ML18270A130

Issuance of Amendment Nos. 326 and 304 to Add Risk-Informed Completion Time Program

ML18270A130
Person / Time
Site:	Calvert Cliffs
Issue date:	10/30/2018
From:	Marshall M L Plant Licensing Branch 1
To:	Bryan Hanson Exelon Generation Co, Exelon Nuclear
Marshall M L, NRR/DORL/LPLI, 415-2871
References
EPID L-2016-LLA-0001
Download: ML18270A130 (136)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, 0.C. 20555-0001 October 30, 2018 Mr. Bryan C. Hanson Senior Vice President Exelon Generation Company, LLC President and Chief Nuclear Officer Exelon Nuclear 4300 Winfield Road Warrenville, IL 60555

SUBJECT:

CALVERT CLIFFS NUCLEAR POWER PLANT, UNITS 1 AND 2-ISSUANCE OF AMENDMENT NOS. 326 AND 304 TO ADD RISK-INFORMED COMPLETION TIME PROGRAM (EPID L-2016-LLA-0001)

Dear Mr. Hanson:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment No. 326 to Renewed Facility Operating License No. DPR-53 and Amendment No. 304 to Renewed Facility Operating License No. DPR-69 for the Calvert Cliffs Nuclear Power Plant (Calvert Cliffs), Units 1 and 2, respectively.

These amendments consist of changes to the Technical Specifications (TSs) in response to your application dated February 25, 2016, as supplemented by letters dated April 3, 2017, and January 11, January 18, June 21, and August 27, 2018. Publicly-available versions are in the Agencywide Documents Access and Management System under Accession Nos. ML 16060A223, ML 17094A591, ML 18011A665, ML 180186340, ML 18172A145, and ML 18239A260, respectively.

These amendments revise the Calvert Cliffs, Units 1 and 2, TSs related to completion times for required actions to provide the option to calculate longer risk-informed completion times. The amendments also add a new program, the "Risk-Informed Completion Time Program," to TS Section 5.5, "Programs and Manuals."

B. Hanson A copy of the related safety evaluation is enclosed.

A notice of issuance will be included in the Commission's biweekly Federal Register notice. Docket Nos. 50-317 and 50-318

Enclosures:

1. Amendment No. 326 to DPR-53 2. Amendment No. 304 to DPR-69 3. Safety Evaluation cc: Listserv Sincerely, Michael L. Marshall, Jr., Senior Project Manager Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 EXELON GENERATION COMPANY, LLC DOCKET NO. 50-317 CALVERT CLIFFS NUCLEAR POWER PLANT, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 326 Renewed License No. DPR-53 1. The U.S. Nuclear Regulatory Commission (the Commission) has found that: A. The application for amendment by Exelon Generation Company, LLC (Exelon, the licensee) dated February 25, 2016, as supplemented by letters dated April 3, 2017, and January 11, January 18, June 21, and August 27, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1 2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 2.C.2. of Renewed Facility Operating License No. DPR-53 is hereby amended to read as follows: 2. Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 326, are hereby incorporated into this license. Exelon Generation shall operate the facility in accordance with the Technical Specifications.

3. This license amendment is effective as of the date of its issuance and shall be implemented within 180 days.

Attachment:

Changes to the Renewed Facility Operating License and Technical Specifications Date of Issuance:

October 3 O, 2 O 1 8 FOR THE NUCLEAR REGULATORY COMMISSION Ja es G. Danna, Chief Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation ATTACHMENT TO LICENSE AMENDMENT NO. 326 CALVERT CLIFFS NUCLEAR POWER PLANT, UNIT 1 RENEWED FACILITY OPERATING LICENSE NO. DPR-53 DOCKET NO. 50-317 Replace the following page of the Renewed Facility Operating License with the attached revised page. The revised page is identified by amendment number and contains a marginal line indicating the area of change. Remove Page 3 Insert Page 3 Replace the following pages of the Appendix A Technical Specifications with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change. Remove Pages 1.3-14 3.3.1-1 3.3.1-2 3.3.1-3 3.3.1-4 3.3.3-1 3.3.4-1 3.3.4-2 3.3.4-3 3.3.5-1 3.3.5-2 3.3.6-1 3.3.6-2 3.3.6-3 3.5.2-1 3.6.2-4 3.6.2-5 3.6.3-2 3.6.3-4 3.6.6-1 3.6.6-2 3.7.3-1 3.7.3-2 3.7.3-3 3.7.3-4 3.7.3-5 Insert Pages 1.3-14 1.3-15 3.3.1-1 3.3.1-2 3.3.1-3 3.3.1-4 3.3.3-1 3.3.4-1 3.3.4-2 3.3.4-3 3.3.5-1 3.3.5-2 3.3.6-1 3.3.6-2 3.3.6-3 3.3.6-4 3.5.2-1 3.6.2-4 3.6.2-5 3.6.2-6 3.6.3-2 3.6.3-4 3.6.6-1 3.6.6-2 3.7.3-1 3.7.3-2 3.7.3-3 3.7.3-4 3.7.3-5 3.7.3-6 Remove Pages 3.7.5-1 3.7.6-1 3.7.6-2 3.7.6-3 3.7.7-1 3.7.7-2 3.7.18-1 3.8.1-2 3.8.1-4 3.8.1-8 3.8.1-9 3.8.1-10 3.8.1-11 3.8.1-12 3.8.1-13 3.8.1-14 3.8.1-15 3.8.1-16 3.8.1-17 3.8.4-1 3.8.7-1 3.8.9-1 3.8.9-2 5.5-19 Insert Pages 3.7.5-1 3.7.6-1 3.7.6-2 3.7.6-3 3.7.7-1 3.7.7-2 3.7.7-3 3.7.18-1 3.8.1-2 3.8.1-4 3.8.1-8 3.8.1-9 3.8.1-10 3.8.1-11 3.8.1-12 3.8.1-13 3.8.1-14 3.8.1-15 3.8.1-16 3.8.1-17 3.8.1-18 3.8.4-1 3.8.7-1 3.8.9-1 3.8.9-2 5.5-19 5.5-20 (4) Exelon Generation pursuant to the Act and 10 CFR Parts 30, 40, and 70, to receive, possess, and use, in amounts as required, any byproduct, source, and special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (5) Exelon Generation pursuant to the Act and 10 CFR Parts 30 and 70 to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.

C. This license is deemed to contain and is subject to the conditions set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act, and the rules, regulations, and orders of the Commission, now or hereafter applicable; and is subject to the additional conditions specified and incorporated below: (1) (2) Maximum Power Level Exelon Generation is authorized to operate the facility at steady-state reactor core power levels not in excess of 2737 megawatts-thermal in accordance with the conditions specified herein. Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 326, are hereby incorporated into this license. Exelon Generation shall operate the facility in accordance with the Technical Specifications. (a) For Surveillance Requirements (SRs) that are new, in Amendment 227 to Facility Operating License No. DPR-53, the first performance is due at the end of the first surveillance interval that begins at implementation of Amendment 227. For SRs that existed prior to Amendment 227, including SRs with modified acceptance criteria and SRs whose frequency of performance is being extended, the first performance is due at the end of the first surveillance interval that begins on the date the Surveillance was last performed prior to implementation of Amendment 227. (3) Additional Conditions The Additional Conditions contained in Appendix C as revised through Amendment No. 318 are hereby incorporated into this license. Exelon Generation shall operate the facility in accordance with the Additional Conditions. ( 4) Secondary Water Chemistry Monitoring Program Exelon Generation shall implement a secondary water chemistry monitoring program to inhibit steam generator tube degradation.

This program shall include: Amendment No. 326 1.3 Completion Times Completion Times 1.3 The Completion Time clock for Condition A does not stop after Condition Bis entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition Bis entered, Condition Bis exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired. EXAMPLE 1.3-8-ACTIONS CONDITION A. One subsystem inoperable.

B. Required Action and associated Completion Time not met. A.1 B.1 AND B.2 REQUIRED ACTION COMPLETION TIME Restore subsystem 7 days to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program Be in MODE 3. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the required Action beyond the 7 day Completion Time. The RICT cannot exceed CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 1. 3-14 Amendment No. 326 Amendment No. 304 Completion Times 1.3 1.3 Completion Times IMMEDIATE COMPLETION TIME 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition B must also be entered. The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions.

For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the plant configuration change, whichever is less. If the 7 day Completion Time clock of Condition A has expired and subsequent changes in plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition Bis also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition Bis also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition Bis entered, Conditions A and Bare exited, and therefore, the Required Actions of Condition B may be terminated.

When 11 Immediately 11 is used as a Completion Time, the Required Action should be pursued without delay and in a controlled manner. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 1.3-15 Amendment No. 326 Amendment No. 304 3.3 INSTRUMENTATION RPS Instrumentation-Operating 3.3.1 3.3.1 Reactor Protective System (RPS) Instrumentation-Operating LCO 3.3.1 Four RPS bistable trip units, associated measurement channels, and applicable automatic bypass removal features for each Function in Table 3.3.1-1 shall be OPERABLE.

APPLICABILITY:

According to Table 3.3.1-1: ACTIONS -------------------------------------NOTE-------------------------------------

Separate Condition entry is allowed for each RPS Function.

CONDITION A. One or more Functions with -0ne RPS bistable trip unit or associated measurement channel inoperable except for Condition C (excore channel not calibrated with incore detectors).

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 REQUIRED ACTION A. l Place affected bistable trip unit in bypass or trip. AND " A.2.1 Restore affected bistable trip unit and associated measurement channel to OPERABLE status. OR 3.3.1-1 COMPLETION TIME 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 48 hours OR In accordance with the Risk Informed Completion Time Program Amendment No.326 Amendment No.304 ACTIONS (continued)

CONDITION A. (Continued)

8. One or more Functions with two RPS bistable trip units or associated measurement channels inoperable except for Condition C (excore channel not calibrated with incore detectors).

C. One or more Functions with one or more power range excore channels not calibrated with the incore detectors.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 A.2.2 8.1 AND 8.2 C.1 OR C.2 RPS Instrumentation-Operating 3.3.1 REQUIRED ACTION Place affected bistable trip unit in trip. Place one affected bistable trip unit in bypass and place the other affected bistable trip unit in trip. Restore one affected bistable trip unit and associated measurement channel to OPERABLE status. Perform SR 3.3.1.3. Restrict THERMAL POWER to< 90% RTP. 3.3.1-2 COMPLETION TIME 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 48 hours OR In accordance with the Risk Informed Completion Time Program 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 24 hours Amendment No.326 Amendment No. 304 ACTIONS {continued)

CONDITION RPS Instrumentation-Operating 3.3.1 REQUIRED ACTION COMPLETION TIME D. One or more Functions D.1 with one automatic Disable bypass channel. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> bypass removal feature inoperable.

OR CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 D.2.1 Place affected bistable trip units in bypass or trip. D.2.2.1 Restore automatic bypass removal feature and affected bistable trip unit to OPERABLE status. OR 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 48 hours In accordance with the Risk Informed Completion Time Program D.2.2.2 Place affected 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> bistable trip unit in trip. OR 3.3.1-3 In accordance with the Risk Informed Completion Time Program Amendment No. 326 Amendment No. 304 ACTIONS (continued)

CONDITION E. One or more Functions with two automatic bypass removal feature channels inoperable. " -CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 E.1 OR E.2.1 E.2.2 RPS Instrumentation-Operating 3.3.1 REQUIRED ACTION Disable bypass channels.

Place one affected bistable trip unit in bypass and place the other in trip for each affected t~ip Function.

AND Restore one automatic bypass removal feature and the affected bistable trip unit to OPERABLE status for each affected trip Function.

3.3.1-4 COMPLETION TIME 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 1 hour 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program Amendment No. 326 Amendment No. 304 3.3 INSTRUMENTATION RPS Logic and Trip Initiation 3.3.3 3.3.3 Reactor Protective System (RPS) Logic and Trip Initiation LCO 3.3.3 Six channels of RPS Matrix Logic, four channels of RPS Trip Path Logic, four channels of reactor trip circuit breakers (RTCBs), and four channels of Manual Trip shall be OPERABLE.

APPLICABILITY:

MODES 1 and 2, MODES 3, 4, and 5, with any RTCBs closed and any control element assemblies capable of being withdrawn.

ACTIONS CONDITION A. One Matrix Logic channel inoperable.

B. One channel of Manual Trip, RTCBs, or Trip Path Logic inoperable in MODE 1 or 2. C. One channel of Manual Trip, RTCBs, or Trip Path Logic inoperable in MODE 3, 4, or 5. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 A.1 B.1 C.1 REQUIRED ACTION Restore Matrix Logic channel to OPERABLE status. Open the affected RTCBs. Open all RTCBs. 3.3.3-1 COMPLETION TIME 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 48 hours Amendment No. 326 Amendment No. 304 3.3 INSTRUMENTATION ESFAS Instrumentation 3.3.4 3.3.4 Engineered Safety Features Actuation System (ESFAS) Instrumentation LCO 3.3.4 Four ESFAS sensor modules, associated measurement channels, and applicable automatic block removal features for each Function in Table 3.3.4-1 shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, and 3. ACTIONS -------------------------------------NOTE-------------------------------------

Separate Condition entry is allowed for each ESFAS Function.

CONDITION A. One or more Functions with one ESFAS sensor module or associated measurement channel inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 A.1 AND A.2.1 REQUIRED ACTION Place affected sensor module in bypass or trip. Restore affected sensor module and associated measurement channel to OPERABLE status. OR 3.3.4-1 COMPLETION TIME 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 48 hours OR In accordance with the Risk Informed Completion Time Program Amendment No. 326 Amendment No. 304 ACTIONS (continued)

CONDITION REQUIRED ACTION ESFAS Instrumentation 3.3.4 COMPLETION TIME A. (continued)

A. 2. 2 Pl ace affected sensor 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> module in trip. B. One or more Functions B.1 with two ESFAS sensor modules or associated measurement channels inoperable.

Place one sensor module in bypass and place the other sensor module in trip. OR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> B.2 Restore one sensor 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> module and associated C. One or more Functions C.1 with the automatic block removal feature of one sensor block module inoperable.

OR measurement channel to OPERABLE status. Disable affected sensor block module. OR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> C.2 Place affected sensor 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> block module in CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 bypass. 3.3.4-2 Amendment No. 326 Amendment No. 304 ACTIONS (continued)

CONDITION D. One or more Functions with the automatic block removal feature of two sensor block modules inoperable.

E. Required Action and associated Completion Time not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 D.1 OR D.2.1 REQUIRED ACTION Disable affected ESFAS Instrumentation 3.3.4 COMPLETION TIME 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> sensor block modules. Place one affected 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> sensor block module in bypass and disable the other for each affected ESFAS Function.

AND D.2.2 Restore one automatic.

block removal feature and the associated sensor block module to OPERABLE status for each affected ESFAS Function.

E.1 Be in MODE 3. AND E.2 Be in MODE 4. 3.3.4-3 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours Amendment No. 326 Amendment No. 304 3.3 INSTRUMENTATION ESFAS Logic and Manual Actuation 3.3.5 3.3.5 Engineered Safety Features Actuation System (ESFAS) Logic and Manual Actuation LCO 3.3.5 Two ESFAS Manual Actuation or Start channels and two ESFAS Actuation Logic channels shall be OPERABLE for each ESFAS Function specified in Table 3.3.5-1. APPLICABILITY:

According to Table 3.3.5-1. ACTIONS -------------------------------------NOTE-------------------------------------

Separate Condition entry is allowed for each ESFAS Function.

CONDITION A. One Auxiliary Feedwater Actuation System Manual Start channel or Actuation Logic channel inoperable.

B. Required Action and associated Completion Time of Condition A not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 REQUIRED ACTION A.1 Restore affected Auxiliary Feedwater Actuation System Manual Start channel and Actuation Logic channel to OPERABLE status. B.1 Be in MODE 3. AND B.2 Be in MODE 4. 3.3.5-1 COMPLETION TIME 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours Amendment No. 326 Amendment No.304 ACTIONS (continued)

CONDITION C. One or more Functions with one Manual Actuation channel or Actuation Logic channel inoperable except Auxiliary Feedwater Actuation System. D. Required Action and associated Completion Time of Condition C not met for one Manual Actuation channel. E. Required Action and associated Completion Time of Condition C not met for one Actuation Logic channel. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 C.1 D.1 AND D.2 E.1 AND E.2 ESFAS Logic and Manual Actuation 3.3.5 REQUIRED ACTION Restore affected Manual Actuation channel and Actuation Logic channel to OPERABLE status. Be in MODE 3. Be in MODE 5. Be in MODE 3. Be in Mode 4. 3.3.5-2 COMPLETION TIME 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours Amendment No. 326 Amendment No. 304 3.3 INSTRUMENTATION 3.3.6 Diesel Generator (DG)-Loss of Voltage Start (LOVS) DG-LOVS 3.3.6 LCO 3.3.6 Four sensor modules and measurement channels per DG for the Loss of Voltage Function, four sensor modules and measurement channels per DG for the Transient Degraded Voltage Function, and four sensor modules and measurement channels per DG for the Steady State Degraded Voltage Function shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4. ACTIONS -------------------------------------NOTE-------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION A. One or more Functions with one sensor module or associated measurement channel per DG inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 A.1 AND A.2.1 REQUIRED ACTION Place sensor module in bypass or trip. Restore sensor module and associated measurement channel to OPERABLE status. OR 3.3.6-1 COMPLETION TIME 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 48 hours OR In accordance with the Risk Informed Completion Time Program Amendment No. 326 Amendment No. 304 ACTIONS (continued)

CONDITION A. (Continued)

B. One or more Functions with two sensor modules or associated measurement channels per DG inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 REQUIRED ACTION A.2.2 Place the sensor module in trip. B.1 Enter applicable Conditions and Required Actions for the associated DG made inoperable by DG-LOVS instrumentation.

OR B.2.1 Place one sensor module in bypass and the other sensor module in trip. AND B.2.2 Restore one sensor module and associated measurement channel to OPERABLE status. 3.3.6-2 DG-LOVS 3.3.6 COMPLETION TIME 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 1 hour 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program Amendment No. 326 Amendment No. 304 ACTIONS {continued)

CONDITION REQUIRED ACTION C. One or more Functions C.1 Restore at least two with more than two sensor modules and sensor modules or associated associated measurement channels measurement channels to OPERABLE status. inoperable.

D. Required Action and D.1 Enter applicable associated Completion Conditions and Time not met. Required Actions for the associated DG made inoperable by DG-LOVS instrumentation.

SURVEILLANCE REQUIREMENTS SURVEILLANCE SR 3.3.6.1 Perform CHANNEL FUNCTIONAL TEST. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.3.6-3 DG-LOVS 3.3.6 COMPLETION TIME 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Immediately FREQUENCY In accordance with the Surveillance Frequency Control Program Amendment No.326 Amendment No.304 '

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.6.2 SURVEILLANCE Perform CHANNEL CALIBRATION with setpoi nt Allowable Values as follows: 1. Transient Degraded Voltage Function 3630 V and~ 3790 V; Time Delay: 7.6 seconds and 8.4 seconds; 2. Steady State Degraded Voltage Function 3820 V and~ 3980 V Time Delay: 97.5 seconds and 104.5 seconds; and 3. Loss of voltage Function~

2345 V and 2555 V Time Delay: 1.8 seconds and 2.2 seconds at 2450 V. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.3.6-4 DG-LOVS 3.3.6 FREQUENCY In accordance with the Surveillance Frequency Control Program Amendment No. 326 Amendment No. 304 3.5 EMERGENCY CORE COOLING SYSTEM (ECCS) 3.5.2 ECCS -Operating LCO 3.5.2 Two ECCS trains shall be OPERABLE.

APPLICABILITY:

MODES 1 and 2, ECCS -Operating 3.5.2 MODE 3 with pressurizer pressure~

1750 psia. ACTIONS CONDITION A. One or more trains inoperable.

AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available.

B. Required Action and associated Completion Time not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 A.1 B.1 AND B.2 REQUIRED ACTION Restore train(s) to OPERABLE status. Be in MODE 3. Reduce pressurizer pressure to < 1750 psia. 3.5.2-1 COMPLETION TIME 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours Amendment No. 326 Amendment No. 304 ACTIONS (continued)

CONDITION B. (continued)

C. One or more containment air locks i noperab 1 e for reasons other than Condition A or B. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 B.2 AND B.3 C.1 AND C.2 AND Containment Air Locks 3.6.2 REQUIRED ACTION Lock an OPERABLE door closed in the affected air lock. --------NOTE-------

Air lock doors in high radiation areas may be verified 1 ocked closed by administrative means. --------------------

Verify an OPERABLE door is locked closed in the affected air lock. Initiate action to evaluate overall containment leakage rate per LCO 3.6.1. Verify a door is closed in the affected air lock. 3.6.2-4 COMPLETION TIME 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Once per 31 days Immediately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Amendment No. 326 Amendment No. 304 Containment Air Locks 3.6.2 ACTIONS (continued)

CONDITION REQUIRED ACTION C. (continued)

C.3 Restore air lock to OPERABLE status. D. Required Action and D.1 Be in MODE 3. associated Completion Time not met. AND D.2 Be in MODE 5. SURVEILLANCE REQUIREMENTS SR 3.6.2.1 SURVEILLANCE

---

NOTES------------------

1. An inoperable air lock door does not invalidate the previous successful performance of the overall air lock 1 eakage test. 2. Results shall be evaluated against acceptance criteria applicable to SR 3.6.1.1. Perform required air lock leakage rate testing in accordance with the Containment Leakage Rate Testing Program. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.6.2-5 COMPLETION TIME 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours FREQUENCY In accordance with the Containment Leakage Rate Testing Program Amendment No. 326 Amendment No. 304 Containment Air Locks 3.6.2 SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.2.2 SURVEILLANCE FREQUENCY Verify only one door in the air lock can be In accordance opened at a time. with the Surveillance Frequency Control Program CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.6.2-6 Amendment No.326 Amendment No. 304 ACTIONS (continued)

CONDITION A. --------NOTE--------

A.1 Only applicable to pen et ration fl ow paths with two containment isolation valves and not a closed system. One or more pen et ration fl ow paths with one containment isolation valve inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 AND A.2 Containment Isolation Valves 3.6.3 REQUIRED ACTION COMPLETION TIME I sol ate the affected 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> penetration flow path by use of at least one closed and de-activated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured. --------NOTE-------

Isolation devices in high radiation areas may be verified by use of administrative means. Verify the affected penetration flow path is isolated.

3.6.3-2 In accordance with the Risk Informed Completion Time Program Once per 31 days following isolation for isolation devices outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside containment Amendment No.326 Amendment No. 304 ACTIONS (continued)

CONDITION C. --------NOTE --------Only applicable to penetration fl ow paths with one or more containment isolation valves and a closed system. ---------------------

One or more penetration flow paths with one or more containment isolation valves inoperable.

D. Required Action and associated Completion Time not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 C.1 AND C.2 D.1 AND D.2 Containment Isolation Valves 3.6.3 REQUIRED ACTION Isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve, closed manual valve, or blind flange. --------NOTE-------

Isolation devices in high radiation areas may be verified by use of administrative means. --------------------

Verify the affected penetration flow path is isolated.

Be in MODE 3. Be in MODE 5. 3.6.3-4 COMPLETION TIME 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program Once per 31 days following isolation 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Amendment No. 326 Amendment No. 304 3.6 CONTAINMENT SYSTEMS Containment Spray and Cooling Systems 3.6.6 3.6.6 Containment Spray and Cooling Systems LCO 3.6.6 Two containment spray trains and two containment cooling trains shall be OPERABLE.

APPLICABILITY:

MODES 1 and 2. MODE 3, except containment spray is not required to be OPERABLE when pressurizer pressure is< 1750 psia. ACTIONS CONDITION A. One containment spray train inoperable.

B. One containment cooling train inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 A.1 B.1 REQUIRED ACTION Restore containment spray train to OPERABLE status. Restore containment cooling train to OPERABLE status. 3.6.6-1 COMPLETION TIME 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 7 days OR In accordance with the Risk Informed Completion Time Program Amendment No.326 Amendment No.304 ACTIONS (continued)

CONDITION C. --------NOTE --------Not applicable when second containment spray train intentionally made inoperable.

---

Two containment spray trains inoperable.

D. Two containment cooling trains inoperable.

E. Required Action and associated Completion Time not met. F. Any combination of three or more trains inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 C.1 AND C.2 D.1 E.1 AND E.2 F.1 Containment Spray and Cooling Systems 3.6.6 REQUIRED ACTION Verify LCO 3.7.8, "CREVS," is met. Restore at least one containment spray train to OPERABLE status. Restore one containment cooling train to OPERABLE status. Be in MODE 3. Be in MODE 4. Enter LCO 3.0.3. 3.6.6-2 COMPLETION TIME 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 24 hours 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> 6 hours 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Immediately Amendment No. 326 Amendment No. 304 3.7 PLANT SYSTEMS AFW System 3.7.3 3.7.3 Auxiliary Feedwater (AFW) System LCO 3.7.3 Two AFW trains shall be OPERABLE.

---

NOTE----------------------------

AFW trains required for OPERABILITY may be taken out of service under administrative control for the performance of periodic testing. APPLICABILITY:

MODES 1, 2, and 3. ACTIONS -------------------------------------NOTE-------------------------------------

LCO 3.0.4.b is not applicable.

CONDITION A. One steam-driven AFW A. 1 pump inoperable.

REQUIRED ACTION COMPLETION TIME Align remaining 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OPERABLE steam-driven pump to automatic initiating status. A.2 Restore steam-driven 7 days pump to OPERABLE CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 status. OR 3.7.3-1 In accordance with the Risk Informed Completion Time Program Amendment No.326 Amendment No.304 ACTIONS (continued)

CONDITION B. One motor-driven AFW pump inoperable.

C. Two AFW pumps inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 B.1 AND B.2 C.1 AND C.2 AND C.3 AND REQUIRED ACTION Align standby steam-driven pump to automatic initiating status. Restore motor-driven pump to OPERABLE status. Align remaining OPERABLE pump to automatic initiating status. Verify the other unit 1 s motor-driven AFW pump is OPERABLE.

Verify, by administrative means, the cross-tie valve to the opposite unit is OPERABLE.

3.7.3-2 AFW System 3.7.3 COMPLETION TIME 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> 7 days OR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 1 hour 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Amendment No. 326 Amendment No. 304 ACTIONS (continued)

CONDITION C. (continued)

D. One AFW train inoperable for reasons other than Condition A, B, or C. E. Required Action and associated Completion Time of Condition A, B, C, or D not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 C.4 D. l E. l AND E.2 REQUIRED ACTION Restore one AFW pump to OPERABLE status. Restore AFW train to OPERABLE status. Be in MODE 3. Be in MODE 4. 3.7.3-3 AFW System 3.7.3 COMPLETION TIME 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours Amendment No.326 Amendment No. 304 ACTIONS (continued)

CONDITION REQUIRED ACTION F. Two AFW trains inoperable.

F.1 --------NOTE-------

LCO 3.0.3 and all other LCO Required Actions requiring . MODE changes are suspended until one AFW train is restored to OPERABLE status. --------------------

Initiate action to restore one AFW train to OPERABLE status. SURVEILLANCE REQUIREMENTS SR 3.7.3.1 SR 3.7.3.2 SURVEILLANCE Verify each AFW manual, power-operated, and automatic valve in each water flow path and in both steam supply flow paths to the steam turbine-driven pumps, that is not locked, sealed, or otherwise secured in position, is in the correct position.

Cycle each testable, remote-operated valve that is not in its operating position.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.7.3-4 AFW System 3.7.3 COMPLETION TIME Immediately FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the INSERVICE TES TI NG PROGRAM Amendment No. 326 Amendment No. 304 I -

SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.3.3 SR 3.7.3.4 SR 3.7.3.5 SURVEILLANCE

---

NOTE-------------------

Not required to be performed for the turbine-driven AFW pump until 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching 800 psig in the steam generators.

Verify the developed head of each AFW pump at the flow test point is greater than or equal to the required developed head. -------------------NOTE-------------------

Not required to be performed for the turbine-driven AFW pump until 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching 800 psig in the steam generators.

Verify each AFW automatic valve that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal. -------------------NOTE-------------------

Not required to be performed for the turbine-driven AFW pump until 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching 800 psig in the steam generators.

Verify each AFW pump starts automatically on an actual or simulated actuation signal. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.7.3-5 AFW System 3.7.3 FREQUENCY In accordance with the* INSERVICE TESTING PROGRAM In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program Amendment No. 326 Amendment No. 304 SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.3.6 SR 3.7.3.7 SURVEILLANCE

---

NOTE-------------------

Not required to be performed for the AFW train with the turbine-driven AFW pump until 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching 800 psig in the steam generators.

Verify the AFW system is capable of providing a minimum of 300 gpm nominal flow to each flow leg. Verify the proper alignment of the required AFW flow paths by verifying flow from the condensate storage tank to each steam generator.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.7.3-6 AFW System 3.7.3 FREQUENCY In accordance with the Surveillance Frequency Control Program Prior to entering MODE 2 whenever unit has been in MODE 5 or 6 for > 30 days Amendment No. 326 Amendment No. 304 3.7 PLANT SYSTEMS 3.7.5 Component Cooling (CC) System LCO 3.7.5 Two CC loops shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4. ACTIONS CONDITION A. One CC loop inoperable.

B. Required Action and associated Completion Time of Condition A not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 REQUIRED ACTION A.1 --------NOTE

---

Enter applicable Conditions and Required Actions of LCO 3.4.6, 11 RCS Loops--MODE 4, 11 for shutdown cooling made inoperable by CC. --------------------

Restore CC loop to OPERABLE status. B.1 Be in MODE 3. AND B.2 Be in MODE 5. 3.7.5-1 CC System 3.7.5 COMPLETION TIME 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Amendment No. 326 Amendment No. 304 3.7 PLANT SYSTEMS 3.7.6 Service Water (SRW) System LCO 3.7.6 Two SRW subsystems shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4. ACTIONS CONDITION A. One SRW heat exchanger inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 A. l REQUIRED ACTION Isolate flow to one of the associated containment cooling units. --------NOTE Enter applicable Conditions and Required Actions of LCO 3.6.6, "Containment Spray and Cooling Systems," for one containment cooling train made inoperable by the heat exchanger.

3.7.6-1 SRW 3.7.6 COMPLETION TIME 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Amendment No. 326 Amendment No. 304 ACTIONS (continued)

CONDITION A. (continued)

B. One SRW subsystem inoperable.

C. Required Action and associated Completion Time of Condition A or B not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 A.2 B.1 C.1 AND C.2 REQUIRED ACTION Restore heat exchanger to operable status. --------NOTE-------

Enter applicable Conditions and Required Actions of LCO 3.8.1, 11 AC Sources--Operating, 11 for diesel generator made inoperable by SRW. --------------------

Restore SRW subsystem to OPERABLE status. Be in MODE 3. Be in MODE 5. 3.7.6-2 SRW 3.7.6 COMPLETION TIME 7 days OR In accordance with the Risk Informed Completion Time Program 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Amendment No.326 Amendment No. 304 SURVEILLANCE REQUIREMENTS SR 3.7.6.1 SR 3.7.6.2 SR 3.7.6.3 SURVEILLANCE

---

NOTE-------------------

Isolation of SRW flow to individual components does not render SRW inoperable.

Verify each SRW manual, power-operated, and automatic valve in the flow path servicing safety-related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

Verify each SRW automatic valve in the flow path that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal. Verify each SRW pump starts automatically on an actual or simulated actuation signal. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.7.6-3 SRW 3.7.6 FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program Amendment No.326 Amendment No. 304 3.7 PLANT SYSTEMS 3.7.7 Saltwater (SW) System LCO 3.7.7 Two SW subsystems shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4. ACTIONS CONDITION A. One SW subsystem inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 A.1 REQUIRED ACTION -------NOTES-------

1. Enter applicable Conditions and Required Actions of LCO 3.8.1, "AC Operating," for emergency diesel generator made inoperable by SW System. 2. Enter application Conditions and Required Actions of LCO 3.4.6, "RCS Loops-MODE 4," for shutdown cooling made inoperable by SW System. 3.7.7-1 SW 3.7.7 COMPLETION TIME Amendment No. 326 Amendment No. 304 ACTIONS (continued)

CONDITION REQUIRED ACTION A. (continued)

Restore SW subsystem to OPERABLE status. B. Required Action and B.1 Be in MODE 3. associated Completion Time of Condition A AND not met. B.2 Be in MODE 5. SURVEILLANCE REQUIREMENTS SR 3.7.7.1 SURVEILLANCE

---

NOTE-------------------

Isolation of SW System flow to individual components does not render SW inoperable.

Verify each SW System manual, operated, and automatic valve in the flow path servicing safety-related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.7.7-2 SW 3.7.7 COMPLETION TIME 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours FREQUENCY In accordance with the Surveillance Frequency Control Program Amendment No. 326 Amendment No. 304 SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.7.2 SR 3.7.7.3 SURVEILLANCE Verify each SW System automatic valve in the flow path that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal. Verify each SW System pump starts automatically on an actual or simulated actuation signal. SW 3.7.7 FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.7.7-3 Amendment No.326 -Amendment No. 304 3.7 PLANT SYSTEMS 3.7.18 Atmospheric Dump Valves (ADVs) LCO 3.7.18 Two ADV lines shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, and 3, ADVs 3.7.18 MODE 4 when steam generator is being relied upon for heat removal. ACTIONS CONDITION A. One required ADV 1 i ne inoperable.

B. Two ADV lines inoperable.

C. Required Action and associated Completion Time not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 A.1 B.1 C.1 AND C.2 REQUIRED ACTION Restore ADV line to OPERABLE status. Restore one ADV line to OPERABLE status. Be in MODE 3. Be in MODE 4 without reliance upon steam generator for heat removal. 3.7.18-1 COMPLETION TIME 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 6 hours 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Amendment No. 326 Amendment No. 304 AC Sources-Operating 3.8.1 ACTIONS -------------------------------------NOTE-------------------------------------

LCO 3.0.4.b is not applicable to DGs. CONDITION REQUIRED ACTION A. One required A.1 Perform SR 3.8.1.1 or LCO 3.8.1.a offsite SR 3.8.1.2 for circuit inoperable.

required OPERABLE offsite circuits.

AND A.2 Declare required feature(s) with no offsite power available inoperable when its redundant required feature(s) is inoperable.

AND A.3 Restore required offsite circuit to OPERABLE status. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.8.1-2 COMPLETION TIME 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> AND Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from discovery of no offsite power to one train concurrent with inoperability of redundant required feature(s) 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program Amendment No. 326 Amendment No. 304 ACTIONS (continued)

CONDITION B. (continued)

C. Required Action and associated Completion Time of Required Action B.1 not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 B.4.2 AND B.5 C .1.1 C.1.2 REQUIRED ACTION Perform SR 3.8.1.3 for OPERABLE DG(s). Restore DG to OPERABLE status. Restore both DGs on the other unit to OPERABLE status and QC DG to available status. OR Restore DG to OPERABLE status. 3.8.1-4 AC Sources-Operating 3.8.1 COMPLETION TIME 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 14 days OR In accordance with the Risk Informed Completion Time Program 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Amendment No.326 Amendment No.304 ACTIONS (continued)

CONDITION G. Two required LCO 3.8.1.a offsite circuits inoperable.

OR One required LCO 3.8.1.a offsite circuit that provides power to the CREVS and CRETS inoperable and the required LCO 3.8.1.c offsite circuit inoperable.

H. One required LCO 3.8.1.a offsite circuit inoperable.

AND One LCO 3.8.1.b DG inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 REQUIRED ACTION G.1 Declare required AC Sources-Operating 3.8.1 COMPLETION TIME 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from feature(s) inoperable discovery of when its redundant required feature(s) is inoperable.

AND G.2 Restore one required offsite circuit to OPERABLE status. -----------

NOTE------------

Enter applicable Conditions and Required Actions of LCO 3.8.9, when Condition H is entered with no AC power source to any train. ----------------------------

H.1 Restore required offsite circuit to OPERABLE status. OR 3 .8.1-8 Condition G concurrent with inoperability of redundant required feature(s) 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> OR In accordance with the Risk Informed Completion Time Program 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> OR In accordance with the Risk Informed Completion Time Program Amendment No. 326 Amendment No. 304 ACTIONS (continued)

CONDITION H. (continued)

I. Two LCO 3.8.1.b DGs inoperable.

OR LCO 3.8.1.b DG that provides power to the CREVS and CRETS inoperable and LCO 3.8.1.c DG inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 H.2 1.1 REQUIRED ACTION Restore DG to OPERABLE status. Restore one DG to OPERABLE status. 3.8.1-9 AC Sources-Operating 3 .8.1 COMPLETION TIME 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> OR In accordance with the Risk Informed Completion Time Program 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Amendment No.326 Amendment No. 304 ACTIONS (continued)

CONDITION J. Required Action and associated Completion Time of Condition A, C, F, G, H, or I not met. OR Required Action and associated Completion Time of Required Action B.2, B.3, B.4.1, B.4.2, or B.5 not met. OR Required Action and associated Completion Time of Required Action E.2, E.3, E.4.1, E.4.2, or E.5 not met. K. Three or more required LCO 3.8.1.a and LCO 3.8.1.b AC sources inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 REQUIRED ACTION J.1 Be in MODE 3. AND J.2 Be in MODE 5. K.1 Enter LCO 3.0.3. 3.8.1-10 AC Sources-Operating 3.8.1 COMPLETION TIME 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Immediately Amendment No. 326 Amendment No. 304 L AC Sources-Operating 3 .8.1 SURVEILLANCE REQUIREMENTS

---

NOTE-------------------------------------

SR 3.8.1.1 through SR 3.8.1.15 are only applicable to LCO 3.8.1.a and LCO 3.8.1.b AC sources. SR 3.8.1.16 is only applicable to LCO 3.8.1.c AC sources. SR 3.8.1.1 SR 3.8.1.2 SURVEILLANCE

---

NOTE-------------------

Only required to be performed when SMECO is being credited for an offsite source. Verify correct breaker alignment and indicated power availability for the 69 kV SMECO offsite circuit. Verify correct breaker alignment and indicated power availability for each required 500 kV offsite circuit. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.8.1-11 FREQUENCY Once within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after substitution for a 500 kV off site circuit In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program Amendment No. 326 Amendment No. 304 AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.3 SURVEILLANCE

---

NOTES------------------

1. Performance of SR 3.8.1.9 satisfies this Surveillance Requirement.

2. All DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading. 3. A modified DG start involving idling and gradual acceleration to synchronous speed may be used for this Surveillance Requirement as recommended by the. manufacturer.

When modified start procedures are not used, the voltage and frequency tolerances of SR 3.8.1.9 must be met. Verify each DG starts and achieves steady state voltage~ 4060 V ands 4400 V, and frequency~

58.8 Hz ands 61.2 Hz. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.8.1-12 FREQUENCY In accordance with the Surveillance Frequency Control Program Amendment No. 326 Amendment No. 304 AC Sources-Operating 3 .8.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.4 SR 3.8.1.5 SR 3.8.1.6 SURVEILLANCE

---

NOTES------------------

1. DG loadings may include gradual loading as recommended by the manufacturer.

2. Momentary transients below the load limit do not invalidate this test. 3. This Surveillance shall be conducted on only one DG at a time. 4. This Surveillance Requirement shall be preceded by and immediately follow without shutdown a successful performance of SR 3.8.1.3 or SR 3 .8.1. 9. Verify each DG is synchronized and loaded, and operates for~ 60 minutes at a load 4000 kW for DG IA and~ 2700 kW for DGs 18, 2A, and 28. Verify each day tank contains~

a one hour supply. Check for and remove accumulated water from each day tank. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.8.1-13 FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program Amendment No. 326 Amendment No. 304 AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1. 7 SURVEILLANCE Verify the fuel oil transfer system operates to automatically transfer fuel oil from storage tank[s] to the day tank. FREQUENCY In acGordance with the Surveillance Frequency Control Program SR 3.8.1.8 Verify interval between each sequenced load In accordance block is within+/- 10% of design interval for with the each emergency and shutdown load sequencer.

Surveillance SR 3.8.1.9 -------------------NOTE-------------------

All DG starts may be preceded by an engine prelube period. Verify each DG starts from standby condition and achieves, in~ 10 seconds, voltage > 4060 V and frequency>

58.8 Hz, and after steady state conditions are reached, maintains voltage~ 4060 V and~ 4400 V and frequency of> 58.8 Hz and~ 61.2 Hz. SR 3.8.1.10 Verify manual transfer of AC power sources from the normal offsite circuit to the alternate offsite circuit. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.8.1-14 Frequency Control Program In accordance with the .Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program Amendment No. 326 Amendment No. 304 l AC Sources-Operating 3 .8.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.11 SURVEILLANCE

---

NOTE-------------------

1. Momentary transients outside the load and power factor limits do not invalidate this test. 2. If performed with the DG synchronized with offsite power, the surveillance test shall be performed at the required power factor. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition, the power factor shall be maintained as close to the limit as practicable.

Verify each DG, operating at a frequency 58.8 Hz and~ 61.2 Hz, and an appropriate accident load power factor operates for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> while loaded to~ 4000 kW for DG IA and~ 3000 kW for DGs IB, 2A, and 28. SR 3.8.1.12 Verify each DG rejects a load~ 500 hp without tripping.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.8.1-15 FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program Amendment No. 326 Amendment No. 304 _\ .

AC Sources-Operating 3 .8.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.13 SURVEILLANCE Verify that automatically bypassed DG trips are automatically bypassed on an actual or simulated required actuation signal. SR 3.8.1.14 Verify each DG: a. Synchronizes with offsite power source while loaded upon a simulated restoration of offsite power; b. Manually transfers loads to offsite power source; and c. Returns to ready-to-load operation.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.8.1-16 FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program Amendment No. 326 Amendment No. 304 AC Sources-Operating 3 .8.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.15 SURVEILLANCE

---

NOTE-------------------

All DG starts may be preceded by an engine prelube period. Verify on an actual or simulated loss of offsite power signal in conjunction with an actual or simulated Engineered Safety Feature actuation signal: a. De-energization of emergency buses; b. Load shedding from emergency buses; c. DG auto-starts from standby condition and: 1. energizes permanently connected loads in~ 10 seconds, 2. energizes auto-connected emergency loads through load sequencer, 3. maintains steady state voltage 4060 V and~ 4400 V, 4. maintains steady state frequency of~ 58.8 Hz and~ 61.2 Hz, and 5. supplies permanently connected and auto-connected emergency loads for 5 minutes. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.8.1-17 FREQUENCY In accordance with the Surveillance Frequency Control Program Amendment No. 326 Amendment No. 304 \.

SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE SR 3.8.1.16 For the LCO 3.8.1.c AC electrical sources, SR 3.8.1.1, SR 3.8.1.2, SR 3.8.1.3, SR 3.8.1.17 SR 3.8.1.5, SR 3.8.1.6, and SR 3.8.1.7 are required to be performed.

---

NOTE-------------------

Momentary transients outside the load and power factor limits do not invalidate this test. Verify each DG operates for~ 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s: a. For~ 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the test loaded to 4200 kW for DG IA, and~ 3150 kW and 3300 kW for DGs 18, 2A, and 28, and b. For the remaining hours of the test loaded to~ 3600 kW for DG IA, and AC Sources-Operating 3.8.1 FREQUENCY In accordance with applicable Surveillance Requirements In accordance with the Surveillance Frequency Control Program 2700 kW and~ 3000 kW for DGs 18, 2A, and 28. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.8.1-18 Amendment No. 326 Amendment No. 304 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources-Operating DC Sources-Operating 3.8.4 LCO 3.8.4 Four channels of DC electrical sources shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4. ACTIONS CONDITION A. One DC channel inoperable due to an inoperable battery and the reserve battery available.

B. One DC channel inoperable for reasons other than Condition A. C. Required Action and associated Completion Time not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 REQUIRED ACTION A.1 Replace inoperable battery with reserve battery. B.1 Restore DC channel to OPERABLE status. C.1 Be in MODE 3. AND C.2 Be in MODE 5. 3.8.4-1 COMPLETION TIME 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> OR In accordance with the Risk Informed Completion Time Program 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Amendment No.326 Amendment No.304 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters-Operating LCO 3.8.7 Four inverters shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4. ACTIONS CONDITION REQUIRED ACTION A. One required inverter A.1 --------NOTE-------

inoperable.

Enter applicable Conditions and Required Actions of LCO 3.8.9, Inverters-Operating 3.8.7 COMPLETION TIME "Distribution Systems-B. Required Action and associated Completion Time not met. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 B.1 AND B.2 Operating" with any vital bus de-energized.

---

Restore inverter to OPERABLE status. Be in MODE 3. Be in MODE 5. 3.8.7-1 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Amendment No. 326 Amendment No. 304 3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems-Operating Distribution Systems-Operating 3.8.9 LCO 3.8.9 The AC. DC. and AC vital bus electrical power distribution subsystems shall be OPERABLE.

APPLICABILITY:

MODES 1. 2. 3. and 4. ACTIONS CONDITION A. One or more AC electrical power distribution subsystems inoperable.

B. One or more AC vital bus subsystem(s) inoperable.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 REQUIRED ACTION A.1 Restore AC electrical power distribution subsystems to OPERABLE status. B.1 Restore AC vital bus subsystems to OPERABLE status. 3.8.9-1 COMPLETION TIME 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> OR In accordance with the Risk Informed Completion Time Program 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> OR In accordance with the Risk Informed Completion Time Program Amendment No. 326 Amendment No. 304 Distribution Systems-Operating 3.8.9 ACTIONS (continued)

CONDITION REQUIRED ACTION C. One DC electrical C.1 Restore DC electrical power distribution power distribution subsystem inoperable.

subsystem to OPERABLE status. D. Required Action and D.1 Be in MODE 3. associated Completion Time not met. AND D.2 Be in MODE 5. E. Two or more E.1 Enter LCO 3.0.3. electrical power distribution subsystems inoperable that result in a loss of function.

SURVEILLANCE REQUIREMENTS SURVEILLANCE SR 3.8.9.1 Verify correct breaker alignments and voltage to AC, DC, and AC vital bus electrical power distribution subsystems.

CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 3.8.9-2 COMPLETION TIME 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Immediately FREQUENCY In accordance with the Surveillance Frequency Control Program Amendment No.326 Amendment No.304 Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.18 inleakage, and assessing the CRE boundary as required by paragraphs c and d respectively.

Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09, Revision 0-A, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days; b. A RICT may only be utilized in MODE 1, and 2; c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09, Revision 0-A, Appendix A, must be considered for the effect on the RICT. 1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the plant configuration change, whichever is less. 3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT. d. If the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either: 1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 5.5-19 Amendment No. 326 Amendment No. 304 Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.19 2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs. e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the completion times must be PRA methods used to support Amendment Nos. 326/304, or other methods approved by the NRC for generic use. Any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

Surveillance Frequency Control Program This program provides controls for Surveillance Frequencies.

The program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met. a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program. b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, 11 Ri sk-Informed Technical Specifications Initiative 5b, Risk Informed Method for Control of Surveillance Frequencies, 11 Revision 1. c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program. CALVERT CLIFFS -UNIT 1 CALVERT CLIFFS -UNIT 2 5.5-20 Amendment No. 326 Amendment No. 304 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 EXELON GENERATION COMPANY, LLC DOCKET NO. 50-318 CALVERT CLIFFS NUCLEAR POWER PLANT, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 304 Renewed License No. DPR-69 1. The U.S. Nuclear Regulatory Commission (the Commission) has found that: A. The application for amendment by Exelon Generation Company, LLC (Exelon, the licensee) dated February 25, 2016, as supplemented by letters dated April 3, 2017, and January 11, January 18, June 21, and August 27, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 2 2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 2.C.2. of Renewed Facility Operating License No. DPR-69 is hereby amended to read as follows: 2. Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 304, are hereby incorporated into this license. The licensee shall operate the facility in accordance with the Technical Specifications.

3. This license amendment is effective as of the date of its issuance and shall be implemented within 180 days.

Attachment:

Changes to the Renewed Facility Operating License and Technical Specifications Date of Issuance:

October 30, 2018 FOR THE NUCLEAR REGULATORY COMMISSION James G. Danna, Chief Plant Licensing Branch I Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation ATTACHMENT TO LICENSE AMENDMENT NO. 304 CALVERT CLIFFS NUCLEAR POWER PLANT, UNIT 2 RENEWED FACILITY OPERATING LICENSE NO. DPR-69 DOCKET NO. 50-318 Replace the following page of the Renewed Facility Operating License with the attached revised page. The revised page is identified by amendment number and contains a marginal line indicating the area of change. Remove Page 3 Insert Page 3 Calvert Cliffs Nuclear Power Plant, Unit 2, uses the same Appendix A as Calvert Cliffs Nuclear Power Plant, Unit 1. Accordingly, the Unit 1 Renewed Facility Operating License has been updated with the following pages, which are applicable to both Units 1 and 2. Remove Pages 1.3-14 3.3.1-1 3.3.1-2 3.3.1-3 3.3.1-4 3.3.3-1 3.3.4-1 3.3.4-2 3.3.4-3 3.3.5-1 3.3.5-2 3.3.6-1 3.3.6-2 3.3.6-3 3.5.2-1 3.6.2-4 3.6.2-5 3.6.3-2 3.6.3-4 3.6.6-1 3.6.6-2 3.7.3-1 3.7.3-2 3.7.3-3 3.7.3-4 3.7.3-5 Insert Pages 1.3-14 1.3-15 3.3.1-1 3.3.1-2 3.3.1-3 3.3.1-4 3.3.3-1 3.3.4-1 3.3.4-2 3.3.4-3 3.3.5-1 3.3.5-2 3.3.6-1 3.3.6-2 3.3.6-3 3.3.6-4 3.5.2-1 3.6.2-4 3.6.2-5 3.6.2-6 3.6.3-2 3.6.3-4 3.6.6-1 3.6.6-2 3.7.3-1 3.7.3-2 3.7.3-3 3.7.3-4 3.7.3-5 3.7.3-6 Remove Pages 3.7.5-1 3.7.6-1 3.7.6-2 3.7.6-3 3.7.7-1 3.7.7-2 3.7.18-1 3.8.1-2 3.8.1-4 3.8.1-8 3.8.1-9 3.8.1-10 3.8.1-11 3.8.1-12 3.8.1-13 3.8.1-14 3.8.1-15 3.8.1-16 3.8.1-17 3.8.4-1 3.8.7-1 3.8.9-1 3.8.9-2 5.5-19 Insert Pages 3.7.5-1 3.7.6-1 3.7.6-2 3.7.6-3 3.7.7-1 3.7.7-2 3.7.7-3 3.7.18-1 3.8.1-2 3.8.1-4 3.8.1-8 3.8.1-9 3.8.1-10 3.8.1-11 3.8.1-12 3.8.1-13 3.8.1-14 3.8.1-15 3.8.1-16 3.8.1-17 3.8.1-18 3.8.4-1 3.8.7-1 3.8.9-1 3.8.9-2 5.5-19 5.5-20 ( 4) Exelon Generation pursuant to the Act and 1 O CFR Parts 30, 40, and 70, to receive, possess, and use, in amounts as required, any byproduct, source, and special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (5) Exelon Generation pursuant to the Act and 10 CFR Parts 30 and 70 to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.

C. This license is deemed to contain and is subject to the conditions set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act, and the rules, regulations, and orders of the Commission, now or hereafter applicable; and is subject to the additional conditions specified and incorporated below: (1) Maximum Power Level Exelon Generation is authorized to operate the facility at steady-state reactor core power levels not in excess of 2737 megawatts-thermal in accordance with the conditions specified herein. (2) Technical Specifications (3) (4) The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 304, are hereby incorporated into this license. The licensee shall operate the facility in accordance with the Technical Specifications. (a) For Surveillance Requirements (SRs) that are new, in Amendment 201 to Facility Operating License No. DPR-69, the first performance is due at the end of the first surveillance interval that begins at implementation of Amendment 201. For SRs that existed prior to Amendment 201, including SRs with modified acceptance criteria and SRs whose frequency of performance is being extended, the first performance is due at the end of the first surveillance interval that begins on the date the Surveillance was last performed prior to implementation of Amendment 201. Less Than Four Pump Operation The licensee shall not operate the reactor at power levels in excess of five (5) percent of rated thermal power with less than four (4) reactor coolant pumps in operation.

This condition shall remain in effect until the licensee has submitted safety analyses for less than four pump operation, and approval for such operation has been granted by the Commission by amendment of this license. Environmental Monitoring Program If harmful effects or evidence of irreversible damage are detected by the biological monitoring program, hydrological monitoring program, and the Amendment No. 304 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 326 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-53 AMENDMENT NO. 304 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-69 EXELON GENERATION COMPANY, LLC CALVERT CLIFFS NUCLEAR POWER PLANT, UNIT NOS. 1 AND 2 DOCKET NOS. 50-317 AND 50-318

1.0 INTRODUCTION

By application dated February 25, 2016 (Reference 1 ), as supplemented by letters dated April 3, 2017 (Reference 2), and January 11 (Reference 3), January 18 (Reference 4), June 21 (Reference 5), and August 27, 2018 (Reference 7), Exelon Generation Company, LLC (Exelon, the licensee) submitted a request for changes to the Calvert Cliffs Nuclear Power Plant, Units 1 and 2 (Calvert Cliffs), Technical Specifications (TSs). The supplement dated August 27, 2018, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the U.S. Nuclear Regulatory Commission (NRC, the Commission) staff's original proposed no significant hazards consideration determination as published in the Federal Register on September 4, 2018 (83 FR 44920). The license amendment request (LAR) was originally noticed in the Federal Register on May'24, 2016 (81 FR 32806). The licensee originally proposed to adopt, with plant-specific variations, Technical Specifications Task Force (TSTF) Traveler TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times -RITSTF [Risk-Informed TSTF] Initiative 4b" (Reference 31). By letter dated November 15, 2016 (Reference 8), the NRC suspended its approval of TSTF-505, Revision 1, because of concerns identified during the review of plant-specific LARs for adoption of TSTF-505, Revision 1. In its letter, the NRC staff stated that it would continue reviewing applications already received and site-specific proposals to address the NRC staff's concerns.

Although the scope of the amendment request has not changed, the bases for the amendments no longer rely on TSTF-505.

The proposed changes would revise the Calvert Cliffs TSs related to completion times (CTs) for required actions to provide the option to calculate longer risk-informed CTs. The proposed amendments would also add a new program, the "Risk-Informed Completion Time Program," to TS Section 5.5, "Programs and Manuals." The methodology for using the Risk-Informed Completion Time Program is described in Nuclear Energy Institute (NEI) topical report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," Revision 0-A (Reference 32). NEI 06-09, Revision 0-A, Enclosure 3 provides a methodology for extending CTs and thereby delay exiting the operational mode of applicability or taking remedial actions if risk is assessed and managed within the limits and programmatic requirements established by a risk-informed completion time {RICT) program or a configuration risk management program. The NRC staff found NEI 06-09, Revision 0-A, acceptable for referencing by licensees proposing to amend their TSs to implement risk managed TSs as documented in the NRC staff's final safety evaluation (SE) for NEI TR NEl-06-09, enclosed with the staff's letter dated May 17, 2007 (Reference 11 ).

2.0 REGULATORY EVALUATION

2.1. Description of Risk-Informed Completion Times TSs contain limiting conditions for operation (LCOs), which are the lowest functional capability or performance levels of equipm~nt required for safe operation of the facility.

When an LCO is not met, the licensee must shut down the reactor or follow any remedial or required action (e.g., testing, maintenance, or repair activity) permitted by the TSs until the condition can be met. The Calvert Cliffs TSs contain conditions that typically describe how the LCO can fail to be met. The licensee must take the specified required actions under designated conditions within specified completion times (CTs). Upon expiration of a CT, the TSs typically require the licensee to exit the TS operational mode of applicability or follow other prescribed remedial actions, such as shutting down the reactor. NEI 06-09, Revision 0-A, provides a risk-informed methodology for extending selected CTs and thereby delay exiting the operational mode of applicability or taking remedial actions if risk is assessed and managed within the limits and programmatic requirements established by an RICT program or a configuration risk management program. The licensee's use of the new CT requires risk to be assessed, monitored, and managed as measured by the configuration-specific core damage frequency (CDF) and large early release frequency (LERF) using processes and limits specified in NEI 06-09, Revision 0-A. Use of the new CT also requires compensatory measures, or risk management actions (RMAs), and quantitative evaluation of risk sources if probabilistic risk assessment (PRA) models are not available.

2.2 Description of Affected Systems 2.2.1 Reactor Protective System (RPS) and Engineered Safety Features Actuation System (ESFAS) Instrumentation Descriptions Chapter 7.2 of the Calvert Cliffs Updated Final Safety Analysis Report (UFSAR) (Reference

34) contains the following description of the RPS: The RPS consists of sensors, amplifiers, logic, and other equipment necessary to monitor selected Nuclear Steam Supply System (NSSS) conditions and to effect reliable and rapid reactor shutdown if anyone or a combination of conditions deviates from a preselected operating range. The system functions to protect the core and RCS [reactor coolant system] pressure boundary.

[ ... ]the RPS consists of four trip paths operating through the coincidence logic matrices to maintain power to, or remove it from, the control element drive mechanisms (CEDMs). Four independent measurement channels normally monitor each plant parameter which can initiate a reactor trip. Individual channel trips occur when the measurement reaches a preselected value. The channel trips are combined in six two out of two logic matrices.

Each two out of two logic matrix provides trip signals to four one out of six logic units, each of which causes a trip of the breakers in the AC supply to the CEDM power supplies.

Each CEDM power supply source is separated into two branches.

Chapter 7.3 of the UFSAR contains the following description of the ES FAS: The Engineered Safety Features Actuation Systems (ESFAS) initiate the start of equipment which protects the public and plant personnel from the accidental release of radioactive fission products in the unlikely event of a loss-of-coolant, main steam line break (MSLB), or loss of feedwater incident.

The safety features function to localize, control, mitigate, and terminate such incidents in order to minimize radiation exposure levels for the general public. The actuation system is divided into four sensor subsystems (sensor channels ZD, ZE, ZF, and ZG), two actuation subsystems (actuation channels ZA and ZB), and two logic subsystems for sequential loading of the diesel generators.

2.2.2 Electrical Systems Descriptions According to Calvert Cliffs UFSAR Chapter 8, "Electrical Systems," electrical (offsite) power from the 500 kilovolt (kV) network to the switchyard is supplied by three physically independent transmission lines. Two physically independent circuits supply offsite pow~r from the 500 kV switchyard to the onsite electrical distribution system via the 13 kV system. The two independent offsite power circuits from the switchyard to the engineered safety features (ESF) electrical system include two 500 kV lines and buses, two 500 kV/14kV plant service transformers, two 13 kV service buses 11 and 21, and 13.8 kV/4.16 kV unit service transformers.

The two 500 kV lines and buses, two 500 kV/14kV plant service transformers, and two 13 kV service buses 11 and 21 are shared between the two units. Each 500 kV/14 kV plant service transformer is capable of supplying the total (two units) plant auxiliary load. Offsite power can also be supplied from the 13 kV circuit from the Southern Maryland Electric Cooperative (SMECO) line. The 13 kV SMECO offsite circuit includes the 13 kV line, 13 kV service bus 23, 13 kV service bus 11 or 21, and 13.8 kV/4.16 kV unit service transformers.

The 13 kV SMECO line is capable of supplying the power required to maintain both units in a safe shutdown condition.

It may be substituted for one of the 500 kV/13 kV circuits as one of the two required, physically independent offsite circuits.

Upon loss of the switchyard power source, the SM ECO line can be used to supply any two 4.16 kV ESF buses ( one from each unit) through the 13 kV service bus 23 and either 13 kV service bus 11 or 21. Four safety-related emergency diesel generators (EDGs) are provided for the plant, two for each unit. Any combination of two of the di~sel generators (DGs) (one from each unit) is capable of supplying sufficient power ( 1) for the operation of necessary ESF loads during accident conditions in one unit and shutdown loads of the alternate unit concurrent with a loss-of-offsite power (LOOP), and (2) for the safe and orderly shutdown of both units under LOOP conditions.

The DGs start automatically on safety injection actuation signal or an undervoltage condition on the 4.16 kV ESF buses that supply vital loads, and are ready to accept loads within 10 seconds. Section 8.4, "Emergency Power Source," of the UFSAR states that the station blackout (SBO) DG is designed to provide a power source capable of starting and supplying the essential loads necessary to safely shut down one unit and maintain it in a safe shutdown condition during an SBO event. The SBO DG has the ability to supply any of the four ESF buses. The SBO diesel is started manually.

The SBO diesel is loaded onto a bus when it is determined that the EOG dedicated to that bus is not available to supply the plant loads. The SBO diesel is capable of . supplying the same emergency plant loads as the EDGs. TS Basis 3.8.1 states that the SBO DG is available to power the inoperable DG bus loads in the event of an SBO or LOOP. TSs require the licensee to administratively verify both opposite-unit DGs are operable and the SBO DG is available within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and to continue this action once every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> thereafter until restoration of the required DG is accomplished.

This verification provides assurance that both opposite-unit DGs and the SBO DG are capable of supplying the . onsite Class 1 E alternating current (AC) electrical power distribution system. The 125 volt (V) direct current (DC) and vital AC systems are designed to furnish continuous power to the plant's vital instrumentation and control (l&C) systems. The 125 V DC and 120 V vital AC systems for the plant are divided into four independent and isolated channels.

Each channel consists of one battery, two battery chargers, one 125 V DC bus, multiple DC unit control panels, and two dual inverters.

AC input for one battery charger is fed from Unit 1, and the second battery charger is fed from Unit 2. Each battery charger is fully rated and can recharge a discharged battery, while at the same time supplying the steady state power requirements of the system. During normal operation, all battery chargers are energized and maintain a constant voltage to supply the batteries with sufficient current to keep them fully charged and maintain the steady state load of DC instruments, control circuits, and inverters.

A reserve 125 V DC system, which consists of one battery, one battery charger, and associated DC switching equipment, is provided.

The reserve battery is capable of replacing any of the 125 V DC batteries, if required.

The reserve battery is connected to its own charger when it is not connected to a safety-related 125 V DC bus. Each dual inverter has two built-in independent inverters, one to serve as primary and the other as backup. In the dual inverter, 120 V AC power output can be manually switched from primary inverter to backup inverter.

The safety-related AC electrical distribution systems ( 4.16 kV, 480 V, and vital 120 V AC) supply power to the ESF systems during normal operation and under accident conditions.

The 4.16 kV and 480 V AC distribution systems for each unit include two 4.16 kV buses, four 480 V buses and load centers, and two motor control centers (MCCs). Each of the two 4.16 kV ESF buses is supplied from either an offsite power source or a DG. The 480 V ESF buses are supplied from the DGs through the 4.16 kV/480 V service transformers in case of failure of the preferred source of power to the 4.16 kV ESF buses. Each of the two MCC buses is supplied from separate EDGs via the 480 V unit load centers. The 120 V AC vital distribution system in each unit has four separate distribution panel boards/buses that provide power for four RPS channels and the four ESF and auxiliary feedwater (AFW) actuation systems (i.e., ESFAS) channels.

Each 120 V AC vital bus is normally supplied by a dual inverter with its own DC feeder from a separate battery and can be manually switched from the dual inverter to a 120 V AC bus fed from an ESF MCC through a regulating transformer.

The TSs require offsite power sources and DGs for the control room emergency ventilation system (CREVS) and control room emergency temperature system (CRETS). Calvert Cliffs UFSAR Section 9.8.2.3, "Auxiliary Building Ventilation Systems," describes the operation of the control room ventilation system. The CREVS provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke. The CREVS also provides automatically actuated airborne radiological protection for the control room operations.

The CREVS is a shared system providing protection for both Units 1 and 2. The CRETS provides temperature control for the control room following isolation of the control room. The CRETS is a shared system that is supported by the CREVS, since the CREVS must be operating in the emergency recirculation mode for the CRETS to perform its safety function.

2.3 Description of Proposed Changes The licensee proposed to add a new program, "Risk-Informed Completion Time Program," in TS Section 5.5, "Programs and Manuals" of the TSs, which would require adherence to NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b: Risk-Managed Technical Specificaitons (RMTS) Guidelines," dated October 2012 (Reference 12). The proposed new RICT program is applied to specific TS LCOs that do not represent a loss of specified safety function or inoperability of all trains of a system required to be operable.

The licensee's application for the changes proposed to use NEI 06-09, Revision 0-A, included documentation regarding the technical adequacy of the PRA models for the RICT program consistent with the guidance of Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," dated March 2009 (Reference 15). As proposd in the LAR, the following description of the RICT program would be added to the TSs: 5.5.18 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09, Revision 0-A, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days; b. An RICT may only be utilized in MODE 1, and 2; c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09, Revision 0-A, Appendix A, must be considered for the effect on the RICT. 1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the plant configuration change, whichever is less. 3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT. d. If the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either: 1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or 2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs. e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods* to assess the risk from extending the completion times must be PRA methods used to support Amendment Nos. 326/304, or other methods approved by the NRC for generic use. Any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

The licensee requested to revise the CTs for the TS required actions in the foflowing list by providing the option to calculate RICTs. The following list reflects proposed changes as supplemented by the licensee's letters dated April 3, 2017 (Reference 2), and January 11, 2018 (Reference 4).

• TS 3.3.1 Condition A -One or more functions with one RPS bistable trip unit or associated measurement channel inoperable except for Condition C (excore channel not calibrated with incore detectors), Required Actions A.2.1 and A.2.2.

• TS 3.3.1 Condition 8 -One or more functions with two RPS bistable trip units or associated measurement channels inoperable except for Condition C (excore channel not calibrated with incore detectors), Required Action 8.2.

• TS 3.3.1 Condition D -One or more functions with one automatic bypass removal feature inoperable, Required Actions D.2.2.1 and D.2.2.2.

• TS 3.3.1 Condition E -One or more functions with two automatic bypass removal feature channels inoperable, Required Action E.2.2.

• TS 3.3.3 Condition A -One matrix logic channel inoperable, Required Action A.1.

• TS 3.3.4 Condition A-One or more functions with one ESFAS sensor module or associated measurement channel inoperable, Required Actions A.2.1 and A.2.2.

• TS 3.3.4 Condition 8 -One or more functions with two ESFAS sensor modules or associated measurement channels inoperable, Required Action 8.2.

• TS 3.3.4 Condition D -One or more functions with the automatic block removal feature of two sensor block modules inoperable, Required Action D.2.2.

• TS 3.3.5 Condition A -One AFW actuation system manual start channel or actuation logic channel inoperable, Required Action A.1.

• TS 3.3.5 Condition C -One or more functions with one manual actuation channel or actuation logic channel inoperable except AFW actuation system, Required Action C.1.

• TS 3.3.6 Condition A -One or more functions with one sensor module or associated measurement channel per DG inoperable, Required Actions A.2.1 and A.2.2.

• TS 3.3.6 Condition B -One or more functions with two sensor modules or associated measurement channels per DG inoperable, Required Action B.2.2.

• TS 3.5.2 Condition A -One or more trains Inoperable and at least 100 percent of the emergency core cooling system flow equivalent to a single operable emergency core cooling system train available, Required Action A.1.

• TS 3.5.2 Condition C -One or more containment air locks inoperable for reasons other than Conditions A or B, Required Action C.3.

• TS 3.6.3 Condition A -One or more penetration flow paths with one containment isolation valve inoperable. (Only applicable to penetration flow paths with two containment isolation valves and not a closed system.) Required Action A.1.

• TS 3.6.3 Condition C -One or more penetration flow paths with one or more containment isolation valves inoperable, Required Action C.1 . *

• TS 3.6.6 Condition A -One containment spray train inoperable, Required Action A.1.

• TS 3.6.6 Condition B -One containment cooling train inoperable, Required Action B.1.

• TS 3.7.3 Condition A-One steam-driven AFW pump inoperable, Required Action A.2. *

• TS 3.7.3 Condition B -One motor-driven AFW pump inoperable, Required Action B.2.

• TS 3.7.3 Condition C -Two AFW pumps inoperable, Required Action C.4.

• TS 3.7.3 Condition D -One AFW train inoperable for reasons other than Conditions A, B, or C, Required Action D.1.

• TS 3.7.5 Condition A -One component cooling (CC) LOOP inoperable, Required Action A.1.

• TS 3.7.6 Condition A-One service water heat exchanger inoperable, Required Action A.2.

• TS 3.7.6 Condition B -One service water subsystem inoperable, Required Action B.1.

• TS 3. 7. 7 Condition A -One saltwater subsystem inoperable, Required Action A.1.

• TS 3. 7 .18 Condition A -One required atmospheric dump valve (ADV) line inoperable, Required Action A.1.

• TS 3.8.1 Condition A -One required LCO 3.8.1.a offsite circuit inoperable, Required Action A.3.

• TS 3.8.1 Condition B -One LCO 3.8.1.b DG inoperable, Required Action B.5.

• TS 3.8.1 Condition G -Two required LCO 3.8.1.a offsite circuits inoperable.

OR One required LCO 3.8.1.a offsite circuit that provides power to the CREVS and CRETS inoperable and the required LCO 3.8.1.c offsite circuit inoperable, Required Action G.2.

• TS 3.8.1 Condition H -One required LCO 3.8.1.a offsite circuit inoperable AND One LCO 3.8.1.b DG inoperable, Required Action H.1 and H.2.

• TS 3.8.4 Condition A -One DC channel A.1 inoperable due to an inoperable battery and the reserve battery available, Required Action A.1. *

• TS 3.8.4 Condition B -One DC channel inoperab1 e for reasons other than Condition A, Required Action B.1.

• TS 3.8. 7 Condition A -One required inverter inoperable, Required Action A.1.

• TS 3.8.9 Condition A -One or more AC electrical power distribution subsystems inoperable.

• TS 3.8.9 Condition B -One or more AC vital bus subsystem(s) inoperable, Required Action B.1.

• TS 3.8.9 Condition C -One DC electrical power distribution subsystem inoperable, Required Action C.1. Also, the licensee proposed to add the following example to the TSs as Example 1.3-8: ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore subsystem 7 days inoperable.

to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action B.1 Be in MODE 3. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and associated Completion Time AND not met. B.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk-Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time. The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition B must also be entered. The Risk-Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions.

For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the plant configuration change, whichever is less. If the 7 day Completion Time clock of Condition A has expired and subsequent changes in plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition B is entered, Conditions A and Bare exited, and therefore, the Required Actions of Condition B may be terminated.

2.4 Applicable Requirements and Guidance 2.4.1 Regulatory Requirements 2.4.1.1 Technical Specifications The regulatory requirements related to the content of the TSs are contained in Title 10 of the Code of Federal Regulations (10 CFR) Section 50.36, "Technical specifications." Section 50.36 of 10 CFR requires TSs to include the following categories related to station operation:

(1) safety limits, limiting safety systems settings, and control settings; (2) LCOs; (3) surveillance requirements; (4) design features; (5) administrative controls; (6) decommissioning; (7) initial notification; and (8) written reports. Section 50.36(c)(2)(i) of 10 CFR states: Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility.

When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met. Section 50.36(c)(2) of 10 CFR does not describe any specific safety standard for the remedial actions permitted by the TSs. However, both the common standards for licenses in 10 CFR 50.40(a) and those specifically for issuance of operating licenses in 10 CFR 50.57(a)(3) provide that there must be "reasonable assurance" that the activities at issue will not endanger the health and safety of the public. Section 50.36(c)(5) of 10 CFR states, in part, "Administrative controls are the provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner." The regulation in 10 CFR 50.36(c)(5) does not provide prescriptive requirements for the content of administrative control programs.

2.4.1.2 Instrumentation and Control Systems The regulations in 10 CFR 50.55a(h) require, for nuclear power plants with construction permits issued before January 1, 1971, that protection systems must be consistent with "their plant-specific licensing basis or may meet the requirements of IEEE Std. 603-1991 and the correction sheet dated January 30, 1995." The plant-specific licensing basis for Calvert Cliffs, Units 1 and 2, is described in Section 7.1, "Introduction," and Section 7.2.2, "Design Basis," of the Calvert Cliffs UFSAR. Section 7.1 states: All protection systems that actuate reactor trip, ESFs, and AFW components are designed to conform to the criteria of Institute of Electrical and Electronic Engineers (IEEE) 279 and those sections that are relevant from the Commission's proposed General Design Criteria, as published February 20, 1971. Section 7.2.2 of the Calvert Cliffs, Units 1 and 2, UFSAR, further states that, "Instrumentation conforms to the provisions of the proposed IEEE, Criteria for Nuclear Power Plant Protection Systems (IEEE 279, August 1968)." IEEE 279-1968 thus established the plant-specific licensing basis to which Calvert Cliffs must conform. Clause 4.2, "Single Failure Criterion," of IEEE 279-1968 requires that: Any single failure within the protection system shall not prevent proper protection system action when required.

Clause 4.11, "Channel Bypass or Removal from Operation," of IEEE 279-1968 requires that: The system shall be designed to permit any one channel to be maintained, and when required, tested or calibrated during power operation without initiating a protective action at the systems level. During such operation the active parts of the system shall of themselves continue to meet the single failure criterion.

However, the single failure criterion is allowed to be violated by the exception specified in this clause: Exception: "One out of two" systems are permitted to violate the single failure criterion during channel bypass provided that acceptable reliability of operation can be otherwise demonstrated.

Appendix A, "General Design Criteria for Nuclear Power Plants" (GDC), to Part 50 of 1 O CFR, GDC-22, "Protection system independence," provides, in part, that, "Design techniques, such as functional diversity or diversity in component design and principles of operation, shall be used to the extent practical to prevent loss of the protection function." 2.4.1.3 Electrical Power Systems Calvert Cliffs UFSAR Appendix 1 C states, in part, "Calvert Cliffs was designed and constructed to meet the intent of the draft (proposed)

GDC for Nuclear Power Plants, which was published by the Atomic Energy Commission in July 1967. Modifications to the facility are evaluated in accordance with 10 CFR 50.59 to assess consistency with the current licensing basis (including the draft GDC, as applicable)." The following draft GDC 24 and 39 are applicable to the Calvert Cliffs electrical power systems. Draft GDC 24, "Emergency Power for Protection Systems," states, "In the event of loss of all offsite power, sufficient alternate sources of power shall be provided to permit the required functioning of the protection systems." Draft GDC 39, "Emergency Power for Engineered Safety Features," states, "An alternate power system shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the ESFs. As a minimum, the onsite power system and the offsite power system shall each, independently, provide this capacity, assuming a failure of a single active component in each power system." Calvert Cliffs UFSAR Appendix 1C states that a new safety-related DG (EDG 1A) was installed at Calvert Cliffs in 1996. The new EDG 1A, its support systems, and the building which houses it, were designed to the final GDC in Appendix A to 10 CFR Part 50. Appendix A to 10 CFR Part 50, GDC 17, "Electric power systems," requires, in part, that an onsite electric power system and an offsite electric power system be provided to permit functioning of SSCs important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences, and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

The onsite electric power supplies, including the batteries and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions, assuming a single failure. 2.4.2 Policy Statements In the Commission's "Final Policy Statement:

Technical Specifications for Nuclear Power Plants," dated July 22, 1993 (58 FR 39132), the Commission addressed the use of probabilistic safety analysis (PSA), (currently referred to as PRA) in the Standard Technical Specifications).

In this 1993 publication, the Commission stated, in part: The Commission believes that it would be inappropriate at this time to allow requirements which meet one or more of the first three criteria [of Title 1 O of the Code of Federal Regulations (10 CFR), Section 50.36] to be deleted from Technical Specifications based solely on PSA (Criterion 4). However, if the results of PSA indicate that Technical Specifications can be relaxed or removed, a deterministic review will be performed.

The Commission Policy in this regard is consistent with its Policy Statement on "Safety Goals for the Operation of Nuclear Power Plants," 51 FR 30028, published on August 21, 1986. The Policy Statement on Safety Goals states in part, "[ ... ] probabilistic results should also be reasonably balanced and supported through use of deterministic arguments.

In this way, judgments can be made[ ... ] about the degree of confidence to be given these [probabilistic]

estimates and assumptions.

This is a key part of the process for determining the degree of regulatory conservatism that may be warranted for particular decisions.

This defense-in-depth approach is expected to continue to ensure the protection of public health and safety." The Commission will continue to use PSA, consistent with its policy on Safety Goals, as a tool in evaluating specific line-item improvements to Technical Specifications, new requirements, and industry proposals for risk-based Technical Specification changes. Approximately 2 years later, the Commission provided additional detail concerning the use of PRA in the "Final Policy Statement:

Use of Probabilistic Risk Assessment in Nuclear Regulatory Activities," dated August 16, 1995 (60 FR 42622). In this publication, the Commission stated: The Commission believes that an overall policy on the use of PRA methods in nuclear regulatory activities should be established so that the many potential applications of PRA can be implemented in a consistent and predictable manner that would promote regulatory stability and efficiency.

In addition, the Commission believes that the use of PRA technology in NRC regulatory activities should be increased to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRC's deterministic approach.

[ ... ] PRA addresses a broad spectrum of initiating events by assessing the event frequency.

Mitigating system reliability is then assessed, including the potential for multiple and common cause failures.

The treatment therefore goes beyond the single failure requirements in the deterministic approach.

The probabilistic approach to regulation is, therefore, considered an extension and enhancement of traditional regulation by considering risk in a more coherent and complete manner. [ ... ] Therefore, the Commission believes that an overall policy on the use of PRA in nuclear regulatory activities should be established so that the many potential applications of PRA can be implemented in a consistent and predictable manner that promotes regulatory stability and efficiency.

This policy statement sets forth the Commission's intention to encourage the use of PRA and to expand the scope of PRA applications in all nuclear regulatory matters to the extent supported by the state-of-the-art in terms of methods and data. [ ... ] Therefore, the Commission adopts the following policy statement regarding the expanded NRC use of PRA: ( 1) The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.

(2) PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state-of-the-art, to reduce unnecessary conservatism associated with current regulatory requirements, regulatory guides, license commitments, and staff practices.

Where appropriate, PRA should be used to support the proposal for additional regulatory requirements in accordance with 10 CFR 50.109 (Backfit Rule). Appropriate procedures for including PRA in the process for changing regulatory requirements should be developed and followed.

It is, of course, understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and regulations are revised. (3) PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review. ( 4) The Commission's safety goals for nuclear power plants and subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments on the need for proposing and backfitting new generic requirements on nuclear power plant licensees.

2.4.3 Regulatory Guidance RG 1.17 4, Revision 3, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" (Reference 13), describes an acceptable risk-informed approach for assessing the nature and impact of proposed permanent licensing basis changes by considering engineering issues and applying risk insights.

This RG also provides risk acceptance guidelines for evaluating the results of such evaluations.

RG 1.177, Revision 1, "An Approach for Plant-Specific, Risk-Informed Decision making: Technical Specifications" (Reference 14), describes an acceptable risk-informed approach specifically for assessing proposed TS changes. Both RGs list the same set of principles of risk-informed integrated (or plant-specific) decisionmaking that are expected to be addressed when implementing risk-informed TS changes. RG 1.177 provides guidance specifically for risk-informed TS changes consistent with, but more detailed than, the generally applicable guidance given in RG 1.17 4. The principles, which are also referred to as key principles, are: 1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption.

2. The proposed change is consistent with the defense-in-depth philosophy.

3. The proposed change maintains sufficient safety margins. 4. When proposed changes result in an increase in core damage frequency (CDF) or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Pc,licy Statement.

5. The impact of the proposed chan,ge should be monitored using performance measurement strategies.

Additionally, RG 1.177, Revision 1, identifies a three-tiered approach for a licensee's evaluation of the risk associated with a proposed TS CT change, as follows.

• Tier 1 assesses the risk impact of the proposed change in accordance with acceptance guidelines consistent with the Commission's Safety Goal Policy Statement, as documented in RG 1.17 4 and RG 1.177. The first tier assesses the impact on plant risk as expressed by the change in core damage frequency

(~CDF) and change in large early release frequency

(~LERF). It also evaluates plant risk while equipment covered by the proposed CT is out of service, as represented by incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP).

Tier 1 also addresses PRA quality, including the technical adequacy of the licensee's plant-specific PRA for the subject application.

Cumulative risk of the proposed TS change is considered with uncertainty/sensitivity analysis with respect to the assumptions related to the proposed TS change.

• Tier 2 identifies and evaluates any potential risk-significant plant equipment outage configurations that could result if equipment, in addition to that associated with the proposed license amendment, is removed from service simultaneously, or if other risk-significant operational factors, su1ch as concurrent system or equipment testing, are also involved.

The purpose of this evaluation is to ensure that there are appropriate restrictions in place such that risk-significant plant equipment outage configurations will not occur when equipment associated with the proposed CT is implemented.

• Tier 3 addresses the licensee's configuration risk management program (CRMP) to ensure that adequate programs and procedures are in place for identifying risk-significant plant configurations resulting from maintenance or other operational activities and appropriate compensatory measures are taken to avoid risk-significant configurations that may not have been considered when the Tier 2 evaluation was performed.

Compared with Tier 2, Tier 3 provides additional coverage to ensure risk-significant plant equipment outage configurations are identified in a timely manner and that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity over extended periods of plant operation.

Tier 3 guidance can be satisfied by the Maintenance Rule, which requires a licensee to assess and manage the increase in risk that may result from activities such as surveillance testing and corrective and preventive maintenance, subject to the guidance provided in RG 1.177, Section 2.3.7.1, and the adequacy of the licensee's program and PRA model for this application.

The CRMP ensures that equipment removed from service prior to or during the proposed extended CT will be appropriately assessed from a risk perspective.

RG 1.200, Revision 2 (Reference 15), describes an acceptable approach for determining whether the quality of the PRA, in total, or the parts that are used to support an application, is sufficient to provide confidence in the results such that the PRA can be used in regulatory decisionmaking for light water-reactors.

RG 1.200 provides regulatory guidance for assessing the technical adequacy of a PRA. RG 1.200, Revision 2, endorses, with clarifications and qualifications, the use of the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) Standard, RA-Sa-2009, "Addenda to ASME RA-S-2008, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications" (i.e., the "PRA standard") (Reference 16). NEI 06-09, Revision 0-A, provides a methodology for modifying selected required actions to provide an optional RICT. The optional RICT can be used to delay exiting the operational mode of applicability or taking remedial actions if risk is assessed and managed within the limits and programmatic requirements established by an RICT program or a configuration risk management program. The NRC staff found NEI 06-09, Revision 0-A, acceptable for referencing by licensees proposing to amend their TSs to implement risk managed TSs as documented in the staff's final SE for NEI TR NEl-06-09, enclosed with the staff's letter dated May 17, 2007 (Reference 11 ). 3.0 TECHNICAL EVALUATION The licensee proposed to add an RICT program to the administrative controls section of the TSs and modify selected TS required actions to p1~rmit extending CTs if risk is assessed and managed as described in NEI 06-09, Revision 0-A (Reference 12). In accordance with NEI 06-09, Revision 0-A, PRA methods are used to justify each extension to a required action CT based on the specific plant configuration that exists at the time of the applicability of the required action, and are updated when plant conditions change. The licensee's LAR included documentation regarding the technical adequacy of the PRA models used in the CRMP, consistent with the requirements of RG 1.200. Most TSs identify one or more conditions for which the LCO may not be met to permit a licensee to perform required testing, maintenance, or repair activities.

Each condition has an associated required action for restoration of the LCO, or for other actions, each with a fixed time interval referred to as the CT, which specifies the tii:ne interval permitted to complete the required action. Upon expiration of the CT, typically the licensee is required to exit operational mode of applicability or follow the required action(s) stated in the LCO. The RICT program provides administrative controls to permit extension of CTs and thereby delay reactor shutdown or completion of the required action(s) if risk is assessed and managed within specified limits and programmatic requirements.

The specified safety function or performance level of TS required equipment is unchanged, and the required action(s), including the requirement to shut down the reactor, are also unchanged.

Only the CTs for the required actions are extended by the RICT program. The NRC staff reviewed the licensee's PRA methods and models to determine if they are technically acceptable for use in the proposed risk-informed CT extensions.

The NRC staff also reviewed the licensee's proposed RICT program to determine if it provides the necessary administrative controls to permit CT extensions. 3.1 Review of Key Principles RG 1.177, Revision 1 (Reference 14 ), identifies five key safety principles to be applied to risk-informed changes to the TSs. The licensee in its LAR addresses each of these principles.

The NRC staff evaluated the licensee's propo,sed use of RICTs against these key safety principles as discussed below. 3.1.1 Key Principle 1: Compliance with Current Regulations As stated in 10 CFR 50.36(c)(2):

Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility.

When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the TSs until the condition can be met, When the necessary redundancy is not maintained (e.g., one train of a two-train system is inoperable), the TSs permit a limited period of time to restore the inoperable train to operable status and/or take other remedial measures.

If these actions are not completed within the CT, the TSs normally require that the plant exit the mode of applicability for the LCO. With one train of a two-train system inoperable, the TS safety function is accomplished by the remaining operable train. In the current TSs, the CT is specified as a fixed time period. The addition of the option to determine the CT in accordance with the RICT program would allow an evaluation to determine an RICT. The evaluation would be done in accordance with the methodology prescribed in NEI 06-09, Revision 0-A, and TS 5.5.18. The RICT is limited to a maximum of 30 days, provided there is no loss of TS safety function.

The CTs in the current TSs were established using experiential data, risk insights, and engineering judgement.

When the necessary redundancy is not maintained and the system loses the capability to perform its safety function(s) without any further failures (e.g., both trains of a two-train system are inoperable), the plant must exit the mode of applicability for the LCO, or take remedial actions, as specified in the TSs. With the incorporation of the RICT program, the required performance levels of equipment specified in LCOs are not changed. Only the required CTs for the required actions are modified by the RICT program. The new TSs providing requirements for the RICT program will be contained in the administrative controls section of the TSs. The program specifies that the RICT program be based on NEI 06-09, Revision 0-A, and specifies additional requirements to ensure the key principles are satisfied.

The licensee proposed one change to the TSs that involves a change other than revising the CT to reflect the option of calculating an RICT. The licensee proposed that LCO 3.6.3, Containment Isolation Valves, Action A.2, also be revised. Currently, Condition A is applicable with one or more penetration flow paths with one containment isolation valve inoperable.

The required action is to isolate the affected penetration within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (Required Action A.1) and verify it is isolated once per 31 days (Required Action A.2). Required Action A.1 is being modified to reflect the incorporation of an RICT. Since Required Action A.1 will have a variable CT, it is necessary to make a conforming change to Required Action A.2 to require verification that the affected penetration flow path is isolated once per 31 days following isolation for isolation devices outside containment.

The NRC staff finds this conforming change acceptable because the verification that the penetration flow path is isolated will continue to be verified once per 31 days. 3.1. 1. 1 Evaluation of Electrical Power Systems Draft GDC 24 and 39, and 10 CFR Part 50, Appendix A, GDC 17 requirements are reflected, in part, in the electrical power systems TS LCOs, which require redundant electrical power sources/equipment to be operable (in operating modes). When a TS LCO is not met because an electrical power source or equipment required by a TS LCO is inoperable, the TSs require the licensee to follow any remedial actions permitted by the TSs until the LCO can be met or exit the mode of applicability for the LCO. The current Calvert Cliffs TSs permit entry in a TS condition to restore the inoperable power source or equipment to operable status within the CT. During the RICT program entry for the proposed electrical TS conditions, when the LCO is not met due to the inoperable electrical power source or equipment, the redundancy required by the TS LCO (in operating modes), as specified by draft GDC 24 and 39, and GDC 17, will not be maintained.

Therefore, the NRC staff finds that the requirements of draft GDC 24 and 39, and 10 CFR Part 50, Appendix A, GDC 17 are not temporarily met during the RICT program entry for the proposed electrical power systems TS conditions since the redundancy required by the GDC is not maintained.

The NRC staff also finds that operating the plant while remedial actions are being taken, during the period of time the redundancy required by the GDC and LCO is not maintained, is allowed by 10 CFR 50.36(c)(2), which states, 'When an LCO of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met." When the necessary redundancy is not maintained (e.g., one train of a two train system is inoperable), the TSs permit a limited period of time to restore the inoperable train to operable status and/or take other remedial measures.

If these actions are not completed within the CT, the TSs normally require that the plant exit the mode of applicability for the LCO. With one train of a two train system inoperable, the TS safety function is accomplished by the remaining operable train. In the current TSs, the CT is specified as a fixed time period. The addition of the option to determine the CT in accordance with the RICT program would allow an evaluation to determine a configuration-specific CT. The evaluation would be done in accordance with the methodology prescribed in NEI 06-09, Revision 0-A, and TS 5.5.18. The RICT is limited to a maximum of 30 days and can only be used when there is no TS or PRA loss of function.

The RICT program provides the necessary administrative controls to permit extension of CTs and thereby delay reactor shutdown or required actions if risk is assessed and managed appropriately within specified limits and programmatic requirements.

3.1.1.2 Evaluation of Instrumentation and Control Systems Calvert Cliffs TS 3.3, "Instrumentation," LCOs were developed to assure that the Calvert Cliffs facility maintains necessary redundancy and diversity, and complies with the "single failure" design criterion as defined in Clause 4.2 of IEEE 279-1968, ~dequate bypass redundancy requirement as defined in Clause 4.11 of IEEE 279-1968, and adequate diversity requirements as defined in GDC 22. The l&C safety functions identified in the LAR maintain the capability to perform their safety functions when a channel is placed out of service. Therefore, the l&C system diversity configuration remains unchanged.

Based on the discussion provided above, the NRC staff concludes that the proposed changes to TS 3.3 meet current diversity requirements as defined in GDC 22. Under certain TS conditions, the single failure criterion cannot be met until the affected channel is placed in trip position or restored to operable.

In accordance with the RICT program defined in TS 5.5.18, the RICT program provides the necessary administrative controls to permit an extension of CTs, and thereby delay exiting the operational mode of applicability or required actions. If an RICT is calculated in accordance with the RICT program, the NRC staff finds that the affected system operation reliability remains acceptable and is consistent with overall system reliability and risk considerations.

3.1.1.3 Key Principle 1 Conclusions The NRC staff finds that the proposed changes are in compliance with the applicable regulations.

The NRC staff concludes that proposed TS 5.5.18 provides the necessary controls to assure operation of the facility in a safe manner. This satisfies 10 CFR 50.36( c)(2), because the minimum required performance levels of SSCs are not changed by the incorporation of the option to calculate an RICT and the remedial actions applicable when an LCO is not met are not changed by the incorporation of the RICT program. Therefore, the NRC staff concludes that the proposed TS changes continue to satisfy the requirements of 10 CFR 50.36(c)(2).

The NRC staff also concludes that operating the plant while remedial actions are being taken, during the period of time the redundancy required by the GDC and LCO is not maintained, is allowed by 10 CFR 50.36(c)(2), which states, "When an LCO of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met." Additionally, the NRC staff considers that the affected l&C systems' operation reliability remains acceptable and is consistent with overall system reliability and risk considerations.

Therefore, the NRC staff concludes that the proposed changes involving the affected l&C power systems meet the requirements defined in Clauses 4.2 and 4.11 of IEEE 279-1968.

3.1.2 Key Principle 2: Evaluation of Defense-in-Depth Defense-in-depth is an approach to designing and operating nuclear facilities that prevents and mitigates accidents that release radiation or hazardous materials.

The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. Defense-in-depth includes the use of access controls, physical barriers, redundant and diverse key safety functions, and emergency response measures.

As discussed throughout RG 1.17 4 (Reference 13), consistency with the defense-in-depth (DID) philosophy is maintained by the following measures:

1. Preserve a reasonable balance among the layers of defense. 2. Preserve adequate capability of design features without an overreliance on programmatic activities as compensatory measures.

3. Preserve system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty.

4. Preserve adequate defense against potential CCFs. 5. Maintain multiple fission product barriers. 6. Preserve sufficient defense against human errors. 7. Continue to meet the intent of the plant's design criteria.

The proposed change provides a technical approach that balances avoidance of core damage, avoidance of containment failure, and consequence mitigation.

The three-tiered approach to risk-informed TS CT changes in RG 1.177 provides additional assurance that DID will not be significantly impacted by such changes to the licensing basis. The licensee is proposing no changes to the design of the plant or any operating parameter, no new operating configurations, and no new changes to the design basis in the proposed changes to the TSs. An RICT may not be determined and used following a loss of TS safety function because the system has lost the capability to perform its safety function(s).

This restriction, to not apply an RICT to loss of a TS-specified safety function or inoperability of all required trains of a system, ensures that consistency with the DID philosophy is maintained by following existing guidance when the capability to perform a TS safety function(s) is lost. The proposed RICT program uses plant-specific operating experience for component reliability and availability data. Thus, the allowances permitted by the RICT program are directly reflective of actual component performance in conjunction with component risk significance.

In certain cases, the RICT program may use compensatory actions to reduce calculated risk in some configurations.

Where credited in the PRA, these actions are incorporated into station procedures or work instructions and have been modeled using appropriate human reliability considerations.

Application of the RICT program determines the risk significance of plant configurations.

It also permits the operator to identify the equipment that has the greatest effect on the existing configuration risk. With this information, the operator can manage the out-of-service duration and determine the consequences of removing additional equipment from service. 3.1.2.1 Use of Compensatory Measures to Retain Defense-in-Depth Application of the RICT program provides a structure to assist the operator in identifying effective compensatory actions for various plant maintenance configurations to maintain and manage acceptable risk levels. NEI 06-09, Revision 0-A, addresses potential compensatory actions and RMA measures by stating, in generic terms, that compensatory measures may include, but are not limited, to the following:

• Reduce the duration of risk sensitive activities.

• Remove risk sensitive activities from the planned work scope.

• Reschedule work activities to avoid high risk-sensitive equipment outages or maintenance states that result in high risk plant configurations.

• Accelerate the restoration of out-of-service equipment.

• Determine and establish the safest plant configuration.

NEI 06-09, Revision 0-A, requires that compensatory measures be initiated when the PRA-calculated risk management action time (RMAT) is exceeded, or for preplanned maintenance for which the RMAT is expected to be exceeded, RMAs shall be implemented at the earliest appropriate time. Compensatory measures are developed to provide assurance that additional defenses are in place for specific plant configurations, as appropriate.

Therefore, the NRC staff finds that compensatory measures support the conclusion that the RICT program is consistent with the principle of DID. 3.1.2.2 Evaluation of Electrical Power Systems In the LAR, the licensee stated that the proposed amendments would modify the TS requirements related to CTs for various required actions to provide the option to calculate a longer risk-informed CT. The licensee is proposing to incorporate the RICT program into its TSs for applicability only during Modes 1 and 2. The RICT program has a maximum limit of 30 days for any required action. The NRC staff evaluated whether the plant would continue to have DID if the proposed RICT program relating to TS Section 3.8 is implemented.

The NRC staff reviewed the DID of the electrical power systems for the TS conditions that would be impacted by the RICT program. The DID philosophy is incorporated into the design of the electrical power systems by having multiple or redundant and independent layers of electrical power sources and subsystems to ensure power to equipment required to prevent and mitigate postulated design-basis accidents (DBAs), events, transients, and abnormal occurrences, assuming a single failure. The LCOs for the electrical power systems TSs require redundant electrical power sources or equipment that is capable of performing necessary safety functions, assuming a single failure, to be operable when a plant is in one of the operating modes. If an electrical power source or equipment required by a TS LCO is inoperable, the required redundancy (i.e., DID) will be reduced or lost, the LCO will not be met, and an applicable TS condition will be entered for remedial actions. For this review, the NRC staff evaluated the reduced DID in each proposed electrical TS condition to determine whether the reduced DID during the RICT program entry for the specific TS condition is consistent with the DID philosophy of having multiple layers of defense during plant operation to mitigate accidents, and the staff considered the attributes of the DID philosophy described in RGs 1.17 4 and 1.177. The NRC staff reviewed information pertaining to the proposed electrical power systems TS conditions in the application, UFSAR, and the applicable TS LCOs and Bases to identify supplemental safety or non-safety-related electrical power sources or equipment (not necessarily required by the LCOs) that is available at Calvert Cliffs and is capable of performing the same safety function of the inoperable electrical power source or equipment.

The following postulated DBAs identified in Calvert Cliffs UFSAR Chapter 14, "Safety Analysis," were considered for the review: control element assembly (CEA) ejection event, steam line break (SLB) event, steam generator tube rupture (SGTR) event, seized rotor event, loss-of-coolant accident {LOCA) event, and feedline break event. The CEA ejection, SGTR, and seized rotor events were analyzed with offsite power available.

The SLB, LOCA, and feedline break events analyses assumed a concurrent LOOP. The SLB and LOCA events also assumed a concurrent single failure. The CEA ejection, SLB, SGTR, and seized rotor events assumed radiological release into the control room. All postulated DBAs credited actuation of the RPS and/or ESFAS. The DBAs were assumed to occur at full power. For this review, the NRC staff grouped the postulated DBAs in two groups based on UFSAR Chapter 14 safety analyses:

DBAs with offsite power (i.e., accidents with offsite power available) and DBAs without offsite power (i.e., accidents concurrent with LOOP). The LOOP was assumed to be the loss of the electrical grid. For each electrical power systems TS condition affected by the RICT program, the licensee provided the Calvert Cliffs design-success criteria in Table E1-1, "In Scope TS/LCO Conditions to Corresponding PRA Functions," of the letter dated January 11, 2018. Each TS condition design success criterion reflects the redundant or absolute minimum electrical power source or subsystem required to be operable by the LCOs to support the minimum safety functions necessary to mitigate postulated DBAs, safely shut down the reactor, and maintain the reactor in a safe shutdown condition.

The NRC staff notes that since the use of the RICT program is based on the plant configurations provided in this application, the NRC staff review of the DID of the electrical power systems was limited to only this set of plant configurations.

For p~rposes of this review, a single layer of DID is considered to be an electrical power source or equipment that is not necessarily required by the LCOs and can be either safety or non-safety-related.

3.1.2.2.1 TS 3.8.1 -AC Sources-Operating During operation, TS LCO 3.8.1 requires the following AC electrical sources to be operable:

a. Two qualified circuits between the offsite transmission network and the onsite Class 1 E AC Electrical Power Distribution System; b. Two DGs each capable of supplying one train of the onsite Class 1 E AC Electrical Power Distribution System; and c. One qualified circuit between the offsite transmission network and the other unit's onsite Class 1 E AC electrical power distribution subsystems needed to supply power to the CREVS and CRETS, and one DG from the other unit capable of supplying power to the CREVS and CRETS. Per TS Basis 3.8.1, the offsite power circuits are the two 13 kV buses 11 and 21, which can be powered by either (1) two 500 kV lines with associated two 500 kV buses and two plant P-13000 service transformers or (2) one 500 kV line with associated one 500 kV bus and one plant P-13000 service transformer and the 13 kV SMECO line. TS Basis 3.8.1 states that the LCO requires operability of two out of three qualified circuits between the transmission network and the onsite Class 1 E AC electrical power distribution system circuits.

These circuits consist of two 500 kV circuits and the 69 kV SMECO dedicated source. TS Basis 3.8.1 further states that when appropriate, the ESFAS loss-of-coolant incident and shutdown sequencer for the 4.16 kV bus will sequence loads on the bus after the 69 kV/13.8 kV SMECO line has been manually placed in service. According to Calvert Cliffs UFSAR Section 8.1.3, "Shared Electrical Equipment," the following components of the offsite power circuits are shared by Units 1 and 2: service transformers P-13000-1 and P-13000-2, 13 kV service bus 11 and bus 21, the 500 kV red bus, and the 500 kV black bus. Therefore, both units would enter their respective TS conditions if any of the common components of the offsite power circuits were inoperable.

Although the SBO DG in its normal operating condition cannot be started within 10 seconds upon receiving a start signal to support the assumptions of the design-basis LOCA analysis in the UFSAR, this DG has been credited in the Calvert Cliffs TSs as an emergency power source. TS 3.8.1 Conditions B, E, and F require the SBO DG to be in an available status (aligned with the safety buses) when one required DG is inoperable.

While in the above TS conditions, operator action (closing a breaker) from the control room will start and load this DG. TS 3.8.1 Condition A -One required LCO 3.8.1.a offsite circuit inoperable The licensee proposed the option to use the RICT program to extend the existing 72-hour CT up to a maximum of 30 days to restore the required offsite circuit to operable status (Required Action A.3) for TS 3.8.1 Condition A. The RICT estimate for TS 3.8.1 Condition A in Table E1-2 is 30 days. According to Table E1-1, the design-success criteria for TS 3.8.1 Condition A is "One qualified circuit between the offsite transmission network and the onsite [Class] 1 E AC Electrical Power Distribution System." Therefore, during an RICT program entry for TS 3.8.1 Condition A, the remaining required LCO 3.8.1.a offsite circuit and SMECO line, in addition to the two LCO 3.8.1.b DGs, will be capable of supplying power to the ESF systems required to mitigate DBAs with offsite power available; thus, the required design-success criteria is met. In case offsite power is lost concurrently with the DBAs, as assumed in the UFSAR Chapter 14 analysis, the two operable LCO 3.8.1.b DGs will have the capability to power the minimum ESF systems required to mitigate the DBAs. Based on the above discussion, the NRC staff finds that during the RICT program entry for TS 3.8.1 Condition A, the DID of the electrical power systems that ensures AC power to key safety-related equipment required to operate during DBAs is reduced (1) to four layers of defense (an LCO 3.8.1.a offsite circuit, the SMECO line, and two LCO 3.8.1.b DGs) for DBAs with offsite power, and (2) two layers of defense (two LCO 3.8.1.b DGs) for DBAs without offsite power. In addition, in the letter dated January 11, 2018, in response to an NRC staff request for additional information (RAI) dated November 13, 2017 (Reference 9), the licensee stated that it will implement RMAs when in TS 3.8.1 Condition A. The example RMA, if implemented, would:

• Prohibit any elective maintenance on the SMECO line, all EDGs, any part of the AFW system to ensure that feedwater trains are fully operable, any components in the switchyard, and electrical component from the switchyard down to the safety-related 4k buses.

• Protect the associated equipment as directed by OP-AA-108-117, "Protected Equipment Program."

• Evaluate weather forecasts prior to entering the LCO to ensure favorable conditions exist for the entire length of the expected CT. Considering that the design-success criteria will be met during operation with a TS RICT, and RMAs will be implemented during operation with a TS RICT, the NRC staff finds that the plant will continue to have adequate DID while in TS 3.8.1 Condition A. Therefore, the proposed changes to TS 3.8.1 Condition A are acceptable. TS 3.8.1 Condition B -One LCO 3.8.1.b diesel generator inoperable The licensee proposed the option to use the RICT program to extend the existing 14-day CT up to a maximum of 30 days to restore the DG to operable status (Required Action 8.5) for Condition B. The RICT estimate for TS 3.8.1 Condition Bin Table E1-2 is 30 days. As stated in Table E1-1, the design-success criterion for TS 3.8.1 Condition Bis "one of two DGs capable of supplying one train of the onsite Class 1 E AC Electrical Power Distribution System." Therefore, during an RICT program entry for TS 3.8.1 Condition B, the remaining LCO 3.8.1.b DG, in addition to the two required LCO 3.8.1.a qualified offsite circuits and the SMECO line, will be capable of supplying power to ESF systems required to mitigate DBAs with offsite power; thus, the required design-success criterion is met. In the event that offsite power is lost concurrent with the DBAs, as assumed in the UFSAR Chapter 14 analysis, the remaining LCO 3.8.1.b DG will be relied on to power the minimum ESF systems required to mitigate the DBAs. The NRC staff further reviewed the examples of RMAs associated with TS 3.8.9 Condition A. In the letter dated February 25, 2016, the licensee provided the following examples of RMAs associated with DGs. 1. Contact the Transmission System Operator to determine the reliability of offsite power supplies prior to entering a RICT, and implement RMAs during times of high grid stress conditions, such as during high demand conditions.

2. Evaluate weather conditions for threats to the reliability of offsite power supplies.

3. Defer elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers associated with the unit. 4. Defer planned maintenance or testing that affects the reliability of the operable DGs and their associated support equipment.

Defer planned maintenance activities on SBO mitigating systems. Treat these as protected equipment.

5. Defer planned maintenance or testing on redundant train safety systems. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.

6. Implement 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected DG. 7. Brief the on-shift operations crew concerning the unit activities, including any compensatory measures established, and review the appropriate emergency operating procedures for a LOOP. The NRC staff notes that the Calvert Cliffs protected equipment program identifies equipment that should be protected to ensure that the minimum required equipment remains available to support plant operation.

The actions specified above would provide additional assurance for the availability of the remaining equipment.

The NRC staff finds that the examples of the RMAs associated with TS 3.8.1 Condition B are reasonable.

Based on the above discussion, the NRC staff finds that during the RICT program entry for TS 3.8.1 Condition B, the DID of the electrical power systems that ensure AC power to key safety-related equipment required to operate during DBAs is reduced (1) to four layers of defense (the remaining LCO 3.8.1.b DG, two required LCO 3.8.1.a qualified offsite circuits, and the SM ECO line) for DBAs with offsite power, and (2) a single layer of defense ( one LCO 3.8.1.b DG) for DBAs without offsite power. The NRC staff reviewed the licensee's proposed TS changes and supporting documentation.

Based on the evaluations above, the NRC staff finds that the design-success criterion is met. While the redundancy is not maintained (a single layer of defense [one LCO 3.8.1.b DG] for DBAs without offsite power), CT extensions in accordance with the RICT program are acceptable because (a) the capability of the systems to perform their safety functions (assuming no additional failures) is maintained, and (b) the licensee's demonstration of identifying and implementing compensatory measures or RMAs in accordance with the RICT program are appropriate to monitor and control risk. Therefore, the NRC staff finds that the plant will continue to have adequate DID while in TS 3.8.1 Condition B, and the proposed change to TS 3.8.1 Condition B is acceptable.

TS 3.8.1 Condition G -Two required LCO 3.8.1.a offsite circuits inoperable OR One required LCO 3.8.1.a offsite circuit that provides power to the CREVS and CRETS inoperable and the required LCO 3.8.1.c offsite circuit inoperable The licensee proposed the option to use the RICT program to extend the existing 24-hour CT to restore one required offsite circuit to operable status (Required Action G.2) for TS 3.8.1 Condition G. The RICT estimate for TS 3.8.1 Condition Gin Table E1-2 is 16 days. The two required LCO 3.8.1.a offsite circuits are the 13 kV service buses 11 and 21 with associated transmission lines, 500 kV buses, plant P-13000 and unit U-4000 service transformers, 13.8 kV voltage regulators, and 4.16 kV circuit breakers.

The 13 kV service buses 11 and 21, 500 kV buses, and plant P-13000 service transformers are shared by both units. The first option of TS 3.8.1 Condition G is applicable when the two LCO 3.8.1.a offsite circuits are inoperable.

The second option of TS 3.8.1 Condition G is applicable when one LCO 3.8.1 offsite circuit and one qualified circuit between the offsite transmission network and the other unit's onsite electrical power distribution subsystem that supplies power to CREVS and CRETS is inoperable.

As stated in Table E1-1, the design-success criteria for TS 3.8.1 Condition G is "One qualified circuit between the offsite transmission network and the onsite 1 E AC Electrical Power Distribution System." Per Calvert Cliffs UFSAR Section 8, offsite power from the 500 kV lines and 13 kV SMECO line supplies power to both units' 4.16 kV ESF buses via the 13.8 kV service buses 11 and 21. The Condition G worst case scenario would be the failure of two required LCO 3.8. 1.a offsite circuits.

During an RICT program entry for the TS 3.8.1 Condition G (worst scenario), the SMECO line, two LCO 3.8.1.b DGs, and the SBO DG, will be capable of supplying power to the ESF equipment required to mitigate all DBAs; thus, the required design-success criteria is met. In case offsite power is lost concurrently with the DBAs, as assumed in the UFSAR Chapter 14 analysis, two LCO 3.8.1.b DGs would be capable of supplying power to the ESF equipment required to mitigate all DBAs. Based on the above discussion, the NRC staff finds that during the RICT program entry for TS 3.8.1 Condition G, the DID of the electrical power systems that ensures AC power to key safety-related equipment required to operate during all DBAs is reduced to (1) four layers of defense ( one qualified offsite circuit, two LCO 3.8.1.b DGs, and the SBO DG) with offsite power, and (2) two layers of defense (two LCO 3.8.1.b DGs) for DBAs without offsite power. In addition, in the letter dated January 11, 2018, in response to the NRC staff's RAls, the licensee stated that it will implement RMAs when in TS 3.8.1 Condition G. The licensee will implement the same RMAs for TS 3.8.1 Condition A, protect the CRETS/CREVS train using OP-AA-108-117, and hold shift briefs. Considering that the design-success criteria will be met during a TS RICT, and RMAs will be implemented during a TS RICT, the NRC staff finds that the plant will continue to have adequate DID while in TS 3.8.1 Condition G~ Therefore, the proposed changes to TS 3.8.1 Condition G are acceptable.

TS 3.8.1 Condition H -One required LCO 3.8.1.a offsite circuit inoperable AND one LCO 3.8.1.b diesel generator inoperable The licensee proposed the option to use the RICT program to extend the existing 12-hour CT to restore either the offsite circuit (Required Action H.1) or the DG (Required Action H.2) to operable status for TS 3.8.1 Condition H. The RICT estimate for TS 3.8.1 Condition H in Table E1-2 is 10 days. As stated in Table E1-1, the design-success criteria for TS 3.8.1 Condition Hare "One qualified circuit between the offsite transmission network and the onsite 1 E AC Electrical Power Distribution System," and "one of two DGs capable of supplying one train of the onsite Class 1 E AC Electrical Power Distribution System." Therefore, during an RICT program entry for TS 3.8.1 Condition H, the remaining required LCO 3.8.1.a offsite circuit, the SMECO line, the remaining LCO 3.8.1.b DG, and the SBO DG will be capable of supplying power to the ESF systems (in both trains) to mitigate DBAs with offsite power; thus, the required design-success criteria are met. In case offsite power is lost concurrently with the DBAs, the remaining LCO 3.8.1.b DG will be relied on to power the minimum ESF systems required to mitigate the DBAs. The NRC staff further reviewed the examples of RMAs associated with TS 3.8.1 Condition H. In the letter dated January 11, 2018, the licensee provided the following examples of RMAs associated with TS 3.8.1 Condition H.

• Contact the Transmission System Operator to determine the reliability of offsite power supplies prior to entering an RICT, and implement RMAs during times of high grid stress conditions, such as during high demand conditions.

• Evaluate weather conditions for threats to the reliability of offsite power supplies.

• Defer elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers associated with the unit.

• Defer planned maintenance or testing that affects the reliability of the operable DGs and their associated support equipment.

Defer planned maintenance activities on station blackout mitigating systems.

• Protect equipment as directed by OP-AA-108-117.

• Defer planned maintenance or testing on redundant train safety systems. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.

• Implement 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected DG.

• Brief the on-shift operations crew concerning the unit activities, including any compensatory measures established, and review the appropriate emergency operating procedures for a LOOP. The NRC staff notes that the Calvert Cliffs protected equipment program identifies equipment that should be protected to ensure that the minimum required equipment remains available to support plant operation.

The actions specified above would provide additional assurance for the availability of the remaining equipment.

The NRC staff finds that the examples of the RMAs associated with TS 3.8.1 Condition H are reasonable.

Based on the above discussion, the NRC staff finds that during the RICT program entry for TS 3.8.1 Condition H, the DID of the electrical power systems that ensures AC power to key safety-related equipment required to operate during DBAs is reduced to (1) four layers of defense (two offsite circuits and two DGs) for DBAs with offsite power, and (2) a single layer of defense (one DG) for DBAs without offsite power. Although there is only a single layer of DID for TS 3.8.1 Condition H, which is a worst case scenario, the NRC staff finds that with the risk management actions in place during the timeframe of 10 days in Table E1-2, as described in the RICT program, this is reasonable and acceptable.

The NRC staff reviewed the licensee's proposed TS changes and supporting documentation.

Based on the evaluations above, the NRC staff finds that the design-success criteria are met. While redundancy is not maintained (a single layer of defense [one LCO 3.8.1.b DG] for DBAs without offsite power), the CT extensions in accordance with the RICT program are acceptable because (a) the capability of the systems to perform their safety functions (assuming no additional failures) is maintained, and (b) the licensee's demonstration of identifying and implementing compensatory measures or RMAs in accordance with the RICT program are appropriate to monitor and control risk. Therefore, the NRC staff finds that the plant will continue to have adequate DID while in TS 3.8.1 Condition H, and the proposed change to TS 3.8.1 Condition H is acceptable.

3.1.2.2.2 TS 3.8.4 -DC Sources-Operating During plant operation, LCO 3.8.4 requires four channels of DC electrical sources to be operable.

According to Calvert Cliffs UFSAR Section 8.1.3, the primary batteries 11, 12, 21, and 22 of the DC channels are shared by Units 1 and 2. Therefore, both units would enter their respective TS conditions if any of the primary batteries were inoperable.

In addition, reserve battery 01 is shared by both units. TS 3.8.4 Condition A -One DC channel inoperable due to an inoperable battery and the reserve battery available The licensee proposed the option to use the RICT program to extend the existing 4-hour CT to replace the inoperable battery with the reserve battery (Required Action A.1) for TS 3.8.4 Condition A. The RICT estimate for TS 3.8.4 Condition A in Table E1-2 is 2 days. As stated in Table E1-1, the design-success criteria for TS 3.8.4 Condition A are "primary or reserve battery for each DC channel, three of four DC channels." The NRC staff notes that Calvert Cliffs has one reserve battery to replace one DC battery at a time. The reserve battery would not be available to the remaining three DC channels, should the reserve battery be used to replace a primary DC battery. The NRC staff also notes once the reserve battery is used to replace a primary DC battery as the required action for TS 3.8.4 Condition A, TS 3.8.4

• Condition A LCO will be exited since the required action would be met. Therefore, there will be four DC channels (batteries and chargers) available.

Because the required design-success criteria are a DC battery for each channel, and three out of four channels available, and because there are four channels of DC batteries and a reserve battery capable of performing the required safety function, the staff finds there are two layers of defense that provide the minimum DC power necessary to mitigate postulated DBAs for Calvert Cliffs design success. During an RICT program entry for TS 3.8.4 Condition A, the remaining three DC channels (batteries and chargers) will be capable of supplying power to the DC loads required to mitigate DBAs with or without offsite power; thus, the required design-success criteria are met. In addition, the two chargers associated with the inoperable DC channel will supply power to the inoperable DC channel during DBAs with offsite power available.

In case offsite power is lost concurrently with the DBAs, the charger powered from the DG relying on the inoperable battery for field flashing would be nonfunctioning, but the charger fed from the other unit's DG would be reenergized to supply the inoperable DC channel's loads that are required to mitigate the DBAs. The charger fed from the other unit's DG will be sequenced onto the DG within 5 seconds of the DG breaker closure (UFSAR Table 8-7, "Load Sequencing").

Based on the above discussion, the NRC staff finds that during an RICT program entry for TS 3.8.4 Condition A, the DID of the electrical power systems that ensures DC power to key safety-related equipment required to operate during DBAs with or without offsite power is reduced to two layers of defense (minimum required three DC channels (batteries and chargers) and at least one charger associated with the inoperable channel).

Considering that the design-success criteria will be met during a TS RICT, and there are two layers of DID, the NRC staff finds that the plant will continue to have adequate DID while in TS 3.8.4 Condition A. Therefore, the proposed changes to TS 3.8.4 Condition A are acceptable.

TS 3.8.4 Condition B -One DC channel inoperable for reasons other than Condition A The licensee proposed the option to use the RICT program to extend the existing 2-hour CT for restoring a DC channel to operable status (Required Action 8.1) in TS 3.8.4 Condition B. The RICT estimate for TS 3.8.4 Condition Bin Table E1-2 is 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />. Table E1-1 identified the design-success criteria for TS 3.8.4 Condition Bas "One of two chargers for each channel. Primary or reserve battery for each channel. Three of four channels." Calvert Cliffs UFSAR Section 8.3.5, "125 Volt DC and 120 Volt AC systems," stated that all battery chargers are energized and maintain a constant voltage to supply the batteries and the steady state DC loads during normal operation.

The NRC staff notes that both chargers would have to be inoperable for the DC channel to be inoperable since both chargers are energized to supply the DC bus (battery and DC loads) and only one charger is required for an operable DC channel. The NRC staff also notes that the remaining three DC channels (batteries and chargers) will provide a single layer of defense since they are the minimum DC channels required to provide the minimum DC power necessary to mitigate Calvert Cliffs postulated DBAs, thus meeting the required design-success criteria.

When TS 3.8.4 Condition B is entered, the following are representative scenarios:

two inoperable chargers, two inoperable chargers and inoperable primary and reserve batteries, or inoperable primary and reserve batteries.

The NRC staff notes that Calvert Cliffs would enter TS 3.8.4 Condition B for Units 1 and 2 since each unit feeds one of the two chargers and both units share the batteries.

The primary and reserve batteries are sized to supply the DC and vital AC loads for a period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> per UFSAR Section 8.3.5, and the reserve battery can be connected to the DC bus within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> per current TS 3.8.4 Condition A. Since the primary battery is able to supply the load for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (a short period of time), the NRC staff notes that within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after the start of the OBA, the DID for the case of "two inoperable chargers" would be the same as that of "two inoperable chargers and inoperable primary and reserve batteries." Therefore, the NRC staff evaluated the case of two inoperable chargers, inoperable primary battery, and inoperable reserve battery as the worst case scenario for TS 3.8.4 Condition B. During an RICT program entry for the TS 3.8.4 Condition B worst case scenario, the remaining three DC channels will be capable of supplying power to the minimum DC loads required to mitigate DBAs with or without offsite power; thus, the required design-success criteria are met. The NRC staff further reviewed the examples of RMAs associated with TS 3.8.4 Condition B. In the letter dated January 11, 2018, the licensee provided the following examples of RMAs associated with TS 3.8.4 Condition B.

• Commence immediate actions to restore the inoperable battery to an operable status.

• Protect equipment as directed by OP-M-108-117.

This protection would include prohibiting all elective maintenance on any Vital AC or DC bus and its associated support equipment.

• Take any required Fire 10 CFR 50.65(a)(4) actions.

• Brief Shift crews on required actions per associated Abnormal Operating Procedures (AOPs) and emergency Operating Procedures (EOPs) with emphasis on the required response to major loads lost.

• Pre-stage materials for work activity.

The NRC staff notes that the Calvert Cliffs protected equipment program identifies equipment that should be protected to ensure that the minimum required equipment remains available to support plant operation.

The actions specified above would provide additional assurance for the availability of the remaining equipment.

The NRC staff finds that the examples of the RMAs associated with TS 3.8.4 Condition B are reasonable.

Considering that the design-success criteria will be met during a TS RICT, and RMAs will be implemented during the TS RICT, the NRC staff finds that the plant will continue to have adequate DID while in TS 3.8.4 Condition B. Therefore, the proposed changes to TS 3.8.4 Condition Bare acceptable.

3.1.2.2.3 TS 3.8.7 -Inverters-Operating During plant operation, LCO 3.8. 7 requires four inverters to be operable.

TS 3.8. 7 Condition A -One required inverter inoperable The licensee proposed the option to use the RICT program to extend the existing 24-hour CT for restoring an inverter to operable status (Required Action A.1) in TS 3.8. 7 Condition A. The RICT estimate for TS 3.8.7 Condition A in Table E1-2 is 12 days. The note for Required Action A.1 requires entry into Condition B of TS LCO 3.8.9 with any AC vital bus deenergized.

As required by current TS 3.8.9 Condition B, the AC vital bus associated with the inoperable inverter will be manually reenergized within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> from its alternate 120 V AC bus fed from an ESF MCC through a regulating transformer.

Therefore, the NRC staff assumed that the AC vital bus associated with the inoperable inverter would be reenergized within the current 24-hour CT for TS 3.8. 7 Condition A prior to entering the RICT for TS 3.8. 7 Condition A. Table E1-1 identified the design-success criterion for TS 3.8. 7 Condition A as three of four inverters.

The NRC staff notes that 3 inverters will provide a single layer of defense since they are the minimum number of inverters required to support the minimum safety functions necessary to mitigate the Calvert Cliffs postulated DBAs; thus, the required design-success criterion is met. During an RICT program entry for TS 3.8. 7 Condition A, the remaining 3 inverters would be capable of providing uninterruptible AC power to the AC vital buses required during DBAs with or without offsite power. In addition, the alternate 120 V AC bus fed from an ESF MCC through a regulating transformer will provide power to the AC vital bus associated with the inoperable inverter when offsite power is available.

In case offsite power is lost, the alternate 120 V AC bus would receive power from the DG associated with the ESF MCC through the regulating transformer and would, in turn, reenergize the affected AC vital bus with some time delay. Based on the above discussion, the NRC staff finds that during the RICT program entry for TS 3.8.7 Condition A, the DID of the electrical power systems that ensure AC power to the safety-related AC vital buses required to operate during DBAs with or without offsite power is reduced to two layers of defense (minimum required three inverters and the alternate 120 V AC bus fed via a regulating transformer).

In addition, in the letter dated January 11, 2018, in response to the NRC staff's RAls, the licensee stated that it may perform the following example RMAs: enter TS 3.8.9 Condition A, complete the RMAs for the Maintenance Rule fire actions, protect equipment using OP-AA-108-117, and perform shift briefs when in TS 3.8.7 Condition A. Considering that the design-success criteria will be met during TS RICT and RMAs will be implemented during TS RICT, the NRC staff finds that the plant will continue to have adequate DID while in TS 3.8.7 Condition A. Therefore, the proposed changes to TS 3.8.7 Condition A are acceptable.

3.1.2.2.4 TS 3.8.9 -Distribution Systems-Operating During plant operation, the LCO for TS 3.8.9 requires the AC, DC, and AC vital bus electrical power distribution subsystems to be operable.

TS 3.8.9 Condition A -One or more AC electrical power distribution subsystems inoperable The licensee proposed the option to use the RICT program to extend the existing 8-hour CT for restoring one or more AC power distribution subsystems to operable status (Required Action A.1) in TS 3.8.9 Condition A. The RICT estimate for TS 3.8.9 Condition A in Table E1-2 is 4 days. Per TS Basis 3.8.9, Condition A represents one or more required AC electrical power distribution subsystems inoperable with no loss of function.

According to Calvert Cliffs UFSAR Chapter 8, the safety-related AC distribution system, except the AC vital systems for each unit, includes a 4.16 kV ESF system and a 480 V ESF system. The 4.16 kV ESF system includes two redundant 4.16 kV buses, and the 480 V ESF system includes four redundant 480 V unit buses, two 480 V MCC buses, and load centers. The 480 V buses are powered from the 4.16 kV buses. Based on TS Table B 3.8.9-1 footnote 1, each bus of the AC electrical power distribution system is a subsystem.

Per TS 3.8.9, operable AC electrical power distribution subsystems require the associated buses, load centers, MCCs, and distribution panels to be energized to their proper voltages.

The NRC staff notes that since the 480 V buses are fed from the 4.16 kV buses, an inoperable 4.16 kV bus ( or subsystem) would render the associated 480 V buses/subsystems, 480 V MCCs, and load centers inoperable (i.e., not energized to proper voltages).

In this case, the 4.16 kV and 480 V buses/subsystems, MCCs, and load centers included in the AC distribution system of one train would be inoperable.

Therefore, the TS 3.8.9 Condition A worst case scenario would be one train of AC distribution system ( 4.16 kV and 480 V subsystems, including MCCs and load centers) inoperable.

As identified in Table E1-1, the design-success criterion for TS 3.8.9 Condition A, is one of two AC distribution systems. The NRC staff notes that one AC distribution system (consisting of the AC distribution subsystems) in the redundant train will provide one layer of defense to mitigate postulated DBAs since one AC distribution system is required to support the minimum safety functions to mitigate Calvert Cliffs' postulated DBAs; thus, the required success design criterion is met. During an RICT program entry for the TS 3.8.9 Condition A worst case scenario, the remaining AC distribution system (4.16 kV and 480 V subsystems) in the redundant train will be capable of providing power to safety-related equipment required during DBAs with or without offsite power. The NRC staff further reviewed the examples of RMAs associated with TS 3.8.9 Condition A. In the letter dated January 11, 2018, the licensee provided the following examples of RMAs associated with TS 3.8.9 Condition A.

• Protect remaining AC power distribution subsystems, per OP-CA-108-117, "Calvert Cliffs Site Specific Protected Equipment Guidance."

• Prohibit any elective maintenance on ALL safety-related AC distribution subsystems.

• Take the required actions per AOP for loss of AC distribution subsystem.

This would include the direction to cross tie buses as appropriate for risk-significant equipment.

• Pre-stage material for work activity and ensure parts availability for any contingent work. The staff notes that the Calvert Cliffs protected equipment program identifies equipment that should be protected to ensure that the minimum required equipment remains available to support plant operation.

The actions specified above would provide additional assurance for the availability of the remaining equipment.

The NRC staff finds that the examples of the RMAs associated with TS 3.8.9 Condition A are reasonable.

Based on the above discussion, the NRC staff finds that during the RICT program entry for TS 3.8.9 Condition A, the DID of the electrical power distribution systems that ensures AC power to the key safety-related equipment required to operate during DBAs with or without offsite power is reduced to a single layer of defense (minimum required AC electrical distribution system (including subsystems) in the redundant train). Although there is only a single layer of DID for the TS 3.8.9 Condition A worst case scenario, the NRC staff finds that with the risk management actions in place during the timeframe of 4 days in Table E1-2 described in the RICT program, this is reasonable and acceptable.

The NRC staff reviewed the licensee's proposed TS changes and supporting documentation.

Based on the evaluations above, the NRC staff finds that the design-success criterion is met. While redundancy is not maintained (a single layer of defense [one train of AC electrical distribution system (including subsystems)]

for DBAs without offsite power), the CT extensions in accordance with the RICT program are acceptable because (a) the capability of the systems to perform their safety functions (assuming no additional failures) is maintained, and (b) the licensee's demonstration of identifying and implementing compensatory measures or RMAs in accordance with the RICT program are appropriate to monitor and control risk. Therefore, the NRC staff finds that the plant will continue to have adequate DID while in TS 3.8.9 Condition A, and the proposed change to TS 3.8.9 Condition A is acceptable.

TS 3.8.9 Condition B-One or more AC vital bus subsystem{s) inoperable The licensee proposed the option to use the RICT program to extend the existing 2-hour CT to restore the AC vital bus subsystems to operable status (Required Action B.1) for TS 3.8.9 Condition B. The RICT estimate for TS 3.8.9 Condition Bin Table E1-2 is 12 days. Per TS 3.8.9, Condition B represents one or more required AC vital buses inoperable with no loss of function.

According to Calvert Cliffs UFSAR Chapter 8, the 120 V AC vital distribution system for each unit includes four independent 120 V AC panelboards/buses.

Per TS Table B 3.8.9-1 footnote 1, each bus of the 120 V AC vital electrical power distribution system is a subsystem.

Table E1-1 identified the design-success criterion for TS 3.8.9 Condition Bas two of four vital AC buses. The NRC staff notes that two AC vital buses subsystems will provide a single layer of defense to mitigate DBAs since two AC vital buses are required to support the minimum safety functions to mitigate Calvert Cliffs postulated DBAs. The NRC staff also notes that since two AC vital buses are required for Calvert Cliffs design success, the Condition B worst case scenario that would not result in a loss of function would be two inoperable AC vital buses (subsystems).

During an RICT program entry for the TS 3.8.9 Condition B worst case scenario (two AC vital bus subsystems inoperable), the remaining two AC vital buses subsystems will be capable of providing power to the RPS and the ESFAS during DBAs with or without offsite power; thus, the required design-success criterion is met. The NRC staff further reviewed the examples of RMAs associated with TS 3.8.9 Condition B. In the letter dated January 11, 2018, the licensee provided the following examples of RMAs associated with TS 3.8.9 Condition B.

• Protect remaining AC and DC vital bus subsystems, per OP-CA-108-117.

• Minimize activities on equipment powered by remaining AC vital bus

• Prohibit any elective maintenance on ALL vital AC and DC distribution subsystems.

• Take the required actions per AOP for loss of Vital AC distribution subsystem.

This would include the direction to cross tie buses as appropriate for significant equipment.

• Prohibit trip sensitive activities and activities that could result in a plant transient.

• Take any maintenance a4 fire risk RMAs.

• Pre-stage materials for work activity.

The NRC staff notes that the Calvert Cliffs protected equipment program identifies equipment that should be protected to ensure that the minimum required equipment remains available to support plant operation.

The actions specified above would provide additional assurance for the availability of the remaining equipment.

The NRC staff finds that the examples of the RMAs associated with TS 3.8.9 Condition Bare reasonable.

Based on the above discussion, the NRC staff finds that during the RICT program entry for TS 3.8.9 Condition B, the DID of the electrical power distribution systems that ensures AC power to the RPS and the ES FAS required to operate during DBAs with or without offsite power is reduced to a single layer of defense (minimum required two AC vital buses). Although there is only a single layer of DID for the TS 3.8.9 Condition B worst scenario, the NRC staff finds that with the RMAs in place during the timeframe of 12 days in Table E1-2 described in the RICT program, this is reasonable and acceptable.

The NRC staff reviewed the licensee's proposed TS changes and supporting documentation.

Based on the evaluations above, the NRC staff finds that the design-success criteria is met. While the redundancy is not maintained (a single layer of defense [two AC vital buses] for DBAs with or without offsite power), the CT extensions in accordance with the RICT program are acceptable because (a) the capability of the systems to perform their safety functions (assuming no additional failures) is maintained, and (b) the licensee's demonstration of identifying and implementing compensatory measures or RMAs in accordance with the RICT program are appropriate to monitor and control risk. Therefore, the NRC staff finds that the plant will continue to have adequate DID while in TS 3.8.9 Condition B, and the proposed change to TS 3.8.9 Condition B is acceptable.

TS 3.8.9 Condition C-One DC electrical power distribution subsystem inoperable The licensee proposed the option to use the RICT program to extend the existing 2-hour CT to restore the DC electrical power distribution subsystem to operable status (Required Action C.1) for TS 3.8.9 Condition C. The RICT estimate for TS 3.8.9 Condition C in Table E1-2 is 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />. Per Calvert Cliffs UFSAR Chapter 8, the safety-related 125 V DC distribution system includes four DC buses that are shared between the two units. Based on TS Table B 3.8.9-1 footnote 1, each bus of the DC electrical power distribution system is a subsystem.

The NRC staff notes that Calvert Cliffs would enter TS 3.8.9 Condition C for Units 1 and 2 since both units share the DC buses as stated in UFSAR Section 8.1.3. As identified in Table E1-1, the design-success criterion for TS 3.8.9 Condition C is three of four DC electrical power distribution subsystems.

The NRC staff notes that the remaining three DC electrical power distribution subsystems will provide one layer of defense to mitigate DBAs with or without power since three DC electrical power distribution subsystems are required to provide the minimum DC power to mitigate the Calvert Cliffs postulated DBAs. During an RICT program entry for TS 3.8.9 Condition C, the remaining three DC electrical power distribution subsystems will be capable of providing the DC power for equipment required during DBAs; thus, the required design-success criterion is met. The NRC staff further reviewed the examples of RMAs associated with TS 3.8.9 Condition C. In the letter dated January 11, 2018, the licensee provided the following examples of RMAs associated with TS 3.8.9 Condition C.

• Protect remaining AC and DC power distribution subsystems, per OP-CA-108-117.

• Prohibit any elective maintenance on ALL vital AC and DC distribution subsystems.

• Take the required actions per AOP for loss of Vital DC distribution subsystem.

This would include the direction to cross tie buses as appropriate for significant equipment.

• Prohibit trip sensitive activities and activities that could result in a plant transient.

• Take any maintenance a4 fire risk RMAs.

• Pre-stage materials for work activity.

The NRC staff notes that the Calvert Cliffs protected equipment program identifies equipment that should be protected to ensure that the minimum required equipment remains available to support plant operation.

The actions specified above would provide additional assurance for the availability of the remaining equipment.

The NRC staff finds that the examples of the RMAs associated with TS 3.8.9 Condition Care reasonable.

Based on the above discussion, the NRC staff finds that during the RICT program entry for TS 3.8.9 Condition C, the DID of the electrical power distribution systems that ensures DC power to key safety-related equipment required to operate during DBAs with or without offsite power is reduced to a single layer of defense (minimum required DC power distribution subsystem).

Although there is only a single layer of DID for the TS 3.8.9 Condition C worst case scenario, the NRC staff finds that with the risk management actions in place during the timeframe of 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> in Table E1-2 described in the RICT program, this is reasonable and acceptable.

The NRC staff reviewed the licensee's proposed TS changes and supporting documentation.

Based on the evaluations above, the NRC staff finds that the design-success criterion is met. While redundancy is not maintained (a single layer of defense [one DC power distribution subsystem]

for DBAs with or without offsite power), the CT extensions in accordance with the RICT program are acceptable because (a) the capability of the systems to perform their safety functions (assuming no additional failures) is maintained, and (b) the licensee's demonstration of identifying and implementing compensatory measures or RMAs in accordance with the RICT program are appropriate to monitor and control risk. Therefore, the NRC staff finds that the plant will continue to have adequate DID while in TS 3.8.9 Condition C, and the proposed change to TS 3.8.9 Condition C is acceptable. 3.1.2.3 Evaluation of Instrumentation and Control Systems The NRC staff examined the design information from the Calvert Cliffs UFSAR and the risk-informed LCO conditions for the affected l&C functions.

Based on this information, the NRC staff confirmed that under any given OBA evaluated in the Calvert Cliffs UFSAR, the affected l&C protective features maintain adequate DID by either necessary redundancy (e.g., at least one redundant channel) and/or necessary diversity (e.g., at least one alternative safety feature).

The licensee confirmed in the LAR that the proposed changes do not alter the Calvert Cliffs l&C system designs. Consequently, the NRC staff concludes that the proposed changes do not alter the ways in which the Calvert Cliffs l&C systems fail, do not introduce new CCF modes, and system independence is maintained.

The NRC staff finds that some proposed changes reduce the level of redundancy of the affected l&C systems, and this reduction may reduce the level of defense against some CCFs; however, the NRC staff finds, as described below, that such reduction in redundancy and defense against CCFs are acceptable due to the existence of adequate diversity.

LCO 3.3.1 -"Reactor Protection System (RPS) Instrumentation-Operating LCO 3.3.1 requires "Four RPS bistable trip units, associated measurement channels, and applicable automatic bypass removal features for each Function in Table 3.3.1-1 shall be OPERABLE."

• Condition A, "One or more Functions with one RPS bistable trip unit or associated measurement channel inoperable except for Condition C (excore channel not calibrated with incore detectors)." Under Condition A Action A.1 is required to "[p]lace affected bistable trip unit in bypass or trip" within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Action A.1 is followed by the risk-informed Action A.2.1 and Action A.2.2. Action A.2.1 is specified to "[r]estore affected bistable trip unit and associated measurement channel to OPERABLE status," and Action A.2.2 is specified to "[p]lace affected bistable trip unit in trip." Both CTs are risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR and Calvert Cliffs TS LCO 3.3.1, each function in Table 3.3.1-1 has four bistable units and four associated measurement channels, and has a 2 out of 4 coincidence logic. Under Condition A, and following the completion of Action A.1 (bypass action is conservatively assumed in this analysis}, the coincidence logic of the affected function becomes 2 out of 3. In this situation, the protective functions are still fulfilled with one additional channel in redundancy.

The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

• Condition B, "One or more Functions with two RPS bistable trip units or associated measurement channels inoperable except for Condition C (excore channel not calibrated with incore detectors)." Under Condition B, Action B.1 is required to "[p] lace one affected bistable trip unit in bypass and place the other affected bistable trip unit in trip" within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Action B.1 is followed by the risk-informed Action B.2. Action B.2 is specified to "[r]estore one affected bistable trip unit and associated measurement channel to OPERABLE status." The CT for this action is risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR and TS LCO 3.3.1, each function in Table 3.3.1-1 has four bistable units and four associated measurement channels, and has a 2 out of 4 coincidence logic. Under Condition B, and following the completion of Action B.1, to place one channel in bypass and another one in trip, the coincidence logic of the affected function becomes 1 out of 2. In this situation, the protective functions are still fulfilled with one additional channel in redundancy.

The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

• Condition D, "One or more Functions with one automatic bypass removal feature inoperable." Under Condition D, Action D.2.1 is required to "[p]lace affected bistable trip units in bypass or trip" within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Action D.2.1 is followed by the risk-informed Action D.2.2.1 and Action D.2.2.2. Action D.2.2.1 is specified to "[r]estore automatic bypass removal feature and affected bistable trip unit to OPERABLE status," and Action D.2.2.2 is specified to "[p]lace bistable trip unit in trip." Both CTs are risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR and TS LCO 3.3.1 each function in Table 3.3.1-1 has four operating bypass channels.

Under Condition D, and following the completion of Action D.2.1 (bypass action is conservatively assumed in this analysis), the coincidence logic of the affected automatic bypass removal function becomes 2 out of 3. In this condition, the protective functions are still fulfilled with one additional channel in redundancy.

The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

• Condition E, "One or more Functions with two automatic bypass removal feature channels inoperable." Under Condition E, Action E.2.1 is required to "[p]lace one affected bistable trip unit in bypass and place the other in trip for each affected trip Function" within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Action E.2.1 is followed by the risk-informed Action E.2.2. Action E.2.2 is specified to "[r]estore one affected bistable trip unit and associated measurement channel to OPERABLE status for each affected trip Function." Its CT is risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR and TS LCO 3.3.1 each function in Table 3.3.1-1 has four operating bypass channels.

Under Condition E, and following the completion of Action E.2.1, the coincidence logic of the affected automatic bypass removal function becomes 1 out of 2. In this condition, the protective functions are still fulfilled with one additional channel in redundancy.

The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

LCO 3.3.3 -"Reactor Protective System (RPS) Logic and Trip Initiation" LCO 3.3.3 requires that "[s]ix channels of RPS Matrix Logic, four channels of RPS Trip Path Logic, four channels of reactor trip circuit breakers (RTCBs), and four channels of Manual Trip shall be OPERABLE."

• Condition A, "One Matrix logic channel inoperable" Under Condition A, the CT of Action A.1 "[r]estore Matrix Logic channel to OPERABLE status" is risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." In accordance with Chapter 7 of the Calvert Cliffs UFSAR and TS LCO 3.3.3, the six channels of the RPS matrix logic implement a 2 out of 4 coincidence logic. Under Condition A, the matrix logic becomes 2 out of 3. In this case, the protective functions are still fulfilled with one additional channel in redundancy.

The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

LCO 3.3.4 -"Engineered Safety Features Actuation System (ESFAS) Instrumentation LCO 3.3.4 requires that "Four ESFAS sensor modules, associated measurement channels, and applicable automatic block removal features for each Function in Table 3.3.4-1 shall be OPERABLE."

• Condition A, "One or more Functions with one ESFAS sensor or associated measurement channel inoperable." Under Condition A, Action A.1 is required to "[p]lace affected sensor module in bypass or trip" within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Action A.1 is followed by the risk-informed Action A.2.1 and Action A.2.2. Action A.2.1 is specified to "[r]estore affected sensor module and associated measurement channel to OPERABLE status." Action A.2.2 is specified to "[p]lace affected sensor module in trip." Both CTs are risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR ahd TS LCO 3.3.4 each function in Table 3.3.4-1 has four ESFAS sensor modules, associated measurement channels, and applicable automatic block removal features.

The coincidence logic to actuate each safety function is 2 out of 4. Under Condition A, and following the completion of Action A.1 (bypass action is conservatively assumed in this analysis), the coincidence logic of the affected function becomes 2 out of 3. In this condition, the protective functions are still fulfilled with one additional channel in redundancy.

The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

• Condition B, "One or more Functions with two ESFAS sensor modules or associated measurement channels inoperable." Under Condition B, Action 8.1 is required to "[p]lace one sensor module in bypass and place the other sensor module in trip" within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Action 8.1 is followed by the risk-informed Action 8.2. Action B.2 is specified to "[r]estore one sensor module and associated measurement channel to OPERABLE status." Its CT is risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR and TS LCO 3.3.4 each function in Table 3.3.4-1 has four ESFAS sensor modules, associated measurement channels, and applicable automatic block removal features.

The coincidence logic to actuate each safety function is 2 out of 4. Under Condition B, and following the completion of Action 8.1, the coincidence logic of the affected function becomes 1 out of 2. In this condition, the protective functions are still fulfilled with one additional channel in redundancy.

The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

• Condition D, "One or more Functions with the automatic block removal feature of two sensor block modules inoperable." Under Condition D, Action D.2.1 is required to "[p]lace one affected sensor block module in bypass and disable the other for each affected ESFAS Function" within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Action D.2.1 is followed by the risk-informed Action D.2.2. Action D.2.2 is specified to "[r]estore one automatic block removal feature and the associated sensor block module to OPERABLE status for each affected ESFAS Function." Its CT is risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR and TS LCO 3.3.4 each function in Table 3.3.4-1 has four ESFAS sensor modules, associated measurement channels, and applicable automatic block removal features.

The coincidence logic to actuate the automatic block removal feature is 2 out of 4. Under Condition D, and following the completion of Action D.2.1, one sensor block module is bypassed and one is disabled, which forces the output of this module to "O." The coincidence logic of the automatic block removal feature becomes 1 out of 2. In this condition, the protective functions are still fulfilled with one additional channel in redundancy.

The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

LCO 3.3.5 -Engineered Safety Features Actuation System (ESFAS) Logic and Manual LCO 3.3.5 requires that "[t]wo ESFAS Manual Actuation or Start channels and two ESFAS Actuation Logic channels shall be OPERABLE for each ESFAS Function specified in Table 3.3.5-1."

• Condition A, "One Auxiliary Feedwater Actuation System Manual Start channel or Actuation Logic channel inoperable." Under Condition A, the CT of Action A.1 "[r]estore affected Auxiliary Feedwater Actuation System Manual Start channel and Actuation Logic channel to OPERABLE status" is risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR and TS LCO 3.3.5, the AFW actuation system specified in Table 3.3.5-1 has two manual actuation or start channels and two automatic actuation logic channels.

Any one of these channels can actuate the corresponding ESFAS safety function.

Under Condition A, either one manual start channel or (automatic) actuation logic channel inoperable leads the affected actuation to a 1 out of 1 logic. In this case, the affected actuation still fulfills its safety function.

The single failure criterion of the affected actuation is temporarily relaxed, but the other actuation is still available, and in 1 out of 2 logic. The protective functions are still fulfilled with diversity provided by the other actuation in redundancy.

The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

• Condition C, "One or more Functions with one Manual Actuation channel or Actuation Logic channel inoperable except Auxiliary Feedwater Actuation System." Under Condition C, the CT of Action C.1 "[r]estore affected Manual Actuation channel and Actuation Logic channel to OPERABLE status" is risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR and TS LCO 3.3.5 each function specified in Table 3.3.5-1 has two manual actuation or start channels and two automatic actuation logic channels.

Any one of these channels can actuate the corresponding ESFAS safety function.

Under Condition C, either one manual start channel or (automatic) actuation logic channel inoperable leads the affected actuation to a 1 out of 1 logic. The affected actuation still fulfills its safety function.

The single failure criterion of the affected actuation is temporarily relaxed, but the other actuation is operable and in 1 out of 2 logic. The protective functions are still fulfilled with a diverse actuation providing protection.

The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

LCO 3.3.6 -Diesel Generator (DG)-Loss of Voltage Start (LOVS) LCO 3.3.6 requires that "Four sensor modules and measurement channels per DG for the Loss of Voltage Function, four sensor modules and measurement channels per DG for the Transient Degraded Voltage Function, and four sensor modules and measurement channels per DG for the Steady State Degraded Voltage Function shall be OPERABLE."

• Condition A, "One or more Functions with one sensor module or associated measurement channel per DG inoperable." Under Condition A, Action A.1 is required to "[p]lace sensor module in bypass or trip" within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Action A.1 is followed by the risk-informed Action A.2.1 and Action A.2.2. Action A.2.1 is specified to "[r]estore sensor module and associated measurement channel to OPERABLE status." Action A.2.2 is specified to "[p]lace sensor module in trip." Both CTs are risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR and TS LCO 3.3.6 each LOVS Function (Loss of Voltage Function, Transient Degraded Voltage Function, Steady State Degraded Voltage Function) has four sensor modules and measurement channels per DG. The coincidence logic for each function to generate LOVS is 2 out of 4. Under Condition A, and following the completion of Action A.1 (bypass action is conservatively assumed in this analysis), the coincidence logic of the affected function becomes 2 out of 3. In this condition, the affected LOVS functions can fulfill the safety function with one additional redundant channel exists. The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

Additionally, the proposed changes do not alter the existing diversity of the l&C systems. The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

• Condition B, "One or more Functions with two sensor modules or associated measurement channels per DG inoperable." The option of calculating an RICT is applied to Action 8.2.2 to "Restore one sensor module and associated measurement channel to OPERABLE status." Under Condition B, Action 8.2.1 is required to "[p]lace one sensor module in bypass and the other sensor module in trip" within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Action 8.2.1 is followed by the risk-informed Action 8.2.2. Action 8.2.2 is specified to "[r]estore one sensor module and associated measurement channel to OPERABLE status." Its CT is risk-informed as "48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or in accordance with the Risk-Informed Completion Time Program." As specified in Chapter 7 of the Calvert Cliffs UFSAR and TS LCO 3.3.6 each LOVS function (Loss of Voltage Function, Transient Degraded Voltage Function, Steady State Degraded Voltage Function) has four sensor modules and measurement channels per DG. The coincidence logic for each function to generate LOVS is 2 out of 4. Under Condition B, and following the completion of Action B.2.1, the affected function becomes 1 out of 2. In this condition, the affected LOVS functions can fulfill the safety function with one redundant channel exists. The NRC staff concludes that the proposed RICT for inoperable instrumentation does not impede accomplishing their safety functions because the proposed RICT program requires, in part, that the redundant channels are operable.

Additionally, the proposed changes do not alter the existing diversity of l&C systems. The NRC staff finds these changes are consistent with the DID philosophy and are, therefore, acceptable.

3.1.2.4 Key Principle 2 Conclusions The LAR, as supplemented, proposes to modify the TS requirements to permit extending CTs for selected conditions that do not represent loss of TS-specified safety functions (e.g., inoperability of all required trains of a system) using the RICT program in accordance NEI 06-09, Revision 0-A (Reference 12). The NRC staff has reviewed the licensee's proposed TS changes and supporting documentation.

The NRC staff finds that extending the selected CTs in accordance with the RICT program following loss of redundancy but maintaining the capability of the system to perform its safety function is an acceptable reduction in DID, provided that the licensee identifies and implements RMAs in accordance with the RICT program during the extended CT. Quantitative risk analysis, qualitative considerations including compensatory measures, and retaining the current CT for loss of all trains of a required system, assure that DID is maintained to assure adequate protection of public health and safety. The NRC staff finds that the proposed changes are consistent with the DID philosophy because:

• System redundancy (with the exceptions discussed above), independence, and diversity commensurate with the expected frequency and consequences of. challenges to the system is preserved.

• Adequate capability of design features without an overreliance on programmatic activities as compensatory measures is preserved.

• The intent of the plant's design criteria continues to be met. The NRC staff determined that the proposed changes meet the intent of GDC 17 concerning the availability, capacity, and capability of the electrical power systems, since the proposed changes do not make any design basis changes. The NRC staff has determined that the proposed changes are consistent with 10 CFR 50.36(c)(2) because the lowest functional capability or performance level of equipment required for safety is maintained, and because operation of the plant will continue to have adequate DID and assure that safety margins are not affected adversely by implementation of the RICT program. The licensee did not propose any changes to quality standards, materials, operating specifications, acceptance criteria for equipment operability, or design basis analyses with regard to l&C systems. The use of the RICT program will not affect the licensee's commitments to codes and standards used in the l&C design of the plants. Although the licensee will be able to have equipment out of service under longer RICTs, the expected increase in unavailability will be addressed in that at least one redundant channel or diverse means exists to provide DID against a potential single failure during the RICT for the Calvert Cliffs l&C systems. Therefore, the NRC staff finds that the licensee's proposed RICT program for the identified l&C systems is in compliance with 10 CFR 50.36(c)(2) and 10 CFR 50.55a(h), and maintains compliance with GDC 22. Also, the NRC staff finds that the proposed RICT program is consistent with the DID philosophy.

3.1.3 Key Principle 3: Evaluation of Safety Margins Section 2.2.2 of RG 1.177, Revision 1 (Reference 14 ), states, in part, that sufficient safety margins are maintained when:

• Codes and standards

... or alternatives approved for use by the NRC are met...

• Safety analysis acceptance criteria in the final safety analysis report are met or proposed revisions provide sufficient margin to account for analysis and data uncertainties.

In the supplement dated April 3, 2017 (Reference 2), as further revised in response to RAI 7 (Reference 3), the licensee removed from the scope of the RICT program all the TS conditions involving a loss of function that were originally proposed in the LAR dated February 25, 2016 (Reference 1 ). Also, the licensee is not proposing in this application to change any quality standard, material, or operating specification.

Acceptance criteria for operability of equipment are not changed, and use of the RICT only when the system(s) retain(s) the capability to perform the applicable safety function(s) ensure that the current safety margins are retained.

Safety margins are also maintained if PRA functionality is determined for an inoperable train. The reduced but available functionality may support a further increase in the CT consistent with available safety margin. The specified safety function is still being met by the operable train and, therefore, existing safety margins are maintained.

3.1.3.1 Key Principle 3 Conclusions Although the licensee will have design-basis equipment out of service longer than the current TSs allow, and the likelihood of successful fulfillment of the function will be decreased when redundant train(s) are not available, the capability to fulfill the TS specified function will be retained by the remaining equipment functions, as designed.

Any increase in unavailability because less equipment is available for a longer time is included in the RICT evaluation.

The NRC staff finds that the proposed changes maintain sufficient safety margins because the licensee is proposing no changes to the design of the plant or any operating parameter, no new operating configurations, and no new changes to the design basis. Therefore, safety margins, as analyzed in the case of accident analysis provided in the UFSAR, would be maintained with minimal impact. Also, in this LAR, the licensee did not request any relief from codes and standards approved in the Calvert Cliffs UFSAR. Therefore, safety margins are not adversely affected by the implementation of the RICT program. 3.1.4 Key Principle 4: Change in Risk Consistent with the Safety Goal Policy Statement In the LAR, as revised in Attachment 2 to the letter dated June 21, 2018 (Reference 5), in new TS Section 5.5.18 entitled "Risk-Informed Completion Time Program," the licensee stated that the RICT "must be implemented in accordance with NEI 06-09, Revision 0-A" (Reference 12). The NRC staff evaluated whether the change in risk resulting from the proposed changes was small and consistent with the intent of the Commission's Safety Goal Policy Statement, as discussed below. The NRC staff also evaluated the licensee's proposed changes against the three-tiered approach in RG 1.177, Revision 1 (Reference 14 ). The results of the staff's review are discussed below. 3.1.4.1 Tier 1: PRA Capability and Insights The first tier evaluates the impact of the proposed changes on plant operational risk. The Tier 1 review involves two aspects: (1) the technical acceptability of the PRA models and their application to the proposed changes, and (2) a review of the PRA results and insights described in the licensee's application.

3.1.4.1.1 PRA Quality The objective of the PRA quality review is to determine whether the Calvert Cliffs PRA that was used to implement the RICT program is of sufficient scope, level of detail, and technical acceptability for this application.

The Calvert Cliffs PRA model is composed of an internal events PRA, including internal flooding and a fire PRA. The Calvert Cliffs PRA model has addressed the current PRA standard (Reference

16) and RG 1.200, Revision 2 (Reference 15), as noted below. The NRC staff evaluated the PRA quality information provided by the licensee in Enclosure 2 of the LAR, as supplemented (References 1, 2, 3, 4, 5, and 7). The NRC staff reviewed the peer review facts and observations (F&Os) for the internal events PRA and the fire PRA provided in LAR Enclosure 2, and in response to RAI 5, and also reviewed the licensee's self-assessment of the plant PRA models for internal events, including internal flooding and fires. External hazards information in LAR Enclosure 4 was also reviewed.

Other external hazard risk evaluations were also reviewed against the applicable requirements of RG 1.200, Revision 2 (Reference 15). Internal Events PRA Enclosure 2 of the LAR states that a full scope peer review was performed in June 2010 for the internal events PRA (including internal flooding) against the requirements of the PRA standard (Reference

16) and RG 1.200, Revision 2 (Reference 15). Further, in response to RAI 5 (Reference 3), the licensee stated that a focused-scope peer review was conducted in January 2017 against ASME/ANS RA-Sa-2009 using the process in NEI 05-04, Revision 3, "Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard," dated November 2009 (Reference 17), for a PRA upgrade related to changes in the internal flooding PRA, including changes to the pipe break rupture frequencies.

This upgrade concerned conversion of a portion of the internal flood model from a pipe segment-based approach to a newer pipe-length approach and frequencies using guidance from EPRI TR-1013141, Revision 1, "Pipe Rupture Frequencies for Internal Flooding PRAs," Electric Power Research Institute (Reference 23). The F&Os from the 2010 peer review were provided in LAR Enclosure

2. Additionally, one F&O that resulted from the 2017 focused-scope peer review was provided in response to RAI 5. The licensee dispositioned each F&O by assessing the impact of the F&O on the internal events PRA and on the results for the LAR. The NRC staff reviewed the licensee's resolution of all the peer review findings and the licensee's assessed impact of the findings on the RICT program. The NRC staff requested supplemental information regarding the resolution of one F&O, which is discussed below. In RAI 1, associated with F&O 4-21, NRC staff requested identification of the specific limitations in the LERF analysis for this application.

In response to RAI 1, the licensee stated that the LERF results have been reviewed, and modeling improvements were implemented to remove conservatism.

It further stated that the updated LERF analysis was reviewed and no specific LERF limitations that could impact the application were identified.

The NRC staff finds the licensee's resolution of F&O 4-21 acceptable because the licensee updated and reviewed the LERF analysis to ensure that there were no specific LERF limitations that could impact the application.

Based on the NRC staff's review, the staff finds that the internal events and internal flooding PRA has been adequately peer reviewed against the current version of the PRA standard and RG 1.200, and that the licensee has adequately dispositioned the F&Os to support the technical adequacy of the internal events PRA for the Calvert Cliffs RICT program. Fire PRA The licensee evaluated the technical adequacy of the Calvert Cliffs Fire PRA model by conducting a full-scope peer review in January 2012 using NEI 07-12, "Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, Draft Version H, Revision 0, dated November 2008 (Reference 18), and the fire PRA (Part 4) of the PRA standard, as clarified by RG 1.200, Revision 2. LAR Enclosure 2 provides the licensee's dispositions of F&Os. The licensee dispositioned each F&O by assessing the impact of the F&O on the fire PRA and the application.

An earlier NRC staff review of the technical adequacy of the fire PRA was performed during its review of the licensee's National Fire Protection Association (NFPA) 805 LAR. The NRC staff considered the resolution of fire PRA issues as documented during the earlier review of the fire PRA for the NFPA-805 LAR during the review of this RICT program LAR. As a result of its review of the NFPA 805 LAR dated September 24, 2013 (Reference 25), as supplemented, the NRC staff concluded in issuance of amendments dated August 30, 2016 (Reference 24), that (1) the fire PRA model adequately represents the current, as-built, as-operated configuration, and is, therefore, capable of modeling the plant as needed; (2) the fire PRA model conforms sufficiently to the applicable industry PRA standards at an appropriate capability category, considering the acceptable disposition of the peer review and NRC staff review findings; and (3) the fire modeling used to support the development of the FPRA has been confirmed as appropriate and acceptable.

The NRC staff evaluated the supplemental information about F&O responses provided in the RICT program LAR. Based on this review, the NRC staff identified no information that would invalidate the staffs NFPA-805 conclusion that the fire PRA is technically acceptable to support risk calculations.

Therefore, the NRC staff concludes that the fire PRA is technically acceptable to support the RICT program, including the RICT calculations. Other External Hazards PRA Calvert Cliffs addressed other external hazards in Enclosure 4 of the LAR, "Information Supporting Justification of Bounding Analyses or Excluding Sources of Risk Not Addressed by the PRA Model." An updated Enclosure 4 was provided by the licensee in the supplement dated April 3, 2017 (Reference 2). This enclosure provided justification for exclusion of certain hazards from the risk assessment based on their insignificance to the calculation of configuration risk, and it provided values, based on conservative or bounding analyses, to be applied to the configuration risk calculation to consider the risk associated with other hazards. External hazards that were considered are identified in LAR Table E4.1, consistent with Section 6 of NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," Volume 1, dated March 2009 (Reference 19), as follows:

• Seismic Events;

• Accidental Aircraft Impacts;

• External Flooding;

• Extreme Winds and Tornados (including generated missiles);

• Turbine-Generated Missiles;

• External Fires;

• Accidents From Nearby Facilities;

• Release of Chemicals Stored at the Site;

• Transportation Accidents;

• Pipeline Accidents (e.g., natural gas). The licensee stated that the hazard screening analysis from the Calvert Cliffs Individual Plant Examination of External Events (IPEEE) has been updated to reflect current Calvert Cliffs site conditions.

All external hazards were screened or shown in the LAR not to be a significant consideration for the RICT calculation, except for seismic events and extreme winds and tornadoes, which will be included in the RICT evaluations.

In response to RAI 3 (Reference 3), and RAI 20 (Reference 5), the licensee provided additional information about the seismic evaluations and provided updated bounding quantitative estimates of the seismic risk. Bounding quantitative estimates of extreme winds and tornado risk are provided in the LAR and further justified in response to RAI 2 (Reference 3). External flooding risk estimates are not proposed to be used in the RICT evaluations and were not provided.

Seismic The licensee explained in the LAR that RICT calculations will include a risk contribution from seismic events. The licensee's approach for including the seismic risk contribution in the RICT calculation is to add a constant seismic CDF and LERF to each calculation.

To estimate an RICT, the licensee proposed in the LAR, and further revised in response to the NRC staffs letter dated May 22, 2018 (Reference 10), regarding RAI 20, to use a baseline seismic CDF contribution of 3.7E-6/year and a seismic LERF contribution of 3.7E-7/year to the configuration-specific delta CDF and delta LERF from the internal events, including internal flooding and internal fire initiating events. In Enclosure 4 of the LAR, the licensee proposed baseline seismic CDF and LERF values of 1.1 E-6/year and 1.1 E-7/year, respectively, for use in the RICT calculations.

The licensee explained that this baseline seismic CDF estimate was based on the most current Calvert Cliffs seismic hazard information performed in 2013 in response to Near-Term Task Force (NTTF) 2.1 (Reference 26 and Reference

27) and an estimated plant level high confidence of low probability of failure (HCLPF) of 0.27 g peak ground acceleration (PGA), as used in the 2003 LAR, "Extension of Diesel Generator Required Action Completion Time" (Reference 28). The NRC staff noted that the Calvert Cliffs Expedited Seismic Evaluation Process (ESEP) report, submitted to the NRC on December 17, 2014 (Reference 27), indicated that certain components, such as safety injection tanks, MCCs, electrical buses, and main control room panels, would fail in a seismic event through interaction with nearby block walls or through anchorage failure. Those components were assigned lower HCLPF values of 0.175 g and 0.21 g due to the block wall or anchorage lower capacity in the Calvert Cliffs ESEP report. Since the lower HCLPF value could increase the seismic baseline CDF and LERF estimates provided in the LAR in RAI 20.a (Reference 5), the NRC staff requested the licensee to justify the assumed plant level HCLPF of 0.27 g PGA, or to provide updated seismic CDF and LERF estimates.

In response to RAI 20.a, the licensee explained that there were 26 components identified from the Calvert Cliffs ESEP report with an estimated HCLPF of less than 0.27 g, and that some of the identified components were not modeled in the licensee's available PRA models. Because a detailed analysis of seismic capacities of relevant plant SSCs was not available, the licensee proposed to use the lower HCLPF value of 0.175 g for the RICT program and updated the seismic CDF and LERF estimates to 3.7E-6/year and 3.7E-7/year, respectively.

Further, in response to RAI 20.b, the licensee explained that although there are some differences in design between Units 1 and 2, mainly regarding availability of the EDGs (air cooled versus service water cooled), the plant HCLPF value and, therefore, the resulting CDF and LERF estimates, apply to both Units 1 and 2. The NRC staff notes that the HCLPF value proposed by the licensee in response to RAI 20.a was used for both units in the Calvert Cliffs ESEP report. To estimate the seismic LERF, the licensee assumed a 0.1 conditional large early release probability (CLERP) for seismic events. The CLERP value was derived from the average of the ratio of LERF to CDF from the non-flooding PRA internal initiating events other than direct containment bypass. The NRC staff notes, however, that a seismic event could lead to seismic-specific failures of SSCs, resulting in additional LERF sequences that are not in the internal events PRA model, or potentially converting non-LERF sequences in the internal events PRA to seismic LERF sequences.

Therefore, in RAI 20.c, the NRC staff requested the licensee to justify the assumed 0.1 CLERP value or provide and justify an updated CLERP value. In response to RAI 20.c, the licensee explained that the IPEEE evaluation identified a limiting HCLPF value of 0. 70 g for the seismically-induced failure of the containment.

The licensee also explained that all containment penetrations and containment isolation valves whose failure could lead to a large release were screened during the IPEEE evaluation at a HCLPF value of 0.5 g based on walkdowns.

The technical evaluation report for the licensee's IPEEE seismic evaluation (Reference

33) stated that, "The failures of the containment penetrations and the isolation valves were screened at 0.5g HCLPF and bound all other failures." The licensee provided details of containment isolation valves and reviewed the interfacing systems coolant accident (ISLOCA) to evaluate seismically-induced containment isolation failures.

The NRC staff finds that due to the high HCLPF values for the containment, its penetrations, and isolation valves, the seismic failure of containment isolation can be considered to be independent of seismically-induced failures leading to core damage. Further, because the cited containment HCLPF values are higher than the proposed HCLPF value to be used for the RICT, and, if used, would reduce the licensee's LERF estimate, the NRC staff finds the licensee's justification for the assumed 0.1 CLERP acceptable for the application. The licensee acknowledged in the LAR that due to its approach of adding the baseline seismic CDF and LERF, "The conditional core damage frequency given a seismic event will remain unaltered whether equipment is out-of-service or not." In RAI 3, the NRC staff requested clarification of how adding the baseline seismic risk in the RICT calculations accounts for the configuration-specific seismic risk increase.

In response to RAI 3, the licensee stated that the approach is conservative and bounding.

The licensee explained that the increase in CDF associated with SSCs within the LCO is calculated based on the limiting plant HCLPF and, therefore, is conservative.

For those SSCs not within the LCO, the full correlation among similar SSCs assumed in seismic PRAs (i.e., if one SSC fails all similar SSCs will also fail) would not contribute to the delta CDF greater than the baseline seismic risk. The NRC staff finds that during RICTs for SSCs credited in the design basis to mitigate seismic events, the licensee's proposed methodology captures the risk associated with seismically-induced failures of redundant SSCs because such SSCs are assumed to be fully correlated.

By assuming the full correlation, the seismic risk for those RICTs will not increase if one of the redundant SSCs is unavailable because simultaneous failure of all redundant trains would be assumed in a seismic PRA. During RICTs for SSCs not credited in the design-basis seismic event, but which could be used when credited SSCs fail, the proposed methodology for considering seismic risk contributions may be nonconservative because the seismically-induced failure of such SSCs during the RICT may not be included in the risk increase.

However, the occurrence and degree of nonconservatism depends on the plant HCLPF value used for the RICT calculations, as compared to the HCLPF values for such SSCs. The degree of nonconservatism will be low or nonexistent if the plant HCLPF value is lower than most or all SSCs impacted by a seismic event. During RICTs for SSCs that are not used to mitigate a seismic event, the proposed methodology for considering seismic risk contributions is conservative because the seismically-induced failure of such SSCs would not result in a risk increase associated with the plant configuration during the RICT, but the baseline seismic risk is still included in the calculation.

The NRC staff finds the licensee's proposal to use the baseline seismic CDF and LERF contributions of 3. ?E-6/year and 3. ?E-7 /year, respectively, to the configuration-specific delta CDF and delta LERF from the internal events, including internal flooding and internal fire initiating events, acceptable for the licensee's RICT program because (1) the licensee used the most current plant-specific seismic hazard information; (2) the licensee used an acceptably low plant HCLPF value of 0.175 g based on the most recent insights from the ESEP report; and (3) adding baseline seismic risk to RICT calculations, which assumes the fully correlated failures, is conservative for SSCs credited in seismic events, while any potential nonconservative results for SSCs that are not credited in seismic events is small or nonexistent, as discussed above. High Winds and Tornado Hazards The licensee proposed to include in the RICT calculations a risk contribution from tornado-generated missile events, and screened out hurricanes and straight winds from consideration in the RICT program. The licensee stated that plant procedures direct a plant shutdown when a hurricane is expected to arrive within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and, therefore, screened out the hurricane hazard. With regard to high straight winds, the licensee stated that the primary concern is LOOP caused by the winds. The licensee explained that there is industry experience with winds that cause siding (such as from a turbine building) to become missiles during high wind events, but these lightweight missiles generally do not damage safety-related SSCs or other engineered structures (e.g., tanks). The NRC staff finds the licensee's explanation for screening of hurricane and straight wind hazards acceptable for the RICT program because (1) procedures direct a plant shutdown before a hurricane arrives, and (2) the internal events PRA already includes LOOP events due to high straight winds. The licensee proposed to include in the RICT calculations a risk contribution from tornado-generated missile events of 5E-06/year for CDF and 5E-07/year for LERF. The licensee provided the results of a bounding estimate for change in risk due to tornadoes.

The licensee stated that it used the methodology for tornado missile protection previously approved for Calvert Cliffs in 1995 (Reference

28) to develop conditional missile strike probabilities.

Tornado missile risk was evaluated individually for each LCO condition in the scope of the RICT program using the zero maintenance model, assuming the equipment associated with the TSs is unavailable, and assumed equipment failures due to tornados.

In response to RAI 2.b, the licensee explained how tornado missile risk was calculated.

The licensee explained that failure probabilities for exposed SSCs were binned into three categories in the PRA: (1) a failure probability of 1.0 was assumed for the DC DG and the switchgear heating, ventilation, and air conditioning, given a tornado event; (2) most failure probabilities were set equal to the missile strike probability (regardless of target robustness);

and (3) for the main steam safety valves (MSSV) and ADV, the assumption is made that a missile strike to any part of the array of 16 MSSV and 2 ADV vent stacks has a 1 in 10 chance of crimping enough stacks to fail the steam generator decay heat removal function.

For the last item, the licensee further explained that this assumption of the MSSV and ADV vent stack failure is conservative, because there are more valves than the number required for decay heat removal, and because the exhaust pipe spacing, size, and elevation reduce the likelihood that large energetic missiles strike the targets. The licensee stated that the most limiting CDF and LERF increases from these evaluations was 5E-06/year and 5E-07/year respectively.

These values were selected as bounding values to be applied to all TS RICT evaluations, with the exception of five LCOs listed in the letter dated April 3, 2017 (Reference 2). In response to RAI 2.a, the licensee further explained that because this approach is not refined to assess specific missile distributions, target hits, and damage probabilities, the calculated risk will be applied as a "penalty factor (i.e., the site-specific PRA will not be used to directly to calculate the tornado risk for each specific plant configuration).

Further, in response to RAI 2.b, the licensee provided a justification for concluding that the proposed CDF and LERF penalties of 5E-06/year and 5E-07/year, respectively, are conservative.

The licensee estimated a mean frequency of a tornado striking Calvert Cliffs with wind speeds that could cause damage to the plant (100 miles per hour (mph) to 167 mph) as 6E-5/year using data from Table 6-1 of NUREG-4461, Revision 2 (Reference 29). The licensee explained that a wind speed of at least 100 mph would generate tornado missiles that could damage components such as EDG exhaust stacks, AFW steam exhaust stacks, MSSV exhaust stacks, and tanks. The licensee explained that the 100 mph wind speed estimate is a low estimate for failures of many such SSCs because most targets are elevated, and missiles that could damage those targets (e.g., utility poles) are unlikely to be elevated or travel at a sufficient speed to damage such equipment.

The licensee further explained that most damaging tornadoes, Enhanced Fujita Scale 4 and 5, are relatively rare in the vicinity of Calvert Cliffs. The licensee estimated the frequency of winds over 167 mph as 1 E-6/year.

Given the licensee's estimated frequency of tornado causing damage to the plant of 6E-5/year, the NRC staff finds that the licensee's proposed tornado CDF/LERF penalty factors of 5E-06/year and 5E-07/year, respectively, are acceptable for the RICT program and will be applied to all TS RICT evaluations, with the exception of four LCOs, as discussed below. The licensee stated in the letter dated April 3, 2017 (Reference 2), that the bounding tornado missile CDF and LERF are not applied to the RICT evaluation for five LCOs because the penalty factors would be negligible contributors to the relatively high risk increase caused by entering these LCOs. The LAR states that "additional analyses or restrictions will be required during RICT implementation, in the unlikely event an RICT evaluation is performed for any of those LCOs." In RAI 2.c, the NRC staff requested an explanation of what additional analyses would be performed or what restrictions will be applied for the five excluded LCOs. In response to RAI 2.c (January 11, 2018), the licensee stated that one of these five LCOs was subsequently withdrawn from the proposed program. For the four remaining LCOs, the licensee proposed to apply an increased penalty factor of 5E-05/year CDF and 5E-6/year LERF for the RICT calculation for these LCOs. The increased penalty factor values will ensure that tornado risk contributes to the LCO risk increase used to calculate the RICT. The NRC staff did not review the method discussed in Enclosure 4 of the LAR for calculating missile strike probabilities and did not evaluate its general applicability of estimating the risk due to tornadoes.

The NRC staff recognizes that this method was previously reviewed by the NRC for use at the Calvert Cliffs site to address nonconforming conditions.

Without relying on the licensee's methodology for calculating missile strike probabilities, the NRC staff concluded, as explained above, that the proposed penalty factors reasonably incorporate the risk associated with tornado generated missiles into the RICT program. Therefore, the NRC staff finds that the licensee's proposed method (i.e., applying the proposed penalty factors) for estimating tornado CDF and LERF increases is acceptable for use in the RICT program at Calvert Cliffs because the licensee systematically analyzed the increase in risk from tornado missiles for all LCO conditions and because the selected penalty factors include a reasonable tornado missile risk in all TS LCOs in the scope of the RICT program. External Flooding The licensee screened out external flooding hazards from the RICT program. The licensee stated that based on the reevaluated external flooding hazard performed in response to the post-Fukushima Flood Hazard Reevaluation Request (Reference 30), two external flood hazards were found to affect the plant: local intense precipitation (LIP) and probable maximum storm surge. The licensee screened out LIP based on the frequency of an LIP event that challenges the plant being below 1 E-6/yr. The licensee stated that a hurricane is the source of the probable maximum storm surge. The licensee screened out storm surge from the RICT program because plant procedures direct the plant to be shut down within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of the arrival of a hurricane, which would result in exiting the RICT. Storm surge that is not caused by a hurricane would be bounded by the probable maximum storm surge. The NRC staff, therefore, finds the licensee's screening out of external flooding hazards is acceptable for the RICT program. External Events Conclusion The NRC staff concludes that the licensee's approach for including external events risk in the RICT calculations is acceptable because the LAR used updated external events hazards analysis from the Calvert Cliffs IPEEE in the screening analysis to meet the current industry screening criteria; it follows the NEI 06-09, Revision 0-A, guidance for application of bounding analysis; and it includes external event risk if design basis evaluations cannot be used to screen out external hazard risks from the RICT calculations. Shutdown Risk Shutdown risk assessment is not applicable to this LAR since the LAR only applies to Modes 1 and 2. PRA Quality Conclusions Based on the NRC staffs review of the licensee's submittal and assessments, the NRC staff concludes that the Calvert Cliffs PRA models for internal events (including internal flooding) and fire events used to implement the RICT program satisfy the guidance of RG 1.200. The NRC staff based this conclusion on the findings that the PRA models conform sufficiently to the applicable industry PRA standards for internal events (including internal flooding) and fires at an appropriate capability category, considering the licensee's acceptable disposition of the peer review and NRC staff review findings.

The NRC staff finds the licensee's PRA acceptable to support the RICT program because the licensee has (1) reviewed the PRA using endorsed guidance and adequately resolved all identified issues, and (2) established a periodic update and review process to update the PRA and associated CRMP model to incorporate changes made to the plant and PRA methods and data consistent with the RICT program, as discussed in Section 3.1.4.1.6 of this SE. 3.1.4.1.2 Scope of the PRA NEI 06-09, Revision 0-A, requires a quantitative assessment of the potential impact on risk due to impacts from internal and external events, including internal fires, floods, and other significant external events. As discussed in Section 3.1.4.1.1 of this SE, the Calvert Cliffs PRA used for the RICT program includes contributions from internal events (including internal flooding) and internal fire events. As discussed in the LAR and its supplements, seismic events, high winds and tornadoes are each evaluated through bounding quantitative risk estimates that will be added to each RICT calculation.

All other external hazards have been evaluated as described in the LAR and determined to be inapplicable or to have negligible frequency at the Calvert Cliffs site. Because the RICT program is not applicable in Modes 3, 4, 5, and 6, risk evaluations for these modes are not relevant to the proposed change. Based on the above, the NRC staff finds that the licensee has satisfied the intent of RG 1.177 (Section 2.3.2) (Reference

14) and RG 1.174 (Section 2.2.3) (Reference 13), and that the scope of the PRA model is appropriate for this application.

3.1.4.1.3 PRA Modeling To evaluate an RICT for a given required action, the specific systems or components involved should be modeled in the PRA. For each TS LCO to which the RICT program is proposed to apply, for any of its required actions, the licensee stated that: (1) the system is included in the PRA models, or is addressed either in the LAR or in response to an RAI; (2) the success criteria used in the PRA models are consistent with the Calvert Cliffs licensing basis, or acceptable plant-specific analyses that were used to support the PRA are justified, consistent with the RG 1.200 PRA review process; (3) CCFs and surrogate identification are appropriately addressed; (4) the CRMP provides the capability to select the system and system trains as out of service in order to calculate an RICT; and (5) the CRMP is maintained consistent with the baseline PRA model, with modifications to the CRMP model to reflect the current plant configuration.

In RAI 4, the NRC staff observed constraints associated with LCO 3.8.1.G requiring electric power supply to the CREVS and the CRETS. The NRC staff requested an explanation of how the CREVS and CRETS are modeled in the PRA and how the inoperability of the power supplies to the CREVS and CRETS impact the risk estimates.

In response to RAI 4, the licensee explained that equipment that is shared and used by CRETS and CREVS to recirculate air in the main control main control 'room is modeled in the PRA, along with a related non-safety chiller system and associated power supplies.

The CREVS-only components associated with post-accident air filtering are not included in the PRA. The licensee explained that loss of power is modeled to fail the heating, ventilation, and air conditioning function, which, in turn, impacts the failure rate of 120 V AC and 125 V DC instruments in the main control room and cable spreading room. The NRC staff concludes that the CREVS and CRETS are sufficiently modeled to include failures of individual instrument channels and support RICT calculations associated with LCO 3.8.1. In RAI 8, the NRC staff requested a description of how the conditions associated with TS 3.3, "Instrumentation," are modeled in the PRA and an explanation of how the models are adjusted to reflect the impact of an inoperable instrumentation channel. In response to RAI 8, the licensee explained that detailed modeling exists in the PRA to represent the functions associated with each instrument-related LCO in the RICT program and each channel associated with those functions.

The licensee explained that PRA modeling of the RPS to support modeling of LCO 3.3.1, RPS Instrumentation

-Operating," and LCO 3.3.3, "Reactor Protective System (RPS) Logic and Trip Initiation," includes individual RPS instrument channels, associated bi-stable trips, relay logic, and circuit breakers.

The response explained that PRA modeling for the eight ESFAS functions to support LCO 3.3.4 (ESFAS Instrumentation), LCO 3.3.5 (ESFAS Logic and Manual Actuation), and LCO 3.3.6 (Diesel Generator Loss of Voltage Start) includes individual channels, sensor modules, relays, and power supplies.

The NRC staff concludes that the licensee's modeling of instrumentation systems includes an acceptable level of detail to support RICT evaluations for LCO 3.3 conditions.

In RAI 14, the NRC staff requested, regarding TS 3.6.6, "Containment Spray and Cooling Systems," Conditions A and B, a description of how the containment spray system (CSS) and containment cooling systems are modeled in the PRA and how an RICT based on CDF and LERF is determined.

In response to RAI 14 (Reference 3), the licensee stated that both systems are explicitly modeled in the PRA and that the PRA modeling "includes system components, such as pumps, valves and heat exchangers, and system dependencies, such as electrical and cooling water systems." Further, the licensee stated that the modeled systems are adequate to support RICT calculations associated with LCOs 3.6.6.A and 3.6.6.B. The licensee further explained that the PRA success criteria are one of the two headers for CSS, and two out of four containment air coolers (CAC) for the containment air recirculation and cooling system. The licensee stated that these systems "can be numerally quantified for impact on CDF and LERF"; however, the licensee did not explain how these systems impact CDF and LERF. Therefore, in RAI 23 (Reference 5), the NRC staff requested the licensee to explain and justify how these systems impact CDF and LERF. In response to RAI 23, the licensee explained that the containment temperature and pressure control are required to prevent core damage when the reactor coolant system boundary is breached, or when once-through cooling is required.

Temperature and pressure control are achieved by the CSS or CAC, and these functions are required for ultimate heat rejection outside the containment.

The licensee further explained that because the inoperability of CSS or CAC impacts flCDF, LERF is also impacted directly because those core damage sequences lead directly to containment failure sequences.

Because the licensee explained that CDF and LERF are impacted by LCOs 3.6.6.A and 3.6.6.B and that CSS and CAC are modeled in the licensee's PRA, the NRC staff concludes that an RICT can be applied to LCOs 3.6.6.A and 3.6.6.B. In RAI 10, the NRC staff requested additional information regarding the treatment of CCF for planned maintenance.

The NRC staff notes that according to RG 1.177, Appendix A, Section A-1.3.1.1, "If the component is down because it is brought down for maintenance, the CCF contributions involving the component should be modified to remove the component and to only include failures of the remaining components." According to RG 1.177, if a component from a CCF group of three or more components is declared inoperable, the CCF of the remaining components should be modified to reflect the reduced number of available components in order to properly model the as-operated plant. Accordingly, the NRC staff requested an explanation of how the CCF contribution is addressed in the PRA models and how the models are adjusted when a component from a CCF group of three or more components is removed for preventative maintenance.

In response to RAI 10 (Reference 3), and followup RAI 21 (Reference 5), the licensee explained that for a CCF group of three components, there would be one CCF basic event for each two out of three SSC failure combination and a CCF basic event for the failure of three out of three SSCs. The licensee explained that it does not adjust the contribution of CCFs for planned maintenance, but this is not necessary, because all two out of three and the three out of three CCF basic events are retained in the model. The licensee stated that this approach is conservative; however, the NRC staff notes that this approach could be slightly nonconservative in some situations because the two out of two CCF tends to be greater than the three out of three CCFs. The NRC staff notes that the licensee's method is a straightforward simplifying calculation that has both conservative and nonconservative impacts. The NRC staff also notes that CCF probability estimates include a high degree of uncertainty, and retaining precision in calculations using these probabilities will not necessarily improve the accuracy of the results. Therefore, the NRC staff concludes that the licensee's method is acceptable because it does not systematically and purposefully produce nonconservative results and because the calculations reasonably include CCFs consistent with the accuracy of the estimates.

In RAI 11, the NRC staff requested additional information regarding the treatment of CCF for emergent failures.

The NRC staff noted that according to Section A-1.3.2.1 of Appendix A of RG 1.177, when a component fails, the CCF probability for the remaining redundant components should be increased to represent the conditional failure probability due to CCF of these components, in order to account for the possibility that the first failure was caused by a CCF mechanism.

In response to RAI 11 (Reference

3) and followup RAI 22 (Reference 5), the licensee explained that in an emergent condition, if the extent of condition for the inoperable SSC is not complete, then the RICT program will account for the increased possibility of CCF with a new administrative TS requirement.

The added requirement gives two options: . (1) account for the increased CCF in the RICT calculation, or (2) implement RMAs not already credited in the RICT calculation that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of the initiating events that challenge the function(s) performed by the inoperable SSCs. In response to RAI 22, the licensee clarified that the first option, to numerically account for the increased possibility of CCF, will be performed in accordance with RG 1.177, Section A-1.3.2.1, of Appendix A. Specifically when a component fails, the CCF probability for the remaining redundant components will be increased to represent the conditional failure probability due to CCF of these components in order to account for the possibility that the first failure was caused by a common cause mechanism.

The NRC staff finds that the first option is acceptable because it quantitatively incorporates the potential CCF into the RICT estimates, consistent with guidance on including CCFs in RG 1.177. The NRC staff finds the second option is acceptable because identifying the redundant and/or diverse SSCs and developing RMAs targeting the function(s) provides adequate additional confidence that the function(s) will be available while investigation into the potential for CCF is conducted.

The Calvert Cliffs PRA model serves as the model used by the CRMP tool, which is used to perform the RICT calculations.

The CRMP tool models a zero-maintenance baseline PRA and the actual plant configuration.

In order to translate the baseline Calvert Cliffs PRA model for use in the CRMP model, adjustments must be made to the baseline PRA model. These adjustments are described in the LAR Enclosure

8. The CRMP tool used to perform the RICT calculations provides a user interface, which supports the RICT program by providing a method to evaluate the plant configuration.

Further discussion of the CRMP tool is provided in Section 3.1.4.3 of this SE. The Calvert Cliffs quality assurance practices of the PRA model and the CRMP model are discussed in Section 3.1.4.1. 7 of this SE. In RAI 6, the NRC staff requested a summary description of the process for converting the baseline PRA to the CRMP model. In response to RAI 6, the licensee explained that, consistent with the Maintenance Rule (a)(4) model, the test and maintenance basic events are changed from their nominal values to zero. The licensee explained that the internal events and internal flood PRA models are integrated into a single fault tree PRA model and that the fire PRA is a separate model. The licensee further explained that the base fault tree is restructured to improve performance speed, but that these changes are reviewed and quantified to assure model fidelity is maintained.

The results from the fire PRA and internal events PRA, which are quantified separately, are combined with the fixed CDF/LERF contributions from the seismic and high winds hazards as part of performing the RICT calculations.

The licensee also explained that, where applicable, surrogate events, which are identified in Enclosure 1 of the LAR are set to "true" or "false" to reflect the availability of the components that they represent, such as containment airlocks, which are not modeled in the PRA. The NRC staff reviewed the information provided by the licensee and concluded that the PRA modeling used to support the RICT program is able to treat alignments of components during periods for which the RICT will be calculated.

Based on its review, the NRC staff finds that the licensee satisfied the intent of Section 2.3.3 of RG 1.177, Revision 1 (Reference 14 ), and Section 2.2.3 of RG 1.17 4, Revision 3 (Reference 13), and that the PRA modeling is appropriate for application of the RICT program. 3.1.4.1.4 Key Assumptions and Sources of Uncertainty Risk-informed analyses of TS changes can be affected by uncertainties regarding the assumptions made during the PRA model's development and application.

Typically, the risk resulting from TS CT changes is relatively insensitive to most uncertainties because the uncertainties tend to affect similarly both the base case and the changed case. The licensee considered PRA modeling uncertainties and their potential impact on the RICT program and identified, as necessary, the applicable RMAs to limit the impact of these uncertainties.

In Enclosure 9 of the LAR, the licensee discussed the sources of key assumptions and sources of uncertainty.

In Enclosure 9 to its letter dated February 25, 2016, the licensee explained that Calvert Cliffs followed NUREG-1855 guidance (Reference 19), which RG 1.17 4 cites for treatment of uncertainties associated with PRA and industry guidance and EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, "Electric Power Research Institute, Final Report, dated December 2008 (Reference 20). The licensee's analysis reviewed its PRA uncertainties and determined if additional RMAs are necessary to address the sources of uncertainty.

Epistemic uncertainties were provided for the internal events and the fire PRA models. In addition, uncertainties associated with translation of the baseline PRA models to the CRMP model used for the RICT calculation were provided.

The licensee's assessments of the internal events PRA epistemic uncertainty were discussed in LAR Enclosure 9 and consisted of two key uncertainties.

The licensee identified uncertainties associated with the assumptions and method of calculating human error probabilities using industry consensus HRA methods. The licensee performed sensitivity studies on human error probabilities for the baseline internal events PRA and concluded that HRA modeling represented a significant source of uncertainty.

Therefore, the licensee will require RMAs, in accordance with the RICT program, on operator performance, including briefings on significant operator actions credited in the PRA. The licensee also identified that the calculation of some pipe break frequencies for the internal flooding PRA was based on an older method than was used for other break frequencies in the internal flooding PRA and represented a source of uncertainty.

In response to RAI 5, the licensee confirmed that the updated pipe frequencies have been included in the internal flooding PRA model used for RICT calculations.

LAR Enclosure 12, Section 3, states that areas of uncertainty associated with the internal events and fire PRA will be considered when defining configuration-specific RMAs, in accordance with the RICT program. LAR Enclosure 9, Table E9-A, identifies two fire event modeling uncertainty issues for which the licensee indicated that RMAs will be considered, configurations for which automatic fire suppression in the cable spreading room or switchgear room are important, and configurations in which transient combustibles and hot work are important.

In RAI 9, the NRC staff requested a description of the Calvert Cliffs process for developing configuration-specific RMAs associated with RICTs and an explanation of how that process accounts for the uncertainty issues identified above. In response to RAI 9, the licensee explained that, in general, RMAs include designation of protected equipment; minimization of activities including online work that could lead to plant conditions and initiating events, crew briefings on appropriate procedures to increase operator success, review of the PRA results to identify further RMAs that may be appropriate, and development of specific RMAs to address the. potential for CCF under emergent conditions.

The licensee explained that RMAs for specifically reducing the uncertainty associated with fire event modeling would include imposing transient combustible and hot work control, as well as review of procedures and shift briefings.

The NRC staff finds that the licensee has identified principal features and criteria that should be, and are, included in the process for developing RMAs, including RMAs for the PRA uncertainties identified in LAR Enclosure

12. The NRC staff's review indicates that the licensee performed an adequate assessment to identify the potential sources of uncertainty, and that the identification of the key assumptions and sources of uncertainty was appropriate and consistent with the guidance in NUREG-1855 (Reference

19) and associated EPRI TR-1016737 (Reference 20). Therefore, the NRC staff finds that the licensee has satisfied the intent of RG 1.177, Revision 1 (Section 2.3.5), and RG 1.17 4, Revision 3 (Section 2.2.2), and that the treatment of model uncertainties for risk evaluation of extended CTs is appropriate for this application and consistent with the guidance identified in NEI 06-09, Revision 0-A. 3.1.4.1.5 PRA Results and Insights The proposed change implements a process to determine TS RICTs rather than specific changes to individual TS CTs. NEI 06-09, Revision 0-A, requires periodic assessment of the risk incurred due to operation beyond the CTs (i.e., the specified fixed time period in the TSs) due to implementation of an RICT program and comparison to the guidance of RG 1.17 4, Revision 3, for small increases in risk. NEI 06-09, Revision 0-A, requires that configuration risk be assessed to determine the RICT and establish the criteria for incremental core damage probability (ICDP) and incremental large early release probability (ILERP) on which to base the RICT. An ICDP of 1E-5 and an ILERP of 1 E-6 are used as the risk measures for calculating individual RICTs. These limits are consistent with NUMARC 93-01, Revision 4A, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," dated April 2011 (Reference 21 ), endorsed by RG 1.160, Revision 3, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," dated May 2012 (Reference 22). The use of these limits in NEI 06-09, Revision 0-A, aligns the TS CTs with the risk management guidance used to support plant programs for the Maintenance Rule, and the NRC staff accepted these supplemental risk acceptance guidelines for RMTS programs in its approval of NEI 06-09, Revision 0-A. In RAI 13, the NRC staff requested confirmation that the latest versions of NUMARC 93-01 and RG 1.160 will be used for the RICT program. In response to RAI 13, the licensee confirmed that the latest versions of NUMARC 93-01 and RG 1.160 are used at Calvert Cliffs and will be referenced and used in the RICT program. NEI 06-09, Revision 0-A, as modified by the limitations and conditions in the SE, requires that the cumulative impact of implementation of an RMT be periodically assessed and shown to result in: (1) a total risk impact below 1 E-5/year for changes to CDF, (2) a total risk impact below 1 E-6/year for changes to LERF, and (3) the total CDF and total LERF must be reasonably shown to be less than 1 E-4/year and 1 E-5/year, respectively.

In response to RAI 5, the licensee stated that the estimated total CDF and LERF meets the 1 E-4/year CDF and 1 E-5/year LERF criteria of RG 1.174, consistent with the guidance in NEI 06-09, Revision 0-A, and that these guidelines be satisfied whenever an RICT is implemented.

The licensee has incorporated NEI 06-09, Revision 0-A, in the RICT program of TS 5.5.18 and, therefore, calculates the RICT consistently with its criteria, and assesses the RICT program to assure any risk increases are small per the guidance of RG 1.17 4. Therefore, the NRC staff finds that the licensee's RICT program is consistent with NEI 06-09, Revision 0-A, guidance and is, therefore, acceptable.

3.1.4.1.6 Implementation of the RICT Program Because NEI 06-09, Revision 0-A, involves the real-time application of PRA results and insights by the licensee, the NRC staff reviewed the licensee's description of programs and procedures associated with implementation of the RICT program provided in the LAR and its enclosures.

The administrative controls on the PRA and on changes to the PRA should provide confidence that the PRA results are reasonable, and the administrative controls on the plant personnel using the RICTs should provide confidence that the RICT program will be applied appropriately.

The quality assurance practices for the PRA models include assessing the PRA against the PRA standard and RG 1.200, which include guidance for performing peer reviews and focused-scope peer reviews. The quality assurance practices for the PRA models are discussed by the licensee in Enclosure 2, "Information Supporting Consistency with Regulatory Guide 1.200," and Enclosure 7, "PRA Model Update Process," of the submittal.

Enclosure 8, "Attributes of the CRMP Model," summarizes the changes made to the baseline PRA model for use in the on-line model. Enclosure 10, "Program Implementation," describes the implementing programs and procedures and the associated personnel training.

Changes to the PRA are expected over time to reflect changes in PRA methods and changes to the as-built, as-operated, and maintained plant, to reflect the operating experience at the plant as specified in RG 1.200, Revision 2. Changes in PRA methods are addressed by the following constraint added* to the TS Section 5.5.18 provided by the licensee in the response to RAI 24 and Attachment 2 to the letter dated June 21, 2018 (Reference 5): The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the completion times must be PRA methods used to support Amendment Nos. 326/304, or other methods approved by the NRC for generic use. Any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

This constraint appropriately requires the licensee to utilize the risk assessment approaches and methods previously approved by the NRC and/or incorporated in the RICT program, and requires prior NRC approval for any change in PRA methods to assess risk that are outside those approval boundaries.

Changes to the as-built, as-operated, and maintained plant to reflect the operating experience at the plant are discussed in LAR Enclosure

7. Enclosure 7 summarizes the PRA configuration control process, delineates the responsibilities and guidelines for updating the full power internal event and fire PRA models, and includes both periodic and interim PRA model updates. The licensee stated that the process includes provisions for monitoring potential impact areas affecting the technical elements of the PRA models (e.g., due to plant changes, plant/industry operational experience, or errors or limitations identified in the model), assessing the individual and cumulative risk impact of unincorporated changes, and controlling the model and necessary computer files, including those associated with the CRMP model. The licensee stated in Enclosure 8 of the LAR that the plant procedures.specify that an acceptance test is performed after every CRMP model update. This test verifies proper incorporation of the baseline PRA models and acceptance of all changes made to the baseline PRA models into the CRMP model. This test also verifies correct mapping of plant components to the basic events in the CRMP model. The NRC staff concludes that the CRMP model used to calculate the RICTs is acceptable because the underlying PRA models will be updated as necessary to remain acceptable, and the acceptance test would verify that the CRMP model is consistent with the underlying baseline PRA, in accordance with the RICT program. NEI 06-09, Revision 0-A, requires that stations implementing an RMTS program shall provide training in the programmatic requirements associated with the RMTS program and of the individual RICT evaluations, to personnel responsible for determining TS operability decisions or conducting RICT assessments.

Training of plant personnel shall be provided for those organizations with functional responsibilities for performing or administering the CRMP commensurate with each position's responsibilities, in accordance with 10 CFR 50.120(b )(3) and other applicable regulations, within the RICT program, as described in NEI 06-09,

• Revision 0-A. As described in Enclosure 10, "Program Implementation," of the LAR, the licensee has established qualification and training programs for development, maintenance, and use of the CRMP model. The licensee identifies the attributes that the RICT program procedures will address, consistent with NEI 06-09, Revi~ion 0-A. The licensee also identified the plant personnel that will be trained and the different types of training that the different plant personnel receive. This includes training for individuals who will be directly involved in the implementation of the RICT program, as well as other individuals who may have some involvement with the RICT program. Based on the new RICT program that will be included in Section 5.5 of the TSs, and the description of the PRA model update process summarized in Enclosures 2, 7, and 8, the NRC staff finds that the licensee's PRA maintenance and change process provides confidence that the CRMP models used in the RICT calculations will continue to use PRA methods that are acceptable to the NRC and that the PRA model used for the RICT calculations will be updated as necessary to reflect the as-built and as-operated plant. The NRC staff finds reasonable assurance that the program described in Enclosure 10 will establish appropriate programmatic and procedural controls for the licensee's RICT program, consistent with the guidance of NEI 06-09, Revision 0-A. 3.1.4.2 Tier 2: Avoidance of Risk-Significant Plant Configurations The second tier provides that a licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is taken out of service in accordance with the proposed TS change. NEI 06-09, Revision 0-A, does not permit voluntary entry into high-risk configurations that would exceed instantaneous CDF and LERF limits of 1 E-3/year and 1 E-4/year, respectively.

It further requires implementation of RMAs when the actual or anticipated risk accumulation during an RICT will exceed one-tenth of the ICDP or ILERP limit. Such RMAs may include rescheduling planned activities to lower risk periods or implementing risk-reduction measures.

The limits established for entry into an RICT and for RMA implementation are consistent with the guidance of NUMARC 93-01, Revision 4A (Reference 21), endorsed by RG 1.160, Revision 3 (Reference 22), as applicable to plant maintenance activities.

The RICT program requirements and criteria are consistent with the principle of Tier 2 to avoid risk-significant configurations.

Based on the licensee's incorporation of NEI 06-09, Revision 0-A, in the TSs as discussed in LAR Attachment 1, as supplemented by letter dated June 21, 2018 (Reference 5), and because the proposed changes are consistent with the guidance of RG 1.17 4, Revision 3 (Reference 13), and RG 1.177, Revision 1 (Reference 14), the NRC staff finds the licensee's Tier 2 program is acceptable and supports the proposed implementation of the RICT program. 3.1.4.3 Tier 3: Risk-Informed Configuration Risk Management The third tier provides that a licensee should develop a program that ensures that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity. NEI 06-09, Revision 0-A, addresses Tier 3 guidance by requiring assessment of the RICT to be based on the plant configuration of all SSCs that might impact the RICT, including safety-related and non-safety-related SSCs. A plant configuration is considered risk-significant when the ICDP or the ILERP exceeds one-tenth of the risk on which the RICT is based, which is generally 1 E-5 and 1 E-6 for the ICDP and ILERP, respectively.

If a risk-significant plant configuration exists, then NEI 06-09, Revision 0-A, via the RICT program in the TSs, would require the licensee to implement compensatory measures and RMAs. Therefore, the NRC staff finds that the RICT program provides an acceptable methodology to assess and address risk-significant configurations.

The NRC staff notes that proposed changes will require reassessment of any plant configuration changes to be completed in a timely manner, based on the more restrictive limit of any applicable TS action requirement, or a maximum of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the configuration change occurs, because it is required by the RICT program. Based on the licensee's incorporation of NEI 06-09, Revision 0-A, into the RICT program, as discussed in Enclosure 1 of the LAR, and because the proposed changes are consistent with the Tier 3 guidance of RG 1.177, Revision 1 (Reference 14 ), the NRC staff finds that the proposed changes are acceptable.

3.1.4.4 Key Principle 4 Conclusions The licensee has demonstrated the technical adequacy and scope of its PRA models, and that the models can support implementation of the RICT program for determining CTs. Proper consideration of key assumptions and sources of uncertainty have been made. The risk metrics are consistent with the approved methodology of NEI 06-09, Revision 0-A, and the RICT program is controlled administratively through plant procedures and training.

The RICT program follows the NRG-approved methodology in NEI 06-09, Revision 0-A. The NRC staff concludes that the RICT program satisfies the fourth key safety principle of RG 1.177, and is, therefore, acceptable.

3.1.5 Key Principle 5: Performance Measurement Strategies RG 1.174, Revision 3 (Reference 13), and RG 1.177, Revision 1 (Reference 14), establish the need for an implementation and monitoring program to ensure that extensions to TS CTs do not degrade operational safety over time and that no adverse degradation occurs due to unanticipated degradation or common cause mechanisms.

An implementation and monitoring program is intended to ensure that the impact of the proposed TS change continues to reflect the reliability and availability of SSCs impacted by the change. RG 1.17 4, Revision 3, states that monitoring performed in conformance with the Maintenance Rule, 10 CFR 50.65, can be used when the monitoring performed is sufficient for the SSCs affected by the risk-informed application.

LAR Enclosure 11, "Monitoring Program," states thatthe SSCs in the scope of the RICT program are also in the scope of the Maintenance Rule. Section 3.3.3 of NEI 06-09, Revision 0-A, instructs licensees to track the risk associated with all entries beyond the CT (i.e., the specified fixed time period in the TSs), and Section 2.3.1 provides a requirement for assessing cumulative risk, including a periodic evaluation of any increase in risk due to the use of the RM TS program to extend the CTs. According to LAR Enclosure 11, the licensee calculates cumulative risk at least every refueling cycle, but the recalculation period does not exceed 24 months, which is consistent with NEI 06-09, Revision 0-A. The licensee converts the cumulative ICDP and ILERP into average annual values, which are then compared to the limits of RG 1.174. If any limits are exceeded, corrective actions are taken to ensure that future plant operational risk is within the acceptance guidance.

This evaluation assures that RMTS program implementation meets RG 1.17 4 guidance for small risk increases.

Because the licensee will be (1) monitoring SSCs affected by this change in accordance with the Maintenance Rule, (2) monitoring cumulative risk against the limits of RG 1.17 4 in accordance with the RICT program, and (3) implementing the programmatic and procedural controls discussed in Section 3.1.4.1.6 of this SE, the NRC staff concludes that the performance measurement (or monitoring) strategies are sufficient to ensure that the impact of the proposed change will reflect the reliability and availability of the SSCs impacted by the change. Therefore, the RICT program satisfies the fifth key safety principle of RG 1.177, Revision 1, and is, therefore, acceptable.

3.2 Technical Specification Administrative Controls Section The NRC staff reviewed the licensee's proposed addition of a new program, the RICT program, to the administrative controls section of the TSs. The NRC staff evaluated the elements of the new program to ensure alignment with the requirements of 10 CFR 50.36(c)(5) and to ensure the programmatic controls are consistent with the RICT program described in NEI 06-09, Revision 0-A. TS 5.5.18 requires that the RICT program be implemented in accordance with NEI 06-09, Revision 0-A. This is acceptable because NEI 06-09, Revision 0-A, establishes an appropriate framework for an acceptable RICT program. The TS states that an RICT may not exceed 30 days. The NRC staff determined that a 30-day limit is appropriate because it allows sufficient time to restore SSCs to operable status while avoiding excessive out-of-service times for TS SSCs. The TS states that the RICT may only be used in Modes 1 and 2. This provision ensures that the RICT is only used for determination of CDF and LERF for modes of operation covered by the PRA. The TS requires that while in an RICT, any change in plant configuration as defined in NEI 06-09, Revision 0-A, must be considered for the effect on the RICT. The TS also specifies time limits for determining the effect on the RICT. These time limitations are consistent with those specified in NEI 06-09, Revision 0-A. The TS contains requirements for the treatment of common cause failures (CCFs) for emergent conditions in which the common cause evaluation is not complete.

The requirements are to either (a) numerically account for the increased probability of CCF or (b) implement RMAs that support redundant or diverse SSCs that perform the functions of the inoperable SSCs and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs. Key Principle 2 of risk-informed decisionmaking is to assure that the change is consistent with DID philosophy.

The seven considerations supporting the evaluation of the impact of the change on DID are discussed in RG 1.17 4, including one to preserve adequate defense against potential CCF. The NRC staff finds that numerically accounting for an increased probability of failure will conservatively account for the possibility of a CCF. Alternatively, implementing actions that can increase the availability of other mitigating SSCs or decrease the frequency of demand on the affected SSCs will decrease the likelihood that a CCF could affect risk. The NRC staff concludes that both the quantitative and the qualitative actions minimize the impact of CCF and, therefore, support meeting Key Principle 2 as described in RG 1.17 4. These methods either limit the exposure time, help ensure the availability of alternate SSCs, or decrease the probability of plant conditions requiring the safety function to be performed.

The NRC staff finds that these methods contribute to maintaining DID because the methods limit the exposure time or ensure the availability of alternate SSCs. The TS contains a provision that risk assessment approaches and methods used shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant, and reflect the operating experience at the plant, as specified in RG 1.200, Revision 2. Methods to assess the risk from extending the CTs must be PRA methods used to support this LAR, or other methods approved by the NRC for generic use. Further, as stated above, the RICT program requires the licensee to utilize the risk assessment approaches and methods previously approved by the NRC and/or incorporated in the RICT program, and any change in the PRA methods to assess risk that is outside these approval boundaries requires prior NRC approval via a license amendment.

As stated in the NRC staff's SE for NEI 06-09, Revision 0-A: TR NEI 06-09, Revision 0, requires an evaluation of the PRA model used to support the RMTS against the requirements of RG 1.200, Revision 1, and ASME RA-S-2002, "Standard for Probabilistic Risk Assessment for Nuclear power Plant Applications," for capability Category II. This assures that the PRA model is technically adequate for use in the assessment of configuration risk. This capability category of PRA is sufficient to support the evaluation of risk associated with out of service SSCs and establishing risk-informed CTs. TS 5.5.18 was updated to reflect the current revision of RG 1.200. RG 1.200 incorporates ASME RA-S-2002 by reference.

The NRC staff's SE for NEI 06-09, Revision 0-A, also states: As part of its review and approval of a licensee's application requesting to implement the RMTS, the NRC staff intends to impose a license condition that will explicitly address the scope of the PRA and non-PRA methods approved by the NRC staff for use in the plant-specific RMTS program. If a licensee wishes to change its methods, and the change is outside the bounds of the license condition, the licensee will need NRC approval, via a license amendment, of the implementation of the new method in its RMTS program. The focus of the NRC staff's review and approval will be on the technical adequacy of the methodology and analyses relied upon for the RMTS application.

This limitation and condition is being relocated from a license condition to the administrative controls section of the TSs. Proposed TS 5.5.18 restates this limitation and condition from the NRC staff's SE in language that is appropriate for the administrative controls section of the TSs. The NRC staff finds that this requirement is appropriately reflected in the Administrative Controls section of the Calvert Cliffs TSs. The regulations in 10 CFR 50.36(c}(5}

require the TSs to contain administrative controls providing "provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner." The NRC staff has determined that the language to be added to the administrative controls section of the TSs will assure operation of the facility in a safe manner when the facility uses the RICT program. Therefore, the NRC staff has determined that the requirements of 10 CFR 50.36(c)(5) are satisfied.

3.3 Conclusion The NRC staff finds that the licensee's proposed implementation of the RICT program for the identified scope of required actions is consistent with the guidance of NEI 06-09, Revision 0-A. The licensee's methodology for assessing the risk impact of extended CTs, including the individual CT extension impacts in terms of ICDP and ILERP, and the overall program impact in terms of ~CDF and ~LERF, is accomplished using PRA models of sufficient scope and technical adequacy based on consistency with the guidance of RG 1.200, Revision 2. For seismic and tornado missile external hazards, which do not have PRA models, the licensee will use bounding analyses in accordance with NEI 06-09, Revision 0-A, guidance.

The licensee determined that risks from the remaining external hazards will not impact the RICT and will not be included in the RICT evaluations.

The RICT calculation uses the PRA model appropriately translated into the CRMP tool, and the licensee has an acceptable process in place to ensure that the PRA model continues to use acceptable methods and is appropriately updated to reflect changes to the plant or operating experience.

In addition, the NRC staff finds that the proposed implementation of the RICT program addresses the RG 1.177 principles on DID and safety margins, and includes adequate administrative controls, as well as acceptable performance measurement strategies.

The regulation in 10 CFR 50.36(a)(1) states, in part, "A summary statement of the bases or reasons for such specifications other than those covering administrative controls shall also be included in the application, but shall not become part of the technical specifications." Accordingly, along with the proposed TS changes, the licensee also submitted TS Bases changes that correspond to the proposed TS changes, to provide the reasons for those TSs. The TS Bases changes were consistent with the Bases changes in the model application dated January 31, 2012 (Reference 6). 4.0 FINAL NO SIGNIFICANT HAZARDS CONSIDERATION The NRC's regulation in 10 CFR 50.92(c) states that the NRC may make a final determination under the procedures in 10 CFR 50.91 that a license amendment involves no significant hazards consideration, if operation of the facility in accordance with the amendments would not: (1) involve a significant increase in the probability or consequences of an accident previously evaluated; or (2) create the possibility of a new or different kind of accident from any accident previously evaluated; or (3) involve a significant reduction in a margin of safety. An evaluation of the issue of no significant hazards consideration is presented below: 1. Do the proposed changes involve a significant increase in the probability or consequences of any accident previously evaluated?

Response:

No. The proposed changes permit the extension of Completion Times provided the associated risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed changes do not involve a significant increase in the probability of an accident previously evaluated because the changes involve no change to the plant or its modes of operation.

The proposed changes do not increase the consequences of an accident because the design-basis mitigation function of the affected systems is not changed and the consequences of an accident during the extended Completion Time are no different from those during the existing Completion Time. Therefore, the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Do the proposed changes create the possibility of a new or different kind of accident from any previously evaluated?

Response:

No. The proposed changes do not change the design, configuration, or method of operation of the plant. The proposed changes do not involve a physical alteration of the plant (no new or different kind of equipment will be installed).

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Do the proposed changes involve a significant reduction in a margin of safety? Response:

No. The proposed changes permit the extension of Completion Times provided that risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed changes implement a risk-informed configuration management program to assure that adequate margins of safety are maintained.

Application of these new specifications and the configuration management program considers cumulative effects of multiple systems or components being out of service and does so more effectively than the current TS. Therefore, the proposed changes do not involve a significant reduction in a margin of safety. Based on the above evaluation, the NRC staff concludes that the three standards of 10 CFR 50.92(c) are satisfied.

Additionally, the NRC staff evaluated the impact of the proposed change on safety margins, as discussed in Section 3.1.3 of this SE, and found that the proposed change maintains sufficient safety margins. Therefore, the NRC staff has made a final determination that no significant hazards consideration is involved for the proposed amendments, and that the amendments should be issued as allowed by the criteria contained in 10 CFR 50.91.

5.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Maryland State official was notified of the proposed issuance of the amendments on September 21, 2018. The State official had no comments.

6.0 ENVIRONMENTAL CONSIDERATION The amendments change a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20 and change inspections or surveillance requirements.

The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure.

The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, published in the Federal Register on September 4, 2018 (83 FR 44920), and there has been no public comment on such finding. Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

7.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

8.0 REFERENCES

1. Letter from David Helker, Exelon Generation Company, LLC, to U.S. Nuclear Regulatory Commission, "License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 1, 'Provide Risk-Informed Extended Completion Times -RITSTF Initiative 4b'," dated February 25, 2016 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML 16060A223).

2. Letter from James Barstow, Exelon Generation Company, LLC, to U.S. Nuclear Regulatory Commission, "Supplement

-License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 1, 'Provide Risk-Informed Extended Completion Times -RITSTF Initiative 4b'," dated April 3, 2017 (ADAMS Accession No. ML 17094A591

). 3. Letter from James Barstow, Exelon Generation Company, LLC, to U.S. Nuclear Regulatory Commission, "Response to Request for Additional Information

-License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 1, 'Provide Risk-Informed Extended Completion Times -RITSTF Initiative 4b'," dated January 11, 2018 (ADAMS Accession No. ML 18011A665). 4. Letter from James Barstow, Exelon Generation Company, LLC, to U.S. Nuclear Regulatory Commission, "Response to Request for Additional Information License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 1, 'Provide Risk-Informed Extended Completion Times -RITSTF Initiative 4b'," dated January 18, 2018 (ADAMS Accession No. ML 180186340).

5. Letter from James Barstow, Exelon Generation Company, LLC, to U.S. Nuclear Regulatory Commission, "Response to Request for Additional Information License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 1, 'Provide Risk-Informed Extended Completion Times -RITSTF Initiative 4b'," dated June 21, 2018 (ADAMS Accession No. ML 18172A145).

6. TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times -RITSTF Initiative 4b," dated June 14, 2011, and Model Application, dated January 31, 2012 (ADAMS Package Accession No. ML 120330410).

7. Letter from James Barstow, Exelon Generation Company, LLC, to U.S. Nuclear Regulatory Commission, "Supplement to Response to Request for Additional Information License Amendment Request to Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times -RITSTF Initiative 4b," dated August 27, 2018 (ADAMS Accession No. ML 18239A260).

8. Letter from Timothy J. McGinty, U.S. Nuclear Regulatory Commission, to Technical Specifications Task Force, "Issues with Technical Specifications Task Force Traveler TSTF-505, Revision 1, 'Provide Risk-Informed Extended Completion Times -RITSTF Initiative 4B'," dated November 15, 2016 (ADAMS Accession No. ML 16281A021

). 9. Letter from Michael Marshall, U.S. Nuclear Regulatory Commission, to Bryan Hanson, Exelon Generation Company, LLC, "Calvert Cliffs Nuclear Power Plant, Units 1 and 2 -Request for Additional Information Regarding Risk-Informed Technical Specification Completion Times," dated November 13, 2017 (ADAMS Accession No. ML 17304A941).

10. Letter from Michael Marshall, U.S. Nuclear Regulatory Commission, to Bryan Hanson, Exelon Generation Company, LLC, "Calvert Cliffs Nuclear Power Plant, Units 1 and 2 -Request for Additional Information Regarding Risk-Informed Technical Specification Completion Times (CAC Nos. MF7415 and MF7416; EPID L-2016-LLA-0001)," dated May 22, 2018 (ADAMS Accession No. ML 18138A137).

11. Final Safety Evaluation for NEI TR NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines," dated May 17, 2007 (ADAMS Accession No. ML071200238).

12. TR NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b: Risk-Managed Technical Specifications (RMTS) Guidelines," dated October 2012 (ADAMS Accession No. ML 122860402). 13. Regulatory Guide 1.17 4, Revision 3, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated January 2018 (ADAMS Accession No. ML 17317A256).

14. Regulatory Guide 1.177, Revision 1, "An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications," dated May 2011 (ADAMS Accession No. ML 1~0910008).

15. Regulatory Guide 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," dated March 2009 (ADAMS Accession.No.

ML090410014).

16. ASME/ANS PRA Standard ASME/ANS RA-Sa-2009, Addenda to ASME RA-S-2008, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications." 17. NEI 05-04, Revision 3, "Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard," dated November 2009. 18. NEI 07-12, "Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines," Revision 0, Draft H, dated November 2008 (ADAMS Accession No. ML083430464

). 19. NUREG-1855, Volume 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," dated March 2009 (ADAMS Accession No. ML090970525).

20. EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," Electric Power Research Institute, Final Report, dated December 2008. 21. NUMARC 93-01, Revision 4A, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," dated April 2011 (ADAMS Accession No. ML 11116A198).

22. Regulatory Guide 1.160, Revision 3, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," dated May 2012 (ADAMS Accession No. ML 113610098).

23. EPRI TR-1013141, Revision 1, "Pipe Rupture Frequencies for Internal Flooding PRAs," Electric Power Research Institute, Palo Alto, CA, 2006. 24. Letter from Richard V. Guzman, U.S. Nuclear Regulatory Commission, to Bryan Hanson, Exelon Generation Company, LLC, "Calvert Cliffs Nuclear Power Plant, Unit Nos. 1 and 2 -Issuance of Amendments Regarding Transition to a Risk-Informed, Performance-Based Fire Protection Program in Accordance with 10 CFR 50/48(c) (CAC Nos. MF2993 and MF2994)," dated August 30, 2016 (ADAMS Accession No. ML 16175A359).

25. Letter from George H. Gellrich, Calvert Cliffs Nuclear Power Plant, LLC, to U.S. Nuclear Regulatory Commission, "Calvert Cliffs Nuclear Power Plant Unit Nos. 1 & 2, Docket Nos. 50-317 & 50-318, License Amendment Request Re: Transition to 10 CFR 50.48(c) -NFPA 805 Performance Based Standard for Fire Protection," dated September 24, 2013 (ADAMS Accession No. ML 13301A673).

26. Letter from Peter E. Katz, Constellation Generation Group, LLC, to U.S. Nuclear Regulatory Commission, "Calvert Cliffs Nuclear Power Plant Unit Nos. 1 & 2; Docket Nos. 50-317 & 50-318 License Amendment Request: Extension of Diesel Generator Required Action Completion Time," dated May 12, 2003 (ADAMS Accession No. ML031360410).

27. Letter from Mary G. Korsnick, Exelon Generation Company, LLC, to U.S. Nuclear Regulatory Commission, "Exelon Generation Company, LLC Expedited Seismic Evaluation Process Report (CEUS Sites), Response to NRC Request for Information Pursuant to 10 CFR50.54(f)

Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident," dated December 17, 2014 (ADAMS Accession No. ML 14365A138).

28. Letter from Daniel G. McDonald, U.S. Nuclear Regulatory Commission, to Robert E. Denton, Calvert Cliffs, transmitting "Safety Evaluation by the Office of Nuclear Reactor Regulation

[of] Tornado Missile Protection for Emergency Diesel Generators

[at] [Calvert Cliffs]" dated May 1, 1995. 29. NUREG/CR-4461, Revision 2, "Tornado Climatology of the Contiguous United States," dated February 2007 (ADAMS Accession No. ML070810400).

30. Letter from George H. Gellrich, Exelon Generation Company, LLC, to U.S. Nuclear Regulatory Commission, "Calvert Cliffs Nuclear Power Plant, Units 1 and 2 -Staff Assessment of Response to 10 CFR 50.54(f) Information Request -Flood-Causing Mechanism Reevaluation (TAC NOS. MF3097 and MF3098)," dated April 16, 2015 (ADAMS Accession No. ML 15077A103).

31. Letter from Norman J Stringfellow, Pressurized Water Reactor Owners' Group, et al., to U.S. Nuclear Regulatory Commission, "Transmittal of TSTF-505, Revision 1, Provide Risk-Informed Extended Completion Times -RITSTF Initiative 49 Errata," dated June 4, 2011 (ADAMS Accession No. ML 111650552).

32. NEI 06-09, Revision 0-A, Risk-Informed Technical Specifications Initiative 4b Risk-Managed Technical Specifications (RMTS) Guidelines Industry Guidance Document," dated November 2006 (ADAMS Accession No. ML 12286A322).

33. Letter from Robert L. Clark, U.S. Nuclear Regulatory Commission, to Charles H. Cruse, Calvert Cliffs Nuclear Power Plant, Inc., "Calvert Cliffs Nuclear Power Plant, Units Nos. 1 and 2 -Review of the Individual Plant Examination of External Events (IPEEE) Submittal (TAC Nos. M83603 and M83604)," dated June 8, 2001 (ADAMS Accession No. ML011550238). 34. Calvert Cliffs Nuclear Power Plant, Units 1 and 2 Updated Final Safety Analysis Report, Revision 49, initially dated September 25, 2017 (ADAMS Accession No. ML 17354B255).

Principal Contributors:

M. Chernoff M. Biro S. Dinsmore M. Li K. Nguyen Date: October 30, 2018 B. Hanson

SUBJECT:

CALVERT CLIFFS NUCLEAR POWER PLANT, UNITS 1 AND 2-ISSUANCE OF AMENDMENT NOS. 326 AND 304 TO ADD RISK-INFORMED COMPLETION TIME PROGRAM (EPID L-2016-LLA-0001)

DATED OCTOBER 30, 2018 DISTRIBUTION:

PUBLIC PM Reading File RidsNrrDorlLpl1 Resource RidsNrrLALRonewicz Resource RidsRgn1 Mail Center. Resource RidsNrrPMCalvertCliffs Resource RidsACRS_MailCTR Resource RidsNrrDs~Stsb Resource RidsNrrDraApla Resource RidsNrrDeEicb Resource RidsNrrDeEeob Resource GDentel, R-1 MChernoff, NRR MBiro, NRR SDinsmore, NRR MU, NRR KNguyen, NRR ADAMS A ccess1on N ML18270A130 o.: OFFICE DORL/LPL 1 /PM DORL/LPL 1 /LA NAME MMarshall LRonewicz DATE 10/05/2018 10/30/2018 OFFICE DSS/STSB/BC*

DMLR/MPHB/BC**

NAME VCusumano SRuffin DATE 08/17/2018 10/10/2018 OFFICE DORL/LPL 1 /BC DORL/LPL 1 /PM NAME JDanna MMarshall DATE 10/30/2018 10/30/2018

• b d 1y memoran um **b *1 1ye-ma1 DRA/APLA/BC*

DE/EEOB/BC*

DE/EICB/BC(A)*

SRosenberg JQuichocho RAlvardo 08/10/2018 07/13/2018 07/03/2018 DSS/SCPB/BC**

DSS/SRXB/BC**

OGC-NLO**

SAnderson JWhitman DRoth 10/10/2018 10/10/2018 10/25/2018 OFFICIAL RECORD COPY