succeeding pages summarize the reasons for the Specifications in Section 2.0, but in accordance with 10 CFR 50.36 are not part of these Technical Specifications. LBDCR No. 06-MP3-014 June 22, 2006 D.' BASES*:, 2.1.1 REACTOR CORE BACKGROUND 10 CER 50, Appendix A, General Design Criterion 10, requires that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs). This is accomplished by having a departure from nucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95%confidence level (the 95/95 DNB criterion) that DNB will not occur and by requiring that fuel centerline temperature stays below the melting temperature. The restrictions of this Safety Limit (SL) prevent overheating of the fuel and cladding, as well as possible cladding perforation, that would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate (LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature. Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the fuel centerline temperature to reach the melting point of the fuel.Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the>: point of failure, allowing an uncontrolled release of activity to the reactor coolant.Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of DNB and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. Thisweaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.The proper functioning of the Reactor Protection System (RPS) and steam generator safety valves prevents violation of the reactor core SLs.APPLICABLE SAFETY ANALYSES The fuel cladding must not sustain damage as a result of nonnal operation and AOOs. The reactor core SLs are established to preclude violation of the following fuel design criteria: a. There must be at least 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB, and b. The hot fuel pellet in the core must not experience centerline fuel melting.MILLSTONE -UNIT 3 B-B2-1 Amendment No. 60, 2--t4, LBDCR No. 06-MP3-014 June 22, 2006 2.1 SAFETY LIMITS BASES (Continued) The Reactor Trip System setpoints, in combination with all the LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System (RCS) temperature, pressure, RCS Flow, ALI, and THERMAL POWER level that would result in a departure from nucleate boiling ratio (DNBR) of less than the DNBR limit and preclude the existence of flow instabilities. Automatic enforcement of these reactor core SLs is provided by the appropriate operation of the RPS and the steam generator safety valves.SAFETY LIMITS The figure provided in the CORE OPERATING LIMITS REPORT (COLR) shows the loci of points of THERMAL POWER, RCS pressure, and average temperature for which the minimum DNBR is not less than the safety analyses limit, that fuel centerline temperature remains below melting, that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturated liquid, or that the exit quality is within the limits defined by the DNBR correlation. The reactor core SLs are established to preclude violation of the following fuel design criteria: a. There must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB, and b. There must be at least a 95% probability at a 95% confidence level that the hot fuel pellet in the core does not experience centerline fuel melting.The reactor core SLs are used to define the various RPS .functions such that the above criteria are satisfied during steady state operation, normal operational transients, and AOOs. To ensure that the RPS precludes the violation of the above criteria, additional criteria are applied to the Overtemperature and Overpower AT reactor trip functions. That is, it must be demonstrated that the average enthalpy in the hot leg is less than or equal to the saturation enthalpy and that the core exit quality is within the limits defined by the DNBR correlation. Appropriate functioning of the RPS ensures that for variations in the THERMAL POWER, RCS Pressure, RCS average temperature, RCS flow rate, and AI that the reactor core SLs will be satisfied during steady state operation, normal operational transients, and AOOs.APPLICABILITY SL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactor is critical. Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The steam generator safety valves or automatic protection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate a reactor trip function, which forces the unit into MODE 3. In MODES 3, 4, 5, and 6, applicability is not required since the reactor is not generating significant THERMAL POWER.MILLSTONE -UNIT 3 B2l mnmn o B2-1a Amendment No. LBDCR No. 06-MP3-014 June 22, 2006 2.1 SAFETY LIMITS BASES (Continued) SAFETY LIMIT VIOLATIONS If SL 2.1.1 is violated, the requireme~nt to go to HOT STANDBY places the unit in a MODE in which this SL is not applicable. The allowed completion time of 1 hour recognizes the importance of bringing the unit to a MODE of operation where this SL is not a~ppicable, and reduces the probability of fuel damage.Amendment No.MILLSTONE -UNIT 3 B2l B2-1b January 31, 1986 SAFETY LIMITS BASES 2.1.2 REACTOR COOLANT SYSTEM PRESSURE The restriction of this Safety Limit protects the integrity of the Reactor Coolant Systemn (RCS) fromn overpressurization and thereby prevents the release of radionuclides contained in the-reactor coolant from reaching the containment atmosphere. The reactor vessel, pressurizer, and the RCS piping, valves and fittings are designed to Section III of the ASME Code for Nuclear Power Plants which permits a. maximum transient pressure of 110% (2750 psia) of design pressure.. The Safety Limit of 2750 psia is therefore consistent with the design criteria and associated Code requirements. The entire RCS is hydrotested at 125% (3125 psia) of design pressure, to demonstrate integrity prior to initial operation. MILLSTONE -UNIT 3B22 B 2-2 LBDCR Noj)4-MP3-01 5 February 24, 2005 2.2 LIMITING SAFETY SYSTEM SETTINGS BASES 2.2.1 REACTOR TRIP SYSTEM INSTRUMENTATION SETPOINTS The Nominal Trip Setpoints specified in Table 2.2-1 are the nominal values at which the reactor trips are set for each functional unit. The Allowable Values (Nominal Trip Setpoints +/-k the calibration tolerance) are considered the Limiting Safety System Settings as identified in 10OCFR50.36 and have been selected to ensure that the core and Reactor Coolant System are .prevented from exceeding their safety limits during normal operation and design basis anticipated operational occurrences and to assist the Engineered SafetyFeatures Actuation System in mitigating the consequences of accidents. The Setpoint for a Reactor Trip System or interlock function is considered to be consistent with the nominal value when the measured "as left" Setpoint is within the administratively controlled (+) calibration tolerance identified in plant procedures (which specifies the difference between the Allowable Value and Nominal Trip Setpoint). Additionally, the Nominal Trip Setpoints may be adjusted in the conservative direction provided the calibration tolerance remains unchanged. Measurement and Test Equipment accuracy is administratively controlled by plant procedures and is included in the plant uncertainty calculations as defined in WCAP-10991. OPERABILITY determinations are based on the use of Measurement and Test Equipment that conforms with the accuracy used in the plant uncertainty calculation. The Allowable Value specified in Table 2.2-1 defines the limit beyond which a channel is inoperable. If the process rack bistable setting is measured within the "as left" calibration tolerance, which specifies the difference between-the A-iiowable Value and Nominal Trip Setpoint, then the channel is considered to be OPERABLE.The methodology, as defined in WCAP- 10991 to derive the Nominal Trip Setpoints, is based upon combining all of the uncertainties .in the channels. Inherent in the determination of the Nominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and other instrumentation utilized in these channels should be capable of operating within the allowances of these uncertainty magnitudes. Occasional drift in excess of the allowance may be determined to be acceptable based on the other device performance characteristics. Device drift in excess of the allowance that is more than occasional, may be indicative of more serious problems and would warrant further investigation. The various reactor trip circuits automatically open the reactor trip breakers whenever a condition monitored by the Reactor Trip System reaches a preset or calculated level. In addition to the redundant channels and trains, the design approach provides Reactor Trip System functional diversity. The MILLSTONE -UNIT 3 B 2-3 Amendment No. 59, Acknowledged by NRC letter dated 08/25/05 LBDCR 07-MP3-037-July 12, 2007 2.2 LIMITING SAFETY SYSTEM SETTINGS BASES REACTOR TRIP SYSTEM INSTRUMENTATION SETPOINTS (Continued) functional capability at the specified trip setting is required for those anticipatory or diverse reactor trips for which no direct credit was assumed in the safety analysis to enhance the overall reliability of the Reactor Trip System. The Reactor Trip System initiates a turbine trip signal whenever reactor trip is initiated. This prevents the reactivity insertion that would otherwise result from excessive Reactor Coolant System cooldown and thus avoids unnecessary actuation of: the Engineered Safety Features Actuation System.Manual Reactor Trip The Reactor Trip System includes manual Reactor trip capability. Power Range. Neutron Flux In each of the Power Range Neutron Flux channels there are two independent bistables, each with its own trip setting used for a High and Low Range trip setting. The Low Setpoint trip provides protection during subcritical and low power operations to mitigate the consequences of a power excursion beginning from low power, and the High Setpoint trip provides protection during power operations to mitigate the consequences of a reactivity excursion from all power levels. l The Low Setpoint trip may be manually blocked above P-i 10 (a power level of approximately 10% of RATED THERMAL PO.WER)._and is automatically reinstated below the P-10 Setpoint.Power Range. Neutron Flux. High Positive Rate The Power Range Positive Rate trip provides protection against rapid flux increases which are characteristic of positive reactivity insertion events. Specifically, this trip complements the Power Range Neutron Flux High and Low trips to ensure that the criteria are met for all rod ejection accidents. This trip also complements the Pressurizer Pressure-High trip, along with the Overtemperature AT and the Power Range Neutron Flux High Positive Rate trips, to ensure that the criteria are met for the rod withdrawal at power accidents. MILLSTONE -UNIT 3 B 2-4 Amendment No. 4-46, 4-59, 24-l-, LBDCR No. 07-MP3-017 April 12, 2007 LIMITING SAFETY SYSTEM SETTINGS BASES Intermediate and Source Range. Neutron Flux The Intermediate and Source Range, Neutron Flux trips provide core protection during reactor startupto mitigate the consequences of an uncontrolled rod cluster control assembly bank withdrawal from a. subcritical condition. These trips provide redundant protection to the Low Setpoint trip of the Power Range, Neutron Flux channels. The Source Range channels will initiate a Reactor trip at about 105 counts per second unless manually blocked when P-6 becomes active. The Intermediate Range channels will initiate a Reactor trip at a current level equivalent to approximately 25% of RATED THERMAL POWER unless manually blocked when P-10 becomes active. No credit was taken for operation of the trips associated with either the Intermediate .or Source Range Channels in the accident analyses; however, their functional capability at the specified trip settings is required by this specification to enhance the overall reliability of the Reactor Trip System.Overtemperature AT The Overtemperature AT trip provides core protection to prevent DNB for all combinations of pressure, power, coolant temperature, and axial power distribution, provided that the transient is slow with respect to piping transit delays from the core to the temperature detectors, and pressure is within the range between the Pressurizer High and Low Pressure trips.The Setpoint is automatically varied with: (1) coolant temperature to correct for temperature induced changes in density and heat capacity of water and ~includes dynamic compensation for .piping delays from the core to the loop temperature detectors, (2) pressurizer pressure, and (3) axial power distribution. With normal axial power distribution, this Reactor trip limit is always below the core Safety Limit as shown by the Reactor Core Safety Limit curves in the COLR. If axial peaks are greater than design, as indicated by the difference between top and bottom power range nuclear detectors, the Reactor trip is automatically reduced according to the notations in Table 2.2-1. Although a direction of conservatism is identified for the Overtemperature AT reactor trip function K 2 and K 3 gains, the gains should be set as close as possible to the values contained in Note 1 to ensure that the Overtemperature AT setpoint is consistent with the assumptions of the safety analyses.Overpower AT The Overpower AT trip provides assurance of fuel integrity (e.g., no fuel pellet melting and less than 1% cladding strain) under all possible overpower conditions, limits the required range for Overtemperature AT MILLSTONE -UNIT 3 B 2-5 MILLTON -NIT3 B2-5Amendment No. 2, 60, 4-52, 2-l--7-, LBDCR No.;08-MP3-014 October 21, 2008 LIMITING SAFETY SYSTEM SETTINGS BASES trip, and provides a backup to the High Neutron Flux trip. The Setpoint is automatically varied with: (1) coolant temperature to correct for temperature induced changes in density and heat capacity of water, and (2) rate of change of temperature for dynamic compensation for piping delays from the core to the loop temperature detectors, to ensure that the allowable heat generation rate (kW/ft) is not exceeded. The Overpower AT trip provides protection to mitigate the consequences of various size steam breaks as reported in WCAP-9226, "Reactor Core Responseto Excessive Secondary Steam Releases." Pressurizer Pressure In each of the pressurizer pressure channels, there are two independent bistables, each with its own trip setting to provide for a High and Low Pressure trip thus limiting the pressure range in which reactor operation is permitted. The Low Setpoint trip protects against low pressure which could lead to DNB by tripping the reactor in the event of a loss of reactor coolant pressure.On decreasing power the Low Setpoint trip is automatically blocked by P-7 (a power level of approximately 10% of RATED THERMAL POWER with turbine impulse chamber pressure at approximately 10% of full power equivalent); and on increasing power, automatically reinstated by P-7.The High Setpoint trip functions in conjunction with the pressurizer relief and safety valves to protect the Reactor Coolant System against system overpressure. Pressurizer Water Level The Pressurizer Water Level High trip is provided~-.to pre-vent water relief through the pressurizer safety valves. On decreasing power the Pressurizer High Water Level trip is automatically blocked by P-7 (a power level of approximately 10% of RATED THERMAL POWER with a turbine impulse chamber pressure at approximately 10% of full power equivalent); and on increasing power, automatically reinstated by P-7.Reactor Coolant Flow The Reactor Coolant Flow Low trip provides core protection to prevent DNB by mitigating the consequences of a loss of flow resulting from the loss of one or more reactor coolant pumps.The nominal RCS flow is the actual measured RCS flow during POWER OPERATION. The low RCS flow RPS trip is set to be greater than or equal to 90% of the actual measured flow.Technical Specification 3.2.3, RCS Flow Rate and Nuclear Enthalpy Rise Hot Channel Factor, assures that the nominal (actual measured) RCS flow will exceed the RCS design Hlow rate used for design basis accidents and the Minimum Measured Flow used in the DNBR analysis as specified in the COLR and consequently the trip setpoint based upon the nominal (actual measured) RCS will be conservative with respect to the safety analysis. A trip setpoint based upon 90% of nominal (actual measured) RCS flow assures that the design basis analyses and the DNBR analyses are conservative and bounding.MILLSTONE -UNIT 3 B- mnmn o B 2-6 Amendment No. LBDCR No. 08-MP3-036 October 30, 2008 LIMITING SAFETY SYSTEM SETTINGS BASES On increasing power above P-7 (a power level of approximately 10%. of RATED THERMAL POWER or a turbine impulse chamber pressure at approximately 10% of full power equivalent), an automatic Reactor trip will occur if the flow in more than one loop drops below 90% of nominal full loop flow. Above P-8 (a power level of approximately 50% of RATED THERMAL POWER) an automatic Reactor trip will occur if the flow in any single loop drops below 90% of nominal full loop flow. Conversely, on decreasing power between P-8 and the P-7 an automatic Reactor trip will occur on low reactor coolant flow in more than one loop and below P-7 the trip function is automatically blocked.'Steam Generator Water Level The Steam Generator Water Level Low-Low trip protects the reactor from loss of heat sink in the event of a sustained steamn/feedwater flow mismatch resulting from loss of normal feedwater. The specified Setp~oint provides allowances for starting delays of the Auxiliary Feedwater System.Low Shaft Speed -Reactor Coolant Pumps The Low Shaft Speed -Reactor Coolant Pumps trip provides core protection to prevent DNB in the event of a sudden significant decrease in reactor coolant pump speed (with resulting decrease in flow) on two reactor coolant pumps in any two operating reactor coolant loops. The trip setpoint ensures that a reactor trip will be generated, considering instrument errors and response times, in sufficient time to allow the DNBR to be maintained greater than the design above limit following a four-pump loss of flow event.Turbine Trip A Turbine trip initiates a Reactor trip. On decreasing power the Reactor trip from the Turbine trip is automatically blocked by P-9 (a power level of approximately 50% of RATED THERMAL POWER); and on increasing power, reinstated automatically by P-9. The P-9 setpoint is acceptable with up to two steam dump valves out of service.Safe.ty Injection Input from ESF If a Reactor trip has not already been generated by the Reactor Trip System instrumentation, the ESF automatic actuation logic channels will initiate Reactor trip upon any signal which initiates a Safety Injection. The ESF instrumentation channels which initiate a Safety Injection signal are shown in Table 3.3-3.Reactor Trip System Interlocks The Reactor Trip System interlocks perform the following functions: P-6 On increasing power, P-6 becomes active above the Interlock Allowable Value specified on Table 2.2-1 to allow the manual block of the Source Range trip (i.e., prevents premature block of the Source Range trip during reactor startup) and deenergizes the high voltage to the detectors. On decreasing power during a MILLSTONE -UNIT 3B27AmnetNo B 2-7 Amendment No. LBDCR No,-08-MP3-014

• October 21, 2008 LIMITING SAFETY SYSTEM SETTINGS BASES Reactor Trip System Interlocks (Continued) reactor shutdown, Source Range Level trips are automatically reactivated and high voltage restored when P-6 deactivates.

The P-6 deactivation will occur at a value below its activation value and may be calibrated to occur below the P-6 Interlock Allowable Value specified on Table 2.2-1 to prevent overlap and chatter based upon.: the expected bistable drift.P-7 On increasing power P-7 automatically enables Reactor trips on low flow in more than one reactor coolant loop, reactor coolant pump low shaft speed, pressurizer low pressure and pressurizer high level. On decreasing power, the above listed trips are automatically blocked.P-8 On increasing power, P-8 automatically enables Reactor trips on low flow in one or more reactor coolant loops. On decreasing power, the P-8 automatically blocks the above listed trips.P-9 On increasing power, P-9 automatically enables Reactor trip on Turbine trip. On decreasing power, P-9 automatically blocks Reactor trip on Turbine trip.P-i10 On increasing power, P- 10 provides input to P-7 to ensure that Reactor Trips on low flow in more than one reactor coolant loop, reactor coolant pump low shaft speed, pressurizer low pressure and pressurizer high level are active when powver reaches 11%. It also allows the manual block of the Intermediate Range trip and the Low Setpoint Power Range trip; and automatically blocks the Source Range trip and deenergizes the Source Range high voltage power.On decreasing power, P-10 resets to automatically reactivate the Intermediate Range trip and the Low Setpoinit Power Range trip before power drops below 9%. It also provides input to reset P-7.P-13 On increasing power, P-13 provides input to P-7 to ensure that Reactor trips on low flow in more than one reactor coolant loop, reactor coolant pump low shaft speed, pressurizer low pressure and pressurizer high level are active when power reaches 10%.On decreasing power, P-13 resets when power drops below 10% and provides input, along with P-10, to reset P-7.MILLSTONE -UNIT 3 B 2-8 MILSTOE UNT B -8Amendment No. -5 2--l-g, :2---, BASES FOR SECTIONS 3.0 AND 4.0 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS NOTE The BASES contained in succeeding pages summarize the reasons for the Specifications in Sections 3.0 and 4.0, but in accordance with 10 CFR 50.36 are not part of these Technical Specifications. october 25, 1990.3/4.0 APPLICABILITY '! BASES 3/4 LIMITING CONDITIONS FOR OPERATION AND SURVEILLANCE REQUIREMENTS 3/4.0 APPLICABILITY Specification

3.0.1 throuah

3.0.4 establish the general requirements applicable to Limiting Conditions for Operation. These requirements are based on the requirements for Limiting Conditions for Operation stated in the Code of Federal Regulations, 10 CFR 50.36(c)(2): "Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility.When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specification until the condition can be met." Specification

3.0.1 establishes

the Applicability statement within each individual specification as the requirement for when (i.e., in which OPERATIONAL MODES or other specif'ied conditions) conformance to the Limiting Conditions for Operation is required for safe operation of the facility. The SACTION requirements establish those remedial measures that must be taken within specified time limits when the requirements of a Limiting Condition for*Operation are not met.S There are two basic types of ACTION requirements. The first specifies the S remedial measures that permit continued operation of the facility which is not further restricted by the time limits of the ACTION requirements. In this case, conformance to the ACTION requirements provides an acceptable level of safety for unlimited continued operation as long as the ACTION requirements continue to be met. The second type of ACTION requirement specifies a time limit in which conformance to the conditions of the Limiting Condition for Operation must be met. This time limit is the allowable outage time to restore an inoperable sYstem or component to OPERABLE status of for restoring parameters within specified limits. If these actions are not completed within the allowable outage time limits, a shutdown is required to place the facility in a MODE or condition in which the specification no longer applies. It is not intended that the shutdown ACTION requirements be used as an operational convenience which permits (routine) voluntary removal of a system(s) or component(s) from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. The specified time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. The time limits of the ACTION requirements are also applicable when a system or component is removed from service for surveillance testing or investigation of operational problems. Individual specifications may include a specified time limit for the completion of a Surveillance Requirement when equipment is removed from service. In this case, the allowable outage time rn limits of the ACTION requirements are applicable when this limit expires if~the surveillance has not been completed. When a shutdown is required to MILLSTONE -UNIT 3 B3401 AEDETN.5 B 3/4 0-I AMENDMENT NO. 57 October 25, 3/4.0 APPLICABILITY W BASES comply with ACTION requirements, the plant may have entered a MODE in which a new specification becomes applicable. In this case, the time limits of the ACTION requirements would apply from the point in time that the new specification becomes applicable if the requirements of the Limiting Condition for Operationfare not met.Specification

3.0.2 establishes

that noncompliance with a specificationexists when the requirements of the Limiting Condition for Operation are not met and the associated ACTION requirements have not been implemented within the specified time interval. The purpose of this specification is to clarify that (I) implementation of the ACTION requirements within the specified time interval constitutes compliance with a specification and (2) completion of the remedial measures of the ACTION requirements is not required when compliance with a Limiting Condition of Operation is restored within the time interval specified in the associated ACTION requirements. Specification

3.0.3 establishes

the shutdown ACTION requirements that must be implemented when a Limiting Condition for Operation is not met and the condition is not specifically addresFzA by the associated ACTION requirements. The purpose of this specification is 'o delineate the time limits for placing the unit in a safe shutdown MODE when plant operation cannot be maintained within the limits for safe operation defined by the Limiting Conditions for i.Operation and its ACTION requirements. It is not intended to be used as an operational convenience which permits (routine) voluntary .removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. This time permits the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and Within the cooldown capabilities of the facility assuming only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the primary coolant system and the potential for a plant upset that could challenge safety systems under conditions for which this specification applies.If remedial measures permitting limited continued operation of the facility under the provisions of the ACTION requirements are completed, the shutdown may be terminated. The time limits of the ACTION requirements are applicable from the point in time it is identified that a Limiting Condition for Operation is not met. Therefore, the shutdown may be terminated if the ACTION requirements have been met or the time limits of the ACTION requirements have not expired, thus providing an allowance for the completion of the required actions. The time limits of Specification

3.0.3 allow

37 hours for the plant to be in COLD SHUTDOWN MODE when a shutdown is required during the POWER MODE of operation. If the plant is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE of operation applies. However, if a lower MODE of operation is reached in less time than allowed, the total allowable time to reach COLD SHUTDOWN, or other applicable MILLSTONE -UNIT 3 MILTN NT3B 3/4 0-2 AMENDMENT NO. 57 3/4.0 APPLICABILITY Apr11 17, 2000 BASES MODE, is not reduced. For example, if HOT STANDBY is reached in 2 hours, the time allowed to reach HOT SHUTDOWN is the next 11 hours because the total time to reach HOT SHUTDOWN is not reduced from the allowable limit of 13 hours.Therefore, if remedial measures are completed that would permit a return to POWER operation, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.The same principle applies with regard to the allowable outage time limits of the ACTION requirements, if compliance with the ACTION requirements for one*specification results in entry. into a MODE or condition of operation for another specification in which the requirements of the Limiting Condition for Operation are not met. If the new specification becomes applicable in less time than specified, the difference may be added to the allowable outage time limits of the second specification. However, the allowable outage.time limits of ACTION requirements for a higher MODE of operation may not be used to extend the allowable outage time that is applicable when a Limiting Condition for Operation is not met in a lower MODE of operation. The Shutdown requirements of Specification 3.0.3 do not apply in MODES 5 and 6, because the ACTION requirements of individual specifications define the remedial measures to be taken.Specification

3.0.4 establishes

limitations on MODEchanges when a Limiting Condition for Operation is not met. It precludes placing the facility in a high MODE of operation when the requirements for a Limiting Condition for Operation are not met and continued noncompliance to these conditions would result in a shutdown to comply with the ACTION requirements if a change in MODES were permitted. The purpose of this specification is to ensure that facility operation is not initiated or that higher MODES of operation are not entered when corrective action is being taken to obtain compliance with a specification by restoring equipment to OPERABLE status or parameters to specified limits. Compliance with ACTION requirements that permit continued operation of the facility for an unlimited period of time provides *an acceptable level of safety for continued operation without regard to the status of the plant before or after a MODE change. Therefore, in this case, entry into an OPERATIONAL MODE or other specified condition may be made in accordance with the provisions of the ACTION requirements. The provisions of this specification should not, however, *be interpreted as endorsing the failure to exercise good practice in restoring systems or components to OPERABLE status before plant startup.When a shutdown is required to comply with ACTION requirements, the provision of Specification 3.0.4 do not apply because they would delay placing the facility in a lower MODE of operation. Specification

3.0.5 establishes

the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to Specifications 3.0.1 and 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate either: a. The OPERABILITY of the equipment being returned to. service; or b. The OPERABILITY of other equipment. MILLSTONE -UNIT 3 B 3/4 0-3 MILLTONE-UNT 3 3 40-3Amendment No. F7, 179 3/4.0 APPLICABILITY Arl1,20 April 17, 2000 BASES The administrative controls ensure the time the equipment is returned to , service in conflict with the requirements of the ACTIONS is limited to the time absolutely neCessary to perform the required testing to demonstrate, OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance. An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the required testing.An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of required testing on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.Specifications

4.0.1 through

4.0.5 establish the general requirements applicable to Surveillance Requirements. These requirements are based on the Surveillance Requirements stated in the Code of Federal Regulations, 10 CFR 50.36(c) (3) : 0i MILLSTONE UNIT 3 B 3/40-3a MILLTONEUNI 3 B3/4 -3aAmendment No. 179 November 15, 2002 3/4.0 APPLICABILITY BASES"Surveillance requirements are requirements relating to test, calibration, or inspection to ensure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met." Specification

4.0.1 establishes

the requirement that surveillances must be met during the OPERATIONAL MODES or other conditions for which the requirements of the Limiting Conditions for Operation apply unless otherwise stated in an individual Surveillance Requirement. The purpose of this specification is to ensure that surveillances are performed to verify the OPERABILITY of systems and components and that parameters are within specified limits to ensure safe operation of the facility when the plant is in a MODE or other specified condition for which the associated Limiting Conditions for Operation are applicable. Failure to meet a Surveillance within the specified surveillance interval, in accordance with Specification 4.0.2, constitutes a failure to meet a Limiting Condition for Operation. Systems and components are assumed to be OPERABLE when the associated Surveillance Requirements have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are when either: a. The systems or components are known to be inoperable, although still meeting the Surveillance Requirements or b. The requirements of the Surveillance(s) are known to be not met between required Surveillance performances. Surveillance requirements do not have to be performed when the facility is in an OPERATIONAL MODE or other specified conditions for which the requirements of the associated Limiting Condition for Operation do not apply unless otherwise specified. The Surveillance Requirements associated with a Special Test Exception are only applicable when the Special Test Exception is used as an allowable exception to the requirements of a specification. Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given Surveillance Requirement. In this case; the unplanned event may be credited as fulfilling the performance. of the Surveillance Requirement. This allowance includes those Surveillance Requirement(s) whose performance is normally precluded in a given MODE or other specified condition. Surveillance Requirements, including Surveillances invoked by ACTION requirements, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with Specification 4.0.2, prior to returning equipment to OPERABLE status.Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with Specification 4.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed. MILLSTONE -UNIT 3 B 3/4 0-4 MILL TON -NIT3 B3/40-4Amendment No. =5-7, -l-2-, 213 LBDCR No. 074-MP3-015 February 24, 2005 3/4.0 APPLICABILITY 'BASES Some examples of this process are: a. Auxiliary feedwater (AFW) pump turbine maintenance during refueling that requires testing at steam pressure > 800 psi. However, if other appropriate testing is satisfactorily completed, the AFW System can be considered OPERABLE. This allows startup and other necessary testing to proceed until the plant reaches the steam pressure required to perform the testing.b. High pressure safety in~jection (I-PSI) maintenance during shutdown that requires*system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPSI considered OPERABLE. This allows operation to reach the specified pressure to complete the necessary post maintenance testing.Specification 4.0.2 This specification establishes the limit for which the specified time interval for surveillance requirements may be extended. It permi~ts an allowable extension of the normal surveillance interval to facilitate surveillance scheduling and consideration of plant operating conditions that may not be suitable for conducting the surveillance; e.g., transient conditions or other ongoing surveillance or maintenance activities. It also provides flexibility to accommodate the length of a fuel cycle for surveillances that are performed at each refueling outage and are specified typically with an 18-month surveillance interval. It is not intended that this provision be used repeatedly as a convenience to extend surveillance intervals beyond that specified for surveillances that are not performed during refueling outage. The limitation of 4.0.2 is based on" engineering judgment and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the surveillance requirements. This provision is sufficient to ensure that the reliability ensured through surveillance activities is not significantly degraded beyond that obtained from the specified surveillance interval.*Specification

4.0.3. establishes

the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified surveillance interval. A delay period of up to 24 hours or up to the limit of the specified surveillance interval, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with Specification 4.0.2, and not at the time that the specified surveillance interval was not met.This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with ACTION requirements or other remedial measures that might preclude completion of the Surveillance. The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of'the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements. MILLSTONE -UNIT 3 B 3/4 0-5 Amendment No. , 22, 06, t-3,0 Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015 February 24, 2005 3/4.0 APPLICABILITY BASES When a Surveillance with a surveillance interval based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations, (e.g., prior to entering MODE I after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not havje been performed when specified, Specification

4.0.3 allows

for the full delay period of up to the specified surveillance interval to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity. Specification

4.0.3 provides

a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by ACTION requirements.[ Failure to comply with specified surveillance intervals for the Surveillance Requirements is expected to be an infrequent occurrence. Use of the delay period established by Specification 4.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours or the limit of the specified surveillance interval is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to.perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should~be managed, through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determinethe safest course of action. All missed Surveillances will be placed in the licensee's Corrective Action Program.If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable* is considered outside the specified limits and the entry into the ACTION requirements for the applicable Limiting Condition for Operation begins immediately upon, expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and entry into the ACTION requirements for the applicable Limiting Conditions for Operation begins immediately upon the failure of the Surveillance. Completion of the Surveillance within the delay period allowed by this Specification, or within the Allowed Outage Time of the applicable ACTIONS, restores compliance with Specification 4.0.1.MILLSTONE -UNIT 3 B 3/4 0-5a Amendment No. 2-4-3, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 07-MP3-009 June 19, 2007 3/4.0 APPLICABILITY BASES Specification

4.0.4 establishes

the requirement that all applicable surveillances must be met before entry into an OPERATIONAL MODE or other condition of operation specified in the Applicability statement. The purpose of this specification is to ensure that system and component OPERABILITY requirements or parameter limits are met before entry into a MODE or condition for which these systems and components ensure safe operation of the facility. This provision applies to changes in OPERATIONAL MODES or other specified conditions associated with plant shutdown as well as startup.Under the provisions of this specification, the applicable Surveillance Requirements must be performed within the specified surveillance interval to ensure that the Limiting Conditions for Operation are met during initial plant startup or following a plant outage.When a shutdown is required to comply with ACTION requirements, the provisions of Specification 4.0.4 do not apply because this would delay placing the facility in a lower MODE of operation. Specification

4.0.5 establishes

the requirement that inservice testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with a periodically updated version of the ASME Code for Operation and Maintenance of Nuclear Power Plants (ASME OMN Code) and applicable Addenda as required by l0CFR5O.55a(f). These requirements apply except when relief has been provided in writing by the Commission. This specification includes a clarification of the frequencies for performing the inservice testing activities required by the ASME. OM Code and applicable Addenda. This clarification is provided to ensure consistency in surveillance intervals throughout the Technical Specifications and to remove any ambiguities relative to the frequencies for performing the required inservice testing activities.. Under the terms of this specification, the more restrictive requirements of the Technical Specifications take precedence over the ASME OM Code and applicable Addenda. The requirements of Specification 4.0.4 to perform surveillance activities before entry into an OPERATIONAL MODE or other specified condition takes-precedence over the ASME OM Code" provision which allows pumps and valves to be tested up to one week after return to normal operation. MILLSTONE -UNIT 3 B 3/4 0-6 MILLTONE-UNT 3 3/40-6Amendment No. 2--3, LBDCR 06-MP3-013 April 5, 2006 3/4.1 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.1 BORATION CONTROL 3/4.1.1.1i and 3/4.1.1.2 SHUTDOWN MARGIN A sufficient SHUTDOWN MARGIN ensures that: (1) the reactor can be made subcritical from all operating. conditions, (2) the reactivity transients associated with postulated accident conditions are controllable within acceptable limnits, and (3) the reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition. sHUTDOWN MARGIN requirements vary throughout core life as a function of fuel depletion, RCS boron concentration, and RCS Tavg. In MODES I and 2, the mnost restrictive condition occurs at EOL with Tav at n1o load operating temperature, and is associated with a postulated steam line break accident and resulting uncontrolled RCS cooldown. In the analysis of this accident, a minimum SHUTDOWN MARGIN as defined in Specification 3/4.1.1.1.1 is required to: control the reactivity transient. Accordingly, the SHUTDOWN MARGIN requirement is based upon this limiting condition and is consistent with FSAR safety analysis assumptions. In MODES 3, 4 and 5, the mnost restrictive condition occurs at BOL, associated with a boron dilution accident. In the analysis of this accident, a minimum SHUTDOWN MARGIN as defined in Specification 3/4.1.1 .1 .2 is required to allow the operator 15 minutes from the initiation of the Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. Accordingly, the SHUTDOWN MARGIN requirement is based upon this limiting requirement and is consistent with the accident analysis assumption. The locking closed of the required valves in MODE 5 (with the loops not filled) will preclude the possibility of uncontrolled boron dilution of the Reactor Coolant System by preventing flow of unborated water to the RCS.3/4.1.1.3 MODERATOR TEMPERATURE COEFFICIENT The limitations on moderator temperature coefficient (MTC) are provided to ensure that the value of this coefficient remains within the limniting condition assumned in the FSAR accident and transient analyses.The MTC values of this specification are applicable to a specific set of plant conditions; accordingly, verification of MTC values at conditions other than those explicitly stated will require extrapolation to those conditions in order to permit an accurate comparison. The most negative MTC, value equivalent to the nmost positive moderator density coefficient (MDC), was obtained by incrementally correcting the MDC used in the ESAR analyses to nominal operating conditions. MILLSTONE -UNIT 3 B 3/4 1-1 Amendment No. 9,-6O, 9~9, 4-1-, Acknowledged by NRC Letter dated 12/19/06 August 27, 2001 REACTIVITY CONTROL SYSTEMS BASES MODERATOR TEMPERATURE COEFFICIENT (Continued) These corrections involved: (1) a conversion of the MDC used in the FSAR safety analyses to its equivalent MTC, based on the rate of change of moderator density with temperature at RATED THERMAL POWER conditions, and (2) subtracting from this value the largest differences in MTC observed between EOL, all rods withdrawn, RATED TIHERMAL POWER conditions, and those most adverse conditions of moderator temperature and pressure, rod insertion, axial power skewing, and xenon concentration that can occur in normal operation and lead to a significantly more negative EOL MTC at RATED THERMAL POWER. These corrections transformed the MDC value used in the FSAR safety analyses into the limiting End of Cycle Life (EOL) MTC value. The 300 ppm surveillance limit MTC value represents a conservative MTC value at a core condition of 300 ppm equilibr/ium boron concentration, and is obtained by making corrections for burnup and soluble boron to the limiting EOL MTC value.The Surveillance Requirements for measurement of the MTC at the beginning and near the end of the fuel cycle are adequate to confirm that the MTC remains within its limits since this coefficient changes slowly due principally to the reduction in RCS boron concentration associated with fuel burnup.3/4.1.1.4 MINIMUM TEMPERATURE FOR CRITICALITY This specification ensures that the reactor will not be made critical with the Reactor Coolant System average temperature less than 551. This limitation is required to ensure: (1) the moderator temperature coefficient is within it analyzed temperature range, (2) the trip instrumentation is within its normal operating range, (3) the P-12 interlock is above its setpoint, (4) the pressurizer is capable of being in an OPERABLE status with a steam bubble, and (5) the reactor vessel is above its minimum RTNDT temperature. 3/4.1.2 DELETED MILLSTONE -UNIT 3 B 3/4 1-2 MILLTON -NIT3 B3/41-2Amendment No. 2-9, 5-0, 4457-, 197 LBDCR 07-MP3-037 Jtily 12, 2007 REACTIVITY CONTROL SYSTEMS BASES 3/4.1.3 MOVABLE CONTROL ASSEMBLIES The specifications of this section ensure that: (1) acceptable power distribution limits are maintained, (2) the minimum SHUTDOWN MARGIN is maintained, and (3) the potential effects of rod misalignment on associated accident analyses are limited. OPERABILITY of the control rod position indicators is required to detennine control rod positions and thereby ensure compliance with the control rod aligmnent and insertion limits. Verification that the Digital Rod Position Indicator agrees with the demanded position within +/--12 steps at 24, 48, 120, and fully withdrawn position for the Control Banks and 18, 210, and fully withdrawn position for the Shutdown Banks provides assurances that the Digital Rod Position Indicator is operating correctly over the full range of indication. Since the Digital Rod Position Indication System does not indicate the actual shutdown rod position between 18 steps and 210 steps, only points in the indicated ranges are picked for verification of agreement with demanded position.The ACTION statements which permit limited variations from the basic requirements are accompanied by additional restrictions which ensure that the original design criteria are met.Misalignment of a rod requires measurement of peaking factors and a restriction in TI-ERMAL POWER. These restrictions provide assurance of fuel rod integrity during continued operation. In addition, those safety analyses affected by a misaligned rod are reevaluated to confirm that the results remain valid during future operation. The maximaum rod drop time restriction is consistent with the assumed rod drop time used in the safety analyses. Measurement with Tavg greater than or equal to 500°F and with all reactor coolant pumps operating ensures that the measured drop times will be representative of insertion times experienced during a Reactor trip at operating conditions. The required rod drop time of< 2.7 seconds specified in Technical Specification 3.1.3A4 is used in the FSAR accident analysis. A rod drop time was calculated to validate the Technical Specification limit. This calculation accounted for all uncertainties, including a plant specific seismic allowance of 0.50 seconds. Since the seismic allowance should be removed when verifying the actual rod drop time, the acceptance criteria for surveillance testing is 2.20 seconds (Reference 4).Measuring rod drop times prior to reactor criticality, after reactor vessel head removal and installation, ensures that the reactor internals and rod drive mechanism will not interfere with rod.motion or rod drop time, and that no degradation in these systems has occurred that would adversely affect rod motion or drop time. Any time the OPERABILITY of the control rods has been affected by a repair, maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. MILLSTONE -UNIT 3 B 3/4 1-3 Amendment No..-!-2., 60, .83, 4-4-, 4-5-7, 164, 4-9-7, LBDCR l2-MP3-010 September 20, 2012 REACTVTSCNRLSYTM BASES MOVABLE CONTROL ASSEMIBLIIES (Continued') Control rod positions and OPERABILITY of the rod position indicators are required to be verified at the frequency specified in the Surveillance Frequency Control Program with more frequent verifications required if an automatic monitoring channel is inoperable. These verification frequencies are adequate for assuring that the applicable LCOs are satisfied. The Digital Rod Position Indication (DRPI) System is defined as follows:* Rod position indication as displayed on DRPI display panel (MB4), or* Rod position indication as displayed by the Plant Process Computer System.With the above definition, LCO 3.1.3.2, "ACTION a." is no applicable with either DRPI display panel or the plant process computer points OPERABLE.The plant process computer may be utilized to satisfy DRIPI System requirements which meets LCO 3.1.3.2, in requiring diversity for determining digital rod position indication. Technical Specification SR 4.1.3.2.1 determines each digital rod position indicator to be OPERABLE by verifying the Demand Positioni Indication System and the DRPI System agree within 12 steps at the frequency specified in the Surveillance Frequency Control Program, except during the time when the rod position deviation monitor is inoperable, then compare the Demand Position Indication System and the DRIPI System at least once each 4 hours.The Rod Deviation Monitor is generated only from the DRIPI panel at M4I34. Therefore, when rod position indication as displayed by the plant process computer is the only available indication, then perform SURVEILLANCE REQUIREMENTS every 4 hours.MILLSTONE -UNIT 3 B 3/4 1-4 Amendment No. 6Q0 : LBDCR 12-MP3-010 September 20, 2012 REACTIVTY CONTROL SYSTEMS D BASES MOVABLE CONTROL ASSEMBLIES (Continued) Additional surveillance is required to ensure the plant process computer indications are in agreement with those displayed on the DRPI. This additional SURVEILLANCE REQUIREMENT is as follows: Each rod position indication as displayed by the plant process computer shall be determined to be OPERABLE by verifying the rod position indication as displayed on the DRPI display panel agrees with the rod position indication as displayed by the plant process computer at the frequency specified in the Surveillance Frequency Control Program.The rod position indication, as displayed by DRPI display panel (@AB4), is a non-QA system, calibrated on a refueling interval, and used to implement T/S 3.1.3.2. Because the plant process computer receives field data from the same source as the DRPI System (MB4), and is also calibrated on a refueling interval, it fully meets all requirements specified in T/S 3.1.3.2 for rod position. Additionally, the plant process computer provides the same type and level of accuracy as the DRPI System (MB4). The plant process computer does not provide any alarm or rod position i deviation monitoring as does DRPI display panel (MB4).For Specification 3.1.3.1 ACTIONS b. and c., it is incumbent upon the plant to verify the trippability of the inoperable control rod(s). Tripp ability is defined in Attachment C to a letter dated December 21, 1984, from E. P. Rahe (Westinghouse) to C. 0. Thomas (NRC). This may be by verification of a control system failure, usually electrical in nature, or that the failure is....as.sociated with the control rod stepping mechanism. In the event the plant is unable to verify the rod(s) trippability, it must be assumed to be untrippable andi-thus f~alls undr therequirements of-ACTION a. Assuming a controlled shutdoWn from 100% RATED THERMAL POWER, this allows approximately 4 hours for this verification. For LCO 3.1.3.6 the control bank insertion limits are specified in the CORE OPERATING LIMITS REPORT (COLR). These insertion limits are the initial assumptions in safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions, assumptions of available SHUTDOWN MARGIN, and initial reactivity insertion rate.The applicable I&C calibration procedure (Reference 1.) being current indicates the associated circuitry is OPERABLE.There are conditions when the Lo-Lo and Lo alarms of the RIu Monitor are limited below the RIL specified in the COLR. The RIL Monitor remains OPERABLE because the lead control rod bank still has the Lo and Lo-Lo alarms greater than or equal to the RIL.MILLSTONE -UNIT 3 B3415AedetN.6 B 3/4 1-5 Amendment No. 60 LBDCR 14-MP3-005 May 8, 2014 REACTIVITY CONTROL SYSTEMS BASES MOVABLE CONTROL ASSEMBLIES (Continued) When rods are at the top of the core, the Lo-Lo alarm is limited below the RIL to prevent spurious alarms. The RIL is equal to the Lo-Lo alarm until the adjustable upper limit setpoint on the RIL Monitor is reached, then the alarm remains at the adjustable upper limit setpoint. When the RIL is in the region above the adjustable upper limit setpoint, the Lo-Lo alarm is below the RIL.

References:

1. SP 3451N23, Rod Insertion Limits Calibration.

2. Letter NS-OPLS-OPL-1-91-226, (Westinghouse Letter NEU-91-563), dated April 24, 1991.3. Millstone Unit 3 Technical Requirements Manual, Appendix 8.1, "CORE OPERATING LIMITS REPORT".4. Westinghouse Letter NEU-07-62, "MPS3 -SPUP RCCA Drop Time," dated June 4, 2007.5. Westinghouse Letter 98NEU-G-0060, "Millstone Unit 3. -Robust Fuel Assembly (Design Report) and Generic SECL," dated October 2, 1998.MILLSTONE

-UNIT 3 B3416Amnmn o B 3/4 1-6 Amendment No. LBDCR No. 04~-MP3-0l5 February 24, 2005 3/4.2 POWER DISTRIBUTION LIMITS BASES The specifications of this section provide assurance of fuel integrity during Condition I (Normal Operation) and II (Incidents of Moderate Frequency) events by: (1) maintaining the minimum DNBR in the core greater than or equal to the design limit during normal operation and*in short-tenn transients, and (2) limiting the fission gas release, fuel pellet temperature, and cladding mechanical properties to within assumed design criteria. In addition, limiting the peak linear power density during Condition I events provides assurance that the initial conditions assumed for the LOCA analyses are met and the ECCS acceptance criteria limit of 2200°F is not exceeded.The definitions of certain hot channel and peaking factors as used in these specifications-are as follows: FQ(Z) Heat Flux Hot Channel Factor, is defined as the maximum local heat flux on thle surface of a fuel rod at core elevation Z divided by the average fuel rod heat flux, allowing for manufacturing tolerances on fuel pellets and rods;, and F NNuclear Enthalpy Rise. Hot Channel Factor, is defined as the ratio of the integral of AH linear power along the rod with the highest integrated power to the average rod power.3/4.2.1 AXIAL FLUX DIFFERENCE The limits on AXIAL FLUX DIFFERENCE (AFD) assure that the FQ(Z) up~per bound envelope of the FQ limit specified in. the CORE OPERATING LIMITS REPORT (COLR) times.the normalized axial peaking factor is not exceeded during either normal operation or in the event of xenon redistribution following power changes.Target flUX difference is determined at equilibrium xenon conditions. The full-length rods may be positioned within the core in accordance with their respective insertion limits and should be inserted near their normal position for steady-state operation at high power levels.' The val~ue of the target flux difference Obtained under these conditions divided by the fraction of RATED THERMAL POWER is the target flux difference at RATED THERMAL POWER for the.associated core burnup conditions. Target flux differences for other THERMAL POWER levels are obtained by multiplying the RATED THERMAL POWER value by the appropriate fractional THERMAL POWER level. The periodic updating of the target flux difference value is necessary to reflect core burnup considerations. MILLSTONE -UNIT 3 B 3/4 2-1 Amendment No. g0, 60, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015 Februaiy 24, 2005 POWER DISTRIBUTION LIMITS BASES AXIAL FLUX DIFFERENCE (Continued) At power lev'els below APLND, the limits on AFD are defined in the COLR consistent with thae Relaxed Axial Offset Control (RAOC) operating procedure and limits. These limits were calculated in a manner such that expected operational transients, e.g., load follow operations, would not result in the AFD deviating outside of those limits. However, in the event such a deviation occurs, the short period of time allowed outside of the limits at reduced power levels will not result in significant xenon redistribution such that the envelope of peaking factors would change sufficiently to prevent operation in the vicinity of the APLND power level.At power levels greater than APLNO, two modes of operation are permissible: (1) RAOC, the AFD limit of which are defined in the COLR, and (2) base load operation, which is defined as the maintenance of the AFD within COLR specifications band about a target value. The RAOC operating procedure above APLNO is the same as that defined for operation, below APLND.However, it is possible when following extended load following maneuvers that the AFD limits may result in restrictions in the maximum allowed power or AFD in order to guarantee operation with FQ(Z) less than its limiting value. To allow operation at. the maximum permissible power level, the base load operating procedure restricts the indicated AFD to relatively small target band (as specified in the COLR) and power swings (APLND < power < APLBL or 100% RATED THERMAL POWER, whichever is lower). For base load operation, it is expected that the plant will .operate within the target band. Operation outside of the target band for the short time period allowed will not result in significant xenon redistribution such that the envelope of peaking factors wotuld change sufficiently to prohibit cohatint~e&d operation iti the power tegiori defined above.. To assure there is no residual xenon redistribution impact from .past operation on the base load operation, a 24-hour waiting period at a power level above APLND and allowed by RAOC is necessary. During this time period load changes and rod motion are restricted to that allowed by the base load procedure. After the waiting period, extended base load operation is permissible. The computer determines the 1-minute average of each of the oPERABLE excore detector outputs and provides an alarm message immediately if the AFD for at least 2 of 4 or 2 of 3 OPERABLE excore channels are: (1) outside the allowed delta-I power operating space (for RAOC operation), or (2) outside the allowed delta-I target band (for base load operation). These.alarms are active when power is greater than (1) 50% of RATED THERMAL POWER (for RAOC operation), or MILLSTONE -UNIT 3 B 3/4 2-2 Amendment No. NO, 60, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 06-MP3-014 June 22, 2006 POWER DISTRIBUTION LIMITS BASES AXIAL FLUX DIFFERENCE (Continued) (2) APN (for base load operation). Penalty deviation minutes for base load operation are not accumulated based on the short period of time during which operation outside of the target band is allowed.3/4.2.2 AND 3/4.2.3 HEAT FLUX HOT CHANNrEL FACTOR AND RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR The limits on heat flux hot channel factor, RCS flow rate, and nuclear enthalpy rise hot channel factor ensure that: (1) the design limits on peak local power density and minimum.DNBR are not exceeded and (2) in the event of a LOCA the peak fuel clad temperature will not exceed the 2200°F ECCS acceptance criteria limit.Each of these is mieasurable but will normally only be determined periodically as specified in Specifications 4.2.2 and 4.2.3. This periodic sutrveillance is sufficienat to ensure that the limits are maintained provided: a. Control rods in a single group move together with no individual rod insertion differing by more than +/-12 steps, indicated, from the group demand position;b. Control rod groups are sequenced with overlapping groups as described in Specification 3.1.3.6;c. The control rod insertion limits of Specifications 3.1.3.5 and 3.1.3.6 are maintained; and d. The axial power distribution, expressed in terms of AXIAL FLUX DIFFERENCE, is maintained within the lhinits.FNAH will be maintained within its limits provided Conditions

a. through d. above are maintained.

The relaxation of FNAH as a function of THERMAL POWER allows changes in the radial power shape for all permissible rod insertion limits.The FNaH as calculated in Specification 3.2.3.1 is used in the various accident analyses where FNN_ influences parameters other than DNBR, e.g., peak clad temperature, and thus is the maximum "as measured" value allowed.The RCS total flow rate and FNAHt are specified in the CORE OPERATING LIMITS REPORT (COLR) to provide operating and analysis flexibility from cycle to cycle. However, the minimum RCS flow rate, that is based on 10% steam generator tube plugging, is retained in the Technical Specifications. MILLSTONE -UNIT 3 B 3/4 2-3 MILSTOE -UNI 3 3/2-3Amendment No. .5-, 60, _9-1--7-, LBDCR 12-MP3-010 September 20, 2012 POWER DISTRIBUTION LIMITS BASES 3/4.2.2 and 3/4.2.3 HEAT FLUX HOT CHANNEL FACTOR and RCS FLOW RATE AND NUCLEAR ENTHALPY RISE HOT CHANNEL FACTOR (Continued) Margin is maintained between the safety analysis limit DNBR and the design limit DNBR. This margin is more than sufficient to offset the effect of rod bow and any other DNB penalties that may occur. The remaining margin is available for plant design flexibility. When an FQ measurement is taken, an allowance for both experimental error and manufacturing tolerance mnust be made. An allowance of 5% is appropriate for a full core map taken with the incore detector flux mapping system and a 3% allowance is appropriate for manufacturing tolerance. The heat flux hot channel factor, FQ(Z), is measured periodically in accordance with the Surveillance Frequency Control Program using the incore detector system. These measurements are generally taken with the core at or near steady state conditions. Using the measured three dimensional power distributions, it is possible to derive F.QM~z),.a computed value Of FQ..(Z).However, because this value represents a steady state condition, it does not include the variations in the value Of FQ(Z) that are present during nonequilibrium situations. To account for these possible variations, the steady state limit of FQ(Z) is adjusted by an elevation dependent factor appropriate to either RAOC or base load operatio~n, W(~Z) or W(Z)BL, that accounts for the calculated worst case transient conditions. The W(Z) and W(Z)BL, factors described above for normal operation are specified in the COLR per Specification 6.9.1.6. Core monitoring and control under nonsteady state conditions are accomplished by operating the core within the limits of the appropriate LCOs, including the limits on AFD, QPTR, and control rod insertion. Evaluation of the steady state FQ(Z) limit is performed in Specification 4.2.2.1 .2.b and 4.2.2.1.4.b while evaluation nonequilibriumn limits are performed in Specification 4.2.2.1.2.c and 4.2.2.1 .4.c.When RCS flow rate and FNAH_ are measured, no additional allowances are necessary prior to comparison with the limits of the Limiting Condition for Operation. Measurement errors for RCS total flow rate and for have been taken into account in determination of the design DNBR value.The measurement error for RCS total flow rate is based upon performing a precision heat balance and using the result to calibrate the RCS flow rate indicators. To perform the precision heat balance, the instrumentation used for determination of steam pressure, feedwater pressure, feedwater temperature, and feedwater venturi AP in the calorimetric calculations shall be calibrated in accordance with the Surveillance Frequency Control Program. Potential fouling of.the feedwater venturi which might not be detected could bias the result fl'om the precision heat balance in a non-conservative manner. Any fouling which might bias the RCS flow rate measurement can be detected by monitoring and trending various plant perfonmance parameters. If detected, action shall be taken before performing subsequent precision heat balance measurements, i.e., either the effect of the fouling shall be quantified and compensated for in the RCS flow rate measurement or the venturi shall be cleaned to eliminate the fouling.MILLSTONE -UNIT 3 B 3/4 2-4 MILLTONE-UNT 3 3/42-4Amendment No. 2, 61), -!-7@,2-7 LBD CR 12-MP3-010 September 20, 2012 POWER DISTRIBUTION LIMITS BASES HEAT FLUX HOT CHANNhEL FACTOR and RCS FLOW RATE AND1T NUCLEAR ENTHAIPY RISE HOT CHAINNEL FACTOR (Continued) The periodic surveillance of indicated RCS flow in accordance with the Surveillance Frequency Control Program is sufficient to detect only flow degradation which could lead to operation outside the acceptable region of operation defined in Specifications 3.2.3.1.3/4.2.4 QUADRANT POWER TILT RATIO The QUADRANT POWER TILT RATIO limit assures that the radial power distribution satisfies the design values used in the power capability analysis. Radial power distribution measurements are made during STARTUP testing and periodically during POWER OPERATION. The limit of 1.02, at which corrective action is required, provides DNB and linear heat generation rate protection with x-y plane power tilts. A limiting tilt of 1.025 can be tolerated before the margin for uncertainty in FQ is depleted. A limit of 1.02 was selected to provide an allowance for the uncertainty associated with the indicated power tilt.The 2-hour" time allowance for operation with a tilt condition greater than 1.02 but less than 1.09 is provided to allow identification and correction of a dropped or misaligned control rod. In the event such action does riot conrect the tilt, the margin for uncertainty on FQ is reinstated by reducing the maximum allowed power by 3% for each percent of tilt in excess of 1.For purposes of monitoring QUADRANT POWER TILT RATIO when one excore detector is inoperable, the moveable incore detectors are used to confirm that the normalized symmetric power distribution is consistent with the QUADRANT POWER TILT RATIO. The incore detector monitoring is done with a full incore flux map or two sets of four symmetric thimbles. The two sets of four symmetric thimbles is a unique set of eight detector locations. These locations are C-8, E-5, E-11, H-3, H-13, L-5, L-11, N-8.3/4.2.5 DNB The limits on the DNB-related parameters assure that each of the parameters are mnaintained within the normal steady-state envelope of operatioii assumed in the transient and accident analyses. The limits are consistent with the initial FSAR assumptions and have been analytically demonstrated adequate to maintain a minimum DNBR greater than the design limit throughout each analyzed transient. The indicated Tavg values MILLS TON~E -UNIT 3 B 3/4 2-5 Amnendment No. 7-, .50, 60,1),!7-LBDCR 12-MP3-010 September 20, 2012 POWER DISTRIBUTION LIMITS BASES DNB PARAMETERS (Continued) and the indicated pressurizer pressure values are specified in the CORE OPERATING LIMITS REPORT. The calculated values of the DN-B related parameters will be an average of the indicated values for the OPERABLE channels.The periodic surveillance of these parameters through instrument readout in accordance with the Surveillance Frequency Control Program is sufficient to ensure that the parameters are restored within their limits following load changes and other expected transient operation. Measurement uncertainties have been accounted for in detennining the parameter linuits.MILLSTONE -UNIT 3 B 3/4 2-6 MILLSONE -UNIT3 B 342-6Amendment No. 4-!, 60, -- LBDCR 12-MIP3-010 September 20, 2012 3/4.3 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION AND ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION The OPERABILITY of the Reactor Trip System and the Engineered Safety Features Actuation System instrumentation and interlocks ensures that: (1) the associated action and/or Reactor trip will be initiated when the parameter monitored by each channel or combination thereof reaches its setpoint, (2) the specified coincidence logic is maintained, (3) sufficient redundancy is maintained to permit a channel to be out of service for testing or maintenance, and (4) sufficient system functional capability is available from diverse parameters. The OPERABILITY of these systems is required to provide the overall reliability, redundancy, and diversity assumed available in the facility design1 for the protection and mitigation of accident and transient conditions. The integrated operation of each of these systems is consistent with the assumptions used in the safety analyses. The Surveillance Requirements specified for these systems ensure that the overall system fimlctional capability is maintained comparable to the original design standards. The periodic surveillance tests performed are sufficient to demonstrate this capability. The surveillance frequency is controlled under the Surveillance Frequency Contr'ol Program.The Engineered Safety Features Actuation System Nominal Trip Setpoints specified in Table 3.3-4 are the nominal values of which the bistables are set for each functional unit. The Allowable Values (Nominal Trip Setpoints +/-- the calibration tolerance) are considered the Limiting Safety System Settings as identified in lOCFR5O.36 and have been selected to mitigate the consequences of accidents. A Setpoint is considered to be consistent with the nominal value when the measured "as left" Setpoint is within the administratively controlled (#) calibration tolerance identified in plant procedures (which specifies the difference between the Allowable Value and Nominal Trip Setpoint). Additionally, the Nominal Trip Setpoints may be adjusted in the conservative direction provided the calibration tolerance remains unchanged. Measurement and Test Equipment accuracy is administratively controlled by plant procedures and is included in the plant uncertainty calculations as defined in WCAP- 10991.OPERABILITY determinations are based on the use of Measurement and Test Equipment that confonns with the accuracy used in the plant uncertainty calculation. The Allowable Value specified in Table 3.3-4 defines the limit beyond which a channel is.inoperable. If the process rack bistable setting is measured within the "as left" calibration tolerance, which specifies the difference between the Allowable Value and Nominal Trip Setpoint, then the channel is considered to be OPERABLE.MILLSTONE -UNMT 3B3/31AmnetNo -9 B 3/43-1 Amendment No. 4-5-9 LBDCR 12-MP3-010 September 20, 2012 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINJEERED SAFETY FEATUIRES ACTUATION SYSTEM 1NSTRUMIENTATION (Continued). The methodology, as defined in WCAP-10991 ito derive the Nomhinal Trip Setpoints, is based upon combining all of the uncertainties in the channels. Inherent in the detennination of the Nominal Trip Setpoints are the magnitudes of these channel uncertainties. Sensors and other instrumentation utilized in these channes should be capable of operating within the allowances of these uncertainty magnitudes. Occasional drift in excess of the allowance may be determined to be acceptable based on the other device perfonnance characteristics. Device drift in excess of the allowance that is more than occasional, may be indicative of more serious problems and would warrant further investigation. The above Bases does not apply to the Control Building Inlet Ventilation radiation monitors ESF Table (Item 7E). For these radiation monitors the allowable values are essentially nominal values.Due to the uncertainties involved in radiological parameters, the methodologies of WCAP- 10991 were not applied. Actual trip setpoints will be reestablished below the allowable value based on calibration accuracies and good practices. The OPERABILITY requirements for Table 3.3-3, Functional Units 7.a, "Control Building Isolation, Manual Actuation," and 7.e, "Control Building Isolation, Control Building Inlet Ventilation Radiation," are defined by table notation "*". These functional units are required to be OPERABLE at all times during plant operation in MODES 1, 2, 3, and 4. These functional units are also required to be OPERABLE during movement of recently irradiated fuel assemblies, as -specified by table notation "*i". The Control Building Isolation Manual Actuation and Control Building.Inlet Ventilation Radiation are required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 350 hours*). Table notation "*" of Table 4.3-2 has the same applicability. The verification of response time provides assurance that the reactor iri and the engineered safety features actuation associated with each channel is completed within the tim~e limit assumed in the safety analysis. No credit is taken in the analysis for those channels with response times indicated as not applicable (i.e., N.A.). The surveillance frequency is controlled under the Surveillance Frequency Control Program.Required ACTION 4. of Table 3.3-1 is modified by a Note to indicate that nonnal plant control operations that individually add limited positive reactivity (e.g., temperature or b~oron fluctuations associated with RCS inventory management or temperature control) are not precluded by this ACTION provided they are accounted for in the calculated SDM. The proposed change pennits operations introducing positive reactivity additions but prohibits the temperature change or overall boron concentration from decreasing below that required to maintain the specified SDM or required boron concentration.

• During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.MILLSTONE

-UNIT 3 B 3/4 3:2 Amendment No. 3,-9-1, 4-!-9,14-7-, 4-7, 2-!9, -230 O March 17, 2004 INSTRUMENTATION BASES I': 3/4.3-1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION andl ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) Response time may be verified. by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic responsetimes with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g. vendor) test measurements, or (3) utilizing vendor engineering specifications. WCAP-13 632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor~response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test. Detector response times may be measured by the in-situ online noise analysis-response time degradation method described in the Westinghouse Topical Report, "The Use of Process Noise Measurements to Determine Response Characteristics of Protection Sensors in U.S. Plants," dated August 1983.WCAP- 14036, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification .of the protection system channel response time.O I The allocations for sensor, signal conditioning and actuation logic response times must be verified i! prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response._ time provided the parts used for repair are of the same. type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter. The Engineered Safety Features Actuation System senses selected plant parameters and determines whether or not predetermined limits are being exceeded. If they are, the signals are combined into logic matrices sensitive to. combinations indicative of various accidents, events, and transients. Once the required logic combination is completed, the system sends actuation signals to those Engineered Safety Features components whose aggregate function best serves the.requirements of the condition. As an example, the following actions may be initiated by the Engineered Safety Features Actuation System to mitigate the consequences of a steam line break or loss-of-coolant accident: (1) Safety Injection pumps start and automatic valves position, (2)Reactor trip, (3) feed-water isolation, (4) startup of the-emergency diesel generators, (5) quench spray pumps start and automatic valves .position, (6) containment isolation, (7) steam line isolation, (8) Turbine trip, (9) auxiliary feedwater pumps start, (10) Service water pumps start and automatic valves position, and (1 1) Control Room isolates.O MILLSTONE -UNIT 3 B 3/4 3-2a Amendment No. 3, 9-3-, 4-98, 219 LBDCR No. 0J4-MP3-015 February 24, 2005 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) For slave relays, or any auxiliary relays in: ESFAS circuits that are of the type Potter & Brumfield MVDR series relays, the SLAVE RELAY TEST is performed at an "R" frequency (at least once every 18 months) provided the relays meet the reliability assessment criteria presented in WCAP- 13 878, of Potter and Brumfield MDR series relays," and WCAP-13 900, "Extensiin of Slave Relay Surveillance Test Intervals." The reliability assessments performed as part of the aforementioned WCAPs are relay specific and apply only to Potter and B~rumfield MDR series relays. Note that for normally energized applications, the relays may have to be replaced periodically in accordance with the guidance given in WCAP-13 878 for MDR relays.REACTOR TRIP BREAKER This trip function applies to the reactor trip breakers (RTBs) exclusive of individual trip mechanisms. The LCO requires two OPERABLE trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single RTS logic train that are racked in, closed, and capable of supplying power to the control rod drive (CRD) system. Thus, the train may consist of the main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the system configuration. Two OPERABLE trains ensure no single random failure can disable the RTS trip capability. These trip f-unctions must be.OPE.R.AB3LE in MODE 1 .or 2 when the reactor is critical.. In MODE 3, 4, or 5, these RTS trip functions must be OPERABLE when the RTBs or associated bypass breakers are closed, and the CRD system is capable of rod withdrawal. BYPASSED CHANNEL* -. Technical Specifications 3.3.1 and 3.3.2 often allow the bypassing of instrument channels in the case of an inoperable instrument or for surveillance testing.A BYPASSED CHARNEL shall be a channel which is:* Required to be .in its accident or tripped condition, but is not presently in its accident or tripped condition using a method described below; or* Prevented from tripping.MILLSTONE -UNIT 3 B 3/4 3-2b Amendment No. 24-9, Acknowledged by NRC letter dated 08/25/05 March 17, 2004 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) A channel may be bypassed by:* Insertion of a simulated signal to the bistable; or* Failing the transmitter or input device to the bypassed condition; or* Returning a channel to service in a untripped condition; or* An equivalent method, as determined by Engineering and I&C*Bypass switches exist only for NIS source range, NIS intermediate range, and containment pressure Hi-3.TRIPPED CHANN'EL -Technical Specifications 3.3.1 and 3.3.2 often require the tripping.of instrument channels in the case of an inoperable instrument or for surveillance testing.A TRIPPED CHANNEL shall be a channel which is in its required accident or tripped condition. A channel may be placed in trip by:-The Bistable Trip Switches; or.. ....o Insertion of a simulated signal to the bistable; or* Failing the transmitter or input device to the tripped condition; or* An equivalent method, as determined by Engineering and I&C The Engineered Safety Features Actuation System interlocks perform the following functions: P-4 Reactor tripped -Actuates Turbine trip, closes main feedwater valves on Tav below Setpoint, prevents the opening of the main feedwater valves which were closed by a Safety Injection or High Steam Generator Water Level signal, allows Safety Injection block so that components can be reset or tripped.Reactor not tripped .- prevents manual block of Safety Injection. MILLSTONE -UNIT 3 B 3/4 3-3 MILLTONE-UNT 3 3/43-3Amendment No. 4-, 4-64, 219 LBDCR ¶ 0-MP3-003 February 23, 2010 INSTRUMENTATION BASES 3/4.3.1 and 3/4.3.2 REACTOR TRIP SYSTEM INSTRUMENTATION and ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION (Continued) P-Il On increasing pressurizer pressure, P-1l automatically reinstates Safety Injection actuation on low pressurizer pressure and low steam line pressure. On decreasing pressure, P-l1 allows the manual block of Safety Injection actuation on low pressurizer pressure and low steam line pressure.P-12 On increasing reactor coolant ioop temperature, P-12 automatically provides an arming signal to the Steam Dump System. On decreasing reactor coolant loop temperature, P-12 automatically removes the arming signal from the Steam Dump System.P-14 On increasing steam generator water level, P-14 automatically trips all feedwater isolation valves, main feed pumps and main turbine, and inhibits feedwater control valve modulation. P-19 Upon decreasing Reactor Coolant System pressure, permits the cold leg injection valves to automatically open upon receipt of a Safety Injection signal.314.3.3 MONITORING INSTRUMENTATION 3/4.3.3.1 RADIATION MONITORING FOR PLANT OPERATIONS The OPERABILITY of the radiation monitoring instrumentation for plant operations ensures.that: (1) the associated action will be initiated when the radiation level monitored by each channel or combination thereof reaches its Setpoint, (2) the specified coincidence logic is maintained, and (3) sufficient redundancy is maintained to permit a channel to be out-of-service for testing or maintenance. The radiation monitors for plant operations .senses radiation levels in selected plant systems and locations and determines whether or not predetermined limits are being exceeded. If they are, the signals are combined into logic matrices sensitive to combinations indicative of various accidents and abnormal conditions. Once the required logic combination is completed, the system sends actuation signals to initiate alarms.The Fuel Storage Pool Area Monitor is required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 350 hours*).*During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.MILLSTONE -UNIT 3 B 3/4 3-4 MILLTONE-UIT 3B 3/3-4Amendment No. 49-3, 2-1-9 LBDCR October 21, 2008 INSTRUMENTATION BASES 3/4.3.3.2 DELETED 3/4.3.3.3 DELETED 3/4.3.3.4 DELETED 3/4.3.3.5 REMOTE SHUTDOWN INSTRUMENTATION The OPERABILITY of the Remote Shutdown Instrumentation ensures that sufficient capability is available to permit safe shutdown of the facility from locations outside of the control room. This capability is required in the event control room habitability is lost and is consistent with General Design Criterion 19 of 10 CFR Part 50.Calibration of the Intermediate Range Neutron Amps channel from Table 4.3-6 applies to the signal that originates from the output of the isolation amplifier within the intermediate range neutron flux processor drawers in the control room and terminates at the displays within the Auxiliary Shutdown Panel.The OPERABILITY of the Remote Shutdown Instrumentation ensures that a fire will not.preclude achieving safe shutdown. The remote shutdown monitoring instrumentation, control, and power circuits and transfer switches necess.a~ryto eliminate effects of the fire and allow operation of instrumentation, control and power circuits required to achieve and maintain a safe-shutdown condition are independent of areas where a fire could damage systems normally used to shut down the reactor. This capability is consistent with General Design Criterion 3 and Appendix R to 10 CFR Part 50.3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION The OPERABILITY of the accident monitoring instrumentation ensures that sufficient information is available on selected plant parameters to monitor and assess these variables following an accident. The instrumentation included in this specification are those instruments provided to monitor key variables, designated as Category 1 instruments following the guidance for classification contained in Regulatory Guide 1.97, Revision 2, "Instrumentation for Light-Water-Cooled Nuclear Power Plants To Assess Plant and Environs Conditions During and Following an Accident." MILLSTONE -UNIT 3 B 3/4 3-5 MILLTON -JNIT3 B3/43-5Amendment No. 3, :76, g4, 2, 2-1-9, LBDCR No;.04.-MP3-015 February 24, 2005 INSTRUMENTATION BASES 3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued) ACTION Statement "a": The use of one main control board indicator and one computer point, total of two indicators per steam generator, meets the requirements for the total number of channels for Auxiliary Feedwater flow rate. The two channels used to satisfy this Technical Specification for each steam generator are as follows: Steam Instrument (M5 Instrument .(Computer),enerator S/G 1 FWA*FI51A1 (Orange) FWA -F33A3 (Purple)S/G 2 FWA*FI33B 1 (Purple) FWA -F51 B3 (Orange)I/G 3 FWA*FI33C1 (Purple) FWA -F51 C3 (Orange)S/0 4 FWA*FI51D1 (Orange) FWA -F33D3 (Purple)The SPDS computer point for auxiliary feedwater flow will be lost 30 minutes following an LOP when the power supply for the plant computer is lost. However, this design configuration -one continuous main control board indicator and one indication via the SPDS/plant computer, total of two per steam generator -was submitted[-o~ the-N!C via "Response to question 420.6" dated January 13, 1984, B 11002. NRC review and approval was obtained with the acceptance of MP3, SSER 4 Appendix L, "Conformance to Regulatory Guide 1.97," Revision 2. (dated November 1985).LCO 3.3.3.6, Table 3.3-10, Item (17), requires 2 OPERABLE reactor vessel water level (heated junction thermocouples -IHJTC) channels. An OPERABLE reactor vessel water level channel shall be defined as: 1. Four or more total sensors operating.

2. At least one of two operating sensors in the upper head.3. At least three of six operating sensors in the upper plenum.MILLSTONE

-UNIT 3 B 3/4 3-5a Amendment No. :3, :-6, 84, 4-42, 2-1-9, Acknowledged by NRC letter dated 08/25/05 LBDCR 05-MP3-028 November 30, 2005 INSTRUMENTATION BASES 3/4.3.3.6 ACCIDENT MONITORING INSTRUMENTATION (Continued) A channel is OPERABLE if four or more sensors, half or more in the upper head region and half or more in the upper plenum region, are OPERABLE.In the event more than four sensors in a Reactor Vessel Level channel are inoperable, repairs may only be possible during the next refueling outage. This is because the sensors are accessible only after the missile shield and reactor vessel head are removed. It is not feasible to repair a channel except during a refueling outage when the missile shield and reactor vessel head are removed to refuel the core. If only one channel is inoperable, it should be restored to OPERABLE status in a refueling outage as soon as reasonably possible. If both channels are inoperable, at least one channel shall be restored to OPERABLE status in the nearest refueling outage..... The Reactor Coolant System Subcooling Margin Monitor, Core Exit The.rmocouples, and Reactor Vessel Water Level instruments are processed by two separate trains of ICC (Inadequate Core Cooling) and HJTC (Heated Junction ThennoCouple) processors. The preferred indication for these parameters is the Safety Parameter Display System (SPDS) via the non-qualified PPC (Plant Process Computer) but qualified indication is provided in the instrument rack room. When.the PPC data links cease to transmit data, the processors must be reset in order to restore the flow of data to the PPC. During reset, the qualified indication in the instrument rack room is lost.These instruments are OPERABLE during this reset since the indication is only briefly interrupted while the processors reset and the indication is promptly restored. The sensors are not removed from service during this reset. The train should be considered inoperable only if the qualified indication fails to be restored following reset. Except for the non-qualified PPC display, the instruments operate as required.3/4.3.3.7 DELETED 3/4.3.3.8 DELETED 3/4.3.3.9 DELETED 3/4.3.3.10 DELETED 3/4.3.4 DELETED MILLSTONE -UN4IT 3 B 3/4 3-6 Amendment No. 4-8%, 9-3,-24-9, Acknowledged by NRC Letter dated 04/12/06 REVERSE OF PAGE B 3/4 3-6 INTENTIONALLY LEFT BLANK 0 LBDCR No. 04-MP3-015 February 24, 2005 INSTRUMENTATION .. BASES 3/4.3.5 SHUJTDOWN MARGIN MONITOR The Shutdown Margin Monitors provide an alarm that a Boron Dilution Event may be in progress. The minimum count rate of Specification 3/4.3.5 and the SHUTDOWN MARGIN requirements specified in the CORE OPERATING LIMITS REPORT for MODE 3, MODE 4 and MODE 5 ensure that at least 15 minutes are available for operator action from the time of the " Shutdown Margin Monitor alarm to total loss of SHUTDOWN MARGIN. By borating an additional 1:50 ppm above the SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT for MODE 3 or 350 ppm above the SHUTDOWN MARGIN specified in the CORE OPERATING LIMITS REPORT for MODE 4, MODE 5 With RCS loops filled, or MODE 5 with RCS loops not filled, lower values of minimum count rate are accepted.Shutdown Margin Monitors

Background:

The purpose of the Shutdown Margin Monitors (SMM) is-to annunciate an increase in core subcritical multiplication allowing the operator at least 15 minutes response time to mitigate the consequences of the inadvertent addition of unborated primary grade water (boron dilution event)into the Reactor Coolant System (RCS) when the reactor is shut down (MODES 3, 4, and 5).* The SMMs utilizes two channels of source range instrumentation (GM detectors). Each channel.provides a signal to its applicable train of SMM. The SMM channel uses the last 600 or more counts to calculate the count rate and updates the measurement after 30 new counts or 1* Second, whichever is longer. Each channel has 20 registers that hold the counts (20 registers X 30 count=600 counts) for averaging the rate. As the .cduiit rate decreasges, the ldiigei- it takes t6 fIl the registers (fill the 30 count minimum). As the instrume~n.t's measured count rate decreases, the delay time in thie instrument's response increases. This delay time leads to the requirement of a minimum count rate for OPERABILITY. During the dilution event, count rate will increase to. a level above the normal steady state count rate. When this new count rate level increases above, the. instrument's setpoint, .the channel will alarm alerting the operator of the event.Applicable Safety Analysis The SMM senses abnormal increases in the source range count per second and alarms the operator of an inadvertent dilution event. This alarm will occur at least 15 minutes prior to the reactor achieving criticality. This 15 minute window allows adequate operator response time to terminate the dilution, FSAR Section 15.4.6.LCO LCO 3.3.5 providesthe requirements for OPERABILITY -of the instrumentation of the SMMs that are used to mitigate the boron dilution event. Two trains are required to be OPERABLE to provide protection against single failure.* MILLSTONE -UN4IT 3 B 3/4 3-7 Amendment No. 64, 217T-, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015 February 24, 2005 BASES (continued) Applicability 9 The SMM must be OPERABLE in MODES 3, 4, and 5 because the safety analysis identifies this system as the primary means to alert the operator and mitigate the event. The SMMs are allowed*to be blocked during start up activities in MODE 3 in accordance with approved plant procedures. The alarm is blocked to allow the SMM channels to be used to monitor the 1/M approach to criticality. The SMM are not required to be OPERABLE in MODES 1 and 2 as other RPS is credited with accident mitigation, over temperature delta temperature and power range neutron flux high (low setpoint of 25 percent RTP) respectively. The SMMs are not required to be OPERABLE in MODE 6 as the dilution event is precluded by administrative controls over all dilution flow paths (Technical Specification 4.1.1.2.2). ACTIONS*Channel inoperability of the SMMs can be caused by failure of the channel's electronics, failure of the channel to pass its calibration procedure, or by the channel's count rate falling below the minimum count rate for OPERABILITY. This can occur when the count rate is so low that the ]channel's delay time is in excess of that assumed in the safety analysis. In any of the above conditions, the channel must be declared inoperable and the appropriate ACTION statement entered. If the SMMs are declared inoperable due to low count rates, an RCS heatup will cause the SMM channel count rate to increase to above the minimum count rate for OPERCABILITY. I Allowing the plant to increase modes will actually return the SMMs to OPERABLE status. Once the SMM channels are above the minimum count rate for OPERABILITY, the channels can~be declared OPERABLE and the LCO ACTION statements can be exited-.LCO 3.3.5, ACTION a. -With one train of SMM inoperable, ACTION a. requires the inoperable train to be returned to OPERABLE status within 48 hours. In this condition, the remaining SMM train is adequate to provide protection. If the above required ACTION cannot be met, alternate compensatory actions must be performed to provide adequate protection from the boron dilution.event. All operations involving positive reactivity changes associated with RCS dilutions and rod~withdrawal must be suspended, and all dilution flowpaths must be closed and secured in position (locked closed per Technical Specification 4.1.1.2.2) within the following 4 hours.LCO 3.3.5, ACTION b. -With both trains of SMM inoperable, alternate protection must be provided: 1. Positive reactivity operations via dilutions and rod withdrawal are suspended. The intent of this ACTION is to stop any planned dilutions of the RCS. The SMMs are not intended to monitor core reactivity during RCS temperature changes. The alarm setpoint is routinely reset during the plant heatup due to the increasing count rate. During cooldowns as the count rate, decreases, baseline count rates are continually lowered automatically by the SMMs. The Millstone Unit No. 3 boron dilution. analysis assumes.steady state RCS temperature conditions. MILLSTONE -UNIT 3 B 3/4 3-8 Amendment No. 4-164, Acknowledged by NRC letter dated 08/25/05 LBDCR 12-MP3-010 September 20, 2012 INSTRUMENTATION 3/4.3.5 SHUTDOWN MARGIN MONITOR BASES (continued) Required ACTION b. is modified by a Note which permits plant temperature changes provided the temperature change is accounted for in the calculated SDM. Introduction of temperature changes, including temperature increases when a positive MTC exists, must be evaluated to ensure they do not result in a loss of required SDM.2. All dilution flowpaths are isolated and placed under admninistrativye control (locked closed). This action provides redundant protection and defense in depth (safety overlap) to the SMMs. In1 this configuration, a boron dilution event (BDE) cannot occur. This is the basis for not having to analyze for BDE in MODE 6. Since the BDE cannot occur with the dilution flow paths isolated, the SMMs are not required to be OPERABLE as the event cannot occur and OPERABLE SMMs provide no benefit.3. Increase the SIIUTDOWN MARGIN surveillance frequency fi-om the frequency specified in the Surveillance Frequency Control Program to every 12 hours. This action in combination with the above, provide defense in depth and overlap to the loss of the SMMs.Surveillance Requirements The SMMs are subject to an ANALOG CHANNEL OPERATIONAL TEST to ensure each train of SMM is fully operational. This test shall include verification that the SMvfls are set per the CORE OPERATING LIMITS REPORT. The surveillance fr'equency is controlled under the Surveillance Frequency Control Program.MILLSTONE-UNIT3 B 3/4 3-9 MILLSONE -UMT B 31 3-9Amendmnent No. 4-64, 2. REVERSE OF PAGE B 314 3-9 INTENTIONALLY LEFT BLANK LBDCR No. 06-MP3-005 May 25, 2006 3/4.4 REACTOR COOLANT SYSTEM BASES 3/4.4.1 REACTOR COOLANT LOOPS AND COOLANT CIRCULATION The purpose of Specification 3.4.1.1 is to require adequate forced flow rate for core heat removal in MODES 1 and 2 during all normal operations and anticipated transients. Flow is represented by the number of reactor coolant pumps in operation for removal of heat by the steam generators. To meet safety analysis acceptance criteria for DNB, four reactor coolant pumps are required at rated power. An OPERABLE reactor coolant ioop consists of an OPERABLE reactor coolant pump in operation providing forced flow for heat transport and an OPERABLE steam generator. With less than the required reactor coolant loops in operation this specification requires that the plant be in at least HOT STANDBY within 6 hours.In MODE 3, three reactor coolant loops, and in MODE 4, two reactor coolant loops provide sufficient heat removal capability for removing core decay heat even in the event of a bank withdrawal accident; however, in MODE 3 a single reactor coolant loop provides sufficient heat removal capacity~if a bank withdrawal accident can be prevented, i.e., the Control Rod Drive System is not capable of rod withdrawal. In MODE 4, if a bank withdrawal accident can be prevented, a single reactor coolant loop or RHR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations require that at least two loops (any combination of RI-R or RCS) be OPERABLE.In MODE 5, with reactor coolant loops filled, a single RUR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations require that at least two RIIR loops or at least one RIHR loop and two steam generators be OPERABLE.In MODE 5 with reactor coolant loops not filled, a single RHR loop provides sufficient heat removal capability for removing decay heat; but single failure considerations, and the unavailability of the steam generators as a heat removing component, require that at least two RHR loops be OPERABLE.In MODE 5, during a planned heatup to MODE 4 with all RAIR loops removed from operation, an RCS loop, OPERABLE and in operation, meets the requirements of an OPERABLE and operating RI-R loop to circulate reactor coolant. During the heatup there is no requirement for heat removal capability so the OPERABLE and operating RCS loop meets all of the required functions for the heatup condition. Since failure of the RCS loop, which is OPERABLE and operating, could also cause the associated steam generator to be inoperable, the associated steam generator cannot be used as one of the steam generators used to meet the requirement of LCO 3.4.1l.4.1.b. MILLSTONE -UNIT 3 B 3/4 4-1 MILLTONE-UNT 3 3/44-1 Amendment No. 60, gO, 99, 4-5--5, -7, 2-t--7, LBDCR No. 04-MP3-015 February 24, 2005 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued) The operation of one reactor coolant pump (RCP) or one RH-R pump provides adequate flow to ensure mixing, prevent stratification and produce gradual reactivity changes during boron concentration reductions in the Reactor Coolant System. The reactivity change rate associated with boron reduction will, therefore, be within the capability of operator recognition and control.The restrictions on starting the first RCP in MODE 4 below the cold overpressure protection enable temperature (226°F), and in MODE 5 are provided to prevent RCS pressure transients. These transients, energy additions due to the differential temperature between the steam generator secondary side and the RCS, can result in pressure excursions which could challenge the PIT limits. The RCS will be protected against overpressure transients and will not exceed the reactor vessel isothermal beitline PIT limit by restricting RCP starts based on the differential water temperature between the secondary side of each steam generator and the RCS cold legs. The restrictions on starting the first RCP only apply to RCPs in RCS loops that are not isolated. The restoration of isolated RCS loops is normally accomplished with all RCPs secured.If an isolated RCS loop is to be restored when an RCP is operating,. the appropriate temperature differential limit between the secondary side of the isolated loop steam generator and the in service RCS cold legs is applicable, and shall be met prior to opening the loop isolation valves.The temperature differential limit between the secondary side of the steam generators and the RCS cold legs is based on the equipment providing cold overpressure protection as required by Technical Specification 3.4.9.3. If the pressurizer PORVs are providing cold overpressure protection, the steam generator secondary to RCS cold leg water temperature differential is limited to a maximum of 50°F. If any P1-R relief valve is providing cold overpressure protection and RCS cold leg temperature is above 150OT, the steam generator secondary water temperature must be at or below RCS cold leg water temperature. If any RHJR relief valve is providing cold overpressure protection and RCS cold leg temperature is at or below 150 0'F, the steam generator secondary to RCS cold leg water temperature differential is limited to a maximum of 50°F.Specification 3.4.1.5 The reactor coolant loops are equipped with loop stop valves that permit any loop to be isolated from the reactor vessel. One valve is installed on each hot leg and one on each cold leg.The loop stop valves are used to perform maintenance on an isolated loop. Operation in MODES 1-4 with a RCS loop stop valve closed is not permitted except for the mitigation of emergency or abnormal events. If a loop stop valve is closed for any reason, the required ACTIONS of this specification must be completed. To ensure that inadvertent closure of a loop stop valve does not occur, the valves must be open with power to the valve operators removed in MODES 1, 2, 3 and 4.MILLSTONE -UNIT 3 B 3/4 4-la Amendment No. 60, :7O, 9-9, .447, 4-9-7, 20-2,,2--7, j Acknowledged by NRC letter dated 08/25/05 W LBDCR 12-MP3-0i0 September 20, 2012 3/4.4 REACTOR COOLANT SYSTEM BASES The safety analyses performed for the reactor at power assume that all reactor coolant loops are initially in operation and the loop stop valves are open. This LCO places controls on the loop stop valves to ensure that the valves are not inadvertently closed in MODES 1, 2, 3 and 4.The inadvertent closure of a loop stop valve when the Reactor Coolant Pumps (RCPs) are operating will result in a partial loss of forced reactor coolant flow. If the reactor is at rated power at the time of the event, the effect of the partial loss of forced coolant flow is a rapid increase in the coolant temperature which could result in DNB with subsequent fuel damage if the reactor is not tripped by the Low Flow reactor trip. If the reactor is shutdown and a RCS loop is in operation removing decay heat, closure of the loop stop valve associated with the operating ioop could also result in increasing coolant temperature and the possibility of fuel damage.The loop stop valves have motor operators. If power is inadvertently restored to one or more loop stop valve operators, the potential exists for accidental closure of the affected loop stop valve(s) and the partial loss of forced reactor coolant flow. With power applied to a valve operator, only the interlocks prevent the valve from being operated. Although operating procedures and interlocks make the occurrence of this event unlikely, the prudent action is to remove power from the loop stop valve operators. The time period of 30 mninutes to remove power from the loop stop valve operators is sufficient considering the complexity of the task.Should a loop stop valve be closed in MODES 1 through 4, the affected valve must be maintained closed and the plant placed in MODE 5. Once in MODE 5, the isolated loop may be started in a controlled manner in accordance with LCO 3.4.1.6, "Reactor Coolant System Isolated Loop Star'tup." Opening the closed loop stop valve in MODES 1 tin'ough 4 could result in colder water or water at a loweriboron concentration being mixed with the operating RCS loops resulting in positive reactivity insertion. The time period provided in ACTION 3.4.1.5 .b allows time for borating the operating loops to a shutdown boration level such that the plant can be brought to MODE 3 within 6 hours and MODE 5 within 30 hours. The allowed ACTION times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.Surveillance Requirement 4.4.1.5 is perforned to ensure that the RCS loop stop valves are open, with power removed from the loop stop valve operators. The primamyr function of this Surveillance is to ensure that power is removed from the valve operators, since Surveillance Requirement 4.4.1.1 requires verification that all loops are operating and circulating reactor coolant, thereby ensuring that the loop stop valves are open. The frequency specified in the Surveillance Frequency Control Program ensures that the required flow is available. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 MILSTOE -UNI 3B 3/4 4-lb Amnendlnent No. 60, 7-0, 9-, 1-7,4-9-7-,-202,2-1 LBDCR No. 05-MVP3-026 October 19, 2005 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued) Specification 3.4.1.6 The requirement to maintain the isolated loop stop valves shut with power removed ensures that no reactivity addition to the core could occur due to the startup of an isolated loop.Verification of the boron concentration in an isolated loop prior to opening the first stop valve provides a reassurance of the adequacy of the boron concentration in the isolated loop.RCS Loops FilledINot Filled: In MODE 5, any RHR train with only one cold leg injection path is sufficient to provide adequate core cooling and prevent stratification of boron in the Reactor Coolant System.The definition of OPERABILITY states that the system or subsystem must be capable of performing its specified function(s). The reason for the operation of one reactor coolant pump (RCP) or .one RHR pump is to:* Provide sufficient decay heat removal capability

• Provide adequate flow to ensure mnixing to:* Prevent stratification
• Produce gradual reactivity changes due to boron concentration changes in the RCS The definition of "Reactor coolant loops filled" includes a ioop that is filled, swept, and vented, and capable of supporting natural circulation heat transfer.

This allows the non-operating RHR loop to be removed from service while filling and unisolating loops as long as steam generators on the OPERABLE reactor coolant loops are available to support decay heat removal.Any loop being unisolated is not OPERABLE until the ioop has been swept and vented. The process of sweep and vent will make the previously OPERABLE loops finoperable and the requirements of LCO 3.4.1.4.2, "Reactor Coolant System,.COLD SI{UTDOWN -Loops Not Filled," are applicable. When the RCS has been filled, swept and vented using an approved procedure, all unisolated loops may be declared OPERABLE.The definition of "Reactor coolant loops filled" also includes a ioop that has been vacuum [filled and capable of supporting natural circulation heat transfer. Any isolated loop that has been I vacuum filled is OPERABLE as soon as the loop is unisolated. One cold leg injection isolation valve on an RI-R train may be closed without considering the train to be inoperable, as long as the following conditions exist:* CCP temperature is at or below 95 0 F* Initial RUR temperature is below 1 84°F MILLSTONE -UNIT 3 B 3/4 4-ic Amendmnent No. ;2-4-7, Acknowledged by NRC Letter dated 04/12/06 LBDCR No._08-MP3-014 October 21, 2008 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued)

• The single RI-R cold leg injection flow path is no_! utilized until a minimum of 48 hours after reactor shutdown* CCP flow is at least 6,600 gpm* RHR flow is at least 2,000 gpm In the above system lineup, total flow to the core is decreased compared to the flow when two cold legs are in service. This is acceptable due to the substantial margin between the flow required for cooling and the flow available, even through a slightly restricted R.HR train.The review concerning boron stratification with the utilization of the single injection point line, indicates there will not be a significant change in the flow rate or distribution through the core, so there is not an increased concern due to stratification.

Flow velocity, which is high, is not a concern from a flow erosion or pipe loading standpoint. There are no loads imposed on the piping system which would exceed those experienced in a seismic event. The temperature of the fluid is low and is not significant from a flow erosion standpoint. The boron dilution accident analysis, for Millstone Unit 3 in MODE 5, assumes a full RHR System flow of approximately 4,000 gpm. Westinghouse analysis, Reference (1), for RHR flows down to 1,000 gpm, determined adequate mixing results. As the configuration will result in a R}IR flow rate only slightly less then 4,000 gpm:-here-is no concern in regards to a boron dilution accident.The basis for the requirement of two RCS loops OPERABLE is~to provide natural circulation heat sink in the event the operating RHR loop is lost. If the RI-R loop were lost, with two loops filled and two loops air bound, natural circulation would be established in the two filled loops.Natural circulation would not be established in the air bound loops. Since there would be no circulation in the air bound loops, there would be no mechanism for the air in those loops to be carried to the vessel, and subsequently into the filled loops rendering them inoperable for heat sink requirements. The LCO is met as long as at least two reactor coolant loops are OPERABLE and the following conditions are satisfied:

• One RI-R loop is OPERABLE and in operation, with exceptions as allowed in Technical Specifications; and MILLSTONE

-UNIT 3B3/4-dAemntN.2, B 3/4 4-1d Amendment No. g-t-7-, LBDCR. 04-MP3-001 December 10, 2003 3/4.4 REACTOR COOLANT SYSTEM BASES (Continued) Either of the following: o An additional RHR loop OPERABLE, with exceptions as allowed in Technical Specifications; or* The secondary side water level of at least two steam generators shall be greater than .17% (These are assumed to be on OPERABLE reactor coolant loops)When the reactor coolant loops are swept, the mechanism exists for air to be carried into previously OPERABLE loops. All previously OPERABLE loops are declared inoperable and an additional RIIR loop is required OPERABLE as specified by LCO 3.4.1.4.2 for loops not filled.When the RCS has been filled, swept, and vented using an approved procedure, all unisolated loops may be declared OPERABLE.ISOLATED LOOP STARTUP The below requirements are for unisolating a loop with all four loops isolated while decay heat is being removed by RIIR and to clarify, prerequisites to meet T/S requirements for unisolating a loop at any time.With no RCS loops operating, the two RHR loops referenced in Specification 3.4.1.4.2 are the operating loops. Starting in MODE 4 as referenced in Specification 3.4.1.3, the RHR loops are allowed to be used in place of an operating R CS loop:. Specification 3.4.1.4.2 requires two RH{R loops OPERABLE and at least one in operation. Ensuring the isolated cold leg temperature is within 20°F of the highest RHR outlet temperature for the operating RHR loops within 30 minutes prior to opening the cold leg stop valve is a conservative approach since the major concern is a positive reactivity addition.SR 4.4.1.6.1

When in MODE 5 with all RCS loops isolated, the two RH-R loops referenced in LCO 3.4.1.4.2 shall be considered the OPERABLE RCS loops. The isolated loop cold leg temperature shall be determined to be within 20°F of the highest RHR outlet temperature for the operating RHR loops within 30 minutes prior to opening the cold leg stop valve.Surveillance requirement 4.4.1.6.2 is met when the following actions occur within 2 hours prior to opening the cold leg or hot leg stop valve:* An RCS boron sample has been taken and analyzed to determine current boron concentration

• The SHUTDOWN MARGIN has been determined using OP 3209B, "Shutdown Margin" using the current boron concentration determined above MILLSTONE

-UNIT 3 B 3/4 4-1le Amendment No. 2-1-7, Acknowledged by NRC Letter dated 04/12/06 LBDCR 12-MiP3-010 September 20, 2012 3/4.4 REACTOR COOLANT SYSTEM BASES (continued)

• For the isolated loop being restored, the power to both loop stop valves has been restored Surveillance 4.4.1.6.2 indicates that the reactor shall be determined subcritical by at least the amount required by Specifications 3.1.1.1.2 or 3.1.1.2 for MODE 5 or Specification 3.9.1.1 for MODE 6 within 2 hours of opening the cold leg or hot leg stop valve.The SHUTDOWN MvARGIN requirement in Specification 3.1.1.1.2 is specified in the CORE OPERATING LIMITS REPORT for MODE 5 with RCS loops filled. Specification 3.1.1.1.2 cannot be used to determine the required SHUTDOWN MARGIN for MODE 5 loops isolated condition.

Specification 3.1.1.2 requires the SHUTDOWN MARGIN to be greater than or equal to the limits specified in the CORE OPERATING LIMITS REPORT for MODE 5 with RCS loops not filled provided CVCS is aligned to preclude boron dilution. This specification is for loops not filled and therefore is applicable to an all loops isolated condition. Specification 3.9.1.1 requires Keff of 0.95 or less, or a boron concentration of greater than or equal to the limit specified in the COLR in MODE 6.Specification 3.1.1.1.2 or 3.1.1.2 for MODE 5, both require boron concentration to be detennined at the frequency specified in the Surveillance Frequency Control Program.SR 4.1.1.1.2.1 .b.2 and 4.1.1 .2.1.b.1 satisfy the requirements of Specifications 3.1.1.1.2 and 3.1.1.2 respectfully. Specification 3.9.1.1 for MODE 6 requires boron concentration to be determined at the frequency specified in the Surveillance Frequency Control Program. S.R. 4.9..1.1.2 satisfy the requirements of Specification 3.9.1.1.Per Specifications 3.4.1.2, ACTION c.; 3.4.1.3, ACTION c.; 3.4.1.4.1, ACTION b.; and 3.4.1.4.2, ACTION b., suspending the introductiorn of coolant into the RCS of coolant with boron concentr~iion less than required to meet the minimum SDM of LCO 3.1.1.1.2 is required to assure continued safe operation. With coolant added without forced circulation, unmrixed coolant could be introduced to the core, however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations.

References:

1. Letter NEU-94-623, dated July 13, 1994; Mixing Evaluation for Boron Dilution Accident in Modes 4 and 5, Westinghouse HR-5 9782.2. Memo No. MP3-E-93-821, dated October 7, 1993.MILLSTONE

-UNIT 3 B 3/4 4-1f MILSTOE -UNT 3B 34 4ifAmendment No. 2-3g. REVERSE OF PAGE B 3/4 4-if INTENTIONALLY LEFT BLANK LBDCR No. 07-MP3-009 June 19, 2007 REACTOR COOLANT SYSTEM BASES 314.4.2 SAFETY VALVES The pressurizer Code safety valves operate to prevent the RCS from being pressurized above its Safety Limit of 2750 psia. Each safety valve is designed to relieve 420,000 lbs per hour of saturated steam at the valve Setpoint. The relief capacity of a single safety valve is adequate to relieve any overpressure condition which could occur during shutdown. If any pressurizer Code safety valve is inoperable, and cannot be restored to OPERABLE status, the ACTION statement requires the plant to be shut down and cooled down such that Technical Specification 3.4.9.3 will become applicable and require cold overpressure protection to be placed in service.During operation, all pressurizer Code safety valves must be OPERABLE to prevent the RCS firom being pressurized above its Safety Limit of 2750 psia. The combined relief capacity of all of these valves is greater than the maximaum surge rate resulting from a complete loss-of-load assuming no Reactor trip until the first Reactor Trip System Trip Setpoint is reached (i.e., no credit is taken for a direct Reactor trip on the loss-of-load) and also assuming no operation of the power-operated relief valves or steam dump valves.Demonstration of the safety valves' lift settings will occur only during shutdown and will be performed in accordance with the provisions of the ASME Code for Operation and Maintenance of Nuclear Power Plants.3/4.4.3 PRESSURIZER Th~e pressurizer provides a point in the RCS when liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primatyr system pressure during steady state operation and limiting the pressure changes caused by reactor. coolant thermal expansion and contraction during load transients. MODES 1 AND 2 The requirement for the pressurizer to be OPERABLE, with pressurizer level maintained at pro granmmed level within 4- 6% of full scale is consistent with the accident analysis in Chapter 15 of the FSAR. The accident analysis assumes that pressurizer level is being maintained at the programmed level by the automatic control system, and when in manual control, similar limits are established. The progralmmed level ensures the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpres sure and pressurizer overfill transients. A pressurizer level control error based upon automatic level control has been taken into account for those transients where pressurizer overfill is a concern (e.g., loss of feedwater, feedwater line break, and inadvertent ECCS actuation at power). When in manual control, the goal is to maintain pressurizer level at the program level value. The +/-- 6% of full scale acceptance criterion in the Technical Specification establishes a band for operation to accommnodate variations between level measurements. This value is bounded by the margin applied to the pressurizer overfill events.MILLSTONE -UNIT 3 B 3/4 4-2 MILLTON -NIT3 B3/44-2Amendment No. -!-60, 4-9-7-, LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.3 PRESSURIZER ('continued) The periodic surveillances require that pressurizer level be maintained at programmed level within =k 6% of full scale. The surveillance is performed by observing the indicated level.The surveillance frequency is controlled under the Surveillance Frequency Control Program.During transitory conditions, i.e., power changes, the operators will maintain progralmmed level, and deviations greater than 6% will be corrected within 2 hours. Two hours has been selected for pressurizer level restoration after a transient to avoid an unnecessary downpower with pressurizer level outside the operating brand. Nonnally, alarms are also available for early detection of abnormal level indications. Electrical itmmersion heaters, located in the lower section of the pressurizer vessel, keep the water in the pressurizer at saturation temperature and maintain a constant operating pressure.A minimumn required available capacity of pressurizer heaters ensures that the RCS pressure can be maintained. The capability to maintain and control system pressure is important for maintaining subcooled conditions in the RCS and ensuring the capability to remove core decay heat by either forced or natural circulation of the reactor coolant. Unless adequate heater capacity is available, the hot high-pressure condition cannot be maintained indefinitely and still provide the required subcooling margin in the primary system. Inability to control the system pressure and maintain subcooling under conditions of natural circulation flow in the primary system could lead to a loss of single-phase natural circulation and decreased capability to remove core decay heat.The LCO requires 'two groups of OPERABLE pressurizer heaters, each with a capacity of at least 175 kW. The heaters are capable of being powered from either the offsite power source or the emergency power supply. The minimum heater capacity required is sufficient to maintain the RCS near normal operating pressure when accounting for heat losses thraough the pressurizer insulation. By maintaining the pressure near" the operating conditions, a wide margin to subcooling can be obtained in the loops. The requirement for two groups of pressurizer heaters, each having a capacity of 175 kW, is met by verifying the capacity of the pressurizer heater groups A and B. Since the pressurizer heater groups A and B are supplied from the emergency 480V electrical buses, there is reasonable assurance that these heaters can be energized during a loss of offsite power to maintain natural circulation at HOT STANhDBY. Providing an emergency (Class 1EB) power source for the required pressurizer heaters meets the requirement of NUREG-0737, "A Clarification of TMI Action Plan Requirements," II.E.3.1, "Emergency Power Requirements for Pressurizer Heaters." If one required group of pressurizer heaters is inoperable, restoration is required within 72 hours. The Completion Time of 72 hours is reasonable considering that a demand caused by loss of offsite power would be unlikely in this time period. Pressure control may be maintained during this time using normal station powered heaters.MODE 3 The requirement for the pressurizer to be OPERABLE, with a level less than or equal to 89%, ensures that a steam bubble exists. The 89% level preserves the steam space for pressure control. The 89% level has been established to ensure the capability to establish and maintain pressure control for MODE 3 and to ensure a bubble is present in the pressurizer. Initial pressurizer level is not significant for those events analyzed for MODE 3 in Chapter 15 of the FSAR.MILLSTONE -UNIT 3 B 3/4 4-2a MILLTON -NIT B /4 -2aAmendment No. 60, !-0 LBDCR 12-MP3-010 September 20, 2012.REACTOR COOLANT SYSTEM O BASES 3/4.4.3 PRESSURIZER (cont'd.)The periodic surveillance requires that during MODE 3 operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The surveillance is performed by observing the indicated level. The surveillance frequency is controlled under the Surveillance Frequency Control Program. Alarms are also available for early detection of abnormal level indications. The basis for the pressurizer heater requirements is identical to MODES 1 and 2.3/4.4.4 RELIEF VALVES The power-operated relief valves (PORVs) and steam bubble function to relieve RCS pressure during all design transients up to and including the design step load decrease with steam dump. Operation of the PORVs minimizes the undesirable opening of the spring-loaded pressurizer Code safety valves. Each PORV has a remotely operated block valve to provide a positive shutoff capability should a relief valve become inoperable. Requiring the PORVs to be OPERABLE ensures that the capability for depressurization during safety grade cold shutdown is met.ACTION statements a, b, and c distinguishes the inoperability of the power operated relief valves! (ORV). Specifically, a PORV mybe designated inoperable but it mybe able to automatically

• and manually open and close and therefore, able to perform its function.

PORV inoperability may be due to seat leakage which does not prevent automatic or manual use and does not create the possibility for a small-break LOCA. For these reasons, the block valve may be closed but the action requires power to be maintained to the valve. This allows quick access to the PORV for pressure control. On the other hand if a PORV is inoperable and not capable of being automatically and manually cycled, it must be either restored or isolated by closing the associated block valve and removing power.Note: PORV position indication does not affect the ability of the PORV to perform any of its safety functions. Therefore, the failure of PORV position indication does not cause the PORV to be inoperable. However, failed position indication of these valves must be restored "as soon as practicable" as required by Technical Specification 6.8.4.e.3. Automatic operation of the PORVs is created to allow more time for operators to terminate an Inadvertent ECCS Actuation at Power. The PORVs and associated piping have been demonstrated to be qualified for water relief. Operation of the PORVs will prevent water relief fr'om the pressurizer safety valves for which qualification for water relief has not been demonstrated. If the PORVs are capable of automatic operation but have been declared inoperable, closure of the PORV block valve is acceptable since the Emergency Operating Procedures provide guidance to assure that the PORVs would be available to mitigate the event. OPERABILITY and setpoint controls for the safety grade PORV opening logic are maintained in the Technical Requirements Manual..MILLSTONE -UNIT 3 B 3/4 4-2b Amendment No. 4-10, 4-4-1 LBDCR No. 14-MP3-014 September 18, 2014 REACTRCOLNESSE 0 BASES RELIEF VALVES (Continued) The prime importan~ce for the capability to close the block valve is to isolate a stuck-open FORM.Therefore, if the block valve(s) cannot be restored to OPERABLE status within 1 hour, the remedial action is to place the PORV in manual control (i.e., the control switch in the "CLOSE" position) to preclude its automatic opening for an overpressure event and to avoid the potential of a stuck-open PORV at a time that the block valve is inoperable. The time allowed to restore the block valve(s) to OPERABLE status is based upon. the remedial action time limits for inoperable PORV per ACTION requirements

b. and c. ACTION statement

d. does not specify closure of the block valves because such action would not likely be possible when the block valve is inoperable.

For the same reasons, reference is not made to ACTION statements

b. and c. for the required remedial actions.SURVEILLANCE REQUIREMENT 4.4.4.2 verifies that a block valve(s) can be opened or closed if necessary.

This SURVEILLANCE REQUIREMENT is not required to be perform~ed with the block valve(s) closed in accordance with the ACTIONS of TS 3.4.4. Opening the block valve(s) in this condition increases the risk of an unisolable leak from the RCS since the PORV(s)is already inoperable. MILLSTONE -UNIT 3 B 3/4 4-2c Amendment No. gg, 4-10, 61-, Acknowledged by NRC letter dated 08/28/15 LBDCR No. 12-MP3-007 June 26, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY LCO The LCO requires that steam generator (SG) tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the plugging criteria be plugged in accordance with the Steam Generator Program.During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging. If a tube was determined to satisfy the plugging criteria but was not plugged, the tube may still have tube integrity. In the context of this Specification, a SG tube is defined as the entire length of the tube, including the tube wall between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 6.8.4.g, "Steam Generator Program," and describe acceptable SG tube performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to meet the LCO.The structural integrity performance criterion provides a margin of safety against tube burst or collapse under normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Ttibe burst is defined as, "The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation." Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero." The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established." For tube integrity evaluations, except for circumferential degradation, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis. The division between primary and secondary classifications will be based on detailed analysis and/or testing.MILLSTONE -UNIT 3B3/4-AmnetNo B 3/4 4-3 Amendment No. LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES.° 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued)

• Structural integrity requires that the primary membrane stress intensity in a tube not exceed the* yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included in the design specification.

This includes safety factors and applicable design basis loads based on ASMIE Code, Section III,* Subsection NB (Ref. 4).and Draft Regulatory Guide 1.121 (Reference 5).The accident induced leakage performance criterion ensures that the primary to secondary.....LE-AKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The accident analysis assumes that accident induced leakage does not exceed 1* gallon per minute or is assumed to increase to 1 gallon per minute for all steam generators. The: accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the ,.-. accident in addition to primary to secondary LEAKAGE induced during the accident..The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in RCS LCO 3.4.6.2, "Operational Leakage," and limits primary to secondary LEAKAGE through any one SG* .to 150 gallons per day. This limit is based on the assumption that a single crack leaking this* amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, r .. and the above assumption is conservative.

• APPLICABILITY Steam generator tube integrity is challenged when the pressure differential across the tubes is* large. Large differential pressures across SG tubes can only be experienced during MODES 1, 2, 3, and 4.* .. RCS conditions are far less challenging during MODES 5 and 6 than during MODES 1, 2, 3, and" 4. During MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.ACTIONS The ACTIONS are modified by a NOTE clarifying that the Conditions may be entered* ...independently for each SG tube. This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube. Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.MILLSTONE -UNIT 3 B3443 mnmno B 3/4 4-3a Amendment No.

LBDCR No. 12-MiP3-007 June 26, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued') a.1 and a.2 ACTION a. applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube plugging criteria but were not plugged in accordance with the Steam Generator Program as required by SR 4.4.5.2. An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG plugging criteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling outage or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, ACTION b. applies.A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity. If the evaluation determines that the affected tube(s) have tube integrity, Required ACTION a.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tube(s). However, the affected tube(s) must be plugged prior to entering MODE 4 following the next refueling outage or SG inspection. This Completion Time is acceptable since operation until the next inspection is supported by the operational assessment.

b. I and b.2 If the ACTIONS and associated Completion Times of ACTION a. are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.MILLSTONE

-UNIT 3 B3443 mnmn o B 3/4 4-3b Amendment No. LBDCR No. 12-MiP3-007 Iune 26, 2012 REACTOR COOLANT SYSTEM 'BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued~) SURVEILLANCE REQUIREMENTS TS 4.4.5.1 During shutdown periods the SGs are inspected as required by this SR and the Steam Generator" Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices. During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring assessment determines the "as found" condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube plugging criteria. Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation. Inspection methods are a function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations. The Steam Generator Program defines the Frequency of TS 4.4.5.1. The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Reference 6).The Steam Generator Program uses information on existing degradations and gr'owth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 6.8.4.g contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections. If crack indications are found in any SG tube, the maximum inspection interval for all affected and potentially affected SGs is restricted by Specification 6.8.4.g until subsequent inspections support extending the inspection interval.TS 4.4.5.2 During a SG inspection, any inspected tube that satisfies the Steam Generator Program plugging criteria is removed from service by plugging. The tube plugging criteria delineated in Specification 6.8.4.g are intended to ensure that tubes accepted for continued service satisfy the S G performance criteria with allowance for error~ in the flaw size measurement and for future flaw growth. In addition, the tube plugging criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s). Reference 1 provides guidance for performing operational MILLSTONE -UNIT 3 B/43 mnmn o B 3/4 4-3c Amendment No. LBDCR No. 12-MIP3-007 June 26, 2012 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued~) assessments to verify, that the tubes remaining in service will continue to meet the SG performance criteria.The Frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the plugging criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential. BACKGROUND SG tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers. The SG tubes have a number of important safety functions. Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary system s pressure and inventory. The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.1.1, "STARTUP and POWER OPERATION," LCO 3.4.1.2, "HOT STANDBY," LCO 3.4.1.3, "HOT SI{UTDOWN," and LCO 3.4.1.4.1, "COLD SI{UTDOWN -Loops Filled." SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements. SG tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradation related to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively. The SG performance criteria are used to manage SG tube degradation. Specification 6.8.4.g., "Steam Generator (SG) Program," requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 6.8.4.g., tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 6.8.4.g. Meeting the SO performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions. The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Reference 1).MILLSTONE -UNIT 3 B3443 mnmno B 3/4 4-3d Amendment No. LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.5 STEAM GENERATOR TUBE INTEGRITY (Continued) APPLICABLE SAFETY ANALYSES The steam generator tube rupture (SGTR) accident is the limiting design basis event for SG tubes and avoiding an SGTR is the basis for this Specification. The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate greater than the operational LEAKAGE rate limits in RCS LCO 3.4.6.2, "Operational LEAKAGE," plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumes the contaminated secondary fluid is released to the atmosphere via safety valves or atmospheric dump valves.The analysis for design basis accidents and transients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture.) In these analyses, the steam discharge to the atmosphere is based on the total primary to secondary LEAKAGE from all S~s of 1 gallon per minute or is assumed to increase to 1 gallon per minute as a result of accident induced conditions. For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUIVALENT 1-131 is assumed to be equal to the RCS LCO 3.4.8, "Specific Activity" limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are within the limits of GDC 19 (Reference 2), 10 CER 50.67 (Reference

3) or the N-RC approved licensing basis (e.g., a small fraction of these limits).Steam Generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

REFERENCES

1. NEJ 97-06, "Steam Generator Program Guidelines." 2. 10 CFR 50 Appendix A, GDC 19.3. 10OCFR 50.67.4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.*5. Draft Regulatory Guide 1.12 1, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.6. EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines." MILLSTONE

-UNIT 3B3/43eAenmtNo B 3/4 4-3e Amendment No. LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BAsEs 3/4.4.6 REACTOR COOLANT SYSTEM LEAKAGE 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS The RCS Leakage Detection Systems required by this specification are provided to monitor and detect leakage from the reactor coolant pressure boundary. These Detection Systems are consistent with the recommendations of Regulatory Guide 1.45, "Reactor Coolant Pressure Boundary Leakage Detection Systems," May 1973.ACTION c-provides a 72 hour allowed outage time (AOT) when both the containment atmosphere particulate radioactivity monitor and the containment drain sump monitoring system, are inoperable. The 72 hour AOT is appropriate since additional actions will be taken during this limited time period to ensure RCS leakage, in excess of the UNIDENTIFIED LEAKAGE TS limit of 1 gpm (TS 3.4.6.2), will be readily detectable. This will provide reasonable assurance that any significant reactor coolant pressure boundary degradation is detected soon after occurrence to minimize the potential for propagation to a gross failure. This is consistent with the requirements of General Design Criteria (GDC) 30 and also Criterion 1 of 10 CFR 50.3 6(d)(2)(ii) which requires installed instrumentation to detect, and indicate in the control roo~m, a significant abnormal degradation of the. reactor coolant pressure boundary. The RCS water inventory balance calculation determines the magnitude of RCS UNIDENTIFIED LEAKAGE by use of instrumentation readily available to the control room operators. However, the proposed additional actions will not restore the continuous monitoring capability normally provided by the inoperable equipment. The RCS water inventory balance is capable of identifying a one gpm RCS leak rate. The containment grab samples will also indicate an increase in RCS leak rate which would then be quantified by the RCS water inventory balance. Since these additional actions are sufficient to ensure RCS LEAKAGE is withi~n TS limits, it is appropriate to provide a limited time period to.restore at least one of the TS-required LEAKAGE monitoring systems.LCO 3.4.6.1 .b. Containment Sump Drain Monitoring System The intent of LCO 3.4.6.1.b is to have a system able to monitor and detect leakage from the reactor coolant pressure boundary (RCPB). Any of the following three methods may be used to meet LCO 3.4.6.l.b: A. 3DAS-P1O, Unidentified Leakage Sump Pump, and associated local and main board annunciation. B. 3DAS-P 10, Unidentified Leakage Sump Pump, and computer point 3DAS-L39 and CVLKR2.C. 3DAS-P2A or 3DAS-P2B, Containment Drains Sump Pump, and computer points.3DAS-L22 and CVLKR2 or CVLKjR3I.To meet Regulatory Guide 1.45 recommendations, the Containment Drain Sump Monitoring System must meet the following five criteria: 1. Must monitor changes in sump water level, changes in flow rate or changes in the operating frequency of pumps.2. Be able to detect an UNIDENTIFIED LEAKAGE rate of 1 gpm in less than one hour.MILLSTONE -UNIT 3B3/44AmnetNo B 3/4 4-4 Amendment No. LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued)

3. Remain OPERABLE following an Operating Basis Earthquake (OBE).4. Provide indication and alarm in the Control Room.5. Procedures for converting various indications to a common leakage equivalent must be available to the Operators.

The three Containment Drain Sump Monitoring Systems identified above meet these five requirements as follows: A. 3DAS-PiO. Unidentified Leakage Sump Pump. and associated main board annunciation.

1. Sump level is monitored at two locations by the starting-and stopping of 3DAS-P 10, Unidentified Leakage Sump Pump. Flow is measured as a function of time between pump starts/stops and the known sunap levels at which these Occur.2. Two timer relays in the control circuitry of 3DAS-P 1O are set to identify a 1 .gpm leak rate within 1 hour.3. This monitoring, system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will. be taken. This position has been reviewed by the NRC and documented as acceptable in the Safety Evaluation Report.4. If the control circuitry of 3DAS-P10 identifies a 1 gpm leak rate within 1 hour, Liquid Radwaste Panel Annunciator LWS :4-5, CTMT UJNIDENT LEAKAGE TROUBLE, and Main Board Annunciator MB1 B 4-3, RAD LIQUID WASTE SYS TROUBLE, will alarm. These control circuits and alarms operate independently from the plant process computer.If the computer is inoperable, these control circuits and alarms meet the Technical Specification requirements for the Containment Drain Sump Monitoring System.5. To convert the unidentified leakage sump pump run times to a leakage rate, use the following formula: (3DAS-P1O run times in minutes -[number of 3DAS-P10 starts x.5 minutes])

x 20 gpm' Elapsed monitored Time in minutes B. 3DAS-P 10. Unidentified Leakage Sump Pump. and computer points 3DAS-L39 and CVLKR2.1. Sump level is monitored by 3DAS-LI39, the Unidentified Leakage Sump Level indicator. This level indicator provides an input to computer point 3DAS-L39.MILLSTONE -UNIT 3 B/44 mnmn o B 3/4 4-4a Amendment No. LBDCR No. 1 1-MP3-004 March 22, 2011 REACTOR COOLANT SYSTEM BASES 3/4.4.6.1I LEAKAGE DETECTION SYSTEMS (Continued)

2. The plant process computer calculates a leakage rate every 30 seconds when 3DASP1O indicates stop. This leakage rate is displayed via computer point CVLKR2. When pump Pl10 does run, the leakage rate calculation is stopped and resumes 10 minutes after pump PlO stops. If it cannot provide a value of the leakage rate within any 54 minute interval, CVDASPIONC (UNDNT LKG RT NOT CALC) alarms which alerts the Operator that UNIDENTIFIED LEAKAGE cannot be determined.

3. This monitoring system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will be taken.4. A priority computer alarm (CVLKR2) is generated if the calculated leakage rate is greater than a value specified on the Priority Alarm Point Log. This alarm value should be set to alert the Operators to a possible RCS leak rate in excess of the Technical Specification maximum allowed UNIDENTIFIED LEAKAGE. The alarm value may be set at one gallon per minute or less above the rate of IDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems, into the unidentified leakage sump. The rate of IDENTIFIED LEAKAGE may be determined by either measurement or analysis.

If the Priority Alarm Point Log is adjusted,.the high leakage rate alarm will be bounded by the IDENTIFIED LEAKAGE rate and the low leakage rate alarm will be set to notify the operator that a decrease in leakage may require the high leakage rate alarm to be reset. The priority alarm setpoint shall be no greater than 2 gallons per minute. This ensures that the IDENTIFIED LEAKAGE will not mask a small increase in UNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit is also within the identified leakage sump level monitoring system alarm operating range which has a maximumn setpoint of 2.3 gallons per minute.To convert unidentified leakage sump level changes to leakage rate, use the following formula: Note: Wait 10 minutes after 3DAS-Pl10 stops before taking level readings.1.083 15 gallons X % change in level from 3DAS-L39 1% time between level readings in minutes C. 3DAS-P2A or 3DAS-P2B. Containment Drains Sump Pump, and computer points 3DAS-L22 and CVLKR2 or CVLKR3I.1. Sump level is monitored by 3DAS-L122, the Containment Drains Sump Level Indicator. This level indicator provides an input to computer point 3DAS-L22.This method can be used to monitor UNIDENTIFIED LEAKAGE when Pump Pl10 and its associated equipment is inoperable provided Pump Pl10 is out of service and 3DAS-L1 39 indicates that the unidentified leakage sump is overflowing to the containment drains sump (approximately 40% level on 3DAS-LI39). MILLSTONE -UNIT 3 B 3/4 4-4b Amendment No. LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.6.1 LEAKAGE DETECTION SYSTEMS (Continued) In this case, CVLKR2 and CVLKR3I monitor flow rate by comparing level indications on the containment drains sump when Pumps Pl10, P2A, P2B and P 1 are not running.2. The plant process computer calculates a leakage rate every 30 seconds when 3DAS-P 10, 3DAS-Pl1, 3DAS-P2A and 3DAS-P2B indicate stop. This leakage rate is displayed via computer points CVLKR3I and CVLKR2 when 3DAS-PI10 is off and when the unidentified leakage sump is overflowing to the containment drains sump. When one of these pumps does run, the leakage rate calculation is stopped and resumes 10 minutes after all pumps stop. If it cannot provide value of the leakage rate within any 54 minute interval, two computer point alarms (CVDASP2NC, UNDNT LKG RT NOT CALC and CVDASP2NC, SMP 3 LKG RT NT CALC) are generated which alerts the Operator that UNIDENTIFIED LEAKAGE cannot be determined.

3. This monitoring system is not seismic Category I, but is expected to remain OPERABLE during an OBE. If the monitoring system is not OPERABLE following a seismic event, the appropriate ACTION according to Technical Specifications will be taken.4. Two priority computer alarms (CVLKR2 and CVLKR3I) are generated if the calculated leakage rate is greater than a value specified on the Priority Alarm Point Log. This alarm value should be set to alert the Operators to a possible RCS leak rate in excess of the Technical Specification maximum allowed UNIDENTIFIED LEAKAGE. The alarm value may be set at one gallon per minute or less above the Wi :P rate of IDENTIFIED LEAKAGE, from the reactor coolant or auxiliary systems, into the containment drains sump. The rate of IDENTIFLED LEAKAGE may be determined by either, measurement or by analysis.

If the Priority Alarm Point Log is adjusted, the high leakage rate alarm will be bounded by the IDENTIFIED LEAKAGE rate and the low leakage rate alarm will be set to notify the operator that a decrease in leakage may require the high leakage, rate alarm to be reset. The priority alarm set-point shall be no greater than 2 gallons per minute. This ensures that the IDENTIFIED LEAKAGE will not mask a small increase in UNIDENTIFIED LEAKAGE that is of concern. The 2 gallons per minute limit is also within the contaimnent drains sump level monitoring system alann operating range which has a maximum setpoint of 2.5 gallons per minute.5. To convert containment drains sump run times to a leakage rate, refer to procedure SP3 670.1 for guidance on the conversion method.3/4.4.6.2 OPERATIONAL LEAKAGE LCO RCS operational LEAKAGE shall be limited to: a. PRESSURE BOUNDARY LEAKAGE No PRESSURE BOUNDARY LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further MILLSTONE -UNIT 3 B3444 mnmn o B 3/4 4-4c Amendment No. LBDCR No. 07-MP3-032 August 8, 2007 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) deterioration, resulting in higher LEAKAGE. Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE.b. UNIDENTIFIED LEAKAGE One gallon per minute (gpm) of UNIDENTIFIED LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.*c. Primary_ to Secondary. LEAKAGE through Any One Steam Generator (SG)The limit of 150 gallons per day per SG is based on the operational LEAKAGE performance criterion in NEl 97-06, Steam Generator Program Guidelines (Reference 4).The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, "The RCS operational primaryr to secondary LEAKAGE through any one SG shall be limited to 150 gallons per day." The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational LEAKAGE rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.d. IDENTIFIED LEAKAGE Up to 10 gpm of IDENTIFIED LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of UNIDENTIFIED LEAKAGE and is well within the capability of the RCS makeup system. IDENTIFIED LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include PRESSURE BOUNDARY LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (CONTROLLED LEAKAGE). Violation of this LCO could result in continued degradation of a component or system.e. CONTROLLED LEAKAGE The CONTROLLED LEAKAGE limitation restricts operation when the total flow supplied to the reactor coolant pump seals exceeds 40 gpm with the modulating valve in the supply line fully open at a nominal RCS pressure of 2250 psia. This limitation ensures that in the event ofa LOCA, the safety injection flow will not be less than assumed in the safety analyses.A limit of 40 gpm is placed on CONTROLLED LEAKAGE.f. RCS Pressure Isolation Valve LEAKAGE The specified allowable leakage from any RCS pressure isolation valve is sufficiently low to ensure early detection of possible in-series valve failure. It is apparent that when pressure isolation is provided by two in-series valves and when failure of one valve in the p~air can go undetected for a substantial length of time, verification of valve integrity is required. Since these valves are important in preventing overpressurization and rupture of the ECCS low pressure piping which could result in a LOCA, these valves should be tested periodically to ensure low probability of gross failure.MILLSTONE -UNIT 3B3/44dAemntN.2, B 3/4 4-4d Amendment No. g09, LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized. In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.LCO 3.4.6.2.f~, RCS Pressure Isolation Valve (PIV) Leakage, measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the. other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.ACTIONS b.,c.UNIDENTIFIED LEAKAGE, IDENTIFIED LEAKAGE or RCS pressure isolation valve LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify' UNIDENTIFIED LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.a. b. c.If any PRESSURE BOUNDARY LEAKAGE exists, or primary to secondary LEAKCAGE is not within limits, or if UNIDENTIFIED LEAKAGE, IDENTIFIED LEAKAGE, or RCS pressure isolation valve LEAKAGE cannot be reduced to within limits within 4 hours, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE. The reactor must be brought to HOT STANDBY within 6 hours and COLD SHUTDOWN within the following 30 hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In COLD SHUTDOWN, the pressure stresses acting on the reactor coolant pressure boundary are much lower, and further deterioration is much less likely.MILLSTONE -UNIT 3B3444eA ndntN.O, B 3/4 4-4e Amendment No. -2419, LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) SURVEILLANCE REOUIREMENTS 4.4.6.2.1 .c CONTROLLED LEAKAGE is determined under; a set of reference conditions, listed below: a. One Charging Pump in operation.

b. RCS pressure at 2250 +/- 20 psia.By limiting CONTROLLED LEAKAGE to 40 gpm during normal operation, it can be assured that during an SI with only one charging pump injecting, RCP seal injection flow will continue to remain less than 80 gpin as assumed in the accident analysis.

When the seal injection throttle valves are set with a normal charging lineup, the throttle valve position bounds conditions where higher charging header pressures could exist. Therefore, conditions which create higher charging header pressures such as an isolated charging line, or two pumps in service are bounded by the single puinp-nonnal system lineup surveillance configuration. Basic accident analysis assumptions are that 80 gpin flow is provided to the seals by a single pump in a runout condition. 4.4.6.2.1 .d Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the reactor coolant pressure is maintained. PRESSURE BOUNDARY LEAKAGE would at first appear as UNIDENTIFIED LEAKAGE and can only be positively identified by inspection. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE.UNIDENTIFIED LEAKAGE and IDENTIFIED LEAKAGE are determined by performance of an RCS water inventory balance.The RCS water inventory balance must be performed with the reactor at steady state operating conditions (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows). The Surveillance is modified by two Notes.Note 1 states that this SR is not required to be performed until 12 hours after establishing steady state operation. The 12 hour allowance provides sufficient thne to collect and process all necessary data after stable plant conditions are established. Steady state operation is required to perform a proper water inventory balance since calculations during maneuvering are not useful. For RCS operational LEAKAGE detennination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flOWS.MILLSTONE -UNIT 3B /4fAenetNo B 3/4 4-4f Amen&nent No. [ LBDCR 12-MP3-010 September 20, 2012 REACTOR. COOLANT SYSTEM l BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) An early warning of PRES SURE BOUNDARY LEAKAGE or UNIDENTIFIED LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. It should be noted that LEAKAGE past seals and gaskets is not PRESSURE BOUNDARY LEAKAGE. These leakage detection systems are specified in RCS LCO 3.4.6.1, "Leakage Detection Systems." Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 150 gallons per day caimot be measured accurately by an RCS water inventory balance.The surveillance frequency is controlled under the Surveillance Frequency Control Program.4.4.6.2.1 .e This SR verifies that primary to secondary¢ LEAKAGE is less than or equal to 150 gallons per day through any one SG. Satisfying the primary to secondary LEAKAGE limait ensures that the operational LEAKAGE performance criterion in the Steam Generator Progr'am is met. If this SR is not met, compliance with LCO 3.4.5, "Steam Generator Tube Integrity," should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference

5. The , operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If it is not practical assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.The Surveillance is modified by a Note which states that the surveillance is not required to be performed until 12 hours after establishment of steady state operation.

For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.The surveillance frequency is controlled under the Surveillance Frequency Control Program. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Reference 5).4.4.6.2.2 The Surveillance Requirements for RCS pressure isolation valves provide assurance of valve integrity thereby reducing the probability of gross valve failure and consequent intersystem LOCA.Leakage from the RCS pressure isolation valve is IDENTIFIED LEAKAGE and will be considered as a portion of the allowed limit.MILLSTONE -UNIT 3B3/4gAenetNo B 3/4 4-4g Amendment No. LBDCR No. 06-MP3--005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stable conditions for performance of Surveillance Requirement 4 .4 .6.2 .2 (including Surveillance Requirement 4.4.6.2.2.d) for RCS pressure isolation valves which can only be leak-tested at elevated RCS pressures. The requirements of Surveillance Requirement 4.4.6.2.2.d to verify that a pressure isolation valve is OPERABLE shall be performed within 24 hours after the required RCS pressures has been met.In MODES 1 and 2, the plant is at normal operating pressure and Surveillance Requirement 4.4.6.2.2.d shall be performed within 24 hours of valve actuation due to automatic or manual action or flow through the valve. In MODES 3 and 4, Surveillance Requirement 4.4.6.2.2.d shall*be performed within 24 hours of valve actuation due to automatic or manual actuation of flow through the valve if and when RCS pressure is sufficiently high for performance of this surveillance. BACKGROUND Components that contain or transport the coolant to or from the reactor core make up the reactor coolant system (RCS). Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCS "Operational LEAKAGE" LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.10 CFR 50, Appendix A, GDC 30 (Reference 1), requires means for detecting and, to the extent.practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Reference

2) describes acceptable methods for selecting leakage detection systems.The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration.

Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary. Quickly separating the IDENTIFIED LEAKAGE from the UNIDENTIFIED LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur detrimental to the safety of the facility and the public.A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS LEAKAGE detection. This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analysis radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).MILLSTONE -UNIT 3 B3444 mnmn o B 3/4 4-4h Amendment No. [ LBDCR No. 06-MP3-005 May 25, 2006 REACTOR COOLANT SYSTEM BASES 3/4.4.6.2 OPERATIONAL LEAKAGE (Continued) APPLICABLE SAFETY ANALYSES -OPERATIONAL LEAKAGE Except for primary to secondary LEAKAGE, the safety analyses do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA;the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes that primary to secondary LEAKAGE from all steam generators (SGs) is 1 gallon per minute or increases to 1 gallon per minute as a result of accident induced conditions. The LCO requirement to limit primary to secondary LEAKAGE through any one SG to less than or equal to 150 gallons per day is significantly less than the conditions assumed in the safety analysis.Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a main steam line break (MSLB). To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR)accident. The leakage contaminates the secondary fluid.The ESAR (Reference

3) analysis for SGTR assumes the contaminated secondary fluid is released via atmospheric dump valves. The 1 gpm primary to secondary LEAKAGE safety analysis assumption is relatively inconsequential.

The safety analysis for the MSLB accident assumes 500 gpd primary to secondary LEAKAGE is through the affected steam generator and the remainder of the 1 gpm is through the intact SGs as an initial condition. The dose consequences resulting from the MSLB accident are within the guidelines based on 10 CFR 50.67 or other staff approved licensing basis.The RCS operational LEAKAGE satisfies Criterion 2 of 10 CER 50.36(c)(2)(ii). REFERENCES

1. 10 CFR 50, Appendix A, GDC 30.2. Regulatory Guide 1.45, May 1973.3. FSAR, Section 15.4. NEI 97-06, "Steam Generator Program Guidelines." 5. EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."* 6. Letter FSD/SS-NEU-37 13, dated March 25, 1985.7. Letter NEU-89-639, dated December 4, 1989.MILLSTONE

-UNIT 3 B3444 mnmn o B3/4 4-4i Amendment No. LBDCR No. 08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES 3/4.4.7 DELETED 3/4.4.8 SPECIFIC ACTIVITY BACKGROUND The maximum dose that an individual at the exclusion area boundary can receive for 2 hours following an accident, or at the low population zone outer boundary for the radiological release duration, is specified in 10 CFR 50.67 (Reference 1). Doses to control room occupants must be limited per GDC 19. The limits on specific activity ensure that the offsite and Control Room Envelope (CRE) doses are appropriately limited during analyzed transients and accidents. The RCS specific activity LCO limits the allowable concentration of radionuclides in the reactor coolant. The LCO limits are established to minimize the dose consequences in the event of a steam line break (SLB) or steam generator tube rupture (SGTR) accident.The LCO contains specific activity limits for both DOSE EQUIVALENT I-i131 and DOSE EQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and CRE doses meet the appropriate acceptance criteria in the Standard Review Plan (Reference 2).APPLICABLE SAFETY ANALYSES The LCO limits on the specific activity of the reactor coolant ensure the resulting offsite and CRE doses meet the appropriate SRP acceptance criteria following a SLB or SGTR accident. The safety analyses (References 3 and 4) assume the specific activity of the reactor coolant is at the LCO limits, and an existing reactor coolant (SG) tube leakage rate of"l gpm exists. The safety analyses assume the specific activity of the secondary coolant is at its limit of 0.1 jgCi/gm DOSE EQUIVALENT 1-131 from LCO 3.7.1.4, "Specific Activity." The analyses for the SLB and SGTR accidents establish the acceptance limits for RCS specific activity. Reference to these analyses is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.The safety analyses consider two cases of reactor coolant iodine specific activity. One case assumes specific activity at 1.0 .ixCi/gm DOSE EQUIVALENT 1-131 with a concurrent large iodine spike that increases the rate of release of iodine from the fuel rods containing cladding defects to the primary coolant immediately after a SLB (by a factor of 500), or SGTR (by a factor of 335) respectively. The second case assumes the initial reactor coolant iodine activity at 60.0 gICi/gm DOSE EQUIVALENT 1-131 due to an iodine spike caused by a reactor or an RCS transient prior to the accident. In both cases, the noble gas specific activity is assumed to be 81 .2 gaCi/gm DOSE EQUIVALENT XE- 133.The SGTR analysis also assumes a loss of offsite power at the same time as the reactor trip. The SGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from a low pressurizer pressure signal or an RCS overtemperature AT signal.MILLSTONE -UNIT 3B3/45AmnetNo24 B 3/4 4-5 Amendment No. 2-04 LBDCR No:08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued) The loss of offsite power causes the steam dump valves to close to protect the condenser. The rise in pressure in the ruptured SG discharges radioactively contaminated steam to the atmosphere through the SG power operated relief valves and/or the main steam safety valves. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends and the Residual Heat Removal (RHIR) system is put in service." The SLB radiological analysis assumes offsite power is lost at the same time as the pipe break occurs outside containment. Reactor trip occurs after the generation of an SI signal on low steam line pressure. The affected SG blows down completely and steam is vented directly to the atmosphere. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends and the RUR system is placed in service.Operation with iodine specific activity levels greater than I /tCi/gm but less than or equal to 60.0 jixCi/gm is permissible for up to 48 hours while efforts are made to restore DOSE EQUIVALENT 1-131 to within the 1 pCi/gm LCO limit. Operation with iodine specific activity levels greater than 60 jgCi/gm is not permissible. The RCS specific activity limits are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices. RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). LCO The iodine specific activity in the reactor coolant is limited to 1.0 paCi/gm DOSE EQUIVALENT I-131, and the noble gas specific activity in the reactor coolant is limited to 81.2 pCi/gm DOSE EQUIVALENT XE-133. The limits on specific activity ensure that offsite and CRE doses will meet the appropriate SRP acceptance criteria (Reference 2).The SLB and SGTR accident analyses (References 3 and 4) show that the calculated doses are within acceptable limits. Operation with activities in excess of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SLB or SGTR, lead to doses that exceed the SRP acceptance criteria (Reference 2).APPLICABILITY In MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT 1-131 and DOSE EQUIVALENT XE-133 is necessary to limit the potential consequences of a SLB or SGTR to within the SRP acceptance criteria (Reference 2).In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS and steam generators are depressurized, and primary to secondary LEAKAGE is minimal. Therefore, the monitoring of RCS specific activity is not required.MILLSTONE -UNIT 3B3/46AmnetNo B 3/4 4-6 Amendment No. LBDCR No. 08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued) ACTIONS a. and b.With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at intervals of four hours must be taken to demonstrate that the specific activity is < 60 pCi/gim. Four hours is required to obtain and analyze a sample. Sampling is continued every four hours to provide a trend.The DOSE EQUIVALENT 1-131 must be restored to within limit within 48 hours. The completion time of 48 hours is acceptable since it is expected that, if there were an iodine spike, the nonnal coolant iodine concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.A statement in ACTION b. indicates the provisions of LCO 3.0.4 are not applicable. This exception to LCO 3.0.4 permits entry into the applicable MODE(S), relying on ACTIONS a. and b. while the DOSE EQUIVALENT 1-13 1 LCO is not met. This exception is acceptable due to the significant conservatism incor~porated into the RCS specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, POWER OPERATION. c.If the required action and completion time of ACTION b. is not met, or if the DOSE EQUIVALENT 1-131 is > 60 jFCi/gm, the reactor must be brought to HOT STANDBY (MODE 3)within 6 hours and COLD SHUTDOWN (MODE 5) within 36 hours. The allowed completion times are reasonable, based on operating experience, to reach the reqfiired plant conditions from full power conditions in an orderly maimer and without challenging plant systems.d_.With the RCS DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENT XE-133 must be restored to within limit within 48 hourns. The allowed completion time of 48 hours is acceptable since it is expected that, if there were a noble gas spike, the normaal coolant noble gas concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.A statement in ACTION d. indicates the provisions of LCO 3.0.4 are not applicable. This exception to LCO 3.0.4 permnits entry into the applicable MODE(S), relying on ACTION d. while the DOSE EQUIVALENT XE-133 LCO is not met. This exception is acceptable due to the significant conservatism incorporated into the RCS specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remnains at, or proceeds to, POWER OPERATION. MILLSTONE -UNIT 3 B3446 mnmn o* B 3/4 4-6a Amendment No. LBDCR 12-MPll3-010 September 20, 2012 REACTOR. COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued) ACTIONS (Continued) e.If the required action and completion time of ACTION d. is not met, the reactor must be brought to HOT STANDBY (MODE 3) within 6 hours and COLD SIIUTDOWN (MODE 5) within 3 6 hours. The allowed completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner mad without challenging plant systems.SURVEILLANCE REQUIREMENTS 4.4.8.1 Surveillance Requirement 4.4.8.1 requires performing a gamma isotopic analysis as a measure of the noble gas specific activity of the reactor coolant at the frequency specified in the Surveillance Frequency Control Program. This measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance Requirement provides an indication of any increase in the noble gas specific activity.Trending the results of this Surveillance Requirement allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The surveillance frequency is controlled under the Survweillance Frequency Control Progr-am.Due to the inaherent difficulty in detecting Kr'-85 in a reactor coolant sample due to masking from radioisotopes with similar decay energies, such as F-18 and 1-134, it is acceptable to include the minimum detectable activity for Kr-85 in the Surveillance Requirement 4.4.8.1 calculation. If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE-133 is not detected, it should be assumed to be present at the minimum detectable activity.A Note modifies the Su'veillance Requirement to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows the Surveillance Requirement to be performned in those MODES, prior to entering MODE 1.4.4.8.2 This Surveillance Requirement is performed to ensure iodine specific activity remains within the.LCO limit during normal operation and following fast power changes when iodine spiking is more apt to occur The surveillance fr'equency is controlled under the Surveillance Frequency Control Program. The frequency of between 2 and 6 hours after a power change _> 15% RTP within a 1 hour period is established because the iodine levels peak during this time following iodine spike initiation; samples at other times would provide inaccurate results.MILLSTONE -UNIT 3 B3446 mnmn o B 3/4 4-6b Amendment No. LBDCR No. 08-MP3-013 March 18, 2008 REACTOR COOLANT SYSTEM BASES SPECIFIC ACTIVITY (Continued) SURVEILLANCE REQUIREMENTS (Continued) The Note modifies this Surveillance Requirement to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the Surveillance Requirement. This allows the Surveillance Requirement to be performed in those MODES, prior to entering MODE 1.REFERENCES

1. 10CFR5O.67.

2. Standard Review Plan (SRP) Section 15.0.1, "Radiological Consequence Analyses Using Alternate Source Terms." 3. FSAR, Section 15.1.5.4. FSAR, Section 15.6.3.3/4.4.9 PRESSURE/TEMPERATURE LIMITS REACTOR COOLANT SYSTEM (EXCEPT THE PRESSURIZER)

BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation. Figures 3.4-2 and 3.4-3 contain P/T limit curves for heatup, cooldown, inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature. Each PIT limit curve defines an acceptable region for normal operation. The usual use of the curves is operational requirements during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region. A heatup or cooldown is defined as a temperature increase or decrease of greater than or equal to 1 0°F in any one hour period. This definition of heatup and cooldown is based upon the ASME definition of isothermal conditions described in ASME, Section XI, Appendix E.MILLSTONE -UNIT 3 B 3/4 4-7 MILLTONE-UNT 3 3/44-7Amendment No. 5, 4-9-7, LBDCR 3-4-03 May 20, 2004 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued) Steady state thermal conditions exist when temperature increases or decreases are <1 0°F in any one hour period and when the plant is not performing a planned heatup or cooldown in accordance with a procedure. The LCO establishes operating limits that provide a margin to brittle failure, applicable to the fenritic material of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the Pressurizer. The P/T limits have been established for the ferritic materials of the RCS considering ASME Boiler and Pressure Vessel Code Section XI, Appendix G (Reference

1) as modified by ASME Code Case N-640 (Reference 2), and the additional requirements of 10 CFR 50 Appendix G (Reference 3). Implementation of the specific requirements provide adequate margin to brittle fracture of ferritic materials during normal operation, anticipated operational occurrences, and system leak and hydrostatic tests.The neutron embrittlement effect on the material toughness is reflected by increasing the nil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.

The actual shift in the RTNDT of the vessel material will be established periodically by removing and evaluating the irradiated reactor ve~ssel material specimens, in accordance with ASTM E 185 (Ref. 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and. the recommendations of Regulatory Guide 1.99 (Ref. 6).The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations may be more restrictive, and thus, the curves are composites of the most restrictive regions.The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient-reversal alters the location of the tensile stress between the outer and inner walls.The P/T limits include uncertainty margins to ensure that the calculated limits are not inadvertently exceeded. These margins include gauge and system loop uncertainties, elevation differences, containment pressure conditions and system pressure drops between the beltline region of the vessel and the pressure gauge or relief valve location.MILLSTONE -UNIT 3 B 3/4 4-8 Amendment No. 48, -l-5-, 19-7, Acknowledged by NRC letter dated 08/25/05 August 27, 2001 REACTOR COOLANT SYSTEM BASES.PRESSURE/TEMPERATURE LIMITS (continued) The criticality limit curve includes the Reference 1lrequirement that it be >_ 40°F above the heatup curve or the cooldown curve, and not less than 1 60°F above the minimum permissible

temperature for ISLH testing. This limit provides the required margin relative to brittle fracture.However, the criticality curve is not operationally limiting; a more restrictive limit exists in LCO 3.1.1.4, "Minimurn Temperature for Criticality." The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the ferritic RCPB materials, possibly leading to a nonisolable leak or loss of coolant accident.

In the event these limits are exceeded, an evaluation must be performed to determine, the effect on the structural integrity of the RCPB components. The ASME Code, Section XI, Appendix F (Ref. 7) provides a recommended methodology for-evaluating an operating event that causes an excursion outside the limits.APPLICABLE SAFETY ANALYSIS The P/T limits are not derived from Design Basis Accident (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to prop agate and cause nonductile

• failure of the RCPB, an unanalyZed condition.

Reference 1, as modified by Reference 2, il!: combined with the additional requirements of Reference 3 provide the methodology for determining the P/T limits. Although the PiT limits are not derived from any DBA, the P/T limits are acceptance limits since they preclude operation in an 'unanalyzed condition. RCS P/T limits satisfy Criterion 2 of.l0CFR,50.36(e)(2)(ii-). LCO The LCO limits apply to ferritic components of the RCS, except the Pressurizer. These limits define allowable operating regions while providing margin against nonductile failure for the" controlling ferritic components. The limitations imposed on the rate of change of temperature have been established to ensure consistency with the resultant heatup, cooldown, and ISLH testing P/T'limit curves. These limits control the thermal gradients (stresses) within .the reactor vessel belt line (the limiting component). Note that while these limits are to provide protection to ferritic components within the reactor coolant pressure boundary, a limit of 1 00 0 F/hr applies to the reactor, coolant pressuire boundary (except the pressurizer) to ensure that operation is maintained within the ASME Section III design loadings, stresses, and fatigue analyses for heatup and cooldown.MILLSTONE -UNIT 3 B 3/4 4-9 MILLTON -NIT3 B3/44-9Amendment No. 4--57-, 197 LBDCR 04-MP3-001 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued) Violating the LCO limits places the reactor vessel outside of the bounds of the analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follows: a. The severity of the departure from the allowable operating P/T regime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced);

and c. The existences, sizes, and orientations of flaws in the vessel material.APPLICABILITY The RCS P/T limits LCO provides a definition of acceptable operation for prevention of nonductile failure of ferritic RCS components using ASME Section XI Appendix G, as modified by Code Case N-640 and the additional requirements of l0CFR50, Appendix G (Ref. 1). The P/T limits were developed to provide requirements for operation during heatup or cooldown (MODES 3, 4, and 5) or ISLH testing, in keeping with the concern for nonductile failure. The limits do not apply to the Pressurizer. During MODES 1 and 2, other Technical Specifications priovide limits for operation that can be more restrictive than or can supplement these P/T limits. LCO 3.2.5, "DNB Parameters"; LCO 3.2.3. 1, "RCS Flow Rate and Nuclear En~thaltpy H'ot Channel Facto',;.LCO 3,1.1.4,"Minimum Temperature for Criticality"; and Safety Limit 2.1, "Safety Limits," also provide operational restrictions for pressure and temperature and maximum pressure. Furthermore, MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed. for normal maneuvering profiles, such as power ascension or descent.ACTIONS Operation outside the P/T limits must be corrected so that the RCPB is returned to a. condition that has been verified by stress analyses. The Allowed Outage Times (AOTs) reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the*activity can be accomplished in this time in a controlled manner.Besides restoring operation within limits, an evaluation is required to. determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components. MILLSTONE -UNIT 3 B 3/4 4-10 Amendment No. 5-7, 1-9-, 2--l--, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP'3-015

• February 24, 2005 REACTOR COOLANT SYSTEM BASES PRESSURE/TEMPERATURE LIMITS (continued)

ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.The 72 hour AOT when operating in MODES 1 through 4 is reasonable to accomplish the evaluation. The evaluation for a mild violation ispossible within this time, but more severe violations may require special; event specific* stress analyses or inspections. A favorable evaluation must be completed before continuing to operate.This evaluation must be completed whenever a limit is exceeded. Restoration within the AOT alone is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity. If the required remedial actions are not *completed within the allowed times, the plant must be placed in a lower MODE or not allowed to enter MODE 4 because either the RCS remained in an unacceptable P/T region for an extended period of increased stress or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased. If the required evaluation for continued operation in MODES 1 through 4 cannot be accomplished within 72 hours or the results are indeterminate or unfavorable, action must proceed to reduce preSur~e and te~fnperathire as sp~cifr~d~ii the ACT]ION stiatement. A evaluation must be completed and documented before r-etrnirng to operating pressure and temperature conditions. Pressure and temperature are reduced by bringing the plan~t to MODE 3 within 6 hours and to MODE 5 with RCS pressure < 500 psia within the next 30 hours.Completion of the required evaluation following limit violation in other than MODES 1 through 4 is required before plant startup to MODE 4 can* proceed..The AOTs are reasonable, based on operating experience to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE REQUIREMENTS Verification that operation is within the LCO limits as well as the :limits of Figures 3.4-2 and -3.4-3 is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This frequency is considered reasonable in view of the control room indication available to monitor RCS status.MILLSTONE -UNIT 3 B 3/4 4-11 Amendment No. 4&, 89, 4-5#, 4)-97, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES : PRES SURE/TEMPERATURE LIMITS (continued) Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied. This Surveillance Requirement is only required to be performed during system heatup, cooldown, and ISLJ- testing. No Surveillance Requirement is given for criticality operations because LCO 3.1.1.4 contains a more restrictive requirement. It is rnot necessary to perform Surveillance Requirement 4.4.9.1.1 to verify' compliance with Figures 3.4-2 and 3.4-3 when the reactor vessel is fully detension'ed. During REFUELING; with the head fully detensioned or off the reactor vessel, the RCS is not capable of being pressuriz~ed to any significant value. The limiting thermal stresses which could be encountered during this time would be limited to flood-up using RWST water as low as 40°F. It is not possible to cause crack growth of postulated flaws in the reactor vessel at normal REFUELING temperatures even injecting 40°F Water.REFERENCES

1. ASME Boiler and Pressure Vessel Code, Section XI, Appendix GQ "Fracture

I Toughness for Protection Against Failure," 1995 Edition.2. ASME Section XI, Code Case N-640, "Alternative R~eference Fracture Toughness for Development of P-T Limit Curves," dated F~ebruary 26, 1999.3. 10 CFR 50 Appendix G, "Fracture Toughness Requirements." 4. ASTM E 185-82, "Standard Practice for Conducting Surveillance Tests for Light-Water Cooled Nuclear Power Reactor. Vessels, E 706." 5. 10 CFR 50 Appendix IH, "Reactor Vessel Material Surveillance Program Requirements." 6. Regulatory Guide 1.99 Revision 2, "Radiation Embrittlement of Reactor Vessel Materials," dated May 1988.7. ASME Boiler and Pressure Vessel Code, Section XI, Appendix E, "Evaluation of Unanticipated Operating Events," 1995 Edition.MILLSTONE

-UNIT 3 B 3/4 4-12 Amendment No. 48,14-7, 9-,-2-04,-2-t-4, Acknowledged by NRC letter dated 08/25/05 May 8, 2002 This page intentionally left blank MILLSTONE -UNIT 3 B 3/4 4-13 MILLTON -NIT B /4 -13Amendment No. #$, Z7'7 204 May 8, 2002 This page intentionally left blank MILLSTONE -UNIT 3 B 3/4 4-14 MILLTON -NIT B /4 -14 Amendment No. JF7, 204 REACTRCOLNESSE May 8, 2002 BASES I OVERPRESSURE PROTECTION SYSTEMS BACKGROUND The Cold Overpressure Protection System limits RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the isothermal beltline. pressure and temperature (P/I)limits developed using the guidance of ASME Section XI, Appendix G (Reference 1)as modified by ASME Code Case N-640 (Reference 2). The reactor vessel is the limiting RCPB component for demonstrating such protection. Cold Overpressure Protection consists of two PORVs with nominal lift setting as specified in Figures 3.4-4a and 3.4-4b, or two residual heat removal (RHR)suction relief valves, or one PORV and one RHR suction relief valve, or a depressurized RCS and an RCS vent of sufficient size. Two relief valves are required for redundancy. One relief valve has adequate relieving capability to prevent overpressurization of the RCS for the required mass input capability. MILLSTONE -UNIT 3 B 3/4 4-15 Amendment No. J7, J 7, 204 REVERSE OF PAGE B 3/4 4-15 INTENTIONALLY LEFT BLANK-LBDCR Nb. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued) The use of a PORV for Cold Overpressure Protection is limited to those conditions when no more than one RCS loop is isolated from the reactor vessel. When two or more ioops are isolated, Cold Overpressure Protection must be provided by either the two RHR suction relief valves or a depressurized and vented RCS, The reactor vessel material is less tough at low temperatures than at normal operating temperature. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to stress at low temperatures (Ref. 3). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased. The potential for vessel overpressurization is most acute when the RCS is water solid, occurring while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the RCS P/T limits by a significant amount could cause nonductile cracking of the reactor vessel. LCO 3.4.9.1, "Pressure/Temperature Limits -Reactor Coolant System,'"requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the limits providedin Figures 3.4-2 and 3.4-3.This LCO provides RCS overpressure protection by limiting mass input capability and requiring adequate pressure relief: capacity. Limiting mass input capability requires all Safety Injection O ~ (illI) pumps and all but one centrifugal charging pump to be incapable of injection into the RCS.W The pressure relief capacity requires either two redundant relief valves or .a depressurized RCS and an RCS vent of sufficient size. One relief valve or the open RCS vent is the overpressure protection device that acts to terminate an increas~ing presswr~e event..With minimum mass input capability, the ability to p rovi'de core coolant addition is restricted. The LCO does not require the makeup control system deactivated or the safety injection (SI)actuation circuits blocked. Due to the lower pressures in the Cold Overpressure Protection modes and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve.If a loss of RCS inventory or reduction in SHUTDOWN MARGIN event occurs, the appropriate response will be to correctthe situation by starting RCS makeup pumps. If the loss of inventory or-SHUTDOWN MARGIN is significant, this may necessitate the use of additional RCS makeup pumps that are being maintained not capable of injecting into the RCS in accordance with Technical Specification 3.4.9.3. The use of these additional pumps to restore RCS inventory or SHUTDOWN MARGIN will require entry into the associated ACTION statement. The ACTION* I statement requires immediate action to comply with the specification. The restoration of RCS inventory or SHUTDOWN MARGIN canbe considered to be part of the immediate action to-restore the additional RCS makeup pumps to a not capable of injecting status. While recovering RCS inventory or SHUTDOWN MARGIN, RCS pressure will be maintained below the P/T limits. After RCS inventory or SHUTDOWN MARGIN has been restored, the additional pumps should be immediately made not capable of injecting and the ACTION statement exited.O MILLSTONE -UNIT 3 B 3/4 4-16 Amendment No. 4-&, 88 3-8, 4-5-7, Acknowledged by NRC letter dated 08/25/05 August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRES SURE PROTECTION SYSTEMS (continued) PORV Requirements As designed, the PORV Cold Overpressure Protection (COPPS) is *signaled to open if the RCS pressure approaches a limit determined by the COPPS actuation logic..The COPPS actuation logic monitors both RCS temperature and RCS pressure and determines when the nominal setpoint of Figure 3.4-4a or Figure 3.4-4b is approached. The wide range RCS temperature indications are auctioneered to select the lowest temperature signal.The lowest temperature signal is processed through a function generator that calculates a pressure setpoint for that temperature. The calculated pressure setpoint is then compared with RCS pressure measured by a wide range pressure channel. If the measured pressure meets or exceeds the calculated value, a PORV is Signaled to open.The use of the PORVs is restricted to three and four RCS loops unisolated: for a loop to be considered isolated, both RCS loop stop valves must be closed. If more than one loop is isolated, then the PORVs must have their block valves closed or COPPS must be blocked. For these cases, Cold Overpressure Protection must be provided by either the two RHR suction relief valves or a depressurized RCS and an RCS vent. This is necessary because the PORV mass and heat injection transients have only been analyzed for a maximum of one loop isolated, the use of the PORVs is i restricted to three and four RCS loops unisolated. W The RHR suction relief valves have been qualified for all mass. injection transients for. any combination of isolated loops. In addition, the heat injection transients not..prohibited by the Technical"Sp~ecificationis have also b~een' the alilifi~ationi of the RHR s~Ictibr relief valves.Figure 3.4-4a and Figure 3.4-4b present the PORY setpoints for COPPS. The setpoints are.staggered so only one valve opens during a low temperature overpressure transient. Setting both valves to the values of Figure 3.4-4a and Figure 3.4-4b within the tolerance allowed for the calibration accuracy, ensures that the isothermal P/T limits will not be exceeded for the analyzed [isothermal events.When a PORV is opened, the release of coolant will cause the pressure increase to slow and reverse; As the PORV releases coolant, the RCS press~ure decreases until a reset pressure is reached and the valve is signaled to close. Thie pressure continues to decrease below the reset pressure as the valve closes.MILLSTONE -UNIT 3 B 3/4 4-16a MILLTON -UIT B 34 416aAmendment No. 48, 88, 4-57, 197 August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRES SURE PROTECTION SYSTEMS RIIR Suction Relief Valve Requirements The isolation valves between the RCS and the RIIR suction relief valves must be open to make*the RIIR.suction relief valves OPERABLE for RCS overpressure mitigation. The RHRsuctionvalves are spring loaded, bellows type water relief valves with setpoint tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (AS ME) Code (Ref. 4) for Class 2 relief valves.When the RHR system is operated for decay heat removal or low pressure letdown control, the.isolation valves between the RCS and the RHR suction relief valves are open, and the RHR_suct~ion relief valves are exposed to the RCS and are able to relieve pressure transients in the RCS.RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the'RCS at acceptable pressure levels in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. *Thus, the vent path must be capable Qf relieving the flow resulting from the limiting mass or heat input transient, and maintaining .pressure below the P/T limits for the analyzed isothermal events.For an RCS vent to meet the flow capacity requirement, it requires removing a Pressurizer safety valve, removing a Pressurizer manway, or similarly establishing a vent by opening* an RCS vent valve provided that the opening meets the relieving capacity requirements. The vent path must be above the level of reactor coolant, so as not to drain t/he RCS wheri open.MILLSTONE -UNIT 3 B 3/4 4-17 MILLTONE-UNT 3 3/4-17Amendment No. 1-5-7, 197 LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES i OVERPRES SURE PROTECTION SYSTEMS (continued) APPLICABLE SAFETY ANALYSIS Safety analyses (Ref. 5) demonstrate that the reactor yessel is adequately protected against exceeding the PIT limits for the analyzed isothermal events. In MODES 1, 2, AND3, and in MODE 4, with RCS cold leg temperature exceeding 226 0 F, the pressurizer safety valves will provide RCS overpressure protection in the ductile region. At.226 0 F and below, overpressure prevention is provided by two means: (1) two OPERABLE relief valves, or (2) a depressurized RCS with a sufficiently sized RCS vent, consistent with ASMIE Section XI, Appendix G for temperatures less than RTNDT +/- 50OF. Each oftlhese means has a limuited overpressure relief capability. The required RCS temperature for a given pressure increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the Technical. Specification curves are revised, the cold overpressure protection must be re-evaluated to ensure its functional requirements continue to be met using the RCS relief valve method or the depressurized and vented RCS condition. Transients capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow: Mass Input Transients

a. Inadvertent safety injection; or b. Charging/letdown flow mismatch Heat Input Transients

a. Inadvertent actuation of Pressurizer heaters;b. Loss of RHIR cooling; or c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.

The Technical Specifications ensure that mass input transients beyond the OPERABILITY of the cold overpressure protection means do not occur by rendering all Safety Injection Pumps and all*but one centrifugal charging pump incapable of injecting into the RCS whenever an RCS cold leg is _226 0 F.The Technical Specifications ensure that energy addition transients beyond the OPERABILITY of the cold overpressure protection means do not occur by limiting reactor coolant pump starts.LCO 3.4.1.4.1, "Reactor Coolant Loops and Coolant Circulation -COLD SHUTDOWN -Loops Filled," LCO 3.4.1.4.2, "Reactor Coolant MILLSTONE -UNIT 3 B 3/4 4-18 Amendment No. 1-5-7, I-9-7, Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BA.SES OVERPRESSURE PROTECTION SYSTEMS (continued) Loops and Coolant Circulatio~n -COLD SHUTDOWN -Loops Not Filled," and LCO 3.4.1.3,""'Reactor Coolant Loops and Coolant Circulation -HOT SHUTDOWN" limit starting the first reactor coolant pump such that it shall not be started when any RCS loop wide range cold leg temperature is 226°F unless the secondary side water temperature of each steam generator is< 50°F above each RCS cold leg temperature. The restrictions ensure the potential energy addition to the RCS from the secondary side of the steam generators will not result in an RCS overpressurization event beyond the capability of the COPPS to mitigate. The COPPS utilizes the pressurizer PORVs and the RHR relief valves to. mitigate th~e limiting mass .and en~ergy addition events, thereby protecting the isothermal reactor vessel b.eltline P/T limits. The restrictions w~ill ensure the reactor vessel. wili~be protected from a. cold .oyerpress~ure event whenlstartinag the first RCP. If at least, one RCP is operating, no restrictions are necessary to start additional RCPs for'reactor vessel protection. In addition, this restriction only applies to RCS loops and associated components that are. not isolated from the reactor vessel.The RCP starting criteria are based on the equipment used to provide cold overpressure protection. A maximum temperature differential of 50°F between the steam generator secondary sides and RCS cold legs will limit the potential energy addition to within the capability of the*pressurizer PORVs to mitigate the transient. The RHR relief valve are also adequate to mitigate energy addition transients constrained by this temperature differential limit, provided all RCS cold leg temperature are at or below 150°F. The ability of the RUR relief valves to mitigate.energ~y cold leg ,temperature is .above,.,50 0 F has not analyzed.As a result, the temperature of the steam-generator secondary sides must 'be at or below the RCS cold leg temperature if the RHR relief valves are providing cold overpressure protection and the RCS cold leg temperature is above 150OT.! MILLSTONE -UNIT 3 B 3/4 4-19 Amendment No. t4-7, -l-9-?, Acknowledged by NRC letter dated 08/25/05 August 27, 2001 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued) The cold overpres sure transient analyses demonstrate that either one relief valve or the depressurized RCS and RCS vent can maintain RCS pressure below limits when RCS letdown is isolated and only one centrifugal charging pump is operating. Thus, the LCO allows only one centrifugal charging pump capable of injecting when cold overpressure protection is required: The cold overpressure protection enabling temperature is conservatively established at a value.< 226°F based on the *criteria provided by ASME Section XI, Appendix G.PORV Performance The analyses show that the vessel is protected against non-ductile failure When the PORVs are set to open at the values shown in Figures 3.4-4a and 3.4-4b within the tolerance allowed for the calibration accuracy. The curves are derived by analyses for both three and four RCS loops unisolated that model the performance of the PORV cold overpressure protection system (COPPS), assuming the limiting mass and heat transients of one centrifugal charging pump injecting into the RCS, or the energy addition as a result of starting an RCP with temperature asymmetry between the RCS and the steam generators. These analyses consider pressure overshoot beyond the PORV opening setpoint resulting from signal processing and valve stroke*times.The PORV setpoints in Figures 3.4-4a and 3.4-4b will be updated when the P/T limits conflict*with the cold overpressure analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement. Revised limits are determined using neutron fluence projections and the results of testing of the reactor vessel material irradiation-survei~ltancee-speeimens. The .Baseso~for ,LCO -3.49-l,. "P..ressure/Temperature Limits -Reactor Coolant System (Except the Pressurizer)," dismiss these, e-valuations. The PORVs are considered active components. Thus, the failure of one PORV is assumed to represent the worst case, single active failure.RHR Suction Relief Valve Performance The RIIR suction relief valves do not have variable pressure and temperature lift s etpoints as do the PORVs. Analyses show that one RHIR suction relief valve with a setpoint at or between 426.8 psig and 453.2 psig will pass flow greater than that required for the limiting cold overpressure transient while maintaining RCS pressure less than the isothermal P/T limit curve.Assuming maximum relief flow requirements during the limiting cold overpressure. event, an RHR suction relief valve will maintain RCS pressure to _< 110% of the nominal lift setpoint.Although each RHR suction relief valve is a passive spring loaded device, which meets single failure criteria, its location within the RHR System precludes meeting single failure criteria when spurious RHR suction isolation valve or RIIR suction valve closure is postulated. Thus the los~s of an RHR suction relief MILLSTONE -UNIT 3 B 3/4 4-20 MILLTON -NIT3 B3/4-20Amendment No. I1-5g, 197 REACTOR COOLANT SYSTEM AUgust 27, 2001 BASES OVFRPRESSURE PROTECTION SYSTEMS (conti~nued) valve is the worst case single failure. Also, as the RCS P/T limits are revised to reflect change in toughness in the reactor vessel materials, the RHR suction.rel~ief valve's analyses must be re-evaluated to ensure continued accommodation of-:the design bases cold overpressure transients. RCS vent Performance With the RCS depressurized, analyses show a vent size of > 2.0 square inches is capable of mitigating the limiting cold overpressure transient. The capacitfof this vent size is greater .than the flow of the limiting transient, while maintaining RCS pressure less than the maximum pressure on the isothermal P/T limit curve.The RCS vent size will be re-evaluated for compliance each time the isothermal P/I limit curves are revised.The RCS vent is a passive device and is not subject to active failure.The RCS vent satisfies Criterion 2 of 1OCFR50.36(c)(2)(ii). MILLSTONE-UNIT 3: B 3/4 4-21 MILL TON -UIT .B /4 -21Amendment No. 197 REACTOR COOLANT SYSTEM August 27, 2001 BASES OVERPRESSURE PROTECTION SYSTEMS (continued) LCO This LCO requires that cold overpressure protection be OPERABLE and the maximum mass input be limited to one charging pump. Failure to meet this LCO could lead to the loss of low temperature overpressure mitigation and violation of the reactor vessel isothermal P/T limits as a result of an operational transient. To limit the mass input capability, the LCO requires a maximum of one centrifugal charging pump capable of injecting into the RCS.The elements of the LCO that provides low temperature overpressure mitigation through pressure relief are: I. Two OPERABLE PORVs; or A PORV is OPERABLE for cold overpressure protection when its block valve is*open, its lift setpoint is set to the nominal- setpoints provided for both three and four loops unisolated by Figure 3.4-4a or 3.4-4b and when the surveillance requirements are met.2. Two OPERABLE RHR suction relief valves; or An RH-R suction relief valve is OPERABLE for cold overpressure protection when its isolation valves from the RCS are open and when its setpoint is at or between 426.8 psig and 453.2 psig, as verified by required testing.3. One OPERABLE PORV and one OPERABLE RHR suction relief valve; or 4. A depressurized RCS and an RCS vent.An RCS vent is OPERABLE when open with an area of > 2.0 square inches.Each of these methods of ovepressure prevention is Capable of mitigating the limiting cold overpressure transient. MILLSTONE -UNIT 3 B 3/4 4-Z2 MILLTON -NIT B /4 -22Amendment No. 197 LBD CR No. 04-MP3-015 February 24, 2005 REACTOR COOLANT SYSTEM BASES OVERPRESSURE PROTECTION SYSTEMS (continued) APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is < 226°F, in MODE 5, and in MODE 6 when the head is on the reactor vessel. The Pressurizer safety valves provide RCS ovelrpressure protection in the ductile region (i.e. > 226°F). When the reactor head is off, overpressurization cannot occur.LCO 3.4.9.1 "Pressure/Temperature Limits" provides the operational P/T limits for all MODES.LCO 3.4.2, "Safety Valves," requires the OPERABILITY of the Pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and 4 when all RCS cold leg temperatures are > 226°F.Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a rapid increase in RCS pressure when little or no time exists for operator action to mitigate the event.ACTIONS a. and b.With two or more centrifugal charging pumps capable of injecting into the RCS, or with any SIH pump capable of injecting into the RCS, RCS over~pressurization is possible.To immediately initiate action to restore restricted massinput capability to the Rcs reflects the urgency of removing the RCS from this condition. Required ACTION a. is modified by a Note that permits two centrifugal charging pumps capable of RCS injection for < 1 hour to allow for pump swaps. This is a controlled evolution of short duration and the procedure prevents having two charging pumps simultaneously out of pull-to-lock while both charging pumps are capable of injecting into the RCS.c.In MODE 4 when any RCS cold leg temperature is < 226°F, with one required relief valve inoperable, the RCS relief valve must be restored to OPERABLE status within an allowed outage time (AOT) of 7 days. Two relief valves in any combination of the PORVs and the RHR suction relief valves are requi'ed to provide low temperature overpressure mitigation while withstanding a single failure of an active component. MILLSTONE -UNIT 3 B 3/4 4-23 Amendmen~t No. 9-7, Acknowledged by NRC letter dated 0 8/25/05 LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES OVERPRES SURE PROTECTION SYSTEMS (continued') The AOT in MODE 4 considers the facts that only one of the relief valves is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low. The RCS must be depressurized and a vent must be established within the following 12 hours if the required relief valve is not restored to OPERABLE within the required AOT of 7 days.d.The consequences of operational events that will overpressure the RCS are more severe at lower temperatures (Ref. 8). Thus, with one of the two required relief valves inoperable in MODE 5 or in MODE 6 with the head on, the AOT to restore two valves to OPERABLE status is 24 hours.The AOT represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE relief valve to protect against events. The RCS must be depressurized and a vent must be established within the following 12 hours if the required relief valve is not restored to OPERABLE within the required AOT of 24 hours.e.The RCS must be depressurized and a vent must be established within 12 hours when both required Cold Overpressure Protection relief valves are inoperable. The vent must be sized >_ 2.0 square inches to ensure that the flow capacity is greater than that required for the worst case cold overpressure transient reasonable during the applicable MODES.This action is needed to protect the RCPB from a low temperature overpressureevent and a possible non-ductile failure of the reactor vessel.The time required to place the plant in this Condition is based on the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements. SURVEILLANCE REQUIREMENTS 4.4.9.3.1 Performance of an ANALOG CHANNEL OPERATIONAL TEST is required within 31 days prior to entering a condition in which the P0KV is required to be OPERABLE and at the[frequency specified in the Surveillance Frequency Control Program thereafter on each required PORV to verify and, as necessary, adjust its lift setpoint. The ANALOG CHANNEL OPERATIONAL TEST will verify the setpoint in accordance with the nominal values given in Figures 3.4-4a and 3.4-4b. P0RV actuation could depressurize the RCS; therefore, valve operation is not required.MILLSTONE -UNIT 3 B 3/4 4-24 MILLTONE-UNT 3 3/44-24Amendment No. 4-l-57-,4-97 LBDCR 12-MiP3-010 September 20, 2012 REACTOR COOLANT SYSTEM BASES OVERPRES SURE PROTECTION SYSTEMS (continued) Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required periodically to adjust the channel so that it responds and the valve opens within the required range and accuracy to a known input. The surveillance frequency is controlled under the Surveillance Frequency Control Program.The PORV block valve must be verified open and COPPS must be verified anned periodically to provide a flow path and a cold overpressure protection actuation circuit for each required PORV to perform its function when required. The valve is remotely verified open in the main control room. This Surveillance is perfonned if credit is being taken for the PORV to satisfy the LCO.The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required to be removed, and the manual operator is not required to be locked in the open position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure transient. The surveillance frequency is controlled under the Surveillance Frequency Control Program.4.4.9.3.2 Each required RH-R suction relief valve shall be demonstrated OPERABLE by verifying the .RHR suction valves, 3R1IS*MV8701A and 3 RHS*M8701 C, are open when suction r.elief valve 3PJHS*RV8708A is being used to meet the LCO and by verify"ing theRiHR suction valves, 3RHS*MVT8702B and 3RHIS*MV\8702C, are open when suction relief valve 3RHS*RV8708B is being used to meet the LCO. Each required RHIR suction relief valve shall also be demonstrated OPERABLE by testing it in accordance with 4.0.5. This Surveillance is only required to be performed if the RUR suction relief valve is being used to meet this LCO.The RHR suction valves are periodically verified to be open. The surveillance frequency is controlled under the Surveillance Frequency Control Program.The ASME Code for Operation and Maintenance of Nuclear Power Plants, (Reference 9), test per 4.0.5 verifies OPERABILITY by proving proper relief valve mechanical motion and by measuring and, if re~quired, adjusting the lift setpoint.MILLSTONE -UNIT 3 B 3/4 4-25 MILLSONE -UNIT B 3/4-25Amendment No. 5, -I-97-, 2. LBDCR 12-MP3-010 September 20, 2012 REACTOR COOLANT SYSTEMd BASES OVERPRESSUJRE PROTECTION SYSTEMS (continued) 4.4.9.3.3 The RCS vent of> 2.0 square inches is proven OPERABLE periodically by verifying its open condition. A removed Pressurizer safety valve fits this category.This passive vent arrangement must only be open to be OPERABLE. This Surveillance is required to be performed if the. vent is being used to satisfy the pressure relief requirements of the LCO. The surveillance frequency is controlled under the Suareillance Frequency Control Program.4.4.9.3.4 and 4.4.9.3.5 To minimize the potential for a low temperature overpressure event by limiting the mass input capability, all SIHl pumps and all but one centrifugal charging pump are verified incapable of injecting into the RCS.The SIll pumps and charging pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control.Alternate methods of control may be employed using at least two independent means to prevent an injection into the RCS. This may be accomplished thr'ough any of the following methods: 1) placing the pump in pull to lock (PTL) and pulling its UJC fuses, 2) placing the pump in pull to lock (PTL) and closing the pump discharge valve(s) to the injection line, 3) closing the discharge valve(s) to the injection line and either removing power from the valve operator(s) or locking manual valves closed, and 4) closing the valve(s) from th~e injection source and either removing power fr'om the valve operator(s) or locking manual valves closed.An SIN- pump may be energized for testing or for filling* teAcmulators provided it is incapable of injecting inato the RCS.The surveillance frequency is controlled under the Surveillance Frequency Control Program.REFERENCES

1. ASME Boiler and Pressure Vessel Code, Section XI, Appendix G-, "Fracture Toughness for Protection Against Failure," 1995 Edition.2. ASME Section XI, Code Case N-640, "Alternative Reference Fracture Toughness for Development of P-T Lim~it Curves," dated February 26, 1999.3. Generic Letter 88-11 4. ASMiE, Boiler and Pressure Vessel Code, Section III 5. FSAR, Chapter 15 6. lOCFR50, Section 50.46 7. 10CFR50, Appendix K 8. Generic Letter 90-06 9. ASME Code for Operation and Maintenance of Nuclear Power Plants MILLSTONE

-UNIT 3 B 3/4 4-26 Amendmnent No. 1-5-7-, 4- 0 , May 8, 2002 This page intentionally left blank MILLSTONE -UNIT 3 B 3/4 4-27 Amendment No. X7204 REVERSE OF PAGE B 3/4-4-27 INTENTIONALLY LEFT BLANK LBDCR 05-MP3-025 March 7, 2006 3/4.5 EMERGENCY CORE COOLING SYSTEMS BASES 3/4.5.1 ACCUMULATORS The OPERABILITY of each Reactor Coolant System (RCS) accumulator ensures that a sufficient volume of borated water will be immnediately forced into the reactor core through each of the cold legs in the event the RCS pressure falls below the pressure of the accumulators. This initial surge of water into the core provides the initial cooling mechanism during large RCS pipe ruptures.The limits on accumulator volume, boron concentration and pressure ensure that the assumptions used for accumulator injection in the safety analysis are met.The accumulator power operated isolation valves are required to meet the guidance of "operating bypasses" in the context of IEEE Std. 279-1971, which requires that bypasses of a protective function be removed automatically whenever permissive conditions are not met. The "operating bypass" designed for the isolation valves is applicable to MODES 1, 2, and 3 with Pressurizer pressure above P-Il1 setpoint. In addition, as these accumulator isolation valves fail to meet single failure criteria, removal of power to the valves is required.The limits for operation with an accumulator inoperable for any reason except an isolation valve closed minimizes the time exposure of the plant to a LOCA event occurring concurrent with failure of an additional accumulator which may result in unacceptable peak cladding temperatures. If a closed isolation valve cannot be immediately opened, the full capability of one accumulator is not available and prompt action is required to place the reactor in a mode where this capability is not required.3/4.5.2 AND 3/4.5.3 ECCS SUBSYSTEMS The OPERABILITY of two independent ECCS subsystems ensures that sufficient emergency core cooling capability will be available in the event of a LOCA assuming the loss of one subsystem through any single failure consideration. Either subsystem operating in conjunction with the accumulators is capable of supplying sufficient core cooling to limit the peak cladding temperatures within acceptable limits for all postulated break sizes ranging from the double ended break of the largest RCS cold leg pipe downward. In addition, each ECCS subsystem provides long-term core cooling capability in the re-circulation mode during the accident recovery period.With the RCS temperature below 350°F, one OPERABLE ECCS subsystem is acceptable without single failure consideration and with some valves out of normal injection lineup, on the basis of the stable reactivity condition of the reactor and the limited core cooling requirements. The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System is required to be available to support charging pump operation. The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System consists of two redundant trains, each capable of providing 100% of the required flow. Each train has a two position, "Off" and "Auto," remote control switch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the operating train. The associated fans do not receive any safety related automatic start signals (e.g., Safety Injection Signal).MILLSTONE -UNIT 3B3/5-AmnetNo -, B 3/4 5-1 Amendment No. :t-5-7, LBDCR No. 05-MP3-025 March 7, 2006 EMERGENCY CORE COOLING SYSTEMS BASES "O ECCS SUBSYSTEMS (Continued) Placing the remote control switch for a Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train in the "Off' position to start the redundant train or" to per~form post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensure the remote control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use of an approved procedure and a designated individual at the control switch for the respective Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respond to instructions from procedures, or control room personnel, based on plant conditions. The Surveillance Requirements provided to ensure OPERABILITY of each component ensures that at a minimum, the assumptions used in the safety analyses are met and that subsystem OPERABILITY is maintained. Surveillance Requirements for throttle valve position stops provide assurance that proper ECCS flows will be maintained in the event of a LOCA.Maintenance of proper flow resistance and pressure drop in the piping system to each injection point is necessary to: (1) prevent total pump flow from exceeding runout conditions when the system is in its minimum resistance configuration, (2) provide the proper flow split between injection points in accordance with the assumptions used in the ECCS-LOCA analyses, and :B.(3) provide an acceptable level of total ECCS flow to all injection points equal to or above that.assumed in the ECCS-LOCA analyses.Any time the OPERABILITY of an ECCS throttle valve or an ECCS Subsystem has been affected by repair, maintenance, modification, or replacement activity that alter flow characteristics, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. Surveillance Requirement 4.5.2.b.l1 requires verifying that the ECCS piping is full of water. The ECCS pumps are normally in a standby, nonoperating mode, with the exception of the operating centrifugal charging pump(s). As such, the ECCS flow path piping has the potential to develop voids and pockets of entrained gases. Maintaining the piping from the ECCS pumps to the RCS full of water ensures that the system will perform properly when required to inject into the RCS.This will also prevent water hammer, degraded performance, cavitation, and gas binding of ECCS pumps, and reduce to the greatest extent practical the pumping of non-condensible gases (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling.This Surveillance Requirement is met by:*VENTING the ECCS pump casings and VENTING or Ultrasonic Test (UT) of the accessible suction and discharge piping high points including the ECCS pump suction crossover piping (i.e., downstream of valves 3RSS*MV8837A/B and 3RSS*MV8838A/B to safety injection and charging pump suction). VENTING of the , MILLSTONE -UNIT 3 B 3/4 5-2 MILSTOE -UNI 3 3/5-2Amendment No. 4-00, 4-4-7, -l--5-7, LBDCR No. 05-MP3-004 April 21, 2005 EMERGENCY COPE COOLING SYSTEMS.BASES ECCS SUBSYSTEMS (Continued) accessible suction and discharge piping high points including the ECCS pump suction crossover piping is required when gas accumulations exceed the gas accumulation limits. NOTE: Certain maintenance (e.g. ECCS pump overhaul) or other evolutions

• can cause gas or air to enter the EGGS. VENTING of the affected portion of the ECCS is necessary for these evolutions.
• VENTING of the nonoperating centrifugal charging pumps at the suction line test connection.

The nonoperating centrifugal charging pumps do not have casing vent connections and VENTING the suction pipe will assure that the pump casing does not voids and pockets of entrained gases.*using ant external water level detection method for the water filled portions of the RSS piping upstream of valves 3RSS*MV8837AJB and 3RSS*MV8838AJB. When deemed necessary by an external water level detection method, filling and venting to reestablish the acceptable water levels may be performed after entering LCO.ACTION statement 3.6.2.2 since VENTING without isolation of the affected train would result in a breach of the containment pressure boundary.The following ECCS subsections are exempt from this Surveillance:

• the operating centrifugal charging pump(s) and associated piping -as an operating pump is self VENTING and cannot develop voids and pockets of entrained gases.* the RSS pumps, since this equipment is partially dewatered during plant operation.

Each RS S pump is equipped with a pump casing vent line that allows automatic VENTING of the pump casing prior to pump operation following an accident.I

• the RSS heat exchangers, since this equipment is laid-up dry during plant operation.

Gas is flushed out of the heat exchangers during the initial operation of the RS S pumps following an accident.* the RSS piping that is not maintained filled with water during plant operation. The configuration of this piping is such that it is self VENTING upon initial operation of the RSS pumps.*the ECCS discharge piping within containment. These piping sections are inaccessible during reactor operations due to accessibility (containment entry), safety, and radiological concerns. They are static sections of piping relatively insensitive to* gas accumulations since these lines are stagnant during normal power operation. The ECCS discharge piping inside containment is filled and vented upon system return to service.* the Residual Heat Removal (RI-R) heat exchangers. These are dual pass, vertical u-tube heat exchangers that do not allow direct measurement of gas voids. System MILLSTONE -UNIT 3 B 3/4 5-2a Amendment No. 4-1-@, 5-7, Acknowledged by NRC Letter dated 04/12/06 LBDCR 12-MIP3-O00 September 20, 2012 EMERGENCY CORE COOLING SYSTEMS ,l 0 BASES ECCS SUB SYSTEMS (Continued) flush upon heat exchanger return to service and procedural compliance is relied upon to ensure that gas is not present within the heat exchanger u-tubes.Surveillance Requirement 4.5 .2.C.2 requires that the visual inspection of the containment he performed at least once daily iffthe contaimnent has been entered that day and when the final containment entry is made. This will reduce the number of unnecessary inspections and also reduce personnel exposure.Surveillance Requirement 4.5.2.d.2 addresses periodic inspection of the containment sump to ensure that it is unrestricted and stays in proper operating condition. The surveillance fr'equency is controlled under the Surveillance Frequency Control Program.The Emergency Core Cooling System (ECCS) has several piping cross connection points for use during the post-LOCA recirculation phase of operation. These cross-connection points allow the Recirculation Spray System (RSS) to supply water from the containment sump to the safety injection and charging pumps. The RSS has the capability to supply both Train A and B safety injection pumps and both Train A and B charging pumps. Operator action is required to position valves to establish flow fr'om the containment sump through the RSS subsystems to the safety injection and charging pumps since the valves are not automatically repositioned. The quarterly stroke testing (Technical Specification 4.0.5) of the ECC/RSS recirculation flowpath valves discussed below will not result in subsystem inoperability (except due to other equipment manipulations to support valve testing) since these valves are manually aligned in accordance with the Emnergency Operating Procedures (EOPs) to establish the recirculation flowpaths. It is expected the valves will be returned to the normal pre-test position following termination of the surveillance testing in response to the 9 accident. Failure to restore any valve to the normal pre-test position will be indicated to the Control Room Operators when the ESF status panels are checked, as directed by the EOPs. The EOPs direct the Control Room Operators to check the ESF status panels early in the event to ensure proper equipment alignment. Sufficient time before the recirculation flowpath is required is expected to be available for operator action to position any valves that have not been restored to the pretest position, including local manual valve operation. Even if the valves are not restored to the pre-test position, sufficient capability will remain to meet ECCS post-LOCA recirculationi requirements. As a result, stroke testing of the ECCS recirculation valves discussed below will not result in a loss of system independence or redundancy, and both ECCS subsystems will remain OPERABLE.When performing the quarterly stroke test of 3 SIH*MV8923A, the control switch for safety injection pump 3SIH*PIA is placed in the pull-to-lock position to prevent an automatic pump stait with the suction valve closed. With the control switch for 3 SIH*PIA in pull-to-lock, the Train A ECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a., applies. This ACTION statement is sufficient to administratively contr'ol the plant configuration with the automatic start of 3S1H*P1A defeated to allow stroke testing of 3SIH*MV8923A. In addition, the EOPs and the ESF status panels will identify this abnormal plant configuration, if not corrected following the termination of the surveillance testing, to the plant operators to allow restoration of the normal post-LOCA recirculation flowpath. Even if system restoration is not accomplished, sufficient equipment will be available to perfonn all ECCS and RSS injection and recirculation functions, provided no additional ECCS or RSS equipment is inoperable, and an additional single failure does not occur (an acceptable assumption since the Technical Specification ACTION statement limits the plant configuration time such that no additional equipment failure need be postulated). During the injection phase the redundant subsystem (Train B) is fully functional, as is a significant portion of the Train A subsystem. During the recirculation phase, the Train A RSS subsystem can supply water from the containment sumnp to the Train A MILLSTONE -UNIT 3 B 3/4 5-2b MILLTON -NIT B 14 -2bAmendment No. -!00, 4-!4-, 4-5 LBDCR No. 05-MP3-004 April 21, 2005 EMERGENCY CORE COOLING SYSTEMvS BASES and B charging pumps, and the Train B RSS subsystem can supply water from the containmaent sump to the B safety injection pump.When performing the quarterly stroke test of 3 SIH*MV8923B, the control switch for safety injection pump 3SIH*'PlB is placed in the pull-to-lock position to prevent an automatic pump start with the suction valve closed. With the control switch for 3SIW*P1B in pull-to-lock, the Train B ECCS subsystem is inoperable and Technical Specification 3.5.2, ACTION a., applies. This ACTION statement is sufficient to administratively control the plant configuration with the automatic start of 3SIH*PlB defeated to allow stroke testing of 3 SIH*VMV8923B. In addition, the EOPs and the ESE status panels will identify this abnormal plant configuration, if not corrected following the termination of the surveillance testing, to the plant operators to allow restoration of the normal po st-LOCA recirculation flowpath. Even if system restoration is not accomplished, sufficient equipment will be available to perform all ECCS and RSS injection and recirculation functions, provided no additional ECCS or RSS equipment is inoperable, and an additional single failure does not occur (an acceptable assumption since the Technical Specification ACTION statement limits the plant configuration time such that no additional equipment failure need be postulated). During the injection phase the redundant subsystem (Train-A) is fully functional, as is a significant portion of the Train B subsystem. During the recirculation phase, the Train A RSS subsystem can supply water from the containment sump to the Train A and B charging pumps and the Train A safety injection pump. The Train B RSS subsystem cannot supply water from the containment sump to any of the remaining pumps.When performing the quarterly stroke test of 3SIH*MV8807A or 3SIH*MV8807B, 3 SIH*IMV8924 is closed first to prevent the potential injection of RWST water into the RCS through the operating charging pump. When 3S1H*MV8924 is closed, it is not necessary to declare either ECCS subsystem inoperable..Although expected to be open for post-LOCA recirculation, sufficient time is expected to be available post-LOCA to identify and open 31H*IV1-V8924 either from thle Control Room or locally at valve. The EOPs and the ESF status panels will identify this abnormal planlt configuration, if not corrected following the termination of thle surveillance testing, to the plant operators to allow restoration of the normal po st-LOCA recirculation flowpath. Even if system restoration is not accoimplished, sufficient equipment will be available to perform all ECCS and RSS binjection and recirculation functions, provided no additional ECCS or RSS equipment is inoperable, eyen if a single failure is postulated. The failure to open 3SIH*'MV8924 due to mechanical binding or the loss of power to ECCS Train A could be the single failure. If a different single failure is postulated, restoration of 3SIH'*MV8924 can be accomplished. The closure of 3SIH*MV8924 has no affect on the injection phase. During the recirculation phase, assuming 3SIH*MI\V8924 remains closed (i.e., the single failure), the Train A RSS subsystem can supply water from the containmaent sump to the Train A and B charging pumps, and the Train B RSS subsystem can supply water from the containment sump to the Train A and B safety injection pumps. If power is lost to ECCS Train A and 3SIH*MV8924 is not opened locally (i.e., the single failure), cold leg recirculation can be accomplished by using RSS Train B to supply containment sump water via 3SIW*PIB to the RCS cold legs and 3S1L*MV8809B can be opened to supply containment sump water via RSS Train B to the RCS cold legs. Hot leg recirculation can be accomplished by using RSS Train B to supply containment sump water via 3SIH*PlB to the RCS hot legs and maintaining 3SIL*~MV8809B open to supply contaimnent sump water via RSS Train B to the RCS cold legs.MILLSTONE -UNIT 3 B 3/4 5-2c Amendment No. 4-08, 7,, Ackn~owledged by NRC Letter dated 04/12/06 LBDCR No. 13-MP3-011 October 30, 2013 CORE COOLING SYSTEMS BASES ECCS Subsystems: Auxiliary Building RPCCW Ventilation Area Temperature Maintenance: In MODES 1, 2, 3 and 4, two trains of 4 heaters each, powered from class 1E power supplies, are required to support charging pump OPERABILITY during cold weather conditions. These heaters are required whenever outside temperature is less than or equal to 17°F.When outside air temperature is below 17°F, if both trains of heaters in the RPCCW Ventilation Area are available to maintain at least 65°F in the Charging Pump and Reactor Comporhent Cooling Water Pump areas of the Auxiliary Building, both charging pumps are OPERABLE for MODES 1, 2 and 3.When outside air temperature is below 17°F, if one train of heaters in the RPCCW Ventilation Area is available to maintain at least 32°F in the Charging Pump and Reactor Component Cooling Water Pump areas of the Auxiliary Building, the operating charging pump is OPERABLE, for MODE 4.With less than 4 OPERABLE heaters in either train, the corresponding train of charging is inoperable. This condition will require entry into the applicable ACTION statement for LCOs 3.5.2 and 3.5.3.LCO 3.5.2 ACTION statement "b", and LCO 3.5.3 ACTION statemnent "c" address special reporting requirements in response to ECCS actuation with water injection to the RCS.The special report completion is not a requirement for logging out of the ACTION statements that require the reports.3/4.5.4 REFUELING WATER STORAGE TANK The OPERABILITY of the refueling water storage tank (RWST) as part of the ECCS ensures that a sufficient supply of borated water is available for injection by theECCS in the evzent of a LOCA. The limits on RWST minimum volume and boron concentration ensure that: (1)sufficient water is available within containmient to permit recirculation cooling flow to the core, and (2) the reactor will remain subcritical in the cold condition following a large break (LB)LOOA, assuming mixing of the RWST, RCS, EGGS water, and other sources of water that may eventually reside in the sump, with all control rods assumed to be out. These assumptions are consistent with the LOCA analyses.The contained water volume limit includes an allowance for water not usable because of tank discharge line location or other physical characteristics. The limits on contained water vo lumne and boron concentration of the RWST also ensure a pH value of between 7.0 and 7.5 for the solution recirculated within containment after a LOCA. This pH band minimizes the effect of chloride and caustic stress corrosion on mechanical systems and components. MILLSTONE -UNIT 3 B 3/4 5-2d Amendment No. 4-I0, ,-i4, ,-4-57, LBDCR No. 13-MP3-011 October 30, 2013 EMERGENCY CORE COOLING SYSTEMS BASES The minimum and maxinmum solution temperatures for the RV\ST in MODES 1, 2, 3 and 4 are based on the following: The 42°F minimum and 73 °F maximum solution temperature values identified within the Technical Specifications include an operational margin of 2°F (e.g., measurement uncertainties, analytical uncertainties, and design uncertainties) from values used in accident analysis/piping stress analysis. Accident analysis/piping stress analysis used 40°F and 75°F for the minimum and maximum RWST solution temperature. MILLSTONE -UNIT 3 B3452 B 3/4 5-2e 0 REVERSE OP PAGE B 3/4 5-2e INTENTIONALLY LEFT BLANK 0 May 26, 1995 EMERGENCY CORE COOLING SYSTEMS 3/4.5.5 TRISODIUM pHOSpHATE STORAGEBASKETS BASES BACKGROUND Trisodlum phosphate (TSP) dodecahydrate is stored in porous wire mesh baskets on the floor or in the sump of the containment building to ensure that iodine, which may be dissolved in the recirculated reactor cooling water following a loss of coolant accident (LOCA), remains In solution, TSP also helps inhibit stress corrosion cracking (SCC) of austenitic stainless steel components in containment during the recirculatlon phase following an accident.Fuel that is damaged during a LOCA will release iodine in several chemical forms to the reactor coolant and to the containment, atmosphere. A portion of the iodine in the containment atmosphere is washed to the sump by containment sprays (i.e.., Quench Spray and/or Containment Recirculation Spray). The emergency core cooling water is borated for reactivity control.This borated water causes the sump solution to be acidic. In a low pH (acidic) solution, dissolved iodine will be converted to a volatile form. The volatile iodine will evolve out of solution Into the containment atmosphere, significantly increasing the levels of airborne iodine. The increased levels of airborne iodine in containment contribute to the radiological releases and increase the consequences from the accident due to containment atmosphere leakage.After a LOCA, the components of the core cooling and containment spray systems will be exposed to high temperature borated water. Prolonged exposure to the core cooling water combined with stresses imposed on the components can cause SCC. The SCC is a function of stress, oxygen and chloride concentrations, pH, temperature, and alloy composition Of the components. High temperatures and low pH,.which would be present after a LOCA, tend to promote SCC. This can lead to the failure of necessary safety systems or components. Adjusting the pH of the recirculation solution to levels above 7.0 prevents a significant fraction of the dissolved iodine from converting to a volatile form. The higher pH thus decreases the level of airborne Iodine in containment and reduces the radiological consequences from containment atmosphere leakage following a LOCA. Maintaining the solution pH Z 7.0 also reduces the occurrence of SCC of austenltic stainless steel components in containment. Reducing SCC reduces the probability of failure of components. Granular TSP dodecahydrate Is employed as a passive form of pH control for post LOCA containment spray and core cooling water. Baskets of TSP are placed on the floor or In the sump of the containment building to dissolve MILLSTONE UNIT NO. 3 B 3/4 5-3 Amendment No.1 1 5 May 26, 1995 CORE COOLING SYSTEMS BASES (continued) BACKGROUND (continued) from released reactor coolant water and containment sprays after a LOCA.Recirculation of the water for core cooling and containment sprays then provides mixing to achieve a uniform solution pH. The dodecahydrate form of TSP is used because of the high humidity in the containment building during normal operation. Since the TSP is hydrated, it is less likely to abso~rb large amounts of water from the humid atmosphere and will undergo less physical and chemical change than the anhydrous form of TSP.APPLICABLE SAFETY ANALYSES The LOCA radiological consequences analysis takes credit for "iodine retention in the sump solution based on the recirculation water pH being S7.0. The radionuclide releases from the containment atmosphere and the consequences of a LOCA would be increased if the pH of the recirculation water were not adjusted to 7.0 or above.LIMITING CONDITION FOR OPERATION The TSP is required to adjust the pH of the recirculation water to Z 7.0 after a LOCA. A pH 7.0 after a LOCA is necessary to prevent significant amounts of iodine released from fuel failures and dissolved in the recirculation water from converting to a volatile form and evolving into the containment atmosphere. Higher levels of airborne iodine in containment may increase the release of radionuclides and the consequences of the accident. A pH 7.0 is also necessary to prevent SCC of austenitic stainless steel components in containment. SCC increases the probability of failure of components. The required amount of TSP is based upon the extreme cases of water volume and pH possible in the containment sump after a large break LOCA. The minimum required volume is the volume of TSP that will achieve a sump solution pH of 7.0 when taking into consideration the maximum possible sump water volume and the minimum possible pH. The amount of TSP needed in the containment building is based on the mass of TSP required to achieve the desired pH. However, a required volume Is specified, rather than mass, since it Is not feasible to weigh the entire amount of TSP In containment. The minimum required volume is based on the manufactured density of TSP dodecahydrate. Since TSP can have a tendency to agglomerate from high humidity In the containment building, the density may increase and the volume decrease during normal plant operation. Due to possible agglomeration and increase in density, estimating the minimum volume of TSP in containment is conservative with respect to achieving a minimum required pH.MILLSTONE UNIT NO. 3 B 3/4 5-4 Amendment No. 115 0303 LBDCR 12-MP3-010 September 20, 2012 EMERGENCY CORE COOLING SYSTEMS BASES (Continued) APPLICABILITY In MODES 1, 2, 3, and 4, a design basis accident (DBA) could lead to a fission product release to containment, that leaks to the secondary containment boundary. The large break LOCA, on which this system's design is based, is a full-power event. Less severe LOCAs and leakage still require the system to be OPERABLE thraoughout these MODES. The probability and severity of a LOCA decrease as core power and reactor coolant system pressure decrease. With the reactor shut down, the probability of release of radioactivity resulting from such an accident is low.In MODES 5 and 6, the probability and consequence of a DBA are low due to the pressure and temperature limitations in these MODES. Under these conditions, the SLCRS is not required to be OPERABLE.ACTIONS If it is discovered that the TSP in the containment building sump is not within limits, action must be taken to restore the TSP to within limits. During plant operation, the containment suinp is not accessible and corrections may not be possible.The 7-day Completion Time is based on the low probability of a DBA occurring during this period. The Completion Time is adequate to restore the volume of TSP to within the technical specification limits.If the TSP cannot be restored within limits within the 7-day Completion Time, the plant must be brought to a MODE in which the LCO does not apply. The specified Completion Times for reaching MODES 3 and 4 are those used throughout the technical specifications; they were chosen to allow reaching the specified conditions from full power in an orderly manner and without challenging plant systems.SURVEILLANCE REQUIREMENTS Surveillance Requirement

4.5.5 Periodic

determination of the volume of TSP in containment must be perfonned due to the possibility of leaking valves and components in the containment building that could cause dissolution of the TSP during nonmal operation. This requirement ensures that there is an adequate volume of TSP to adjust the pH of the post LOCA sump solution to a value > 7.0. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B 3/4 5-5 MILLTON -NIT3 B3/45-5Amendment No. 14-5-, 204

• 0 REVERSE OF PAGE B 3/4 5-5 i TNTENTIONALLY LEFT BLANK 0 LBDCR No. 06-MP3-026 October* 15,. 2006 3/4.6 CONTAINMENT sYSTEMS BASES 3/4.6.1 PRIMARY CONTAINMENT 3/4.6.1.1

'CONTAINMENT INTEGRITY Primary CONTAINMENT INTEGRITY ensures that the release of radioactive materials from the containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the safety analyses. This restriction, in conjunction with the leakage rate limitation, will. limit the SITE BOUNDARY radiation doses to within the dose guidelines of 10 CFR 50.67 during accident conditions and the control room operators dose to withinthe guidelines of GDC 19.* Prim~ary .CONTAINM. ENT INTEGR.TY is-req~ui.red i:.n .MODE...!.h_.ugl;;:, 4 i .......press~ure, low pressufizer pressure and low steam~line pressure. In MODE 4 the automatic containment isolation* signals generated by high containment pressure, low pressurizer pressure and 1 0ow steamline pressure .ar~e not required to be OPERABLE. Automatic actuation of the containment i solation system in-MODE 4 is not required because adequate time is available for plant operators to evaluate plant Conditions and respond by manually operating engineered safety features components. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. Since the manual actuation pushbuttons porti~on.;of the containment isolation system is required to be OPERABLE in MODE 4, the plant operators can. use the manual pushbuttons to rapidly position all automatic containment isolation valves to the required accident positioni. Therefore, the containment isolation actuation pushbuttons satisfy the requirementfor an OPERABLE containment automatic isolation valve system in MODE 4." 3/4.6.1.2 CONTAINMENT LEAKAGE The limitations on containment leakage rates, as specified in the Containment Leakage Rate Testing Program,. ensure that the total containment~leakage volume will not exceed the value assumed in the safety analyses at the peak accident pressure, P a- As an added conservatism, the measured overall integra~ted leakage rate is flurther limited to less than 0.75 La during performnance of the periodic test to account for possible degradation of the containment leakage barriers between leakage tests..*The Limiting Conditioh for Operation defines the limitations on containment leakage.The leakage rates are verified by surveillance testing as specified in the Containment Leakage Rate Testing Program, in accordance with therequirements of Appendix J. Although the LCO specifies the leakage rates at accident pressure, Pa, it is not feasible to perform a test at such an exact vahue for~pressiire. Consequently, the surveillance testing is performed at a pressure greater than or equal to Pa to. account for test instrument uncertainties and stabilization changes. This conservative test pressure en'sures that the measured leakage rates MILLSTONE -UNIT 3 B 3/4 *6-1 Amendment No. 5gg, 89, 1-, 54, 4-1-6, 2-1-6 NRC Verbal Acknowledgement: 07/05/07 May 15, 2002 3/4.6 CONTAINMENT SYSTEMS BASES 3/4.6.1.2 CONTAINMENT LEAKAGE (continued) are representative of those which would occur at accident pressure while meeting the intent of the LCO. This test methodology is in accordance with the Containment Leakage Rate Testing Program.The surveillance testing. for~measuring leakage rates' are in accordance with the Containment Leakage Rate Testing Program.The enclosure building bypass leakage paths are listed in the "Technical Requirements Manual." The addition or deletion of the enclosure buiilding bypass leakage paths shall be made in accordance with Section 50.59 of 10CFR50.and approved by the Plant Operations Review Committee. Th& requireiiii:

t~ ar6 "ri:di~fi~d

!by a -1f46tg That allow6 'nfy it:id exift (6efon.repairs on the affected air lock components. .This means there, m~ay be a short time during which the containment boundary .is not intact (e.g., duri~ng access through the OPERABLE door). The -ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an evenit that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After.each entry and exit, the OPERABLE door must be immediately closed.ACTION a.. is only applicable when one air lock door is inoperable.. With only one air lock door inoperable, the remaining OPERABLE air lock door murst be verified closed within 1 hour. This ensures a leak tight containment barrier is maintained by use of the remaining* OPERABLE air lock door. The 1lhour requirement is consistent with the requirements of.Technical Specification 3.6.i. 1 to restore CONTAINMENT INTEGRITY. In addition, the remaining OPERABLE air lock door must be locked closed within 24 hours and then verified periodically to ensure an acceptable containment leakage bounda~ry is maintained. Otherwise, a plant shutdown is required.ACTION b. is only applicable when the air lock door intdrlock mechanism is inoperable. With only the air lock interlock mechanism inoperable, an. OPERABLE air lock door must be verified closed within 1 hour. This ensures a leak tight containment barrier is maintained by use of an OPERABLE air lock door. The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore.CONTAJNMENT INTEGRITY. In addition, an OPERABLE air" lock door must be locked closed within 24 hours and then verified periodically to ensure an acceptable containment leakage boundary is maintained. Otherwise, a. plant shutdown is required. In addition, entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i. e., the individual perfoimas the function of the in~terlock) is permitted. ACTION c. is applicable when both air lock doors, are inoperable, or the air lock is inoperable for any other reason excluding the door interlock mechanism. With both air lock doors inoperable or the air lock otherwise inoperable, an evaluation of the overall containmaent leakage rate per Specification 3.6.1.2" MILLSTONE -UNIT 3 B 3/4 6-1la Amendment No. 59189, 4-4,4--7-7,4-1-6, 205 3/4.6 .CONTAINMENT SYSTEMS.-May 15, 2002 BASES 3/4.6.1.3. CONTAINMENT.AIR.LOCKS (continued). shall be initiated immediately, and an air lock door must be verified closed within 1.hour. .An evaluation..is acceptable since it is overly .conservative to.i y decl.are .the. cont ai nment .i noper.ab~le eif both doors in the. air .lock. have.failed, a seal-test or if overall a~ir.lockileakage

• is not within limi~ts. In many.instances (e.g.,i .only..one.

seal iper doQor has fai~led), containment: remains OPERABLE, yet only 1 hour (.per'..S'pecificati~on"3.6.1.1). woul'd'.be provided to.restore the air .lock to OPERABLE status pri~or to requiri~ng ap1lant s~hutdown.. In addition,, even with both.'dOors .fail inlg the seal test., .the. ove~rall, leakage rate can still be within limits. The 1 hour requirement is consistent with the requirements of Technical Specification 3.6.1.1 to restore CONTAINMENT INTEGRITY. In'addit~ion, the air.lock, and/or at least one air lock door' must be.restored to .OPERABLE. status within .24 hours or a-plant *shutdown is..required... SurveilIlance Requi rement 4 .*6.1..3. a .veri fi es leakage through the .cont ainment air l ock..i~s within' the requirements specified in' the. Containment .Leakage, Rate.Testing Program. T!he containment air *lock leakage results are account'ed for in the combined: Type Band C containment, leakage, rate. Failure of an a'ir lock door does not invalidate the previous satisfactory overall air lock leakage test because either air lock door is capable of providing a fission product barrier in the event of a design basis accident.The .limitations on. closure rate for .the containment air locks are required to meet the restrictions on CONTAINMENT INTEGRITY and containment leak rate. Surveillance.testing of the air lock seals is performed in accordance with the Containment Leakage Rate Testing Program, which ensures that the overall air lock leakage will not become excessive due .to seal damage during the intervals between air lock leakage tests. While the leakage rate limitation is specified at accident pressure, Pa the actual surveillance testing is performed by applying a pressure greater than or equal to Pa. This higher pressure accounts for test instrument uncertainties and test volume stabilization changes which occurs under actual test conditions. 3/4.6.1.4 and 3/4.6.1.5 AIR PRESSURE and AIR TEMPERATURE The limitations on containment pressure and average air 'temperature ensure that: (1) the containment structure is prevented from exceeding its design negative pressure 'of 8 psia, and (2) the containment peak pressure does not exceed the design pressure of 60 psia during LOCA conditions. Measure-ments .shall be made at all listed locations, whether by fixed or portable instruments, prior to determining the average air temperature. The limits on the pressure and average air temperat~ure are consistent with the assumptions of the safety analysis. The minimum total containment pressure of 10.6 psia is determined by summing the minimum 'permissible. air partial pressure of.8.9 psia and the maximum expected vapor pressure of .l.7 psia (occurring at the maximum permissible containment initial temperature of 120 0 F).MILLSTONE -UNIT 3 B3 3/4 6-lb Amendment No. ;I#082 77, 7 zo25 REVERSE OF PAGE B 3/4 6-lb INTENTIONALLY LEFT BLANK June 3, 2002 CONTAINMENT SYSTEMS BASES 3/4.6.1.6 CONTAINMENT STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the containment will be manahtained comparable to the original design standards for the life of the facility. Structural integrity is required to ensure that the containment will withstand the maximum pressure of 60 psia in the event of a LOCA. A visual inspection, in accordance with the Containment Leakage Rate Testing Program, is sufficient to demonstrate this capability. 3/4.6.1.7 CONTAINMENT VENTILATION SYSTEM The 42-inch containment purge supply and exhaust isolation valves are required to be locked closed during plant operation since these valves have not been demonstrated capable of closing during a LOCA or steam. line break accident. Maintaining these valves closed during plant operations ensures that excessive quantities of radioactive materials will not be released via the Containment Purge System. To provide assurance that these containment valves cannot be inadvertently opened, the valves are locked closed in accordance with Standard Review Plan 6.2.4 which incudes mechanical devices to seal or lock the valve closed, or prevents power from being supplied to the valve operator.The Type C testing frequency required by 4.6.1.2 is acceptable, provided that the resilient seats of these valves are replaced every other refueling outage.3/4.6.2 DEPRESSURIZATION AND COOLING SYSTEMS 3/4.6.2.1 and 3/4.6.2.2 CONTAINMENT OUENCH SPRAY SYSTEM and RECIRCULATION SPRAY SYSTEM The OPERABILITY of the Containment Spray Systems ensures that containmeflt depressurization and iodine removal will occur in the event of a LOCA. The pressure reduction, iodine removal capabilities and resultant containment leakage are consistent with the assumptions used in the safety analyses.LCO 3.6.2.2 One Recirculation Spray System consists of:* Two OPERABLE contaimnent recirculation heat exchangers

• Two OPERABLE contaiznment recirculation pumps The Contaimnent Recirculation Spray System. (RSS) consists of two paralle redundant subsystems which feed two parallel 360 degree spray headers. Each subsystem consists of two pumps and two heat exchangers.

Train A consists of 3RSS*P1A and 3R5S*P1C. Tamn B consists of 3RSS*PIB and 3RSS*PID.MILLSTONE -UNIT 3 B 3/4 6-2 Amendment No. 145,4-4,"Revised by NRC Letter A15710" LIBDCR 12-MP3-010 September

20. 2012 CONTAINMENT SYSTEMS BASES The design of the Containment RSS is sufficiently independent so that an active failure in the recirculation spray mode, cold leg recirculation mode, or hot leg recirculation mode of the ECCS has no effect on its ability to perform its engineered safety function.

In other words, the failure in one subsystem does not affect the capability of the other subsystem to perfonn its designated safety function of assuring adequate core cooling in the event of a design basis LOCA. As long as one subsystem is OPERABLE, with one pump capable of assuring core cooling and the other*pump capable of removing heat from containment, the RSS system meets its design requirements. The LCO 3.6.2.2. ACTION applies when any of the RSS pumps, heat exchangers, or associated components are declared inoperable. All four RSS pumps are required to be OPERABLE to meet the requirements of this LCO 3.6.2.2. During the injection phase of a Loss Of Coolant Accident all four RSS pumps would inject into containment to perform their contaimnent heat removal function. The minimum requirement for the RSS to adequately perform this function is to have at least one subsystem available. Meeting the requirements of LCO 3.6.2.2. ensures the minimum RSS requirements are satisfied. Surveillance Requirement 4.6.2.2.c requires that verification is made that on a CDA test signal, each RSS pump starts automatically after receipt of an RWST Low-Low level signal. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.6.2.1.d and 4.6.2.2.e require verification that each spray nozzle is unobstructed following maintenance that could cause nozzle blockage. Nonnal plant operation and maintenance activities are not expected to trigger performance of these surveillance requirements. However, activities, such as an inadvertent spray actuation that causes fluid flow through the nozzles, a major configuration change, or a loss of for~eign material control when working within the respective system boundary may require surveillance performance. An evaluation, based on the specific situation, Will detennine the appropriate test method (e.g., visual inspection, air or smoke flow test) to verify no nozzle obstruction. MILLSTONE -UNIT 3 B3462 mnmn o B 3/4 6-2a Amendment No. LBDCR 12-MIP3-010 September 20, 2012 CONTAINMENT SYSTEMS BASES 3/4.6.3 CONTAINMEvffNT ISOLATION VALVES The OPERABILITY of the contairnment isolation valves ensures that the containment atmosphere will be isolated from the outside environment in the event of a release of radioactive material to the containment atmosphere or pressurization of the containment and is consistent with the requirements of General Design Criteria 54 through 57 of Appendix A to 10 CFR Part 50. Containment isolation within, the time limits specified for these isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a LOCA. FSAR Table 6.2-65 lists all containment isolation valves. The addition or deletion of any contaimnent isolation valve shall be made in accordance with Section 50.59 of 10OCFR50 and approved by the committee(s) as described in the QALP Topical Report.For the purposes of meeting this LCO, the safety function of the containment isolation valves is to shut within the time limits assumed in the accident analyses. As long as the valves can shut within the time limits assurned in the accidefit analyses, the valves are OPERABLE. Where the valve position indication does not affect the operation of the valve, the indication is not required for valve OPERABILITY under this LCO. Position indication for contaimnent isolation valves is covered by Technical Specification 6.8.4.e., Accident Monitoring Inastrumentation. Failed position ...indication on these valves must be restored "as soon as practicable" .as re quired by Technical Specification 6.8.4.e.3. Maintaining the valves OPERABLE, when position indication fails, facilitates troubleshooting and correction of the failure, allowing the indication to be restored "as soon as practicable.".. With one or more penetration flow paths with one containanent isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and deactivated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. If the containment isolation valve on a closed system becomes inoper'able, the remaining barrier is a closed system since a closed system is an acceptable alternative to an automatic valve.However, actions must still be taken to meet Technical Specification ACTION 3.6.3 .d and the valve, not nonnally considered as a containment isolation valve, and closest to the containment wall should be put into the closed position. No leak testing of the alternate valve is necessary to satisfy the ACTION statement. Placing the manual valve in the closed position sufficiently deactivates the penetration for Technical Specification compliance." Closed system isolation valves applicable to Technical Specification ACTION 3.6.3.d are included in FSAR Table 6.2-65, and are the isolation valves for those penetrations credited as General Design Criteria 57. The specified time (i.e., 72 hours) of Technical Specification ACTION 3.6.3.d is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3 and 4. In the event the affected penetration is isolated in accordance with 3.6.3.d, the affected penetration flow path must be verified to be isolated on a periodic basis, (Surveillance Requirement 4.6.1.1 .a). This is necessary to assure leak tightness of contaimnent and that containment penetrations requiring isolation following an accident are isolated. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B 3/4 6-3 MILLTONE-UNT 3 3/46-3Ameihdment No. 2-8, 62:-, 4-4-2_,2-- LBDCR 05-MiP3-028 November 30, 2005 CONTAINMENT SYSTEMS O BASES For the purposes of meeting this LCO, neither the containmaent isolation valve, nor any alternate valve on a closed system have a leakage limit associated with valve OPERABILITY. The opening of contafinment isolation valves on an fintermittent basis under administrative controls includes the following considerations: (1) stationing an operator, who is in constant communication with the control room, at the valve controls, (2) instructing this operator to close these valves in an accident situation, and (3) assuring that environmnental conditions will not preclude access to close the valves and that this action will prevent the release of radioactivity outside the containment. The appropriate administrative controls, based on the above considerations, to allow containment isolation valves to be opened are contained in the procedures that will be used to operate the valves. Entries should be placed in the Shift Manager Log when these valves are opened or closed. However, it is not necessary to log into any Technical Specification ACTION Statement for these valves, provided the appropriate administrative controls have been established. Opening a closed containmaent isolation valve bypasses a plant design feature that prevents the release of radioactivity outside the contafi~nment. Therefore, this should not be done frequently, and the time the valve is opened should be minimized. The determination of the appropriate administrative controls for containment isolation valves requires an evaluation of the 'expected environmnental conditions. This evaluation must conclude environmental conditions will not preclude access to close the valve, and this action will prevent the release of radioactivity outside of contafinment through the respective penetration. When the Residual Heat Removal (RHR) System is placed in. service finthe plant cooldown mode of operation, the RIIR suction isolation remotely operated valves 3RHS*MV8701A and 3RHS*MV8701B, and/or 3RTIS*MV8702A and 3RP-IS*MV8702B are opened. These valves are nonnally operated fr~om the control room. They do not receive an automatic containment isolation closure signal, but are interlocked to prevent their opening if Reactor Coolant System (RCS) pressure is greater than approximately 412.5 psia. When any of these valves are opened, either one of the two required licensed (Reactor Operator) control room operators can be credited as the operator required for administrative control. It is not necessary to use a separate dedicated operator.3/4.6.4 DELETED MILLSTONE -UNIT 3 B 3/4 6-3a Amendment No. 2--, 6-3, -42_ ---,0 Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028 November 30, 2005 THIS PAGE INTENTIONALLY LEFT BLANK 9 YILLSTONE -UNIT. 3 B 3/4 6-3b Amendment No. , 6-3,. 4-4, 24l-6,.Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028 November 30, 2005 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE -uNIT3 B 3/46-3c Amendment No. 6-3-, 442, 6 Acknowledged by NRC Letter dated 04/12/06 LBDCR 05-MP3-028 November 30, 2005 CONTAINMENT SYSTEMS BASES 3/4.6.5 SUJBATMOSPHERIC PRESSURE CONTROL SYSTEM 3/4.6.5.1 STEAM JET AIR EJECTOR The closure of the isolation valves in the suction of the steam jet air ejector ensures that: (1) the containment internal pressure may be maintained within its operation limits by the mechanical vacuum pumps, and (2) the containment atmosphere is isolated from the outside environment in the event of a LOCA. These valves are required to be closed for containment isolation. MILLSTONE -UNIT 3 B 3/4 6-3d... Amendment No. 3-3, 4-42, 216, Acknowledged by NRC Letter dated 04/12/06 REVERSE OF PAGE B 314 6-3d INTENTIONALLY LEFT BLANK June 3, 2002 CONTAINMENT SYSTEMS BASES 3/4.6.6 SECONDARY CONTAINMENT 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM B ack ground.The OPERABILITY of the Supplementary Leak Collection and Release System (SLCRS)ensures thatradioactive materials that leak from the primary containment into the Secondary Containment following a Design Basis Accident (DBA) are filtered out and adsorbed prior to any.release to the environment. SLCRS Ductwork Integrity: The Supplementary Leak Collection and Release System (SLCRS) remains OPERABLE with the following bolting*configuration:

a. For 311VR*DMPF44:

• Eight bolts properly installed on the ductwork access panels.* At least one bolt must be installed in each corner area.*The remaining bolts should be installed in the center area of each side.b. For 3HVR*DMPF29:
• 12 bolts properly installed on the ductwork access panel.* At least one bolt must be installed in each corner area.* The remaining bolts should be approximately equally spaced along each side with two bolts per side.With the above bolting specified for- 3HVR*DMPF44 and 3HVR*DMPF29, reference* (l)concluded the foillowing:..
• Any leakage around the plates is minimal and causes negligible effect on the performance of the SLCRS system.* Assures the gasket will not be extruded from between the plate and duct flange when the. SLCRS fans are started.* The remaining bolts may be installed with the fans running.* Provides adequate structural integrity in the seismic event based on engineering analysis.Applicable Safety Analyses The SLCRS design basis is established by the consequences of the limiting DBA, which is a LOCA. The accident analysis assumes that only one train of the SLCRS and one train of the.auxiliary building filter system is functional due to a single failure that disables the other train.The accident analysis accounts for the reduction of the airborne radioactive material provided by the remaining one train of this filtration system. The amount of fission products available for release from the containment is determined for a LOCA.The SLCRS is not normally in operation.

The SLCRS starts on a SIS signal. The modeled SLCRS actuation in the safety analysis (the Millstone 3 MILLSTONE -UNIT 3 B 3/4 6-4 Amendment No. 87 4-2-6,"Revised by NRC Letter A15710". LBDCR No. 04-MP3-015 February 24, 2005 CONTATNMENT SYSTEMS BASES O 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued) FSAR Chapter 15, Section 15.6) is based upon a worst-case response time following an SI initiated at the limiting setpoint. One train of the SLCRS in conjunction with the Auxiliary Building Filter (ABF) system is capable of drawing a negative pressure (0.4 inches water gauge at.the auxiliary building 24'6" elevation) within 120 seconds after a LOCA. This time includes diesel generator startup and sequencing time, system startup time, and time for the system to attain the required negative pressure after starting.LCO In the event of a DBA, one SLCRS is required to provide the minimum postulated iodine removal assumed in the safety analysis. Two trains of the SLCRS must be OPERABLE to ensure that at least one train will operate, assuming that the other train is disabled by a single-active failure. The SLCRS works in conjunction with the ABF system. Inoperability of one train of the ABF system also results in inoperability of the corresponding train of the SLCRS. Therefore, whenever LCO 3.7.9 is entered due to the ABF train A (B) being inoperable, LCO 3.6.6.1 must be entered due to the SLCRS train A (B3) being inoperable. When a SLCRS LCO is not met, it is not necessary to declare the secondary containment inoperable. However, in this event, it is necessary to determine that a loss of safety function does not exist. A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed. Applicability In MODES 1, 2, 3, and 4, a DBA could lead to a fission product release to containment that leaks to the seco~idar contaipnment. Th~e !rge b~reak LOCA, o~n whic. sys!ter's d~e sign is based, is a full- power event. Less severe LOCAs and leakage still require the syst.em to be OPERABLE throughout these MODES. The probability and severity of a LOCA decrease as*core power and reactor coolant system pressure decrease. With the reactor shut down, the probability of release of radioactivity resulting from such, an accident is low.In MODES 5 and 6, the probability and consequences of a DBA are low due to the pressure and temperature limitations in these MODES. Under these conditions, the SLCRS is not required to be OPERABLE.ACTIONS With one SLCRS train inoperable, the inoperable train must be restored to OPERABLE status within 7 days. The OPERABLE train is capable of providing 100 percent of the iodine removal needs for a DBA. The 7-day Completion Time is based on consideration of such factors* as the reliability of the OPERABLE redundant SLCRS train and the low probability of a DBA occurring during this period. The Completion Time is adequate to make most repairs. If the SLCRS cannot be restored to OPERABLE status :within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and MODE 5 within the following 30 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full-power conditions in an orderly manner and without challenging plant systems.MILLSTONE -UNIT 3 B 3/4 6-5 Amendment No. g-7, -I-2-6, Acknowledged by NRC letter dated 08/25/05 LBDCR 12-MTP3-010 September 20, 2012 CONTAINMENT SYSTEMS BASES 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued) Surveillance Requirements Cumulative operation of the SLCRS with heaters operating for at least 10 continuous hours is sufficient to reduce the buildup of moisture on the adsorbers and HEPA filters. The surveillance frequency is controlled under the Surveillance Frequency Control Program.b, c, e, and f These surveillances verify that the required SLCRS filter testing is performed in accordance with Regulatory Guide 1.52, Revision 2. ANSI N510-1980 shall be used in place of ANSI N510-1975 referenced in Regulatory Guide 1.52, Revision 2. Laboratory testing of methyl iodide penetration shall be performed in accordance with ASTM D3803-89 and Millstone Unit 3 specific parameters. The surveillances include testing HEPA filter perfonnance,. charcoal adsorber efficiency, system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). The heater kW measured must be corrected to its nameplate rating.Variations in system voltage can lead to measurements of kW which cannot be compared to the nameplate rating because the output kW is proportional to the square of the voltage.Any time the OPERABILITY of a HEPA filter or charcoal adsorber housing has been affected by repair, maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. The 720 hours of operation requirement originates from Regulatory Guide 1.52, Revision 2, March 1978, Table 2, Note "c", which states that "Testing should be performed (1) initially, (2) at least once per 18 months thereafter for systems maintained in a standby status or after 720 hours of system operations, and (3) following painting, fire, or chemical release in any ventilation zone colmmunicating with the system." This testing ensures that the charcoal adsorbency capacity has not degraded below acceptable limits, as well as providing trend data. The 720 hour figure is an arbitrary number which is equivalent to a 30 day period.. This criteria is directed to filter systems that are normally in operation and also provide emergency air cleaning functions in the event of a Design Basis Accident. The applicable filter units are not normally in operation and the sample canisters are typically removed due to the 18 month criteria.d The periodic automatic startup ensures that each SLCRS train responds properly. The surveillance frequency is controlled under the Surveillance Frequency Contr'ol Program. The surveillance verifies that the SLCRS starts on a SIS test signal. It also includes the automatic functions to isolate the other ventilation systems that are not part of the safety-related postaccident operating configuration and to start up and to align the ventilation systems that flow thr'ough the secondary contaimunent to the accident condition. MILLSTONE -UNIT 3 B 3/4 6-6 MILSTOE UNT 3B /4 -6Amendment No. 8-- 23-, 84-,--2-06 LBDCR 05-MIP3-025 March 7, 2006 CONTAINMENT SYSTEMS BASES 3/4.6.6.1 SUPPLEMENTARY LEAK COLLECTION AND RELEASE SYSTEM (Continued)

• The main steam valve building ventilation system isolates.* Auxiliary building ventilation (normaal) system isolates.* Charging pump/reactor plant component cooling water pump area cooling subsystem aligns and discharges to the auxiliary building filters and a filter fan starts.* Hydlrogen recombiner ventilation system aligns to the postaccident configuration.
• The engineered safety features building ventilation system aligns to the postaccident configuration.

References:

1. Engineering analysis, Memo MP3-DE-94-539, "Bolting Requirements for Access Panels on Dampers 3HVR*DMPF29

& 44," dated June 16, 1994.MILLTON -NIT B /4 -6aAmendment No. 8-7-, 23-, 84, MILLSTONE -UNIT 3 B 3/4 6-6a LBDCR No. 06-MIP3-026 October 15, 2006 CONTAINMENT SYSTEMS BASES 3/4.6.6.2 SECONDARY CONTAINMENT The Secondary Containment is comprised of the containment enclosure building and all contiguous buildings (main steam valve building [partially]; engineering safety features building[partially], hydrogen recombiner building [partially], and auxiliary building). The Secondary Containment shall exist when: a. Each door in each access opening is closed except when the access opening is being used for normal transit entry and exit, b. The sealing mechanism associated with each penetration (e.g., Welds, bellows, or 0-rings) is OPERABLE.Secondary Containment ensures that the release of radioactive materials from the primary containment atmosphere will be restricted to those leakage paths and associated leak rates assumed in the safety analyses. This restriction, in conjunction with operation of the Supplemnentary Leak Collection and Release System, and Auxiliary Building Filter System will limit the SITE BOUNDARY radiation doses to within the dose guideline values of 10 CFR 50.67 during accident conditions. The SLCRS and the ABF fans and filtration units are located in the auxiliary building. The SLCRS is described in the Millstone Unit No. 3 FSAR, Section 6.2.3.order to ensure a negative pressure in all areas within the Secondary Containment under most meteorological conditions, the negative pressure acceptance criterion at the measured location (i.e., 24' 6" elevation in the auxiliary building) is 0.4 inches water gauge.LCO The Secondary Containment OPERABILITY must be maintained to ensure proper operation of the SLCRS and the auxiliary building filter system and to limit radioactive leakage fr'om the containment to those paths and leakage rates assumed in the accident analyses.Applicability Maintaining Secondary Contaimnent OPERABILITY prevents leakage of radioactive material fr'om the Secondary Containment. Radioactive material may enter the Secondary Containment from the containment following a LOCA. Therefore, Secondary Containment is required in MODES 1, 2, 3, and 4 when a design basis accident such as a LOCA could release radioactive material to the containment atmnosphere. MILLSTONE -UNIT 3 B 3/4 6-7 Amendment No. 8-7-, 4--26 NRC Verbal Acknowledgement: 97/05/07 LBDCR 12-MP3-010 September 20, 2012 CONTAINMENT SYSTEMS 1 BASES 3/4.6.6.2 SECONDARY CONTAINMENT (continued) In MODES 5 and 6, the probability and consequences of a DBA are low due to the RCS temperature and pressure limitation in these MODES. Therefore, Secondary Containmrent is not required in MODES 5 and 6.ACTIONS In th~e event Secondary Containment OPERABILITY is not maintained, Secondary Containment OPERABILITY must be restored within 24 hours. Twenty-four hours is a reasonable Completion Time considering the limited leakage. design of contaimnent and the !ow probability of a DBA occurring during this time period.Inoperability of the Secondary Contahunent does not make the SLCRS fans and filters inoperable. Therefore, while in this ACTION Statement solely due to inoperability of the Secondary Containment, the conditions and required ACTIONS associated with Specification 3.6.6.1 (i.e., Supplementary Leak Collection and Release System) are not required to be entered.If the Secondary Containment OPERABILITY cannot be restored to OPERABLE status within the required completion time, the plant must be brought to a MODE in which the LCO does apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and toW MODE 5 within the following 30 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full-power conditions in an orderly manner and without challenging plant Systems.Surveillance Requirements 4.6.6.2.1 Maintaining Secondary Containment oPERABILITY requires maintaining each door in each access opening in a closed position except when the access opening is being used for normal entry! and exit. The normal time allowed for passage of equipment and personnel through each access opening at a time is defined as no more than 5 minutes. The access opening shall not be blocked open. During this time, it is not considered necessary to enter the ACTION statement. A 5-minute time is considered acceptable since the access opening can be quickly closed without special provisions and the probability of occurrence of a DBA concurrent with equipment andlor personnel transit time of 5 minutes is low.The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B3468AedetN.~-2 B 3/4 6-8 Amendment No. 8-7-, February 5, 1998 CONTAINMENT SYSTEMS BASES 3/4.6.6.2 SECONDARY CONTAINMENT (continued) 4.6.6.2.2 The ability of a SLCRS to produce the required negative pressure during the test operation within the required time provides assurance that the Secondary Containment is adequately sealed.With the SLCRS in postaccident configuration, the required negative pressure in the Secondary Containment is achieved, in 110 seconds from the time of simulated emergency diesel generator breaker closure. Time delays of dampers and, logic delays must be accounted for in this surveillance. The time to achieve the required negative pressure is 120 seconds, with a loss-of-offsite power coincident with a SIS. The surveillance verifies that one train of-'SLCRS in conjunction with the ABF system will produce a negative pressure of-O.4 inches water gauge at the auxiliary building 24'6" elevation relative to the outside atmosphere in the Secondary Containment. For the purpose of this surveillance, pressure measurements will be made at the 24'6" elevation in the auxiliary building. This single location is considered to be adequate and representative of the entire Secondary Containment due to the large cross-section of the air passages which interconnect the various buildings within the Secondary Containment. In order to ensure a negative pressure in all areas inside the Secondary Containment under most meteorological conditions, the negative pressure acceptance criterion at the measured location is_0.4 inch water gauge. It is recognized that there will be an occasional meteorological condition under which slightly positive pressure may exist at some localized portions of the boundary (e.g., the upper elevations on the down-wind side of a building). For example, a very low outside temperature combined with a moderate wind speed could cause a slightly positive pressure at the upper elevations of the containment enclosure building on the leeward face. The probability of occurrence of meteorological conditions which could result in such a positive differential pressure condition in the upper levels of the enclosure building has been estimated to be less than 2% of the time.The probability of wind speed within the necessary moderate band, combined with the probability of extreme low temperature, combined with the small portion of the boundary affected, combined with the low probability of airborne radioactive material migrating to the upper levels ensures that the overall effect on the design basis dose calculations is insignificant. The SLCRS system and fan sizing was based on an estimated infiltration rate. The fan flow rates are verified within a minimum and maximum on a monthly basis. Initial testing verified that the drawdown criterion was met at the lowest acceptable flow rate. The new standard Technical Specification (NUREG-1431) 3.6.6.2 surveillance requirement requires that the drawdown HILLSTONE -UNIT 3 B 3/4 6-9 MILLTONE-UNT 3 3/46-9Amendment No. F7, 126 February 5, 1996 CONTAINMENT SYSTEMS BASES 3/4.6.6,2 SECONDARY CONTAINMENT (continued) criterion be met while not exceeding a maximum flow rate. It is assumed that the purpose of this flow limit is to ensure that adequate attention is given to maintain the SLCRS boundary integrity and not using excess system capacity to cover .for boundary degradation. The SLCRS system was designed with minimal marginand, therefore, does not have excess capacity that can be substituted for boundary integrity. Additionally, since SLCRS fan flow rates are verified to be acceptable on a more frequent basis than the drawdown test surveillance, and by means of previous testing the minimum flow rate is acceptable, verifying a flow rate during the drawdown test would not provide an added benefit. Historical SLCRS flow measurements show a lack of repeatability associated with the inaccura-cies of air flow measurement. As a result, the more reliable verification of system performance is the actual negative pressure generated by the drawdown test and a measured flow rate would add little.3/4.6.6.3 SECONDARY CONTAINMENT STRUCTURAL INTEGRITY This limitation ensures that the structural integrity of the Secondary Containment will be maintained comparable to the original design standards for the life of the facility. Structural integrity is required to provide a secondary boundary surrounding the primary containment that can be maintained at a negative pressure during accident conditions. A visual inspection is sufficient to demonstrate this capability. MILLSTONE -UNIT 3 B s/4 6-zo MILLTON -NIT B /4 -10Amendment No. F7, 126 LBDCR-.07-MP3 -037 July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES BACKGROUND The primary purpose of the main steam line Code safety valves (MSSVs) is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available. Five MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in the FSAR, Section 10.3.1 (Reference 1). The MSSVs must have sufficient capacity to limit the secondary system pressure to less than or equal to 110% of the steam generator design pressure in order to meet the requirements of the ASME Code, Section III (Reference 2). The design minimum total relieving capacity for all valves on all of the steam lines is 1.579 x 107 lbs/hr which is 105% of total secondary steam flow of 1.504 x 10 lbs/h at 100%RATED THERMAL POWER. The MSSV design includes staggered setpoints, according to Table 3.7-3 in the accompanying LCO, so that only the needed valves will actuate. Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine reactor trip. Table 3.7-3 allows a +/- 3% setpoint tolerance (allowable value) on the lift setting for OPERABILITY to account for drift over an operating cycle.APPLICABLE SAFETY ANALYSES The design basis for the MSSVs comes from Reference 2 and its purpose is to limit the secondary system pressure to less than or equal to 110% of design pressure for any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis.The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are those characterized as decreased heat removal events, which are presented in the FSAR, Section 15.2 (Reference 3). Of these, the full power turbine trip without steam dump is typically the limiting AOO. This event also terminates normal feedwater flow to the steam generators. The safety analysis demonstrates that the transient response for turbine trip occurring from full power without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System. One turbine trip analysis is performed assuming primary system pressure control via operation of the pressurizer relief valves and spray. This analysis demonstrates that the DNB design basis is met. Another analysis is performed assuming no primary system pressure control, but crediting reactor trip on high pressurizer pressure and operation of the pressurizer safety MILLSTONE -UNIT 3 B 3/4 7-1 MILLTON -NIT3 B3/47-1Amendment No. 4-t02,, 7-, LBDCR_.7-MP3-037 July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) valves. This analysis demonstrates that RCS integrity is maintained by showing that the maximum RCS pressure does not exceed 110% of the design pressure. All cases analyzed demonstrate that the MSSVs maintain Main Steam System integrity by limiting the maximum steam pressure to less than 110% of the steam generator design pressure.In addition to the decreased heat removal events, reactivity insertion events may also challenge the relieving capacity of the MSSVs. The uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power event is characterized by an increase in core power and steam generation rate until reactor trip occurs when either the Overtemperature AT or Power Range Neutron Flux-High setpoint is reached. Steam flow to the turbine will not increase from its initial value for this event.The increased heat transfer to the secondary side causes an increase in steam pressure and may result in opening of the MSSVs prior to reactor trip, assuming no credit for operation of the atmospheric or condenser steam dump valves. The FSAR Section 15.4 safety analysis of the RCCA bank withdrawal at power event for a range of initial core power levels demonstrates that the MSSVs are capable of preventing secondary side overpressurization for this AOO.The FSAR safety analyses discussed above assume that all of the MSSVs for each steam generator are OPERABLE. If there are inoperable Ms sv(s), it is necessary to limit the primary system power during steady-state operation and AOOs to a value that does not result in exceeding the combined steam flow capacity of the turbine (if available) and the remaining OPERABLE MSSVs. The required limitation on primary system power necessary to. prevent secondary system overpressurization may be determined by system transient analyses or conservatively arrived at by a simple heat balance calculation. In some circumstances it is necessary to limit the primary side heat generation that can be achieved during an AOO by reducing the setpoint of the Power Range Neutron Flux-High reactor trip function. For example, if more than one MSSV on a single steam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurring from a~partial power level may result in an increase in reactor power that exceeds the combined steam flow capacity of the turbine and the remaining OPERABLE MSSVs. Thus, for multiple inoperable MSSVs on the same steam generator it is necessary to prevent this power increase by lowering the Power Range Neutron Flux-High setpoint to an appropriate value. If the Moderator Temperature Coefficient (MTC) is positive, the reactor power may increase above the initial value during an RCS heatup event (e.g., turbine trip). Thus, for any number of inoperable MSSVs, it is necessary to reduce the trip setpoint if a positive MTC may exist at partial power conditions, unless it is demonstrated by analysis that a specified reactor power reduction alone is sufficient to prevent overpressurization of the steam system.MILLSTONE -UNIT 3 B347l mnmn o -2 B 3/4 7-1a Amendment No. LBDCR 07-MP3-037 July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) The MSSVs are assumed to have two active and one passive failure modes. The active failure modes are spurious opening, and failure to reclose once openfed. The passive failure mode is .failure to open upon demand.The MSSVs satisfy Criterion 3 of 10 CFR 50.3 6(c)(2)(ii). LCO The accident analysis requires that five MSSVs per steam generator be OPERABLE to provide overpressure protection for design basis transients occurring at 102% RTP. The LCO requires that five MSSVs per steam generator be OPERABLE in compliance with Reference 2, and the DBA analysis.The OPERABILITY of the MSSVs is defined as the ability to open upon demand within the setpoint tolerances, to relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the Inservice Testing Program.This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that challenge to the RCPB, or Main Steam System integrity. APPLICABILITY In MODES 1, 2, and 3, five MSSVs per steam generator are required to be OPERABLE to prevent Main Steam System overpressurization. In MODES 4 and 5, there are no credible transients requiring the MSSVs. The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.ACTIONS ACTIONS are modified by a Note indicating that separate Condition entry is allowed for each MSSV.With one or more MSSVs inoperable, action must be taken so that the available MSSV relieving capacity meets Reference 2 requirements for the applicable THERMAL POWER.MILLSTONE -UNIT 3 B347l mnmn o B 3/4 7-1b Amendment No. LBDCR 07-MP3-037-July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1 .1 SAFETY VALVES (Continued) Operation with less than all five MSSVs OPERABLE for each steam generator is permissible, if THERIMAL POWER is limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam .generator. In the case of only a single inoperable MSSV on one or more steam generators when the Moderator Temperature Coefficient is not positive, a reactor power reduction alone is sufficient to limit primary side heat generation such that overpressurization of the secondary side is precluded for any RCS heatup event. Furthermore, for this case there is sufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Therefore, ACTION a. requires an appropriate reduction in reactor power within 4 hours. If the power reduction is not completed within the required time, the unit must be placed in at least HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following 6 hours.The maximum THERMAL POWER correspondin~g to._he.heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the attachment to Reference 4 with an appropriate allowance for calorimetric power uncertainty. The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined by the governing heat transfer relationship is the equation q = mnAh, where q is the heat input from the primary side, mn is the mass flow rate of the steam, and Ah is the increase in enthalpy that occurs in converting the secondary side water to steam. If it is conservatively assumed that the secondary side water is all saturated liquid (assuming no subcooled feedwater), then the Ah is the heat of vaporization (hfg) at the steam'relief pressure.For each steam generator, at a specified pressure, the maximum allowable power level is determined as follows: 100 w Q- x shfgN Maximum Allowable Power Level < K MILLSTONE -UNIT 3 B347l mnmn o B 3/4 7-1c Amendment No. LBDCR- 07-MP3-037 July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (Continued) Where: Q =Nominal NSSS power rating of the plant (including reactor coolant pump heat), MWt K =Conversion factor, 947.8 2 (Btu/sec)MWt Ws= Minimum total steam flow rate capability of the OPERABLE MSSVs on any one steam generator at the highest OPERABLE MSSV opening pressure including tolerance and accumulation, as appropriate, lb/sec.hfg =Heat of vaporization at the highest MSSV opening pressure including tolerance and accumulation as appropriate, Btu/lbm.N =Number of loops in the plant.For use in determining the % RTP in ACTION a., the Maximum NSSS Power calculated above is reduced by 2% RTP to account for calorimetric power uncertainty. b and c In the case of multiple inoperable MSSVs on one or more steam generators, with a reactor power reduction alone there may be insufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Furthermore, for a single inoperable MSSV on one or more steam generators when the Moderator Temperature Coefficient is positive the reactor power may increase as a result of an RCS heatup event such that flow capacity of the remaining OPERABLE MSSVs is insufficient. The 4 hour completion time to reduce reactor power is consistent with ACTION a. An additional 32 hours is allowed to reduce the Power Range Neutron Flux High reactor setpoint. The total completion time of 36 hours is based on a reasonable time to correct the MSSV inoperability, the time to perform the power reduction, operating experience to reset all channels of a protection function, and on the low probability of the occurrence of a transient that could result in steam generator overpressure during this period. If the required action is not completed within the associated time, the unit must be placed in at least HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following 6 hours.MILLSTONE -UNIT 3 B347i mnmn o B 3/4 7-1d Amendment No. LBDCR 07-MP3-037 July 12, 2007 3/4.7 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 3/4.7.1.1 SAFETY VALVES (.Continued) The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the.: attachment to Reference 4, with an appropriate allowance for nuclear instrumentation system trip channel uncertainties. ..To determine the Table 3.7-1 Maximum Allowable Power for Required ACTIONS b and c (%RTP), the calculated Maximum NSSS Power is reduced by 9% RTP to account for Nuclear Instrumentation System trip channel uncertainties. ACTIONS b and c are modified by a Note. The Note states that the Power Range Neutron Flux High reactor trip setpoint reduction is only required in MODE 1. in MODES 2 and 3 the reactor protection system trips specified in LCO 2.2.1, "Reactor Trip System Instrumentation Setpoints," provide sufficient protection. The allowed completion times are reasonable based on operating experience to accomplish the ACTIONS in an orderly manner without challenging unit systems.d If one or more steam generators have four or more inoperable MSSVs, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, .the unit must be placed in at least HOT STANDBY within the next 6 hours, and in HOT SHUTDOWN within the following 6 hours. The allowed completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE REQUIREMENTS (SR) 4.7.1.1 This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint (Table 3.7-3) in accordance with the Inservice Testing Program. During this testing, the MSSVs are OPERABLE provided the actual lift settings are within +/- 3% of the required lift setting. The ASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7-3 allows a +/- 3% setpoint tolerance for OPERABILITY; however, the valves are reset to +/- 1%during the Surveillance to allow for drift during the next operating cycle. However, if the testing is done at the end of the operating cycle when the plant is being shut down for refueling, MILLSTONE -UNIT 3 B347l mnmn o B 3/4 7-1e Amendment No. LBDCR 07-MIP3-037 July 12, 2007 PLANT SYSTEMS BASES 3/4.7.1 TURBINE CYCLE 314.7.1.1 SAFETY VALVES (Continued') restoration to +/- 1% of the specified lift setting is not required for valves that will not be used (e.g., replaced) for the next operating cycle. While the lift settings are being restored to within the +/- 1%of the required setting, the MS SVs remain OPERABLE provided the actual lift setting is within+/-t 3% of the required setting. The lift settings, according to Table 3.7-3, correspond to ambient conditions of the valve at nominal operating temperature and pressure.This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.REFERENCES

1. FSAR, Section 10.3.1.2. ASMdE, Boiler and Pressure Vessel Code, Section~ III, 1971 edition.3. FSAR, Section 15.2.4. NRC Information Notice 94-60, "Potential Overpressurization of the Main Steam System," August 22, 1994.3/4.7.1.2 AUXILIARY FEED WATER SYSTEM The OPERABILITY of the Auxiliary Feedwater (AFW) System ensures a makeup water supply to the steam generators (SGs) to support decay heat removal from the Reactor Coolant System (RCS) upon the loss of normal feedwater supply, assuming the worst case single failure. The AFW System consists of two motor driven AFW pumps and one steam turbine driven AFW pump. Each motor driven AFW pump provides at least 50% of the AEW flow capacity assumed in the accident analysis.

After reactor shutdown, decay heat eventually decreases so that one motor driven AFW pump can provide sufficient SG makeup flow. The steam driven AFW pump has a rated capacity approximately double that of a motor driven AFW pump and is thus defined*as a 100% capacity pump.Given the worst case single failure, the AFW System is designed to mitigate the consequences of numerous design basis accidents, including Feedwater Line Break, Loss of Normal Feedwater, Steam Generator Tube Rupture, Main Steam Line Break, and Small Break Loss of Coolant Accident.MILLSTONE -UNIT 3 B 3/4 7-2 MILLTON -NIT3 B3/47-2Amendment No. 0-2, 3-, 0, LBDCR 14-MIP3-006 July 8, 2014 PLANT SYSTEMS BASES AUXILIARY FEED WATER SYSTEM (Continued) In addition, given the worst case failure, the AFW is designed to supply sufficient makeup water to replace SG inventory loss as the RCS is cooled to less than 350°F at which point the Residual Heat Removal System may be placed into operation. Motor driven auxiliary feedwater pumps and associated flow paths are OPERABLE in the following alig-nment during normal operation below 10% RATED THIERMVAL POWER.*Motor operated isolation valves (3FWA*MOV35A/B/CiD) are open in MODE 1, 2 and 3,*Control valves (3FWA*HV3 1A/B/C/D) may be throffled or closed during alignment, operation and restoration of the associated motor driven AFW pump for steam generator inventoly control.The motor operated isolation valves must remain fully open due to single failure criteria (the valves and associated pump are powered from the opposite electrical trains).The Turbine Driven Auxiliary Feedwater (TDAFW) pump and associated flow paths are OPERABLE with all control and isolation valves fully open in MODE 1, 2 and 3. Due to High Energy Line Break analysis, the TDAFW pump cannot be used for steam generator inventory control during normal operation below 10% RATED THERMAL POWER.At M/IPS 3, only two of the three available steam supplies are required to establish an OPERABLE steam supply sys~tem. With one of the two required steam supplies inoperable, normally the third steam supply will be used to satisfy the requirement for two OPERABLE steam supplies. If the third steam supply is also inoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwater pump is OPERABLE), then ACTION a. is entered.If the turbine-driven auxiliary feedwater pump is inoperable due to one required steam supply being inoperable in MODES 1, 2, and 3, or ifra turbine-driven auxiliary feedwater pump is inoperable while in MODE 3 immnrediately following REFUELING, action must be taken to restore the inoperable equipment to an OPERABLE status within 7 days. The 7 day allowed outage time is reasonable, based on the following reasons: MILLSTONE -UNIT 3 B 3/4 7-2a MILLTONE-UNT 3 3/47-2aAmendment No. 03, 4-39, 4-5-0 LBDCR No. 04-MP3-011 November 10, 2005 PLANT SYSTEMS BASES AUXILIARY FEED WATER SYSTEM (Continued)

a. For the inoperability of the turbine-driven auxiliary feedwater pumrp due to one required steam supply to the turbine-driven auxiliary feedwater pump being inoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwater pump is operable), the 7 day allowed outage time is reasonable since the auxiliary* feedwater system design affords adequate redundancy for the steam supply line for the turbine-driven pump.b. For the inoperability of a turbine-driven auxiliary feedwater pump while in MODE 3 ilmmediately subsequent to a refueling, the 7 day allowed outage time is* reasonable due to the minimal decay heat levels in this situation.

c. For both the inoperability of the turbine-driven auxiliary feedwater pump due to one required steam supply to the turbine-driven auxiliary feedwater pump being inoperable (i.e., only one steam supply to the turbine-driven auxiliary feedwater pump is operable), and an inoperable turbine-driven auxiliary feedwater pump while in MODE 3 imxmediately following a refueling outage, the 7 day allowed outage time is reasonable due to the availability of redundant OPERABLE motor driven auxiliary feedwater pumps, and due to the low probability of an event requiring the use of the turbine-driven auxiliary feedwater pump.The required ACTION dictates that if either the 7 day allowed outage time is reached the unit must be in at least HOT STANDBY within the next 6 hours and in HOT SHUTDOWN within the following 12 hours.The allowed time is reasonable, based on operating experience, to reachithe required conditions from full power conditions in an. orderly manner and without challenging plant systems.A Note limits the applicability of the inoperable equipment condition

b. to when the unit has not entered MODE 2 following a REFUELING.

Required ACTION b. allows one auxilia-y fee~dwater pump to be inoperable for 7 days vice the 72 hour allowed outage time in required ACTION c. This longer allowed outage thne is based on the reduced decay heat following REFUELING and prior to the reactor being critical.With one of the auxiliary feedwater pumps inoperable in MODE 1, 2, or 3 for reasons other than ACTION a. or b., ACTION must be taken to restore OPERABLE status within 72 hours. This includes the loss of three steam supply lines to the turbine-driven auxiliary feedwater pump. The 72 hour allowed outage time is reasonable, based on redundant capabilities afforded by the auxiliamy feedwater system, time needed for repairs, and the low probability of a DBA occurring during this time period. Two auxiliary feedwater pumps and flow pathls remain to supply feedwater to the steam generators. MILLSTONE -UNIT 3 B 3/4 7-2b MILLTON -NIT B /4 -2bAmendment No. -!-02-, 4-39, -0, LBDCR 12-MIP3-010 September 20, 2012 PLANT SY STEMS BASES AUXILIARY FEED WATER SYSTEM (Continued) If all thr'ee AFW pumps are inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with non safety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore oneAFW pump to OPERABLE status. Required ACTION e. is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW pump is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe conditio~n. SR 4.7.1.2.1

a. verifies the correct alignment for manual, power operated, and automatic valves in the auxiliaiy¢ feedwater water and steam supply flow paths to provide assurance that the proper flow paths exist for auxiliary feedwater operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misalign~ed, such as check valves. This Surveillance does not require any testing or valve manipulations; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. The surveillance fr'equency is controlled under the Surveillance Frequency Control Program.*The SR is modified by a Note that states one or more auxiliary feedwater pumps may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually (i.e., remotely or locally, as appropriate) realigned to the auxiliary feedwater mode of operation, provided it is not otherwise inoperable. This exception to pump OPERABILITY allows the pump(s) and associated valves to be out of their normal standby alignment and temporarily incapable of automatic initiation without declaring the pump(s)inoperable. Since auxiliary feedwater may be used during STARTUP, SI{UTDOWN, HOT STANDBY operations, and HOT SHUTDOWN operations for steam generator level control, and these mmaual operations are an accepted function of the auxiliatry feedwater system, OPERABILITY (i.e., the intended safety function) continues to be maintained. MILLSTONE -UNIT 3 B3472 mnmn o B 3/4 7-2c Amendment No. LBDCR 14-MiP3-006 July 8, 2014 AUXILIARY FEED WATER SYSTEM (Continued) Surveillance Requirement 4.7.1.2.1 .b, which addresses periodic surveillance testing of the AFW pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems, is required by the ASME GM Code. This type of testing may be accomplished by measuring the pump developed head at only one point on the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pumps baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the unit safety analysis. The surveillance requirements are specified in the Inservice Testing Program, which encompasses the ASME OM Code. The ASME GM Code provides the activities and frequencies necessary to satisfy the requirements. This surveillance is modified by a note to indicate that the test can be deferred for the steam driven AFW pump until suitable plant conditions are established. This deferral is required because steam pressure is not sufficient to perform the test until after MODE 3 is entered.However, the test, if required, nmst be performed prior to entering MODE 2.Surveillance Requirement 4.7.1.2.1 .c demonstrates that each AFW pump starts on receipt of an actual or simulated actuation signal. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the Engineered Safety Feature Actuation System (ESFAS) testing, and equipment performance is monitored as part of the Inservice Testing Program.Surveillance Requirement 4.7.1.2.2 demonstrates the AFW System is properly aligned by verifying the flow path to each steam generator prior to entering MODE 2 after more than 30 days in any comnbination of MODE 5 or 6 or defueled. OPERABILITY of the AFW flow paths must be verified before sufficient core heat is generated that would require operation of the AFW System during a subsequent shutdown. To further ensure AEW System alignmaent, the OPERABILITY of the flow paths is verified following extended outages to determnine that no misalignment of valves has occurred. The frequency is reasonable, based on engineering judgenment, and other administrative controls to ensure the flow paths are OPERABLE.MILLSTONE -UNIT 3 B3472 B 3/4 7-2d LBDCR 14-MP3-006 July 8, 2014 PLANT SYSTEMS BASES 3/4.7.1.3 DEM1hERALIZED WATER STORAGE TANK The OPERABILITY of the demineralized water storage tank (DWST) with a 334,000 gallon minimum measured water volume ensures that sufficient water is available to maintain the reactor coolant system at HOT STANDBY conditions for 7 hours with steam discharge to the atmosphere, concurrent with a total loss-of-offsite power, and with an additional 6-hour cooldown period to reduce reactor coolant temperature to 350°F. The 334,000 gallon required water volume contains an allowance for tank inventory not usable because of tank discharge line location, other tank physical characteristics, and surveillance measurement uncertainty considerations. The inventory requirement is conservatively based on 120°F water temperature which maximizes inventory required to remove RCS decay heat. In the event of a feedline break, this inventory requirement includes an allowance for 30 minutes of spillage before operator action is credited to isolate flow to the line break.If the combined condensate storage tank (CST) and DWST inventory is being credited, there are 50,000 gallons of unusable CST inventory due to tank discharge line location, other physical characteristics, level measurement uncertainty and potential measurement bias error due to the CST nitrogen blanket. To obtain the Surveillance Requirement 4.7.1.3.2's DWST and CST combined volume, this 50,000 gallons. of unusable CST inventory has been added to the 334,000 gallon DWST water volume specified in LCO 3.7.1.3 resulting in a 384,000 gallons 0 requirement (334,000 + 50,000 = 384,000 gallons).3/4.7.1.4 SPECIFIC ACTIVITY The limitations on Secondary Coolant System specific activity ensure that the resultant offsite radiation dose will be limited to 10 CFR 50.67 and Regulatory Guide 1.183 dose guideline values in the event of a steam line rupture. This dose also includes thae effects of a coincident 1 gpm primary-to-secondary tube leak in the steam generator of the affected steam line. These values are consistent with the assumptions used in the safety analyses.MILLSTONE -UNIT 3 B 3/4 7-2e LBDCR No. 08.-MP3-032 Octobher 28, 2008 PLANT SYSTEMS BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES BACKGROUND The main steam line isolation valves (MSIVs) isolate steam flow from the secondary side of the steam generators following a high energy line break (HELB). MSIV closure terminates flow from the unaffected (intact) steam generators. One MSIV is located in each main steam line outside, but close to, containment. The MSIVs are downstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam supply, to prevent MSSV and AFW isolation from the steam generators by MSIV closure. Closing the MSIVs isolates each steam generator from the others, and isolates the turbine, Steam Bypass System, and other auxiliary steam supplies from the steam generators. The MSIVs close on a main steam isolation signal generated by low steam generator pressure, high containment pressure, or steam line pressure negative rate (high). The MSIVs fail closed on loss of control or actuation power.Each MSIV has an MSIV bypass valve. Although these bypass valves are normally closed, they receive the same emergency closure signal as do their associated MSIVs. The MSIVs may also be actuated manually.A description of the MSIVs is found in the FSAR, Section 10.3.APPLICABLE SAFETY ANALYSIS The design basis of the MSIVs is established by the containment analysis for the large steam line break (SLB) inside containment, discussed in the FSAR, Section 6.2. It is also affected by the accident analysis of the SLB events presented .in the FSAR, Section 15.1.5. The design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one MSIV to close on demand).The limiting temperature case for the containment analysis is the SLB inside containment, at 102% power with mass and energy releases based on offsite power available following turbine trip, and failure of the MSIV on the affected steam generator to close.At hot zero power, the steam generator inventory and temperature are at their maximum, maximizing the analyzed mass and energy release to the containment. Due to reverse flow and failure of the MSIV to close, the additional mass and energy in the steam headers downstream from the other MSIV contribute to the total release. With the most reactive rod cluster control assembly assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power. The reactor is ultimately shut down by the boric acid injection delivered by the Emergency Core Cooling System.MILLSTONE -UNIT 3B3/73AmnetNo B 3/4 7-3 Amendment No. LBDCR No.-0)4-MP3-0 15 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued) The accident analysis compares several different SLB events against different acceptance criteria.The large SLB outside containment upstream of the MSIVs is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB upstream of the MSIV at hot zero power is the limiting case for a post trip return to power. The , analysis includes scenarios with offsite power available and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System cooldown. With a loss of offsite power, the response of mitigating systems is delayed. Significant single failures considered include failure of an MSIV to close.The MSIVs serve only a safety function and remain open during POWER OPERATION. These valves operate under the following situations:

a. An HELB inside containment.

In order to maximize the mass and energy release into containment, the analysis assumes that the MSIV in the affected steam generator remains open. For this accident scenario, steam is discharged into containment from all steam generators until the remaining MSIVs close. After MSIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIVs in the unaffected loops. Closure of the MSIVs isolates the break from the unaffected steam generators.

b. A break outside of containment and upstream from the MSIVs is not a containment pressurization concern. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition.

Closure of the MSIVs isolates the break and limits the blowdown to a single steam generator.

c. A break downstream of the MSIVs will be isolated by the closure of the MSIVs.d. Following a steam generator tube rupture, closure of the MSIVs isolates the ruptured steam generator from the intact steam generators.

In addition to minimizing radiological releases, this enables the operator to maintain the pressure of the steam generator with the ruptured tube below the MSSV setpoints, a necessary step toward isolating the flow through the rupture.e. The MSIVs are also utilized during other events, such as a feedwater line break. This event is less limitinig so far as MSIV OPERABILITY is concerned. MILLSTONE -UNIT 3 B 3/4 7-4 MILLTONE-UNT 3 3/47-4Amendment No. 4-1-9, 41-3-6, PLANT SYSTEMS 10/19/i00 BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued) LCO This [CO requires that four MSIVs in the steam lines be OPERABLE. The MSIVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal.This LCO provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 1OCFRIOO limits or the NRC Staff approved licensing basis.APPLICABILITY The MSIVs must be OPERABLE in MODE 1 and in MODES 2, 3, and 4 except when closed and deactivated when there is significant mass and energy in the RCS and steam generators. When the MSIVs are closed, they are already performing the safety function.In MODES 1, 2, and 3 the MSIVs are required to close within 10 seconds to ensure the accident analysis assumptions are met. In MODE 4 the MSIVs are required to close within 120 seconds to ensure the accident analysis assumptions are met.*i An engineering evaluation has determined that a Reactor Coolant System (RCS)temperature greater than or equal to 320°F is required to provide sufficient steam energy to provide the motive force to operate the MSIVs. Therefore, below an RCS temperature of 320°F the MSIVs are not OPERABLE and are required to be closed.In MODE 5 or 6, the steam generators do not contain much energy because their temperature is below the boiling point of water; therefore, the MSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.ACTIONS MODE 1 With one MSIV inoperable in MODE 1, action must be taken to restore OPERABLE status within 8 hours. Some repairs to the MSIV can be made with the unit hot.The 8 hour Completion Time is reasonable, considering the low probability of an accident occurring during this time period that would require a closure of the MSIVs.The 8 hour Completion Time is greater than that normally allowed for containment isolation valves because the MSIVs are valves that isolate a closed system penetrating containment. These valves differ from other containment isolation valves in that the closed system provides a passive barrier for containment O isolation. MILLSTONE -UNIT 3 B 3/4 7-5 Amendment No. 1 85 PLANT SYSTEMS 10119100 BASES 3/4.7.1.5 MAIN STEAM LINE ISOLATION VALVES (continued) If the MSIV cannot be restored to OPERABLE status within 8 hours, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours. The ComPletion Times are reasonable, based on operating experience, to reach MODE 2 and to close the MSIVs in an orderly manner and without challenging plant systems.MODES 2. 3. and 4 Since the MSIVs are required to be OPERABLE in MODES 2, 3, and 4, the inoperable MSIVs may either be restored to OPERABLE status or closed. When closed, the MSIVs are already in the position required by the assumptions in the safety analysis. The MSIVs may be opened to perform Surveillance Requirement 4.7.1.5.2. The 8 hour Completion Time is consistent with that allowed in MODE 1.For inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, the inoperable MSIVs must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day verification time is reasonable, based on engineering judgment, in view of MSIV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position.If the MSIVs cannot be restored to OPERABLE status or are not closed within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed at least in MODE 3 within 6 hours, and in MODE 5 within the next 30 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems. The Action Statement is modified by a note indicating that separate condition entry is allowed for each MSIV.SURVEILLANCE REQUIREMENTS 4.7.1.5.1 DELETED MILLSTONE -UNiT 3 B 3/4 7-6 Amendment No. 7$, 185 PLANT SYSTEMS 10/19100 BASES SURVEILLANCE REQUIREMENTS (continued) 4.7.1.5.2 This surveillance demonstrates that MSIV closure time is less than 10 seconds (120 seconds for MODE 4 only) on an actual or simulated actuation signal, when tested pursuant to Specification 4.0.5. A simulated signal is defined as any of the following engineering safety features actuation system instrumentation functional units per Technical Specifications Table 4.3-2: 4.a.1) manual initiation, individual, 4.a.2) manual initiation system, 4.c.containment pressure high-2, 4.d. steam line pressure low, or 4.e. steam line pressure -negative rate high. The MSIV closure time is assumed in the accident analyses. This surveillance is normally performed upon returning the plant to operation following a refueling outage. The test is normally conducted in MODES 3 or 4 with the plant at suitable (appropriate) conditions (e.g., pressure and temperature). The MSIVs should not be tested at power, since even a part stroke exercise increases the risk of valve closure when the unit is generating power.This surveillance requirement is modified by an exception that will allow entry into and operation in MODES 3 and 4 prior to performing the test to establish conditions consistent with those under which the acceptance criterion was generated. Successful performance of this test within the required frequency is necessary to operate in MODES 3 and 4 with the MSIVs open, to enter MODE 2 from MODE 3, and for plant operation in MODE 1. If this surveillance has not been successfully performed within the required frequency, the MSIVs. are inoperable and are required to be closed.In MODE 4 only, the MSIVs can be considered OPERABLE if the closure time is less than 120 seconds. An engineering evaluation has determined that a RCS temperature greater than or equal to 320°F is required to provide sufficient steam energy to provide the motive force to operate the MSIVs. Therefore, below an RCS temperature of 320°F the MSIVs are not OPERABLE and are required to be closed.MILLSTONE -UNIT 3 B 3/4 7-6a MILLTON -NIT B /4 -5aAmendment No. X~g 185 REVERSE OF PAGE B 3/4 7-6a INTENTIONALLY LEFT BLANK LBDCR No. 04-MP3--015 February 24, 2005 PLANT SYSTEMS BASES 3/4.7.1.6 STEAM GENERATOR ATMOSPHERIC RELIEF BYPASS LINES The OPERABILITY of the *steam generator atmospheric relief bypass valve (SGARBV)lines provides a method to recover from a steam generator tube rupture (SGTR) event dulring which the operator i's required to perform a-limited coo ldbwn establish adequate sub cooling as anecessary step to *limit the primary to secondary break flow into* the r, ptured steam generator.. The time required to limit the primary to"secondary break flow for an SGTR event is more critical than the time required to cooldown to RHR entry conditions. Because of these time constraints, these valves afnd associated flow paths must be OPERABLE from the control room. The number of SGA.RB Vs requiredi to be OPERABLE from the control room to satisfy the S GTR accident.analysis requires consideration of single failure criteria; Four SGARBV are required to be OPER~ABLE to ensure the credited steam release pathways available to conduct a unit cooldown following a SGTR." For other design events, the SGARBVs provide a safety grade method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sinik via the steam bypass system or the steam generator atmospheric relief valves be unavailable. Prior to operator action to cooldown, the main steam safety valves (MS SVs) are assumed to operate automatically to relieve steam and maintain the, steam generator pressure below design limits.Each SGARIBV line consists of one SGARBV and an associated block valve (main steam atmospheric relief isolation valve, 3MSS*MOV18SA/B/C/D). These block valves are used in the event a steam generator atmospheric relief valve (S GARY) or SGARBV fails to close. Becauise of the electrical power relationship .b.etw~en the SGARV and the block v~alys,.if a b~iqok yaly.e, is maintained closed, the SGARBV flow path is inoperable because of single failure consideration. The bases for the required ACTIONS can be found in NUREG 1431, Rev. 1.The LCO APPLICABILITY and ACTION statements uses the terms "MODE 4 when steam generator is relied *upon for heat removal" and "in MODE 4 without reliance upon steam generator for heat removal." This means that those steam generators which are credited for decay heat removal to comply with LCO 3.4.1.3 (Reactor Coolant System, HOT SHUTDOWN) shall have an OPERABLE SGARBV line. See Bases Section 3/4.4.1 for more detail.3/4.7..2 DELETED MILLSTONE -UNIT 3 B 3/4 7-7 Amendment No. 4-46, -448, 1-54-, 2-4, Acknowledged by NRC letter dated 08/25/05. LBDCR 3-22-02 March 14, 2002 PLANT SYSTEMS BASES 3/4.7.3 REACTOR PLANT COMPONENT COOLING WATER SYSTEM The OPERABILITY of the Reactor Plant Component Cooling Water. System ensures that sufficient cooling capacity is. available for continued operation of safety-related equipment during normal and accident conditions. The redundant cooling capacity of this system, assuming a single failure, is. consistent with the assumptions used in. the safety analyses.The Charging Pump/Reactor Plant Componenit Cooling Water Pump.Ventilation System is required to be available to. support reactor plant component cooling water pump operation. The Charging Pump/Reactor Plaint Component Cooling Water Pump Ventilation System consists of two redundant trains, each capablle of providing 100% of the required flow. Each train has. a two position, and "Auto," renmote control S'witch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the..operating train. The associated fans do not receive any safety related automatic start.signals (e.g., Safety Injection Signal).Placing the remote control switch for a Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation Train in the "Off' position to start the redundant train or to perform post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensurethe remote.control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use of an approved procedure and a designated individual .at the control switch for the respective Charging PumpReaetor" Planit Comrponeni Cooling'Water PUmp Ventilatiori Train Who6 apidly respond to instructions from procedures, or control room personnel, based on plant conditions. 3/4.7.4 SERVICE WATER SYSTEM The OPERABILITY of the Service Water System ensures that 'sufficient cooling capacity is available for contintied operation of safety-related equipmen~t during nonmal land accident conditions. The redundant.cooling Capacity of this system, assuming a single failure, is consistent with the assumptions used in the safety analyses.An OPERABLE service water loop requires one OPERABLE service water pump and .associated strainer. Two OPERABLE service water loops, with one OPERABLE service water pump and associated strainer per loop, will provide sufficient core (and containment) decay heat removal during a design basis accident coincident with a loss of offsite power and a single failure.MILLSTONE -UNIT 3 B 3/4 7-7a Amendment No. 4-4-~,' Acknowledged by NRC letter dated 08/25/05 LBDCR No. 13-MP3-002 May 2, 2013 PLANT SYSTEMS BASES 3/4.7.5 ULTIMATE HEAT SINK BACKGROUND The ultimate heat sink (UIIS) for Millstone Unit No. 3 is Long Island Sound. The Long Island Sound is connected to the Atlantic Ocean and provides the required 30 day supply of water. It serves as a heat sink for both safety and nonsafety-related cooling systems. Sensible heat is discharged to the UHS via the service water (SW) and circulating water (CWV) systems.The basic performance requirement is that a 30 day supply of water be available, and that the design basis temperatures of safety related equipment not be exceeded.Additional information on the design and operation of the system, along with a list of components served, can be found in References 1, 2, and 3.APPLICABLE SAFETY ANALYSES The UIHS is the sink for heat removed from the reactor core following all accidents and anticipated operational occurrences in which the unit is cooled down and placed on residual heat removal (RTIR) operation. With UHS as the normal heat sink for condenser cooling via the CW System, unit operation at full power is its maximum heat load. Its maximum post accident heat load occurs <1 hour after a design basis loss of coolant accident (LOCA). Near this time, the unit switches from injection to recirculation and the containment recirculation system removes the core decay heat.The operating limits are based on conservative heat transfer analyses for the worst case LOCA.References 1, 2, and 3 provide the details of the assumptions used in the analysis, which include worst expected meteorological conditions, conservative uncertainties .when calciulating decay heat, and worst case single active failure (e.g., single failure of a man-made structure). The limitations on the temperature of the UTHS ensure that the assumption for temperature used in the analyses for cooling of safety related components by the SW system are satisfied. These analyses ensure that under normal operation, plant cooldown, or accident conditions, all components cooled directly or indirectly by SW will receive adequate cooling to perform their design basis functions. The UHS satisfies Criterion 3 of 10 CFR 50.3 6(c)(2)(ii). LCO The UHS is required to be OPERABLE and is considered OPERABLE if it contains a sufficient volume of water at or below the maximum temperature that would allow the SW System to operate for at least 30 days following the design basis LOCA without the loss of net positive MILLSTONE -UNIT 3B347-AmnetNo43-B 3/4 7-8 Amendment No. 4-36 REVERSE OF PAGE B 3/4 7-8 INTENTIONALLY LEFT BLANK LBDCR No. 13-MP3-002 May 2, 2013 PLANT SYSTEMS BASES LCO (Continued) suction head (NP SH), and without exceeding the maximum design temperature of the*equipment served by the SW System. To meet this condition, the UHS temperature should not exceed 80°F during normal unit operation. While the use of any supply side SW temperature indication is adequate to ensure compliance with the analysis assumptions, precision instruments installed at the inlet to the reactor plant closed cooling water (RPCCW) (CCP) heat exchanges will normally be used.Therefore, instrument uncertainty need not be factored into the surveillance acceptance criteria. All in-service instruments must be within the limit. If all of the precision instruments are out of service, alternative instruments that measure SW supply side temperature will be used. In this case, an appropriate instrument uncertainty will be subtracted from the acceptance criteria.Since Long Island Sound temperature changes relatively slowly and in a predictable fashion according to the tides, it is acceptable to monitor this temperature daily when there is ample (>5°F) margin to the limit. When within 5 0 F of the limit, the temperature shall be monitored every 6 hours to ensure that tidal variations are appropriately captured.APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of the equipment serviced by the UHS and required to be OPERABLE in these MODES.In MODE 5 or 6, the OPERABILITY requirements of the uHS are determined by the systems its supports.ACTION If the UHS is inoperable, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed inl at least HOT STANDBY within 6 hours and in COLD SHUTDOWN within the following 30 hours.The allowed outage times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.MILLSTONE -UNIT 3 B 3/4 7-9 Amendment No. 4-36, LBDCR 13-MP3-002 May 2, 2013 PLANT SYSTEMS BASES SURVEILLANCE REQUIREMENTS This surveillance requirement verifies that the UHS is capable of providing a 30 day cooling water supply to safety related equipment without exceeding its design basis temperature. This surveillance requirement verifies that the water temperature of the UHS is < 80°F.REFERENCES

1. FSAR, Section 6.2, Containment Systems 2. FSAR, Section 9.2, Water Systems 3. FSAR, Section 15.6, Decrease in Reactor Coolant Inventory 3/4.7.6 DELETED 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM BACKGROUND The control room emergency ventilation system provides a protected environment from whichd operators can control the unit following an uncontrolled release of radioactivity, hazardous 0 chemicals, or smoke. Additionally, the system provides temperature control for the control room : envelope (CRE) during normal and post-accident operations.

The control room emergency ventilation system is comprised of the CRE emergency air filtration system and a temperature control system..The control room emergency air filtration system consists of two redundant systems that recirculate and filter the air in the CRE and a CRE boundary that limits the inleakage of unfiltered air. Each control room emergency air filtration system consists of a moisture separator, electric heater, prefilter, upstream high efficiency particulate air (IiEPA) filter, charcoal adsorber, downstream 1-EPA filter, and fan. Additionally, ductwork, valves or dampers, and instrumentation form part of the system.The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and other non-critical areas including adjacent support offices, MILLSTONE -UNIT 3 B 3/4 7-10 Amendment No. 44l9, 4-36, 444, g--t4 O LBDCR No...08-MP3-014 October 21, 2008 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) BACKGROUND (Continued) toilet and utility rooms. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, ceiling, ducting, valves, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program and UFSAR Section 6.4.2.1.Normal Operation A portion of the control room emergency ventilation system is required to operate during norrnial operations to ensure the temperature of the control room is maintained at or below 95°0 F.Post Accident Operation The control room emergency ventilation systemn'is re quired to operate during post-accident operations to ensure the temperature of the CRE is maintained and to ensure the CRE will remain habitable during and following accident conditions. The following event occurs upon receipt of a control building isolation (CBI) signal or a signal indicating high radiation in the air supply duct to the CRE.The control room emergency ventilation system will automatically start in the emergency mode (filtered pressurization whereby outside air is diverted through the filters to the CRE to maintain a positive pressure). APPLICABLE SAFETY ANALYSIS The OPERABILITY of the Control Room Emergency Ventilation System ensures that: (1) the ambient air temperature does not exceed the allowable temperature for continuous-duty rating for the equipment and instrumentation cooled by this system, and (2) the CRE will remain MILLSTONE -UNIT 3 B 3/4 7-11 MILLTONE-UNT 3 3/4-11Amendment No. 4-3-6, 2-1-, LBDCR No._08-MP3-014 October 21, 2008 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) APPLICABLE SAFETY ANALYSIS (Continued) habitable for occupants during and following all credible accident conditions. The OPERABILITY of this system in conjunction with control room design provisions is based on limiting the radiation exposure to CRE occupants. For all postulated design basis accidents, the radiation exposure to CRE occupants shall be 5 rem TEDE or less, consistent with the requirements of 10 CFR 50.67. This limitation is consistent with the requirements of General Design Criterion 19 of Appendix A, 10 CFR Part 50.LIMITING CONDITION FOR OPERATION Two independent control room emergency air filtration systems are required to be OPERABLE to ensure that at least one is available in the event the other system is disabled.Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem TEDE to the CRE occupants in the event of a large radioactive release.A control room emergency air filtration system is OPERABLE when the associated:

a. Fan is OPERABLE;b. HEPA filters and charcoal adsorbers are not excessively restricting flow and are capable of performing their filtration, functions; and c. moisture separator, heater, ductwork, valveS, and dampers are OPERABLE, and air circulation can be maintained.

In order for the CREVs to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.TS LCO 3.7.7 is modified by a footnote allowing the CRE boundary to be opened intermittently under administrative controls. This footnote only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, MILLSTONE -UNIT 3 B 3/4 7-12 MILLTON -NIT B /4 -12Amendment No. 14-6, -2093, 2--9, LBDCR No.-0O8-MP3-014 October 21, 2008 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) LIMITING CONDITION FOR OPERATION (Continued) floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the GRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated. Operation of the Control Room Emergency Ventilation System in the emergency mode is credited for design basis accident mitigation. The fuel handling accident analyses assume the emergency mode will be established within 30 minutes of a fuel handling accident. The other applicable design basis accidents (e.g., large break loss of coolant accident) assume the emergency mode will be established within 101 minutes of the accident. Even though manual operator action to establish the emergency mode could be credited within these time periods, the system has been designed to automatically establish the required equipment alignment upon receipt of a Control Building Isolation signal. Therefore, when stopping a Control Room Emergency Filter Fan by placing the control switch in OFF, the fan remains OPERABLE. The administrative controls associated-with the procedure in use to stop the fan are sufficient to ensure the associated control switch is returned to the AUTO position.In addition, the Emergency Operating Procedure will ensure a Control Room Emergency Filter fan is running in the emergency mode post accident well within the credited accident mitigation time frame.Control Room inlet isolation valves 3HVC*AOV25 and 3HVC*A0V26 are maintained open with air isolated whenever Technical Specification 3.7.7 is applicable. The only procedural guidance to close 31H1VC*AO V25 when this specification is applicable is in the alarm response procedure for smoke in the control room air inlet ventilation duct. The alarm response procedure will provide direction to establish the filtered recirculation mode of operation by restoring air and closing 3HVC*AOV25. During this limited time period, both Control Room Emergency Filtration trains remain OPERABLE, but degraded. Even though 3HVC*AOV25 is closed, it is a fail open valve and will automatically open on a Control Building Isolation signal, making it OPERABLE. However, should it to fail open, the system will not function. Therefore, it is not single failure proof and is degraded.Operation in this condition should be minimized. MILLSTONE -UNIT 3 B 3/4 7-12a MILLTON -UIT B 34 712aAmendment No. 3-6, -2O)3, 2-1-, REVERSE OF PAGE B 3/4 7-12a INTENTIONALLY LEFT BLANK LBDCR 10-MP3-003 February 23, 2010 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) APPLICABILITY In MODES 1, 2, 3, and 4.During movement of recently irradiated fuel assemblies. ACTIONS a., b., and c. of this specification are applicable at all times during plant operation in MODES 1, 2, 3, and 4. ACTIONS d. and e. are applicable during movement of recently irradiated fuel assemblies. The CREVs is required to be OPERABLE during fuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 350 hours*).An analysis was completed that analyzed a bounding drop of a non-spent fuel component. The analysis showed that the amount of fuel damage from this drop resulted in control room dose less than 5 rem TEDE without operation of the control room ventilation system.ACTIONS MODES 1, 2. 3. and 4 a. With one control room emergency air filtration system inoperable for reasons other than an inoperable CRE boundary, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. In this condition, the remaining control room emergency air filtration system is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a single failure in the OPERABLE train could result in a loss of the control room emergency air filtration system function. The 7-day completion time is based on the low probability of a DBA occurring during this time period, and the ability of the remaining train to provide the required capability. If the inoperable train cannot be restored to an OPERABLE status within 7 days, the unit must be placed in at least HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. These completion times are reasonable, based on operating experience, to reach the required unit condition from full power conditions in an orderly manner and without challenging unit systems.*During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.MILLSTONE -UNIT 3 B 3/4 7-13 MILLTONE-UNT 3 3/47-13Amendment No. 36, N3-3, LBDCR 07-MP3-033 June 25, 2007 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) ACTIONS (Continued)

b. With both control room emergency air filtration systems inoperable, except due to an inoperable CRE boundary, at least one control room emergency air filtration system must be restored to OPERABLE status within 1 hour, or the unit must be in HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours. These completion times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.c. With one or more control room emergency air filtration systems inoperable due to an inoperable CRE boundary, (1) action must be immediately initiated to implement mitigating actions; (2) action must be taken within 24 hours to verify mitigating actions*ensure CRE occupant exposures to radiological and chemical hazards will not exceed limits, and mitigating actions are taken to smoke hazards; and (3) the CRE boundary must be restored to OPERABLE status within 90 days. Otherwise, the unit must be in HOT STANDBY within the next 6 hours and in COLD SHUTDOWN within the following 30 hours.If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants-ffom chemicals or smoke, the CRE boundary is inoperable.

Actions must be taken to restore an OPERABLE CRE boundary within 90 days.During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect MILLSTONE -UNIT 3 B 3/4 7-13a MILLSONE UNI 3 B3/4 -13aAmendment No. 36, 8--, 2413, 2-2-9, LBDCR 12-MP3-010 September 20, 2012 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) ACTIONS (Continued) their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.Immediate action(s), in accordance with the LCO ACTION Statements, means that the required action should be pursued without delay and in a controlled manner.During movement of recently irradiated fuel assemblies

d. With one control room emergency air filtration system inoperable, action must be taken to restore the inoperable system to an OPERABLE status within 7 days. After 7 days, either* initiate and maintain operation of the remaining OPERABLE control room emergency air filtration system in the emergency mode or suspend the movement of fuel. Initiating and maintaining operation of the OPERABLE train in the emergency mode ensures: (i) OPERABILITY of the train will not be compromised by a failure of the automatic actuation logic; and (ii) active failures will be readily detected.e. With both control room emergency air filtration systems inoperable, or with the train required by ACTION 'd' not capable of being powered by an OPERABLE emergency power source, actions must be taken to suspend all operations involving the movement of recently irradiated fuel assemblies.

This action places the unit in a condition that minimizes risk. This action does not preclude the movement of fuel to a safe position.SURVEILLANCE REQUIREMENTS 4.7.7.a The CRE environment should be checked periodically to ensure that the CRE temperature control system is functioning properly. The surveillance frequency is controlled under the Surveillance Frequency Control Program. It is not necessary to cycle the CRE ventilation chillers. The CRE is manned during operations covered by the technical specifications. Typically, temperature aberrations will be readily apparent.4.7.7.b Standby systems should be checked periodically to ensure that they function properly. The surveillance frequency is controlled under the Surveillance Frequency Control Program.1 MILLSTONE -UNIT 3B/4-bAmnetNo B 3/4 7-13b Amendment No. LBDCR 12-MP3-010 September 20, 2012 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) SURVEILLANCE REQUIREMENTS (Continued) This surveillance requirement verifies a system flow rate of 1,120 cfln -20%. Additionally, the system is required to operate for at least 10 continuous hours with the heaters energized. These operations are sufficient to reduce the buildup of moisture on the adsorbers and HEPA filters due to the humidity in the ambient air.4.7.7.c The performance of the control room emergency filtration systems should be checked periodically by verifying the 1HEPA filter efficiency, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal. The frequency is as specified in the Surveillance Frequency Control Program and following painting, fire, or chemical release in any ventilation zone communicating with the system.ANSI N5 10-1980 will be used as a procedural guide for surveillance testing.Any time the OPERABILITY of a JiEPA filter or charcoal adsorber housing has been affected by repair, maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. 4.7.7.c.l This surveillance verifies that the system satisfies the in-place penetration and bypass leakage testing acceptance criterion of less than 0.05% in accordance with Regulatory Position C.5.a, C.5.c, and C.5.d of Regulatory Guide 1.52, Revision 2, March 1978, while operating the system at a flow rate of 1,120 cfm+/-+ 20%. ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in the regulatory guide.4.7.7.c.2 This surveillance requires that a representative carbon sample be obtained in accordance with Regulatory Position C.6.b of Regulatory Guide 1.52, Revision 2, March 1978 and that a laboratory analysis verify that the representative carbon sample meets the laboratory testing criteria of ASTM D3803-89 and Millstone Unit 3 specific parameters. The laboratory analysis is required to be performed within 31 days after removal of the sample. ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in Revision 2 of Regulatory Guide 1.52.MILLSTONE -UNIT 3 B 3/4 7-14 MILSTOE UNT 3B /4714Amendment No. -!-3-, 4-84, _2-06 LBDCR 12-MP3-010 September 20, 2012 PLANT SYSTEMS BASES 314.7.7 CONTROL ROOM EMERGENCY VENTILATION sYSTEM (Continued) SURVEILLANCE REGUIREMENTS (Continued) 4.7.7.c.3 This surveillance verifies that a system flow rate of 1,120 cfrn + 20%, during system operation when testing in accordance with ANSI N5 10-1980.4.7.7.d After 720 hours of charcoal adsorber operation, a representative carbon sample must be obtained in accordance with Regulatory Position C.6.b of Regulatory Guide 1.52, Revision 2, March 1978, and a laboratory analysis must verify that the representative carbon sample meets the laboratory testing criteria of ASTM D3803-89 and Millstone Unit 3 specific parameters. The laboratory analysis is required to be performed within 31 days after removal of the sample.ANSI N510-1980 is used in lieu of ANSI N510-1975 referenced in Revision 2 of Regulatory Guide 1.52.The maximum surveillance interval is 900 hours, per Surveillance Requirement 4.0.2. The 720 hours of operation requirement originates from Nuclear Regulatory Guide 1.52, Table 2, Note C. This testing ensures that the charcoal adsorbency capacity has not degraded below acceptable limits as well as providing trending data.4.7.7.e. 1 This surveillance verifies that the pressure drop across the combined IHEPA filters and charcoal adsorbers banks at less than 6.75 inches water gauge when the system is operated at a flow rate of 1,120 cfmn -20%. The surveillance frequency is controlled under the Surveillance Frequency Control Program.4.7.7.e.2 Deleted.4.7.7.e.3 This surveillance verifies that the heaters can dissipate 9.4 4- 1 kW at 480V when tested in accordance with ANSI N510-1980. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The heater kW measured must be corrected to its nameplate rating. Variations in system voltage can lead to measurements of kW which cannot be compared to the nameplate rating becaus~e the output kW is proportional to the square of the voltage.MILLSTONE -UNIT 3 MILSTOE -UNI 3B 314 7-15 Amendment No. 4-3-6,4-1-84-,--84, 2-0-3,20 LBDCR 07-MP3-033 June 25, 2007 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued) SURVEILLANCE REOUIREMENTS (Continued) 4.7.7.f Following the complete or partial replacement of a HEPA filter bank, the OPERABILITY of the cleanup system should be confirmed. This is accomplished by verifying that the cleanup system satisfies the in-place penetration and bypass leakage testing acceptance criterion of less than 0.05% in accordance with ANSI N5 10-1980 for a DOP test aerosol while operating the system at a flow rate of 1,120 cfm d 20%.4.7.7.g_Following the complete or partial replacement of a charcoal adsorber bank, the OPERABILITY of the cleanup system should be confirmed. This is accomplished by verifying that the cleanup system satisfied the in-place penetration and bypass leakage testing acceptance criterion of less than 0.05% in accordance with ANSI N5I10-1 980 for a halogenated hydrocarbon refrigerant test gas while operating the system at a flow of 1,120 cfmn +/- 20%.4.7.7.h O This Surveillance verifies the OPERABILITY of the CR3 boundary by testing for unfiltered air inleakage past the CR3 boundary and into the CR3. The details of the testing are specified in the Control Room Envelope Habitability Program.The CR3_ is considered habitable when the radiological dose to CR3 occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem TEDE and the CR3 occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CR3 is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, ACTION c. must be entered. ACTION c. allows time to restore the CR3 boundary to OPERABLE status provided mitigating actions can ensure that the CR3 remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, which endorses, with exceptions, NEI 99-03.These compensatory measures may also be used as mitigating actions as required by ACTION c.Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY. Options for restoring the CR3 boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CR3 boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CR3 boundary has been restored to OPERABLE status.MILLSTONE -UNIT 3 B 3/4 7-16 Amendment No. .-34, _20-3, _206, O LBDCtR-07-MP3-033 June 25, 2007 PLANT SYSTEMS BASES 3/4.7.7 CONTROL ROOM EMERGENCY VENTILATION SYSTEM (Continued)

References:

(1) Nuclear Regulatory Guide 1.52, Revision 2 (2) MP3 UFSAR, Table 1.8-1, NRC Regulatory Guide 1.52 (3) NRC Generic Letter 9 1-04 (4) Condition Report (CR) #M3-99-027 1 (5) NEI 99-03, "Control Room Habitability Assessment" (6) Letter from Eric 3. Leeds (NRC)'to James W. Davis (NEI) dated January 30, 2004, "NEI Draft White paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." 3/4.7.8 DELETED MILLSTONE -UNIT 3B3/7-7AedntN.4-6 B 3/4 7-17 Amendment No. LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE -UNIT 3 B 3/4 7-18 Amendment No. 4-36, 20-3, 2-1-9 NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK.ILLSTONE -UNIT. 3 B 3/4 7-19... Amendment No. 3-6, 2O-4, 24-9 NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK ..MILLSTONE -UNIT 3 B 3/4 7-20.Amendment No.4--36,4--84-, 20-3, 9 NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026 October 15, 2006* THIS PAGE INTENTIONALLY LEFT BLANK O -UNIT 3 B 3/4 7-21 Amendment No. 4-3~6, -2Ot-, -246 NRC Verbal Acknowledgement: 07/05/07 LBDCR No. 06-MP3-026 October 15, 2006 THIS PAGE INTENTIONALLY LEFT BLANK MILLSTONE TJN{IT 3 B 3/4 7-22.Amendment No. 4-36 NRC Verbal Acknowledgement: 07/05/07 LBDCR 12-MiP3-010 September 20, 2012 PLANT SYSTEMS BASES 3/4.7.9 AUXILIARY BUILDING FILTER SYSTEM The OPERABILITY of the Auxiliary Building Filter System, and associated filters and fans, ensures that radioactive materials leaking from the-~equipment within the charging pump, component cooling water pump and heat exchanger areas following a LOCA are filtered prior to reaching the environmnent. Periodic operation of the system with the heaters operating for at least 10 continuous hourns is sufficient to reduce the buildup of moisture on the ads orbers and 1-EPA filters. The surveillance frequency is controlled under the Surveillance Frequency Control Program. The operation of thtis system and the resultant effect on offsite dosage calculations was assumed in the safety analyses. ANSI N510-1980 will be used as a procedural guide for surveillance testing. Laboratory testing of methyl iodide penetration shall be performed in accordance with ASTM D3 803-89 aind Millstone Untit 3 specific parameters. The heater kW measured must be corrected to its nameplate rating. Variations in system voltage can lead to measurements of kW which cannot be compared to the nameplate rating because the output kW is proportional to the square of the voltage.The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System is required to be available to support the Auxiliary Building Filter System and the Supplementaiy Leak Collection and Release System (SLCRS). The Charging Pump/Reactor Plant Component Cooling Water Pump Ventilation System consists of two redundant trains, each capable of providing 100% of the required flow. Each train has a two position, "Off' and "Auto," remote control switch. With the remote control switches for each train in the "Auto" position, the system is capable of automatically transferring operation to the redundant train in the event of a low flow condition in the operating train. The associated fans do not receive any safety related automatic start signals (e.g. Safety Injection Signal).Placing the remote control switch for a Charging Pump/Reactor plant Component Cooling Water Pump Ventilation Train in the "Off' position to start the redundant train or to perform post maintenance testing to verify availability of the redundant train will not affect the availability of that train, provided appropriate administrative controls have been established to ensure the remote control switch is immediately returned to the "Auto" position after the completion of the specified activities or in response to plant conditions. These administrative controls include the use Of an approved procedure and a designated individual at the control switch for the respective Charging P~ump/Reactor Plant Component Cooling Water Pump Ventilation Train who can rapidly respond to instructions from procedures, or control room personne, based on plant conditions. MILLSTONE -UNIT 3 B 3/4 7-23 Amendment No. &-7, 9, -!3, -!-84, LBDCR March 12, 2012 PLANT SYSTEMS BASES6 LCO 3.7.9 ACTION statement: With one Auxiliary Building Filter System inoperable, restoration to OPERABLE status within 7 days is required.The 7 days restoration time requirement is based on the following: The risk contribution is less for an inoperable Auxiliary Building Filter System, than for the charging pump or reactor plant component cooling water (RPCCW) systems, which have a 72 hour restoration time requirement. The Auxiliamyr Building Filter System is not a direct support system for the charging pumps or RPCCW pumps. Because the pump area is a colmmon area, and as long as the other train of the Auxiliary Building Filter System remains OPERABLE, the 7 day restoration timne limit is acceptable based on the low probability of a DBA occurring during the time period and the ability of the remaining train to provide the required capability. A concurrent failure of both trains would require entry into LCO 3.0.3 due to the loss of functional capability. The Auxiliary Building Filter System does support the Supplementary Leak Collection and Release System (SLCRS) and the LCO ACTION statement time of 7 days is consistent with that specified for SLCRS (See LCO 3.6.6.1).Any time the OPERABILITY of a I{EPA filter or charcoal adsorber housing has been affected by repail; maintenance, modification, or replacement activity, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. Surveillance Requirement 4.7.9.c O Surveillance requirement 4.7.9.c requires that after 720 hours of operation a charcoal sample must be taken and the sample must be analyzed within 31 days after removal.The 720 hours of operation requirement originates from Regulatory¢ Guide 1.52, Revision 2, March 1978, Table 2, Note "c", which states that "Testing should be perfonne~d (1) initially, (2)at least once per 18 months thereafter for systems maintained in a stanmdby status or after 720 hours of system operations, and (3) following painting, fire, or chemical release in any ventilation zone cormmunicating with the system." This testing ensures that the charcoal adsorbency capacity has not degraded below acceptable limits as well as providing trending data. The 720 hour figure is an arbitramyj numaber which is equivalent to a 30 day period. This criteria is directed to filter systems that are normally in operation and also provide emergency air cleaning functions in the event of a Design Basis Accident. The applicable filter units are not normaally in operation and sample canisters are typically removed due to the 18 month criteria.3/4.7.10 SNUJBBERS All snubbers are required OPERABLE to ensure that the structural integrity of the Reactor Coolant System and all other safety-related systems is maintained .during and following a seismic or other event initiating dynamic loads. For the purpose of declaring the affected system OPERABLE with the inoperable snubber(s), an engineering evaluation may be performed, in accordance with Section 50.59 of 10 CFR Part 50.MILLSTONE -UNIT 3 B 3/4 7-23 a Amendment No. 8-7-, 4-1--9, 4-1-6, -184 Q LBDCR 12-MP3-003 March 12, 2012 THIS PAGE INTENTIONALLY LEFT BLANK O@} MILLSTONE -UNIT 3 B 3/4 7-24 Amendment No. 4-6, -7,4-1-9, 43-6, LBDCR 12-MP3-003 March 12, 2012 PLANT SYSTEMS BASES 3/4.7.11 DELETED 314.7.14 DELETED 0/MILLSTONE -UNIT 3 B 3/4 7-25 Amendment Nos. g-g,--84, 4-1-, 4-19, 1362 14 LBDCR No. 04-MP3-015

• February 24, 2005 3/4.8 ELECTRICAL POWER SYSTEMS BASES I.: 3/4.8.1. 3/4.8.2 and 3/4.8.3 A.C. SOURCES, D.C. SOURCES, and ONSITE POWER DISTRIBUTION The OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety-related equipment required for: (1) the safe shutdown of the facility, and (2) the mitigation and control of accident conditions within the facility.

The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criterion 17 of Appendix A to 10 CFR Part 50.LCO 3.8.1.l.a LCO 3.8.1.1l.a requires two independent offsite power sources. With both the RSST and* the NSST available, either power source may supply power to the Vital busses to meet the intent of Technical Specification 3.8.1.1. The FSAR, and Regulatory Guide 1.32, 1.6, and 1.93 provide the basis for requirements concerning off-site power sources. The basic requirement is to have*two independent offsite power sources. The requirement to have a fast transfer is not Specifically stated. An automatic fast transfer is required for plants without a generator output trip breaker, where power from the NSST is lost on a turbine trip. The surveillance requirement for transfer from the nonnal circuit' to the alternate circuit is required for a transfer from the NS ST to the RSST in the event Of an electrical failure. There is no specific requirement to have an automatic transfer from the RSST to the NSST...S~i The ACTION requirements specified for the levels of degradation of the power sources;provide restriction upon continued facility operation commensurate with the level of degradation. The OPERBI-BLITY of the power sources are consistent with tche initi'al' conditiotn a~rpti'ons of the safety analy~ses anid are based upon. rnain~tainig at !east set of onsite AL., and.D.C. power sb~itees arid associa~ted' distrbtiofin systehs OPERABLE dturing accident conditions: coincident with an assumed loss-of-offsite power and single failure :of the other onsite A.C.source. The A.C. and D.C. source allowable out-of-service times are based in part on Regulatory Guide 1.93, "Availability of Electrical Power Sources," December 1974. Technical Specification 3.8.1.1 ACTION Statements b.2 and: c.2 provide an allowance to avoid unnecessary testing of the other OPERABLE diesel generator. If it can be determined that the cause of the inoperable diesel: generator does no~t exist on the OPERABLE diesel generator, Surveillance Requirement 4.8.1.1.2.a.5 does not have to be performed. If the cause of inoperability exists on the other OPERABLE diesel generator, the other OPERABLE diesel generator would be declared inoperable upon discovery, ACTION Statement

e. would be entered, and appropriate actions will be taken. Once the failure is corrected, the common cause failure no longer exists, and thle required ACTION Statements (b., c., and e.) will be satisfied.

If it can not be determined that the cause of the inoperable diesel generator* does not exist on the remaining diesel generator, performance of Surveillance Requirement 4.8.1.1 .2.a.5, within the allowed time period, suffices to provide assurance of continued OPERABILITY of the diesel generator. If the inoperable diesel generator is restored to OPERABLE status prior to the determination of the impact on the other diesel generator, evaluation will continue of the possible common cause failure. This continued evatuation is no O i MILLSTONE.- UNIT 3 B 3/4 8-1 Amendment No. 4-1-2,-1,-z0,* Acknowledged by NRC letter dated 08/25/05 LBDCR No. 04-MP3-01 5 February 24, 2005 3/4.8 ELECTRICAL POWER SYSTEMS BASES longer under the time constraint imposed while in ACTION Statements b.2 or c.2.The determination of the existence of a common cause failure that would affect the remaining diesel generator will require an evaluation of.the current failure and the applicability to the remaining diesel generator. Examples that would not be a common cause failure include, but are not limited to: 1. Preplanned preventative maintenance or testing; or 2. An inoperable support system With no potential common mode failure for the remaining diesel generator; or 3. An independently testable component with no potential common mode failure for the remaining diesel generator. 'When one diesel generator is inoperable, there is an additional ACTION requirement (b.3 and c.3) to verify that all required systems, subsystems, trains, compon~ents addevices, that depend on the remaining OPERABLE diesel generator as a source of emergency power, are also OPERABLE, and that the steam-driven auxiliary feedwater pump is OPERABLE. This requirement is intended to provide assurance that a loss-of-offsite power event will not result in a.complete loss of safety function of critical systems during the period One of the diesel generators is inoperable. The term, verify, as used in this context means to administratively check by examining logs or other information to determine if certain components are out-of-service for maintenance or other reasons. It does not mean to perform the Surveillance Requirements needed to demonstrate the OPERABILITY of the component. if one Mill~triie Uniit No iS3 diesl Nisinoperaible ini MODES 1 tlhroutghi 4, a 72 hour allowed outa~ge time :is :provcided by.ACTQNStat~emt to~allowi restoratiori

of the diesel generator, provided" the requirements oi ACTION Statements bi~l, b.2, and b.l3 ar-e met. This allowed outage time can be extended to 14 days if the additional requirements contained in ACTION Statement b.4 are also met. ACTION Statement b.4 requires verification that the Millstone Unit No. 2 diesel generators are OPERABLE as required by the applicable Millstone Unit No. 2 Technical Specification (2 diesel generators in MODES 1 through 4, and 1 diesel generator in MODES 5 and 6) and the Millstone Unit No. 3 SBO diesel generator is available.

The term verify, as used in this context, means to administratively check by examining logs or other information to determine if the required Millstone Unit No. 2 diesel generators 'and the.Millstone Unit No. 3 SBO diesel generator are out of service for maintenance or other reasons. It does not mean to perform Surveillance Requirements needed to demonstrate the OPERABILITY of the required Millstone Unit No. 2 diesel generators or availability of the Millstone Unit No. 3 SBO diesel generator. When using the 14 day allowed outage time provision and the Millstone Unit No. 2 diesel generator requirements and/or Millstone Unit No. 3 SBO diesel generator requirements .are not met, 72 hours is allowed for restoration of the required Millstone Unit No. 2 diesel generators and the Millstone Unit No. 3 SBO diesel generator. If any of the required Millstone Unit No. 2 diesel generators and/or Millstone Unit No. 3 SBO diesel generator are not restored Within 72 hours, and one Millstone Unit No. 3 diesel generator is still inoperable, Millstone Unit No. 3 is required to shut down.MILLSTONE -UNIT 3 B 3/4 8-l a Amendment No.14-t-,24-0, Acknowledged by NRC letter dated 08/25/05 LBDCR 14-MP3-013 October 16, 2014 3/4.8 ELECTRICAL POWER SYSTEMS BASES The 14 day allowed outage time for one inoperable Millstone Unit No. 3 diesel generator will allow perfonrmance of extended diesel generator maintenance and repair activities (e.g., diesel inspections) while the plant is operating. To minimize plant risk when using this extended allowed outage time the following additional Millstone Unit No. 3 requirements must be met: 1) The charging pump and charging pump cooling pump in operation shall be powered from the bus not associated with the out of service diesel generator. In addition, the spare charging pump will be available to replace an inservice charging pump if necessary.

2) The extended diesel generator outage shall not be scheduled when adverse or inclement weather conditions and/or unstable grid conditions are predicted or present.3) The availability of the Millstone Unit No. 3 SBO DG shall be verified by test performance within 30 days prior to allowing a Millstone Unit No. 3 EDG to be inoperable for greater than 72 hours.4) All activity in the switchyard shall be closely monitored and controlled.

No elective maintenance within the switchyard that could challenge offsite power availability shall be scheduled.

5) A contingency plan shall be available (OP 33 14J, Auxiliary Building Emergency Ventilation and Exhaust) to provide alternate room cooling to the charging and CCP pump area (24' 6" Auxiliary Building) in the event of a failure of the ventilation system prior to commencing an extended diesel generator outage.In addition, the plant configuration shall be controlled during the diesel generator maintenance and repair activities to minimize plant risk consistent with the Configuration Risk Management Program, as required by 10 CFR 50.65(a) (4).The OPERABILITY of the minimum specified A.C. and D.C.. power sources and associated distribution systems during shutdown and REFUELING ensures that: (1) the facility can be maintained in the shutdown or REFUELING condition for extended time periods, and (2)sufficient instrumentation and control capability is available for monitoring and maintaining the unit status.The Surveillance Requirements for demonstrating the OPERABILITY of the diesel generators are in accordance with the recommendations of Regulatory Guides 1.9, "Selection of Diesel Generator Set Capacity for Standby Power Supplies," March 10, 1971; 1.108, "Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants," Revision 1, August 1977; and 1.137, "Fuel-Oil Systems for Standby Diesel Generators," Revision 1, October 1979. The surveillance frequencies for demonstrating OPERABILITY of the diesel generators are in accordance with the Surveillance Frequency Control Program.LCO 3.8.1.1 ACTION statement b.3 and c.3 Required ACTION Statement b.3 and c.3 requires that all systems, subsystems, trains, components, and devices that depend on the remaining OPERABLE diesel as a source of emergency power be verified OPERABLE.MILLSTONE

-UNIT 3 B 3/4 8-lb Amendment No. 1-1-2., , LBDCR 12-MP3-010 September 20, 2012 3/4.8 ELECTRICAL POWER SYSTEMS BASES 3/4.8.1, 3/4.8.2, and 3/4.8.3 A.C. SOURCES, D.C. SOURCES, AND ONSITE POWER DISTRIBUTION Technical Specification 3.8.1.1 .b. 1 requires each of the diesel generator day tanks contain a minimum volume of 278' gallons. Technical Specification 3.8.1 .2.b.l requires a minimum volume of 278 gallons be contained in the required diesel generator day tank. This capacity ensures that a minimum usable volume of 189 gallons is available. This volume permits operation of the diesel generators for approximately 27 minutes with the diesel generators loaded to the 2,000 hour rating of 5335 kw. Each diesel generator has two independent fuel oil transfer pumps. The shutoff level of each fuel oil transfer pump provides for approximately 60 minutes of diesel generator operation at the 2000 hour rating. The pumps start at day tank levels to ensure the minimum level is maintained. The loss of the two redundant pumps would cause day tank level to drop below the minimum value.Technical Specification 3.8.1.1i .b.2 requires a minimum volume of 32,760 gallons be contained in each of the diesel generator's fuel storage systems. Technical Specification 3.8.1 .2.b.2 requires a minimum volume of 32,760 gallons be contained in the required diesel generator's fuel storage system. This capacity ensures that a minimum usable volume (29,180 gallons) is available to permit operation of each of the diesel generators for approximately three days with the diesel generators loaded to the 2,000 hour rating of 5335 kW. The ability to cross-tie the diesel generator fuel oil supply tanks ensures that one diesel generator may operate up to approximately six days.Additional fuel oil can be supplied to the site within twenty-four hours after contacting a fuel oil supplier.Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM.Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power source and distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit Safety systems.Surveillance Requirements 4.8.1.1.2.a.6, 4.8.1.1.2.b.2, and 4.8.1.1.2.j The Surveillances 4.8.1.l.2.a.6 and 4.8.l.1.2.b.2 verify that the diesel generators are capable of synchronaizing with the offsite electrical system and loaded to greater than or equal to continuous rating of the machine. A minimum time of 60 minutes is required to stabilize engine temperatures, wlhile MILLSTONE -UNIT 3 MILSTOE UM 3B 3/4 8-ilc Amendment No. 9-7, -I4t-, -t-3-7, 4-94, 24-Q, 2-LBDCR 12-MIP3-010 September 20, 2012 3/4.8 ELECTRICAL POWER SYSTEMS BASES minimizing the time that the diesel generator is connected to the offsite source. Surveillance Requirement 4.8.1.1 .2.j requires demonstration that the diesel generator can start and run continuously at full load capability for an interval of not less than 24 hours, _ 2 hours of which are at a load equivalent to 110% of the continuous duty rating and the remainder of the time at a load equivalent to the continuous duty rating of the diesel generator. The load band is provided to avoid routine overloading of the diesel generator. Routine overloading may result in more fr'equent teardown inspections in accordance with vendor recommendations in order to maintain diesel generator OPERABILITY. The load band specified accounts for instrumentation inaccuracies, operational control capabilities, and human factor characteristics. The note (*)acknowledges that a mnomentatmy transient outside the load range shall not invalidate the test. The surveillance flequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirements 4.8.1 .1.2.a.5, 4.8.1.1 .2.b.1, 4.8.1.1.2.g.4.b, 4.8.1.1.2.g.5, and 4.8.1.1.2.g.6.b Several diesel generator surveillance requirements specify that the emergency diesel generators are started from a standby condition. Standby conditions for a diesel generator means the diesel engine coolant and lubricating oil are being circulatced and temperatures are maintained within design ranges. Design ranges for standby temperatures are greater than or equal to the low temperature alann setpoints and less than or equal to the standby "keep-wanln" heater shutoff temperatures for each respective sub-system. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Surveillance Requirement 4.8.1.1 .2.j The existing "standby condition" stipulation contained in specification 4.8.1.1 .2.a.5 is superseded when performing the hot restart demonstration required by 4.8.1.1 .2.j.Any time the OPERABILITY of a diesel generator haes been affected by repair, maintenance, or replacement activity, or by modification that could affect its interdependency, post maintenance testing in accordance with SR 4.0.1 is required to demonstrate OPERABILITY. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B 3/4 8-1d MILLTO1SE -UNIT3 B3/4 -idAmendment No. 9-7-, 14-2, 4-3-7, 1-94, 4-0 LBDCR 12-MP3-010 September 20, 2012 ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES. D.C. SOURCES, and ONSITE POWER DISTRIBUTION (Continued) The Surveillance Requirement for demonstrating the OPERABILITY of the station batt~eries are based on the recommendations of Regulatory Guide 1.129, "Maintenance Testing and Replacement of Large Lead Storage Batteries for Nuclear Power Plants," February 1978, and IEEE Std 450-1975 & 1980, "IEEE Recolmmended Practice for Maintenance, Testing, and Replacement of Large Lead Storage Batteries for Generating Stations and Substations." Sections 5 and 6 of IEEE Std 450-1980 replaced Sections 4 and 5 oflIEEE Std 450-1975. Guidance on bypassing weak cells, if required, is in accordance with section 7.4 of IEEE 450-2002. The balance of IEEE Std 450-1975 applies. The surveillance frequency is controlled under the Surveillance Frequency Control Program.Verifying average electrolyte temperature above the minimum for which the battery was sized, total battery terminal voltage on float charge, connection resistance values, and the performance of battery service and discharge tests ensures the effectiveness of the charging system, the ability to handle high discharge rates, and compares the battery capacity at that time with the rated capacity.Table 4.8-2a specifies the normal limits for each designated pilot cell and each connected cell for electrolyte level, float voltage, and specific gravity. The limits for the designated pilot cells float voltage and specific gravity, greater than 2.13 volts and 0.015 below the manufacturer's full charge specific gravity or a battery charger current that had stabilized at a low val[ue, is characteristic of a charged cell with adequate capacity. The nonnal limits for each connected cell for float voltage and specific gravity, greater than 2.13 volts and not more than 0.020 below the manufacturer's full charge specific gravity with an average specific gravity of all the connected cells not more than 0.010 below the manufacturer's full charge specific gravity,.ensures the OPERABILITY and capability o~f the battery. with a battery cell's parameter outside the normal limit but within the allowable value specified in Table 4.8-2a is permitted for up to 7 days. During this 7-day period: (l)the allowable values for electrolyte level ensures no physical damage to the plates with an adequate electron transfer capability; (2) the allowable value for the average specific gravity of all the cells, not more than 0.020 below the manufacturer's recommended full charge specific gravity, ensures that the decrease in rating will be less than the safety margin provided in sizing; (3) the allowable value for an individual cell's specific gravity, ensures that an individual cell's specific gravity will not be more than 0.040 below the manufacturer's full charge specific gravity and that the overall capability of the battery will be maintained within an acceptable limit; and (4) the allowable value for an individual cell's float voltage, greater than 2.07 volts, ensures the battery's capability to perform its design function.If the required power sources or distribution systems are not OPERABLE in MODES 5 and 6, operations involving CORE ALTERATIONS, positive reactivity changes, movem-ent of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the MIfLLSTONE -UNIT 3B348-AmnetNo B 3/4 8-2 Amenchnent No. LB3DCR 10-MP3-003 February 23, 2010 ELECTRICAL POWER SYSTEMS BASES A.C. SOURCES. D.C. SOURCES. and ONSITE POWER DISTRIBUTION (Continued) previous 350 hours*), crane operation with loads over the fuel storage pooi, or operations with a potential for draining the reactor vessel are required to be suspended. 3/4.8.4 DELETED I*During fuel assembly cleaning evolutions that involve the handling or cleaning of two fuel assemblies coincidentally, recently irradiated fuel is fuel that has occupied part of a critical reactor core within the previous 525 hours.MILLSTONE -UNIT 3 B 3/4 8-3 MILSTOE UNT 3B /4 -3Amendment No. , 89, -I-5-3, 4-7-, 49-2, REVERSE OF PAGE B 3/4 8-3 INTENTIONALLY LEFT BLANK 06/28/06 3/4.9 REFUELING OPERATIONS BASES --. .. ..3/4.9.1 BORON CONCENTRATION The limitations on reactivity conditions during REFUELING ensure that: (1) the reactor will remain subcritical during CORE ALTERATIONS, and (2) a uniform boron concentration is maintained for reactivity control in the water volume having direct access to the reactor vessel, The value of 0.95 or less for Keff includes a 1% Ak/k conservative allowance for uncertainties. Similarly, the boron concentration value specified in the CORE OPERATING LIMITS REPORT includes a conserx~ative uncertainty allowance of 50 ppm boron. The boron concentration, specified in the CORE OPERAT[NG LIMITS REPORT, provides for boron concentraition measurement uncertainty between the spent fuel pool and the RWST. The locking closed of the.required valves during refueling operations precludes the possibility of uncontrolled boron dilution of the filled portion of the RCS. This action prevents flow to the RCS of unborated water by closing flow paths from sources of unborated water.MODE ZERO shall be the Operational MODE where all fuel assemblies have been removed from containment to the Spent Fuel Pool. Technical Specification Table 1.2 defines MODE 6 as "Fuel in the reactor vessel with the vessel head closure bolts less than fully tensioned or with the head removed." With no fuel in the vessel the definition for MODE 6 no longer applies. The transition from MODE 6 to MODE ZERO occurs when the last fuel assembly of a full core off load has been transferred to the Spent Fuel Pool and has cleared the transfer canal while in transit to a storage location. This will:* Ensure Technical Specifications regarding sampling the transfer canal boron concentration are observed (4.9.-1.1.2);.

• Ensure that MODE 6 Technical Specification requirements are not relaxed prematurely during fuel movement in containment.

Concerning ACTION a., suspension of CORE ALTERATIONS and positive reactivity additions shall not preclude moving a component to a safe position. Operations that individually add limited positive reactivity (e.g., temperature fluctuations from inventory addition or temperature control fluctuations) but when combined with all other operations affecting core reactivity (e.g., intentional boration) result in overall net negative reactivity addition, are not precluded by this action.MILLSTONE -UNIT 3 B 3/4 9-1 MiLLSONE -UNIT B 3/ 9-1Amendment No. , 60, 14-8, 41-9, 230 LBDCR No. 10-MP3-006 March 9, 2010 3/4.9 REFUELING OPERATIONS BASES 3/4.9.1.2 BORON CONCENTRATION [N SPENT FUEL POOL During normal Spent Fuel Pool operation, the spent fuel racks are capable of maintaining Keff at less than or equal to 0.95 in an unborated water environment. This is accomplished in Region 1, 2, and 3 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers in some fuel storage regions, the limits on fuel burnup, fuel enrichment and minimum fuel decay time, and the use of blocking devices in certain fuel storage locations. The boron requirement in the spent fuel pool specified in 3.9.1.2 ensures that in the event of a fuel assembly handling accident involving either a single dropped or misplaced fuel assembly, the Keff of the Spent fuel storage racks will remain less than or equal to 0.95.3/4.9.2 INSTRUMENTATION The source range neutron flux monitors are used during refueling operations to monitor the core reactivity condition. The installed source range-neutron flux monitors are part of the Nuclear Instrumentation System (NIS). These detectors are located external to the reactor vessel and detect neutrons leaking from the core.There are two sets of source range neutron flux monitors: (1) Westinghouse source range neutron flux monitors, and (2) Gamma-Metrics source range neutron flux monitors.The Westinghouse monitors are the normal source range monitors used during refueling*activities. Gamma-Metrics source range neutron flux monitors are an acceptable equivalent control room indication for the Westinghouse source range neutron flux Monitors in MODE 6, including CORE Alterations, as follows: with the core in place within the reactor vessel or, with the Gamma Metrics source range neutron flux monitor(s) coupled to the core.Reactor Engineering shall determine whether each monitor is coupled to the core.This limiting condition for operation requires two source range neutron flux. monitors be OPERABLE to ensure that redundant monitoring capability is available to detect changes in core reactivity. To be OPERABLE, each monitor must provide visual indication in the control room. In addition, at least one of the two monitors must provide an OPERABLE audible count rate function in the control room and containment. MILLSTONE -UNIT 3 B 3/4 9-la Amendment No. 42, 60, 4-58, -204, 21-9, 2T3 LBDCR No. 1 0-MP3-006 March 9, 2010 3/4.9 REFUEL[NG OPERATIONS BASES The limiting condition for operation is satisfied .with either two Westinghouse source range neutron flux monitors OPERABLE, or with any combination that contains one OPERABLE Westinghouse source range neutron flux monitor (to provide audible indication) and one OPERABLE Gamma-Metrics source range neutron flux monitor that is coupled to the core.With only one Westinghouse source range neutron flux monitor OPERABLE and no Gamma-Metrics source range neutron flux monitors oPERABLE, ACTION a. must be entered.With both Westinghouse source range neutron flux monitors inoperable and one or more Gamma-Metrics source range neutron flux monitors OPERABLE and coupled to the core, ACTIONb.must be entered, since the Gamma-Metrics source range neutron flux monitors are incapable of providing audible indication in the containment. Concemning ACTION a., with only one of the required source range neutron flux monitor" OPERABLE, redundancy has been lost.. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with borOn concentration less than required to meet the minimum boron concentration of LCO 3.9.1.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Performance of ACTION a. shallnot preclude completion of movement of a component to a safe position.3/4.9.3 DECAY TIME The minimum requirement for reactor subcriticalityprior to movement of irradiated fuel assemblies in the reactor vessel ensures that sufficient time has elapsed to allow the radioactive decay of the short-lived fission products. This decay time is consistent with the assumptions used in the safety analyses.MILLSTONE -UNIT 3 B349l B 3/4 9-1b LBDCR No. 10-MP3-006 March 9, 2010 3/4.9 REFUIELING OPERATIONS BASES 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS S The requirements on containment penetration closure and OPERABILITY ensure that a release of radioactive material within containment to the environment will be minimized. The OPERABILITY, closure restrictions, and administrative controls are sufficient to minimize the release of radioactive material from a fuel element rupture based upon the lack of containment pressurization potential during the movement of fuel within containment. The containment purge valves are containment penetrations and must satisfy, all requirements specified for a containment penetration. ,: This specification is applicable during the movement of new and spent fuel assemblies within the containment building. The fuel handling accident analyses assume that during a fuel handling accident some of the fuel that is dropped and some of the fuel impacted upon is damaged.Therefore, the movement of either new or irradiated fuel can cause a fuel handling accident, and this specification is applicable whenever new or irradiated fuel is moved within the containment. Containment penetrations, including the personnel access hatch doors and equipment access hatch, can be open during the movement of fuel provided that sufficient administrative controls are in place such that any 0f these containment penetrations can be closed within 30 minutes.Following a Fuel Handling Accident, each penetration, including the equipment access hatch, is closed such that a containment atmosphere boundary can be established. However, if it is determined that closure of all containment penetrations would represent a significant radiological hazard to the personnel involved, the decision may be made to forgo the closure of the affected penetration(s). The containment atmosphere boundary is established when any penetration which provides direct access to the outside atmosphere is closed such that at least one barrier between the containment atmosphere and the outside atmosphere is established. Additional actions beyond establishing the containment atmosphere boundary, such as installing flange bolts for the equipment access hatch or a containment penetration, are not necessary. Administrative controls for opening a containment penetration require that one or more designated persons, as needed, be available for isolation of containment from the outside atmosphere. Procedural controls are also in place to ensure cables or hoses which pass through a containment opening can be quickly removed. The location of each cable and hose isolation device for those cables and hoses which pass through a containment opening is recorded to ensure timely closure of the containment boundary. Additionally, a closure plan is developed for each containment opening which includes an estimated time to close the containment opening. A log of personnel designated for containment closure is maintained, including identification of which containment openings each person has responsibility for closing. As necessary, equipment will be pre-staged to support timely closure of a containment penetration. MILLSTONE -UNIT 3 B349I mnmn o 3 B 3/4 9-1c Amendment No. [ March 17, 2004 3/4.9 REFUELING OPERATIONS BASES 3/4.9.4 CONTAINMENT BUILDING PENETRATIONS (Continued) The ability to close the equipment access hatch penetration within 30 minutes is verified each refueling outage prior to the first fuel movement in containment with the equipment access hatch open. Prior to opening a containment penetration, a review of containment penetrations currently open is performed to verify that sufficient personnel are designated such that all containment penetrations can be closed within 30 minutes. Designated personnel may have other duties, however, they must be available such that their assigned containment openings can be closed within 30 minutes. Additionally, each new work activity inside containment is reviewed to consider its effect on the closure of the equipment access hatch, at least one personnel access hatch door, and/or other open containment penetrations. The required number of designated personnel are continuously available to perform closure of their assigned containment openings whenever fuel is being moved within the containment. Controls for monitoring radioactivity within containment and in effluent paths from containment are maintained consistent with General Design Criterion

64. Local area radiation monitors, effluent discharge radiation monitors, and containment gaseous and particulate radiation monitors provide a defense-in-depth monitoring of the containment atmosphere and effluent releases to the environment.

These monitors are adequate to identify the need for establishing the containment atmosphere boundary. When containment penetrations are open during a refueling outage under administrative control for extended periods of time, routine grab samples of the containment atmosphere, equipment access hatch, and personnel access hatch will be required.The containment atmosphere is monitored during normal and transient operations of the reactor plant by the containment structure particulate and gas monitor located in the upper level of the Auxiliary Building or by grab sampling. Normal effluent discharge paths are monitored duirirng plant operation by the ventilation particulate samples and gasmonitors in the Auxiliary Building.,Administrative controls are also in place to ensure that the containment atmosphere boundary is established if adverse weather conditions which could present a potential missile hazard threaten the plant. Weather conditions are monitored during fuel movement whenever a containment penetration, including the equipment access hatch and personnel access hatch, is open and a storm center is within the plant monitoring radius of 150 miles.The administrative controls ensure that the containment atmosphere boundary can be quickly established (i.e. within 30 minutes) upon determination that adverse weather conditions exist which pose a significant threat to the Millstone Site. A significant threat exists when a hurricane warning or tornado warning is issued which applies to the Millstone Site, or if an average wind speed of 60 miles an hour or greater is recorded by plant meteorological equipment at the meteorological tower. If the meteorological equipment is inoperable, information from the National Weather Service can be used as a backup in determining plant wind speeds. Closure of containment penetrations, including the equipment access hatch penetration and at least one personnel access hatch door, begin immediately upon determination that a significant threat exists.MILLSTONE -UNIT 3 B 3/4 9-2 MILLTON -NIT3 B3/49-2Amendment No, 4-9-7-, 219 LBDCR 04-MP3-013 November 29, 2004 3/4.9 REFUELING OPERATIONS BASES 3/4.9.5 DELETED 3/4.9.6 DELETED 3/4.9.7 DELETED 3/4.9.8 RESIDUAL HEAT REMOVAL AND COOLANT CIRCULATION 3/4.9.8.1 HIGH WATER LEVEL BACKGROUN.D The purpose of the Residual Heat Removal (RH-R) System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant and to prevent boron stratification. Heat is removed fr'om the RCS by circulating reactor coolant through the RHR heat exchanger(s), where the heat is transferred to the Reactor Plant Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR system for normal cooldown or decay heat removal is manually accomplished from the control room. The heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR system.MILLSTONE -UNIT 3 B 3/4 9-2a Amendment No. 2-1-, Acknowledged by NRC Letter dated 04/12/06 06/28/06 3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.1 Ii-UGH WATER LEVEL (continued) APPLICABLE SAFETY ANALYSES If the reactor coolant temperature is not maintained below 200°F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant would eventually challenge the integrity of the fuel cladding, which is fission product barrier. One train of the RHR system is required to be operational in MODE 6, with the water level > 23 ft above the top of the reactor vessel flange to prevent this challenge. The LCO does permit deenergizing the RI-R pump for short durations, under the conditions that the boron concentration is not diluted. This conditional deenergizing of the RHR pump does not result in a challenge to the fission product banrier.APPLICABILITY One RI-R loop must be OPERABLE and in operation in MODE 6, with the water level _ 23 ft above the top of the reactor vessel flange, to provide decay heat removal. The 23 ft level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.10, "Water Level -- Reactor Vessel." Requirements for the RH-R system in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency Core Cooling Systems (ECCS). RHiR loop requirements in MODE 6 with the water level < 23 ft are located in LCO 3.9.8.2, "Residual Heat Removal (RHR) and Coolant Circulation--Low Water Level." LIMITING CONDITION FOR OPERATION The requirement that at least one RHR loop be in operation ensures that: (1) sufficient cooling capacity is available to remove decay heat an maintain the water in the reactor vessel below 140°F as required during the REFUELING MODE, and (2) sufficient coolant circulation is maintained through the core to minimize the effect of a boron dilution incident and prevent stratification. An OPERABLE RHR loop includes an RIIR pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path. An operating RI-R flow path should be capable of determining the low-end temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs.The LCO is modified by a Note that allows the required operating RHR loop to be removed from operation for up to 1 hour per 8 hour period, provided no operations are permitted that would dilute the RCS boron concentration by introduction of coolant into the RCS with boron concentration less than required to meet the minimaum boron concentration of LCO 3.9.1.1I.Boron concentration reduction with coolant at boron concentrations less than required to assure the RCS boron concentration is maintained is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RI-R isolation valve testing. During this 1 hour period, decay heat is removed by natural convection to the large mass of water in the refueling cavity.MILLSTONE -UNIT 3 B 3/4 9-3 MILLTONE-UIT 3B 3/9-3Amendment No. 4-1-7-, _2--9-, 230 LBDCR 12-MP3-01i0 September 20, 2012 3/4.9 REFUELING OPERATIONS BASES 3/4.9.8.1 HIGH WATER LEVJEL (continued) ACTIONS RHR loop requirements are met by haying one RER loop OPERABLE and in operations, except as penmitted in the Note to the LCO.If RHR ioop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimnum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. If RHR loop requirements are not met, actions shall be taken immediately to suspend loading of irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core.A minimumn refueling water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase decay heat load, such as loading a fuel assembly, is a prudent action under this condition. If RI-R loop requirements are not met, actions shall be initiated and continued in order to satisfy RI-R loop requirements. With the unit in MODE 6 and the refueling water level >_ 23 ft above the top of the reactor vessel flange, corrective actions shall be initiated immediately. If RtRR loop requirements are not met, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours. With the RK-R loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures dose limits are not exceeded.The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boiling in that time.Surveillance Requirement This Surveillance demonstrates that the RI-R loop is in operation and circulating reactor coolant.The flow rate is deternined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B 3/4 9-4 MILLTONE-UNT 3 3/49-4Amendment No. 44)-7, 2a-1-9-, 2 April 12, 1995.BASES 3/4.9.8.2 LOW WATER LEVEL BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant, and to prevent boron stratification. Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass lines. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR system.APPLICABLE SAFETY ANALYSES If the reactor coolant temperature is not maintained below 200°F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to the boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant will eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two trains of the RIIR System are required to be OPERABLE, and one train in operation, in order to prevent this challenge. LIMITING CONDITION FOR OPERATION In MODE 6, with the water leveI< 23 ft above the top of the reactor vessel flange, both RHR loops must be OPERABLE. Additionally, one loop of RUR must be in operation in order to provide: a. Removal of decay heat;b. Mixing of borated coolant to minimize the possibility of criticality; and c. Indication of reactor cooling temperature. The requirement to have two RHIR loops OPERABLE when there is less than 23 feet of water above the reactor vessel flange ensures that a single failure of the operating RHR loop will not result in a complete loss of residual heat removal capability. With the reactor vessel head removed and at least 23. feet of water above the reactor pressure vessel flange, a large heat sink is available for core cooling. Thus, in the event of a failure of the operating RHR loop, adequate time is provided to initiate emergency procedure to cool the core.MILLSTONE -UNIT 3"B34- mnmn o 0 B 3/4 9-5 Amendment No. 107 06/28/06 3/4.9 REFUELING OPERATIONS[ BASES 3/4.9.8.2 LOW WATER LEVEL (continued) An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path. An operating RHR flow path should be capable of determining the low end temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs.APPLICABILITY Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation in MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to proviide decay heat removal. Requirements for the RHR System in other MODES are covered by LCOs in Section 3.5, Emergency Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level _ 23 ft are located in LCO 3.9.8.1, "Residual Removal (RHR) AND Coolant Circulation--High WCater Level." ACTIONS a. If less than the required number of RI-R loops are OPERABLE, actions shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status and to operation, or until _ 23 ft of water level is established above the reactor vessel flange. When the water level is _ 23 ft above the reactor vessel flange, the Applicability changes to that of LCO 3.9.8.1, and only one RHIR loop is required to be OPERABLE and in operation. An immediate Completion Time is necessary for an operator to initiate corrective action.b. If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a, boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. If no RH-R loop is in operation, actions shall be initiated immediately, and continued, to restore.one RHR loop to operation. Since the unit is in ACTIONS 'a' and 'b' concurrently, the restoration of two OPERABLE RITR loops and one operating RH-R loop should be accomplished expeditiously. If no RtHR loop is in operation, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours. With the RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Closing containment penetrations that are open to the outside atmosphere ensures that dose limits are not exceeded.MILLSTONE -UNIT 3 B 3/4 9-6 MILSTNE UIT B3/4-6Amendment No. 230 LBDCR 12-IvP3-010 September 20, 2012 3/4.9 REFUELING OPERATIONS BASES The Completion Time of 4 hours is reasonable, based on the low probability of the coolant boiling in that time.Surveillance Requirement This Surveillance demonstrates that one RIIR loop is in operation and circulating reactor coolant.The flow rate is detennined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. In addition, during operation of the RHR loop with the water level in the vicinity of the reactor vessel nozzles, the RHR pump suction requirements must be met. The surveillance frequency is controlled under the Surveillance Frequency Control Program.MILLSTONE -UNIT 3 B 3/4 9-7 MILLTON -NIT3 B3/49-7Amendment No. 4-05, 49-l-, 23-0 LIBDCR No. 06-MP3-026 October 15, 2006+3/4.9 R FiFITFLFNG OPER ATiONS BASES 3/4.9.10 AND 3/4.9.11 WATER LEVEL -REACTOR VES SEL AND STORAGE POOL The restrictions on minimum water level ensure that sufficient water depth is available to remove at least 99% of the assumed iodine gap activity released from the rupture of an irradiated fuel assembly. The minfimum water depth is consistent with the assumptions of the safety analysis.MILLSTONE -UNIT 3 13 3/4 9-8 Amendment No. 3?-9, -!-0-7, 4-58, 4-84-, -I-89,-20-., 24t-9 NRC Verbal Ackn~owledgement: 07/05/07 LBDCR No. 07-MiP3-037 July 12, 2007 REFUELING OPERATIONS BASES 3/4.9.13 SPENT FUEL POOL -REACTIVTY During normal spent fuel pool operation, the spent fuel racks are capable of maintaining Keff at less than or equal to 0.95 in an unborated water environment. Maintaining Keff~ at less than or equal to 0.95 is accomplished in Region 1 3-OUT-OF-4 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers in the racks, a maximum nominal 5 weight percent fuel enrichment, and the use of blocking devices in certain fuel storage locations, as specified by the interface requirements shown in Figure 3.9-2.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 1 4-OUT-OF-4 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers in the racks, and the limits on fuel enrichment/fuel burnup specified in Figure 3.9-1.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 2 storage racks by the combination of geometry of the rack spacing, the use of fixed neutron absorbers in the racks, and the limits on fuel enrichment/fuel burnup and fuel decay time specified in Figure 3.9-3.Maintaining Keff at less than or equal to 0.95 is accomplished in Region 3 storage racks by the combination of geometry of the rack spacing, and the limits on fuel enrichment/fuel burnup and fuel decay time specified in Figure 3.9-4 for assemblies used exclusively in the pre-uprate ](3411 Mwt) cores and Figure 3.9-5 for assemblies used in the post-update (3650 Mwt) cores.Fixed neutron absorbers are not credited in the Regioni 3 fuel storage racks.The limitations described by Figures 3.9-1, 3.9-2, 3.9-3, 3.9-4, and 3.9-5 ensure that the [reactivity of the fuel assemblies stored in the spent fuel pool are conservatively within the assumptions of the safety analysis.Administrative controls have been developed and instituted to verif~y that the fuel enrichment, fuel bumup, fuel decay times, and fuel interface restrictions specified in Figures 3.9-1, 3.9-2, 3.9-3, 3.9-4, and 3.9-5 as well as restrictions specified in the Note on Figures 3.9-3 and 3.9-5 are complied with.3/4.9.14 SPENT FUEL POOL -STORAGE PATTERN The limitations of this specification ensure that the reactivity conditions of the Region 1 3-OUT-OF-4 storage racks and spent fuel pool keff will remain less than or equal to 0.95.The Cell Blocking Devices in the 4th location of the Region 1 3-OUT-OF-4 storage racks are designed to prevent inadvertent placement and/or storage of fuel assemblies in the blocked locations. The blocked location remains empty to provide the flux trap to maintain reactivity control for fuel assemblies in adjacent and diagonal locations of the STORAGE PATTERN.STORAGE PATTERN for the Region 1 storage racks will be established and expanded from the walls of the spent fuel pool per Figure 3..9-2 to ensure definition and control of the Region 1 3-OUT-OF-4 Boundary to other Storage Regions and minimize the number of boundaries where a fuel misplacement incident can occur.MILLSTONE -UNIT 3 MILSTOE -UNI 3B 3/4 9-9 Amendment No. :39, 410-5, 4lOg, -8, 4189, 2O-REVERSE OF PAGE B 3/4 9-9 INTENTIONALLY LEFT BLANK 3/4.10 SPECIAL TEST EXCEPTIONS July 30, 2002 BASES 3/4.10.1 SHUTDOWN MARGIN This speci~altest,.ex~ception provides that..a minimum amount, of control rod worth is immedia~tely..available for reactivity control, when~tests are performed. for control rod worth, measurement.. Thi~s..sPecial .test exception .is requi~red to permit the periodicvyeri~fication of the actual versus predicted core reactivity condition occurring as.a result-of fuel .burnup or fuel cycling operations. 3/4.10.2 GRouP HEIGHT, INSERTION, AND POWER DISTRIBUTION LIMITS.This special .test except~ion, permits ind~ividual control .rods to be positioned-outside of their normal.-group: heights. and i~nsertion limits during the performance. of such PHYSICS TESTS as those required to: (1) measure control rod. worth, and (2) determine the reactor stability index and damping factor under xenon oscillation, condi~tions.i " ..""-3/4.10.3 PHYSICS TESTS This special test exception permits PHYSICS TESTS to be performed at less than or equal to 5% of RATED THERMAL POWER with. the RCS Tavg slightly lower than normally allowed so that the fundamental nuclear characteristics of the core and related instrumentation can be verified.. In order for various cha~rac-teristics t~o be accurately measured, it *is at times necessary to operate outside the normal restrictions of these Technical Specifications. For instance, to measure the moderator temperature coefficient at BOL, it is necessary to position the various control rods at heights which may not normally be allowed by Specification 3.1.3.6 which in turn may cause the RCS ITv to fall slightly below the minimum temperature of Specification 3.1.1.4.3/4.10.4 REACTOR COOLANT LOOPS This special test exception permits reactor criticality under no flow conditions and is required to perform certain STARTUP and PHYSICS TESTS while at low THERMAL POWER levels.3/4.10.5 DELETED MILLSTONE -UNIT 3 B 314 10-I MILLTON -NIT B /4 0-1Amendment No. 7J7, 207 Juiy 30, 200-2 THIS PAGE INTENTIONALLY LEFT BLANK MILLTON -NIT B /4 0-2Amendment No. XJ7, 207~i MILLSTONE -UNIT 3 B 3/4 10-2 November 28, 2000 3/4.11 DELETED BASES 3/4.11.1 -DELETED 3/4.11.2 -DELETED 3/4/11/3 -DELETED MILLSTONE -UNIT 3 B341- mnmn o 8 B 3/4 11-1 Amendment No= 188 ZUUUJ This page intentionally left blank MILLSTONE -UNIT 3 B341- mnmn o 8 B 3/4 11-2 Amendment NOo 188 November 28, 2000 This page intentionally left blank MILLSTONE -UNIT 3 B 3/4 11-3 MILL TON -NIT B /4 1-3Amendment No. , 188 REVERSE OF PAGE B 3/4 11-3 INTENTIONALLY LEFT BLANK .}}